chore(release): 1.1.2 [skip ci]

## [1.1.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.1...v1.1.2) (2025-02-19)

### Bug Fixes

* **dovecot:** Add Dovecot Pro [EE] ([6e343c7](6e343c76a3))
* **element:** Add Element EE components ([61d94a8](61d94a8de6))
* **helmfile:** Add missing customizing option for Matrix widgets ([9c79c44](9c79c44453))
* **helmfile:** Add SSL option for Keycloak Extensions Proxy's PostgreSQL connection ([91d0f98](91d0f98682))
* **helmfile:** Fine-grained service types ([de8b560](de8b560fe7))
* **helmfile:** Integrate oD EE ([03ec704](03ec70435c))
* **helmfile:** Introduce `apps` as top level in `opendesk_main.yaml.gotmpl`; Please check migrations.md for upgrades of existing installations ([2fcf014](2fcf014894))
* **helmfile:** Make openDesk IAM attributes optional with enabled as default ([b32996d](b32996da34))
* **helmfile:** Provide toggle in `functional.yaml.gotmpl` for "new device notification" mails ([284c9fe](284c9fe0c7))
* **helmfile:** Remove reference to no longer required `elementWeb` chart ([cd9c54b](cd9c54b177))
* **helmfile:** Set default for domain to `opendesk.internal` to avoid enforcing DOMAIN environment variable for deployments using YAML overrides ([930ae9d](930ae9d3e7))
* **helmfile:** Update/streamline theming ([8eeaa23](8eeaa23c2f))
* **jitsi:** Support for phone dial-in into Jitsi conferences ([1323ef1](1323ef142e))
* **nextcloud:** Update `groupfolders` app to fix group selection in admin mode ([ab49bf9](ab49bf9f6b))
* **nextcloud:** Update Nextcloud to 29.0.11 and support for Cron-Job specific resource definitions ([09f4829](09f482981b))
* **nubus:** Disable unused notification feature ([955f17e](955f17ef8b))
* **nubus:** Fix Keycloak dialogue background length on small screens ([4662709](4662709673))
* **nubus:** Only configure apps that are deployed to show up in IAM admin UI and Keycloak ([1f051e7](1f051e7779))
* **nubus:** Re-implement toggle for UDM-REST-API based on `functional.externalServices.nubus.udmRestApi.enabled` ([777e7d2](777e7d2fc6))
* **nubus:** Remove doublet `resources` key in `udm-listener` StatefulSet ([10e0b0a](10e0b0ad6c))
* **nubus:** Support for custom UDM commands ([aff8edb](aff8edbde2))
* **nubus:** Update Keycloak Extensions Proxy ([601e649](601e649913))
* **open-xchange:** Parameters to split read and write queries to MariaDB ([370247b](370247b951))
* **open-xchange:** Update OX App Suite to 8.33 ([581c8ae](581c8aed1f))
* **openproject:** Update OpenProject to 15.2.1 ([83c311b](83c311b101))
* **oxconnector:** Update to strict `securityContext` from upstream defaults ([32df165](32df1657d2))

.gitignore

@@ -6,7 +6,14 @@
 
 # Ignore changes to sample environments
 helmfile/environments/dev/*.yaml.gotmpl
+helmfile/environments/test/*.yaml.gotmpl
 helmfile/environments/prod/*.yaml.gotmpl
+helmfile/environments/dev/*/
+helmfile/environments/test/*/
+helmfile/environments/prod/*/
+!helmfile/environments/dev/sample.yaml.gotmpl
+!helmfile/environments/test/sample.yaml.gotmpl
+!helmfile/environments/prod/sample.yaml.gotmpl
 
 # Ignore in CI generated files
 .kyverno/opendesk.yaml

.gitlab-ci.yml

@@ -1,15 +1,20 @@
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 include:
   - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "v2.3.3"
+    ref: "v2.4.8"
     file:
-      - "ci/common/automr.yml"
       - "ci/common/lint.yml"
       - "ci/release-automation/semantic-release.yml"
   - local: "/.gitlab/generate/generate-docs.yml"
+  - local: "/.gitlab/renovate/renovate.yml"
+  - local: "/.gitlab/release/release-common.yml"
+  - local: "/.gitlab/release/release-generate-version.yml"
+  - local: "/.gitlab/release/release-semantic.yml"
+  - local: "/.gitlab/lint/lint-common.yml"
+  - local: "/.gitlab/lint/lint-reuse.yml"
   - project: "${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
     file: "gitlab/environments.yaml"
     ref: "main"
@@ -32,21 +37,22 @@ stages:
   - ".pre"
   - "renovate"
   - "scan"
-  - "automr"
   - "env-cleanup"
   - "env"
   - "pre-services-deploy"
-  - "migrations-pre"
-  - "basic-services-deploy"
-  - "component-deploy-stage-1"
-  - "component-deploy-stage-2"
-  - "migrations-post"
+  - "010-migrations-pre"
+  - "030-services"
+  - "050-components"
+  - "060-components"
+  - "090-migrations-post"
   - "lint"
-  - "tests"
+  - "post-prepare"
+  - "post-execute"
   - "env-stop"
   - ".post"
 
 variables:
+  RELEASE_BRANCH: "main"
   NAMESPACE:
     description: "The name of namespaces to deploy to."
     value: ""
@@ -68,11 +74,17 @@ variables:
       - "no"
   DEBUG_ENABLED:
     description: "Allows to set `debug.enabled` to true for a deployment, needs to be supported by stage specific\
-     configuration containting: `debug.enabled: {{ env \"DEBUG_ENABLED\" | default false }}`"
+     configuration containing: `debug.enabled: {{ env \"DEBUG_ENABLED\" | default false }}`"
     value: "no"
     options:
       - "yes"
       - "no"
+  OPENDESK_ENTERPRISE:
+    description: "Set to `true` if you want to deploy openDesk EE (but be sure you provide the required EE keys/tokens for the application)"
+    value: "false"
+    options:
+      - "true"
+      - "false"
   DEPLOY_ALL_COMPONENTS:
     description: "Enable all component deployment (overwrites 'no' setting on component level)."
     value: "no"
@@ -97,12 +109,6 @@ variables:
     options:
       - "yes"
       - "no"
-  DEPLOY_PROVISIONING:
-    description: "Enable Provisioning Components."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
   DEPLOY_COLLABORA:
     description: "Enable Collabora deployment."
     value: "no"
@@ -127,12 +133,6 @@ variables:
     options:
       - "yes"
       - "no"
-  DEPLOY_ICS:
-    description: "Enable ICS deployment."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
   DEPLOY_XWIKI:
     description: "Enable XWiki deployment."
     value: "no"
@@ -157,9 +157,22 @@ variables:
     options:
       - "yes"
       - "no"
+  CREATE_DEFAULT_ACCOUNTS:
+    description: "Creates `default` and `default-admin` in the instance using the password defined as CI variable
+                 `DEFAULT_ACCOUNTS_PASSWORD`."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
+  DEPLOY_NOTES:
+    description: "Enable Notes deployment."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
   RUN_TESTS:
     description: "Triggers execution of E2E-tests."
-    value: "yes"
+    value: "no"
     options:
       - "yes"
       - "no"
@@ -171,14 +184,37 @@ variables:
       - "no"
   TESTS_BRANCH:
     description: "Branch of E2E-tests on which the test pipeline is triggered"
-    value: "main"
+    value: "develop"
+  TESTS_PROJECT_URL:
+    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
+    value: "gitlab.opencode.de/api/v4/projects/1506"
+  TESTS_TESTSET:
+    description: "Selects test set for E2E-tests"
+    value: "Smoke"
+    options:
+      - "Regression"
+      - "Smoke"
+  TESTS_GRACE_PERIOD:
+    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail.
+                  GRACE_PERIOD is the period in seconds that should be waited before running the tests."
+    value: "0"
+  TESTS_NUMBER_OF_THREADS:
+    description: "How many threads are used for executing the tests in parallel?"
+    value: "8"
+
+# Declare .environments which is in `opendesk-env` repository. In case it is not available
+# 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
+.environments:
+  cache: {}
 
 .deploy-common:
   cache: {}
   dependencies: []
   extends: ".environments"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.0.1\
-          @sha256:d38f41b88374e055332860018f2936db8807b763caf6089735db0484cbb2842a"
+  environment:
+    name: "${NAMESPACE}"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.1.0\
+          @sha256:74f349066ac5d20e3afaa6abd28781b4c8dc086f67e3d3c1b8345e4a9c3371b1"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
     # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD
@@ -198,9 +234,6 @@ variables:
 
 env-cleanup:
   extends: ".deploy-common"
-  environment:
-    name: "${NAMESPACE}"
-    action: "stop"
   needs: []
   rules:
     - if: >
@@ -214,6 +247,7 @@ env-cleanup:
         for OPENDESK_RELEASE in $(helm ls -n ${NAMESPACE} -aq); do
           helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
         done
+        # if you update the section below, please also update the respective section in getting_started.md
         kubectl delete pvc --all --namespace ${NAMESPACE};
         kubectl delete jobs --all --namespace ${NAMESPACE};
         kubectl delete configmaps --all --namespace ${NAMESPACE};
@@ -223,9 +257,6 @@ env-cleanup:
   stage: "env-cleanup"
 
 env-start:
-  environment:
-    name: "${NAMESPACE}"
-    on_stop: "env-stop"
   extends: ".deploy-common"
   image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
   rules:
@@ -236,14 +267,46 @@ env-start:
   script:
     - "echo \"Deploying to Environment ${NAMESPACE} in ${CLUSTER} Cluster\""
     - "kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -"
-    - >
-      kubectl create secret
-      --namespace "${NAMESPACE}"
-      docker-registry external-registry
-      --docker-server "${EXTERNAL_REGISTRY}"
-      --docker-username "${EXTERNAL_REGISTRY_USERNAME}"
-      --docker-password "${EXTERNAL_REGISTRY_PASSWORD}"
-      --dry-run=client -o yaml | kubectl apply -f -
+    - "export FILENAME_CERT_SECRET=cert_to_import.yaml"
+    # from self-signed-certificates.md:
+    # "Copy this cert's secret into the/each namespace you want to make use of the cert."
+    - |
+      kubectl get secret opendesk-root-cert-secret -n cert-manager -o yaml | \
+        grep -v \ uid\: | \
+        grep -v \ resourceVersion\: | \
+        grep -v \ creationTimestamp\: | \
+        sed --expression 's/namespace\:\ cert-manager/namespace: '"${NAMESPACE}"'/g' \
+        >${FILENAME_CERT_SECRET} || true
+    - |
+      if [ -s ${FILENAME_CERT_SECRET} ]; then
+        echo "Applying ${FILENAME_CERT_SECRET}"
+        kubectl apply -f ${FILENAME_CERT_SECRET}
+      fi
+    # from self-signed-certificates.md:
+    # "Create issuer in the/each namespace you want to make use of the cert."
+    - |
+      kubectl apply -f - <<EOF
+      apiVersion: cert-manager.io/v1
+      kind: Issuer
+      metadata:
+        name: "selfsigned-issuer"
+        namespace: ${NAMESPACE}
+      spec:
+        ca:
+          secretName: opendesk-root-cert-secret
+      EOF
+  after_script:
+    # Set credentials for openDesk Enterprise Registry
+    - |
+      if [ "${OPENDESK_ENTERPRISE}" = "true" ]; then
+        kubectl create secret \
+        --namespace "${NAMESPACE}" \
+        docker-registry enterprise-registry \
+        --docker-server "registry.opencode.de" \
+        --docker-username "${OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME}" \
+        --docker-password "${OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD}" \
+        --dry-run=client -o yaml | kubectl apply -f -
+      fi
   stage: "env"
 
 policies-deploy:
@@ -256,11 +319,11 @@ policies-deploy:
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
       when: "on_success"
   variables:
-    COMPONENT: "services"
+    COMPONENT: "opendesk-services"
     ADDITIONAL_ARGS: "-l name=opendesk-otterize"
 
 migrations-pre:
-  stage: "migrations-pre"
+  stage: "010-migrations-pre"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -269,10 +332,10 @@ migrations-pre:
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
       when: "on_success"
   variables:
-    COMPONENT: "migrations-pre"
+    COMPONENT: "opendesk-migrations-pre"
 
 migrations-post:
-  stage: "migrations-post"
+  stage: "090-migrations-post"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -281,10 +344,10 @@ migrations-post:
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
       when: "on_success"
   variables:
-    COMPONENT: "migrations-post"
+    COMPONENT: "opendesk-migrations-post"
 
-services-deploy:
-  stage: "basic-services-deploy"
+services-external-deploy:
+  stage: "030-services"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -293,22 +356,22 @@ services-deploy:
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
       when: "on_success"
   variables:
-    COMPONENT: "services"
+    COMPONENT: "services-external"
 
-provisioning-deploy:
-  stage: "component-deploy-stage-2"
+opendesk-services-deploy:
+  stage: "030-services"
   extends: ".deploy-common"
   rules:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no" || $DEPLOY_PROVISIONING != "no")
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
       when: "on_success"
   variables:
-    COMPONENT: "provisioning"
+    COMPONENT: "opendesk-services"
 
-ums-deploy:
-  stage: "component-deploy-stage-1"
+nubus-deploy:
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -320,7 +383,7 @@ ums-deploy:
     COMPONENT: "nubus"
 
 ox-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   timeout: "30m"
   rules:
@@ -332,20 +395,8 @@ ox-deploy:
   variables:
     COMPONENT: "open-xchange"
 
-ics-deploy:
-  stage: "component-deploy-stage-1"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ICS != "no")
-      when: "on_success"
-  variables:
-    COMPONENT: "intercom-service"
-
 xwiki-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -357,7 +408,7 @@ xwiki-deploy:
     COMPONENT: "xwiki"
 
 collabora-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -369,7 +420,7 @@ collabora-deploy:
     COMPONENT: "collabora"
 
 cryptpad-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -381,7 +432,7 @@ cryptpad-deploy:
     COMPONENT: "cryptpad"
 
 nextcloud-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -393,7 +444,7 @@ nextcloud-deploy:
     COMPONENT: "nextcloud"
 
 openproject-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -405,7 +456,7 @@ openproject-deploy:
     COMPONENT: "openproject"
 
 openproject-bootstrap-deploy:
-  stage: "component-deploy-stage-2"
+  stage: "060-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -414,10 +465,10 @@ openproject-bootstrap-deploy:
           ($DEPLOY_ALL_COMPONENTS != "no" || ($DEPLOY_OPENPROJECT != "no" && $DEPLOY_NEXTCLOUD != "no"))
       when: "on_success"
   variables:
-    COMPONENT: "openproject-bootstrap"
+    COMPONENT: "opendesk-openproject-bootstrap"
 
 jitsi-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -428,8 +479,20 @@ jitsi-deploy:
   variables:
     COMPONENT: "jitsi"
 
+notes-deploy:
+  stage: "050-components"
+  extends: ".deploy-common"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NOTES != "no")
+      when: "on_success"
+  variables:
+    COMPONENT: "notes"
+
 element-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
@@ -440,49 +503,71 @@ element-deploy:
   variables:
     COMPONENT: "element"
 
-env-stop:
+fetch-administrator-credentials:
   extends: ".deploy-common"
-  environment:
-    name: "${NAMESPACE}"
-    action: "stop"
-  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
-  needs: []
+  stage: "post-prepare"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/
-      when: "manual"
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api"
+          && $NAMESPACE =~ /.+/
+          && ($CREATE_DEFAULT_ACCOUNTS == "yes" || $RUN_TESTS == "yes")
+      when: "on_success"
   script:
-    - "echo 'We do not stop the env (delete the namespace) at the moment in this stage, as deleting a branches also
-      triggers this env-stop stage and we do not want this to happen.'"
-    # - kubectl delete namespace "${NAMESPACE}"
-  stage: "env-stop"
-  variables:
-    GIT_STRATEGY: "none"
+    - |
+      echo "DEFAULT_ADMINISTRATOR_PASSWORD=$(
+       kubectl \
+         -n ${NAMESPACE} \
+         get secret ums-nubus-credentials \
+         -o jsonpath='{.data.administrator_password}' | base64 -d \
+      )" >> .env
+  artifacts:
+    reports:
+      dotenv: ".env"
 
-.ums-default-password: &ums-default-password
-  - |
-    UMS_PASSWORDS=$( \
-      kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}' \
-      | yq '.properties.password' > passwords.txt \
-    )
-    DEFAULT_USER_PASSWORD=$( \
-      awk 'NR==1{print $1}' passwords.txt \
-    )
-    DEFAULT_ADMIN_PASSWORD=$(
-      awk 'NR==3{print $1}' passwords.txt \
-    )
-
-run-tests:
-  extends: ".deploy-common"
+import-default-accounts:
+  stage: "post-execute"
+  extends: ".environments"
+  dependencies:
+    - "fetch-administrator-credentials"
+  environment:
+    name: "${NAMESPACE}"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $CREATE_DEFAULT_ACCOUNTS == "yes"
+      when: "on_success"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0"
+  script:
+    - "echo \"Starting default account import for ${DOMAIN}\""
+    - "cd /app"
+    - |
+      ./user_import_udm_rest_api.py \
+        --import_domain ${DOMAIN} \
+        --udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
+        --set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
+        --import_filename ./template.ods \
+        --admin_enable_fileshare True \
+        --admin_enable_knowledgemanagement True \
+        --admin_enable_projectmanagement True \
+        --create_admin_accounts True \
+        --verify_certificate False
+
+run-tests:
+  stage: "post-execute"
+  extends: ".deploy-common"
+  dependencies:
+    - "fetch-administrator-credentials"
   environment:
     name: "${NAMESPACE}"
-  stage: "tests"
   rules:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
       when: "on_success"
+  parallel:
+    matrix:
+      - LANGUAGE:
+          - "de"
+          - "en"
   script:
-    - *ums-default-password
     - |
       curl --request POST \
       --header "Content-Type: application/json" \
@@ -490,34 +575,33 @@ run-tests:
         \"ref\": \"${TESTS_BRANCH}\", \
         \"token\": \"${CI_JOB_TOKEN}\", \
         \"variables\": { \
-          \"url\": \"https://portal.${DOMAIN}\", \
-          \"user_name\": \"${DEFAULT_USER_NAME}\", \
-          \"user_password\": \"${DEFAULT_USER_PASSWORD}\", \
-          \"admin_name\": \"${DEFAULT_ADMIN_NAME}\", \
-          \"admin_password\": \"${DEFAULT_ADMIN_PASSWORD}\", \
-          \"DEPLOY_ALL_COMPONENTS\": \"${DEPLOY_ALL_COMPONENTS}\", \
-          \"DEPLOY_COLLABORA\": \"${DEPLOY_COLLABORA}\", \
-          \"DEPLOY_ELEMENT\": \"${DEPLOY_ELEMENT}\", \
-          \"DEPLOY_ICS\": \"${DEPLOY_ICS}\", \
-          \"DEPLOY_JITSI\": \"${DEPLOY_JITSI}\", \
-          \"DEPLOY_KEYCLOAK\": \"${DEPLOY_UMS}\", \
-          \"DEPLOY_NEXTCLOUD\": \"${DEPLOY_NEXTCLOUD}\", \
-          \"DEPLOY_OPENPROJECT\": \"${DEPLOY_OPENPROJECT}\", \
-          \"DEPLOY_OX\": \"${DEPLOY_OX}\", \
-          \"DEPLOY_SERVICES\": \"${DEPLOY_SERVICES}\", \
-          \"DEPLOY_UCS\": \"${DEPLOY_UMS}\", \
-          \"DEPLOY_XWIKI\": \"${DEPLOY_XWIKI}\", \
-          \"DEPLOY_PROVISIONING\": \"${DEPLOY_PROVISIONING}\" \
+          \"operator\": \"${OPERATOR}\", \
+          \"cluster\": \"${CLUSTER}\", \
+          \"namespace\": \"${NAMESPACE}\", \
+          \"url\": \"https://portal.${DOMAIN}/\", \
+          \"language\": \"${LANGUAGE}\", \
+          \"udm_api_username\": \"Administrator\", \
+          \"udm_api_password\": \"${DEFAULT_ADMINISTRATOR_PASSWORD}\", \
+          \"screenshot_test\": \"yes\", \
+          \"screenshot_before_step\": \"yes\", \
+          \"screenshot_after_step\": \"yes\", \
+          \"screenshot_redirect_step\": \"yes\", \
+          \"testset\": \"${TESTS_TESTSET}\", \
+          \"testprofile\": \"Namespace\", \
+          \"OPENDESK_ENTERPRISE\": \"${OPENDESK_ENTERPRISE}\", \
+          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\", \
+          \"NUMBER_OF_THREADS\": \"${TESTS_NUMBER_OF_THREADS}\" \
         } \
       }" \
       "https://${TESTS_PROJECT_URL}/trigger/pipeline"
+  retry: 1
 
 avscan-prepare:
   stage: ".pre"
   rules:
     - if: >
           $JOB_AVSCAN_ENABLED != 'false' &&
-          $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+          $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
           $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "always"
     - when: "never"
@@ -537,7 +621,7 @@ avscan-prepare:
           - "freshclam"
           - "mkdir /scan"
         script:
-          - "export IMAGE=${EXTERNAL_REGISTRY:-${CONTAINER_REGISTRY}}/${CONTAINER_IMAGE}:${CONTAINER_TAG}"
+          - "export IMAGE=${AV_SCAN_PROXY:-${CONTAINER_REGISTRY}}/${CONTAINER_IMAGE}:${CONTAINER_TAG}"
           - "echo Pulling and scanning $IMAGE..."
           - "crane pull $IMAGE /scan/image.tar"
           - "clamscan /scan"
@@ -545,7 +629,7 @@ avscan-prepare:
           CONTAINER_IMAGE: ""
           CONTAINER_REGISTRY: ""
           CONTAINER_TAG: ""
-          DATABASE_MIRROR: "https://nexus.souvap-univention.de/repository/ClamAV"
+          DATABASE_MIRROR: "https://gitlab.opencode.de/bmi/opendesk/tooling/clamav-db-mirror/-/raw/main"
       EOF
     - >
       yq '.images
@@ -556,7 +640,7 @@ avscan-prepare:
       | del(.[].repository)
       | del(.[].tag)
       | del(.[].registry)'
-      helmfile/environments/default/images.yaml
+      helmfile/environments/default/images.yaml.gotmpl
       >> dynamic-scans.yml
   artifacts:
     paths:
@@ -567,7 +651,7 @@ avscan-start:
   rules:
     - if: >
         $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
         $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "always"
     - when: "never"
@@ -576,116 +660,4 @@ avscan-start:
       - artifact: "dynamic-scans.yml"
         job: "avscan-prepare"
     strategy: "depend"
-
-# Declare .environments which is in environments repository. In case it is not available
-# 'cache' is used because job must contain at least one key, so cache is just a dummy key.
-.environments:
-  cache: {}
-
-# Overwrite shared settings
-.common-semantic-release:
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release-patched:latest"
-  tags: []
-
-conventional-commits-linter:
-  rules:
-    - if: >
-          $RUN_RENOVATE == "yes" ||
-          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
-          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
-      when: "never"
-    - when: "always"
-
-common-yaml-linter:
-  rules:
-    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
-      when: "never"
-    - when: "always"
-
-reuse-linter:
-  allow_failure: false
-  rules:
-    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
-      when: "never"
-    - when: "always"
-
-generate-release-version:
-  rules:
-    - if: >
-        $JOB_RELEASE_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
-        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
-      when: "on_success"
-
-release:
-  rules:
-    - if: >
-        $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
-        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
-      when: "on_success"
-  script:
-    - >
-      export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
-      "@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
-      grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
-    - |
-      if [ -z "${RELEASE_VERSION}" ]; then
-        echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
-      else
-        echo "RELEASE_VERSION=${RELEASE_VERSION}"
-      fi
-    - |
-      echo -e "\n[INFO] Writing data to helm value file..."
-      cat <<EOF >helmfile/environments/default/global.generated.yaml
-      # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-      # SPDX-License-Identifier: Apache-2.0
-      ---
-      global:
-        systemInformation:
-          releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
-      ...
-      EOF
-    - |
-      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
-      {
-        "branches": ["main"],
-        "plugins": [
-          "@semantic-release/gitlab",
-          "@semantic-release/release-notes-generator",
-          "@semantic-release/changelog",
-          ["@semantic-release/git", {
-            "assets": [
-              "charts/**/Chart.yaml",
-              "CHANGELOG.md",
-              "charts/**/README.md",
-              "helmfile/environments/default/global.generated.yaml",
-              ".kyverno/kyverno-test.yaml",
-              "docs"
-            ],
-            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
-          }]
-        ]
-      }
-      EOF
-    - "semantic-release"
-  needs:
-    - "generate-docs"
-
-renovate:
-  rules:
-    - if: >
-        $RUN_RENOVATE == "yes"
-      when: "on_success"
-  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
-  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
-  variables:
-    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
-    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
-    # Increase the renovatebot log level on stdout
-    LOG_LEVEL: "DEBUG"
-  script:
-    - "renovate ${RENOVATE_EXTRA_FLAGS}"
-  stage: "renovate"
-
 ...

.gitlab/common/common.yml

@@ -2,10 +2,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.4.4\
-    @sha256:4120fe717071876f4c9ff128f26019d089fda158a4fb1912911e09af2fd3875f"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.5\
-    @sha256:60870adb64b0503d4a6efd16cef4e074b91a4ca52b48811cfcea057bcccd07e4"
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.2\
+    @sha256:e33a6327b9c8f89f6e86d13804d5d81e9fdf6974a2f280874d6901067c22fd83"
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.14\
+    @sha256:34d2a96e5fc25155abd48fef4d335b131c71d8cbc00ad531df0cae9918b9f2ab"
 
 .common:
   cache: {}

.gitlab/generate/generate-docs.yml

@@ -13,7 +13,7 @@ generate-docs:
   extends: ".generate-common"
   image: "${OPENDESK_CI_CLI_IMAGE}"
   rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $RELEASE_BRANCH"
       when: "on_success"
   script:
     - "node /app/src/index.js generate-docs -d ${CI_PROJECT_DIR}"

.gitlab/lint/lint-common.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024-2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 include:
@@ -8,4 +8,18 @@ include:
   extends: ".common"
   stage: "lint"
 
+common-yaml-linter:
+  rules:
+    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
+      when: "never"
+    - when: "always"
+
+conventional-commits-linter:
+  rules:
+    - if: >
+          $RUN_RENOVATE == "yes" ||
+          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
+          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
+      when: "never"
+    - when: "always"
 ...

.gitlab/lint/lint-kyverno.yml

@@ -14,19 +14,40 @@ lint-kyverno:
           - "collabora"
           - "cryptpad"
           - "element"
-          - "intercom-service"
           - "jitsi"
           - "nextcloud"
+          - "notes"
           - "nubus"
           - "open-xchange"
+          - "opendesk-migrations-post"
+          - "opendesk-migrations-pre"
+          - "opendesk-openproject-bootstrap"
+          - "opendesk-services"
           - "openproject"
-          - "openproject-bootstrap"
-          - "provisioning"
-          - "services"
+          - "services-external"
           - "xwiki"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${APP}"
-    - "helmfile template -e test --include-needs > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-env
+      -d ${CI_PROJECT_DIR}/helmfile/environments
+      -x ${CI_PROJECT_DIR}/.kyverno/_overwrite.yaml
+    - "helmfile template -e test --include-needs --skip-tests > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
+    - >
+      node /app/opendesk-ci-cli/src/index.js remove-empty-keys
+      -f ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml
+    - "cd ${CI_PROJECT_DIR}/.kyverno"
+    # Test optional
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
+      -d ${CI_PROJECT_DIR}/.kyverno
+      -t optional
+      -s manifest
+      -f opendesk.yaml
+      --skip-tests true
+      ${APP}
+    - "kyverno test . || true"
+    # Test required
     - >
       node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
       -d ${CI_PROJECT_DIR}/.kyverno
@@ -35,8 +56,5 @@ lint-kyverno:
       -f opendesk.yaml
       --skip-tests true
       ${APP}
-    - "node /app/opendesk-ci-cli/src/index.js filter-for-kinds -f ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
-    - "cd ${CI_PROJECT_DIR}/.kyverno"
     - "kyverno test ."
-
 ...

.gitlab/lint/lint-reuse.yml

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+reuse-linter:
+  allow_failure: false
+  rules:
+    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
+      when: "never"
+    - when: "always"
+...

.gitlab/release/release-common.yml

@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# Overwrite shared settings
+.common-semantic-release:
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
+  tags: []
+...

.gitlab/release/release-generate-version.yml

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+generate-release-version:
+  rules:
+    - if: >
+        $JOB_RELEASE_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
+      when: "on_success"
+...

.gitlab/release/release-semantic.yml

@@ -0,0 +1,63 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+release:
+  cache:
+    - key: "generate-docs-${CI_COMMIT_REF_SLUG}"
+      paths:
+        - "${CI_PROJECT_DIR}/docs"
+      policy: "pull"
+  rules:
+    - if: >
+        $JOB_AVSCAN_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
+      when: "on_success"
+  script:
+    - >
+      export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
+      "@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
+      grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
+    - |
+      if [ -z "${RELEASE_VERSION}" ]; then
+        echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
+      else
+        echo "RELEASE_VERSION=${RELEASE_VERSION}"
+      fi
+    - |
+      echo -e "\n[INFO] Writing data to helm value file..."
+      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
+      # SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+      # SPDX-License-Identifier: Apache-2.0
+      ---
+      global:
+        systemInformation:
+          releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
+      ...
+      EOF
+    - |
+      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
+      {
+        "branches": ["main"],
+        "plugins": [
+          "@semantic-release/gitlab",
+          "@semantic-release/release-notes-generator",
+          "@semantic-release/changelog",
+          ["@semantic-release/git", {
+            "assets": [
+              "charts/**/Chart.yaml",
+              "CHANGELOG.md",
+              "charts/**/README.md",
+              "helmfile/environments/default/global.generated.yaml.gotmpl",
+              ".kyverno/kyverno-test.yaml",
+              "docs"
+            ],
+            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+          }]
+        ]
+      }
+      EOF
+    - "semantic-release"
+  needs:
+    - "generate-docs"
+...

.gitlab/renovate/renovate.yml

@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+renovate:
+  rules:
+    - if: >
+        $RUN_RENOVATE == "yes"
+      when: "on_success"
+  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
+  variables:
+    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
+    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
+    # Increase the renovatebot log level on stdout
+    LOG_LEVEL: "DEBUG"
+  script:
+    - "renovate ${RENOVATE_EXTRA_FLAGS}"
+  stage: "renovate"
+...

.kyverno/_overwrite.yaml

@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+replicas:
+  umsLdapServerPrimary: 2
+...

.kyverno/policies/_policies.yaml

@@ -13,7 +13,7 @@ pod:
       - "DaemonSet"
   - name: "disallow-default-serviceaccount"
     rule: "disallow-default-serviceAccountName"
-    type: "required"
+    type: "optional"
     kinds:
       - "StatefulSet"
       - "Deployment"
@@ -58,7 +58,7 @@ pod:
       - "DaemonSet"
   - name: "require-health-and-liveness-check"
     rule: "require-health-and-liveness-check"
-    type: "required"
+    type: "optional"
     kinds:
       - "StatefulSet"
       - "Deployment"
@@ -158,7 +158,7 @@ pod:
       - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-seccomp-profile"
-    type: "required"
+    type: "optional"
     kinds:
       - "StatefulSet"
       - "Deployment"
@@ -176,7 +176,7 @@ pod:
       - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-empty-seLinuxOptions"
-    type: "required"
+    type: "optional"
     kinds:
       - "StatefulSet"
       - "Deployment"
@@ -285,7 +285,7 @@ pod:
       - "Ingress"
   - name: "template-replicas"
     rule: "template-replicas"
-    type: "required"
+    type: "optional"
     kinds:
       - "StatefulSet"
       - "Deployment"

.kyverno/policies/require-requests-limits.yaml

@@ -27,6 +27,20 @@ spec:
         message: "CPU and memory resource requests and limits are required."
         pattern:
           spec:
+            =(ephemeralContainers):
+              - resources:
+                  limits:
+                    memory: "?*"
+                  requests:
+                    cpu: "?*"
+                    memory: "?*"
+            =(initContainers):
+              - resources:
+                  limits:
+                    memory: "?*"
+                  requests:
+                    cpu: "?*"
+                    memory: "?*"
             containers:
               - resources:
                   limits:

.kyverno/policies/template-storage.yaml

@@ -10,7 +10,7 @@ metadata:
     policies.kyverno.io/subject: "Pod"
     policies.kyverno.io/description: >-
       This policy validates if `.Values.persistence.storageClassNames` variables are used in templates and if the size
-      of volumes can be customized by `.Values.persistence.size` variable.
+      of volumes can be customized by `.Values.persistence.storages.<COMPONENT>.size` variable.
 spec:
   background: true
   rules:

.renovate/config.yaml

@@ -35,12 +35,12 @@ repositories:
     dependencyDashboard: true
     # Include package files only within these defined paths
     includePaths:
-      - "helmfile/environments/default/images.yaml"
-      - "helmfile/environments/default/charts.yaml"
+      - "helmfile/environments/default/images.yaml.gotmpl"
+      - "helmfile/environments/default/charts.yaml.gotmpl"
     customManagers:
       - customType: "regex"
         fileMatch:
-          - "helmfile/environments/default/images.yaml"
+          - "helmfile/environments/default/images.yaml.gotmpl"
         datasourceTemplate: "docker"
         matchStrings:
           # yamllint disable rule:line-length rule:quoted-strings
@@ -48,7 +48,7 @@ repositories:
           # yamllint enable rule:line-length rule:quoted-strings
       - customType: "regex"
         fileMatch:
-          - "helmfile/environments/default/charts.yaml"
+          - "helmfile/environments/default/charts.yaml.gotmpl"
         datasourceTemplate: "docker"
         matchStrings:
           # yamllint disable rule:line-length rule:quoted-strings

.reuse/dep5

@@ -1,16 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: openDesk - der Souveräne Arbeitsplatz
-Upstream-Contact: <opendesk@zendis.de>
-Source: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk
-
-Files: helmfile/files/theme/*
-Copyright: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-License: Apache-2.0
-
-Files: helmfile/files/gpg-pubkeys/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: CC0-1.0
-
-Files: cspell.json
-Copyright: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-License: Apache-2.0

CHANGELOG.md

@@ -1,3 +1,254 @@
+## [1.1.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.1...v1.1.2) (2025-02-19)
+
+
+### Bug Fixes
+
+* **dovecot:** Add Dovecot Pro [EE] ([6e343c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6e343c76a32a5bf4b431bdad6be1f7d107caa4f5))
+* **element:** Add Element EE components ([61d94a8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/61d94a8de655d1289aaf59c42f0dbf30b0156e1f))
+* **helmfile:** Add missing customizing option for Matrix widgets ([9c79c44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9c79c44453af7b0c68f4ee2a5e40f1f9fb298570))
+* **helmfile:** Add SSL option for Keycloak Extensions Proxy's PostgreSQL connection ([91d0f98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/91d0f9868226b08128af518be741c8614342581e))
+* **helmfile:** Fine-grained service types ([de8b560](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/de8b560fe7e2294229a959398be60bec9b6a7790))
+* **helmfile:** Integrate oD EE ([03ec704](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/03ec70435c365eca9f555a195b7ab92cc9eee907))
+* **helmfile:** Introduce `apps` as top level in `opendesk_main.yaml.gotmpl`; Please check migrations.md for upgrades of existing installations ([2fcf014](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2fcf014894ac3356ef8c6e57dda30c5176172e5e))
+* **helmfile:** Make openDesk IAM attributes optional with enabled as default ([b32996d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b32996da347c7ec24fb53afe72fee8c07631bebe))
+* **helmfile:** Provide toggle in `functional.yaml.gotmpl` for "new device notification" mails ([284c9fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/284c9fe0c7e217e3f92ec70eaad6ccf593ff2a87))
+* **helmfile:** Remove reference to no longer required `elementWeb` chart ([cd9c54b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cd9c54b17733f9e334c558ccd86e69677264970a))
+* **helmfile:** Set default for domain to `opendesk.internal` to avoid enforcing DOMAIN environment variable for deployments using YAML overrides ([930ae9d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/930ae9d3e71bcd3f4034aa4dae5eabb3ae04d11b))
+* **helmfile:** Update/streamline theming ([8eeaa23](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8eeaa23c2f68e8e0cbda5b3763ab15ba8262c48d))
+* **jitsi:** Support for phone dial-in into Jitsi conferences ([1323ef1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1323ef142e789820acb05cb4991d10502a35498b))
+* **nextcloud:** Update `groupfolders` app to fix group selection in admin mode ([ab49bf9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ab49bf9f6bb945cdce3950e46382b7361c48e6e4))
+* **nextcloud:** Update Nextcloud to 29.0.11 and support for Cron-Job specific resource definitions ([09f4829](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/09f482981b96774b3fe0948b7bb120be90157148))
+* **nubus:** Disable unused notification feature ([955f17e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/955f17ef8bb72459beb536cdcf6b502b16eabbff))
+* **nubus:** Fix Keycloak dialogue background length on small screens ([4662709](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/466270967310fab9333b892c904efa86d21f7d17))
+* **nubus:** Only configure apps that are deployed to show up in IAM admin UI and Keycloak ([1f051e7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1f051e777905668297c98dfa507875c08158bfda))
+* **nubus:** Re-implement toggle for UDM-REST-API based on `functional.externalServices.nubus.udmRestApi.enabled` ([777e7d2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/777e7d2fc6afa9c53a4ff1c6853c9960b9a22d5f))
+* **nubus:** Remove doublet `resources` key in `udm-listener` StatefulSet ([10e0b0a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/10e0b0ad6cbd89bd88b119f17b6cba6ec698f698))
+* **nubus:** Support for custom UDM commands ([aff8edb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/aff8edbde2150763d6a36f97b9403c8c67e51fab))
+* **nubus:** Update Keycloak Extensions Proxy ([601e649](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/601e6499132c3adaaaea374033511eab09132cb2))
+* **open-xchange:** Parameters to split read and write queries to MariaDB ([370247b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/370247b95197792a65b84b2d01b9c1806f8b059a))
+* **open-xchange:** Update OX App Suite to 8.33 ([581c8ae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/581c8aed1f86bad251141ecb105e59d0054d5a1a))
+* **openproject:** Update OpenProject to 15.2.1 ([83c311b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/83c311b101a6fa551d9c25ea4e9a7ef6673137ca))
+* **oxconnector:** Update to strict `securityContext` from upstream defaults ([32df165](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/32df1657d29a2d73495d52b62bb77521cb8b8e86))
+
+## [1.1.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.0...v1.1.1) (2025-01-27)
+
+
+### Bug Fixes
+
+* **docs:** Add permissions.md ([04ab28c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/04ab28c029bb60575c1936ca5acdd2f829b26c06))
+* **element:** MatrixID for Element "Welcome User" to support deployments where matrix domain differs from homeserver FQDN ([ccb51a0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ccb51a0de32525a93fd982d52dc8e6a35db8f09a))
+* **element:** Update Element to 1.11.90 ([335806a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/335806a53e51c3fc6a03440316e909aa51af5be8))
+* **element:** Update Helm chart to v6.0.2 for a fix when using non generated secrets in `opendesk-synapse` ([d5e73fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d5e73feb880c33e8127f284fcc685ffdc15874a8))
+* **element:** Update Synapse to 1.121.1 ([33ff922](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/33ff9227b745f99e3abdde6dbbe6b00042fca655))
+* **helmfile:** Move the access restriction configuration for Keycloak client scopes into helmfile templating, instead of hardcoded Helm chart values ([3662b5c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3662b5cd255b37321d3a3625f78feff07b7e633c))
+* **helmfile:** Remove duplicate entries from `secrets.yaml.gotmpl` ([a13cf63](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a13cf630242343dc8f759cfeb423ff626480b086))
+* **helmfile:** Support component specific storageClassNames. **Note:** Please check the migration.md if you upgrade a deployment that has set custom PVC sizes using `persistence.size` settings. ([bacf51e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bacf51efb1b042b80f13f5cf3f50557006f32374))
+* **helmfile:** Support PostgreSQL as alternative database backend for Nextcloud and XWiki. **Note:** PostgreSQL is likely to become the preferred option/default in the future and MariaDB might be deprecated at a later point. ([a0f52ee](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a0f52ee7d4f6a9b82c9d4e288bc4c6cc96018985))
+* **helmfile:** Update `opendesk-alerts` and `opendesk-dashboards` to get predictable sort order, improving GitOps deployments ([0c91117](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0c91117575a3b56ff9f0b4ae72a501b9f3b4384c))
+* **helmfile:** Update upstream images for k8s/kubectl to v1.32.0 ([b71c2e5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b71c2e57eec10093d96804e249fbaf81c51fb22e))
+* **intercom:** Remove legacy OIDC claims ([6796f32](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6796f320f72db02d67b73685aa6356cda9ac86d1))
+* **nextcloud:** Update image and Helm chart to support app toggles during deployment ([1cdfcf2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1cdfcf2784271f2b8ea61d2e8e534db2aa386f4b))
+* **nextcloud:** Update to Nextcloud 29.0.10 ([d096fb1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d096fb1154dbcd092e105d4450e7996dfda0388e))
+* **nubus:** Fix `pullPolicy` setting for `ldapServer.leaderElector` to satisfy Kyverno linter ([6f2f7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6f2f7cd5db6708c1fc523e3cf3160f39f1dba2bb))
+* **nubus:** Merge yaml files for better maintainability ([6c67eca](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6c67eca7aa68c3f597cc5790ba1046ca0855c329))
+* **nubus:** Pre-create groups in Keycloak to avoid race condition on group sync when initial users login parallel ([5496317](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5496317fee1ca47a80d0798b9048a1474ca8e2a6))
+* **nubus:** Remove `extra` settings from ldapServer needed for openDesk 1.0.0 LDAP migration ([fab862e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fab862eec689bf8ef547c4bd06244313f24f6d0b))
+* **nubus:** Remove b64 encoded files from CSS, instead use `opendesk-static-files` ([2926e2c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2926e2c93a2b4be24abd1e6dd4ce02071a629cb4))
+* **nubus:** Template `secrets.nubus.masterpassword`. **Note:** Please check migrations.md for details. ([5aae75a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5aae75a1521f73e497859fe3d3b89a8752bb47a1))
+* **nubus:** Update customizations for group cleanup ([0b230fa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0b230fa2cc841edfde99f5d94dc9c8054bfbb5ec))
+* **open-xchange:** Add missing `registryOpencodeDe` to OX-Connector's `waitForDependency` image ([a16d907](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a16d9071c96ef7fde87e6579c328e1e05509824b))
+* **openproject:** Update to 15.1.1 ([b4b714f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4b714ff41a8f01d4b44c6d5ced3f036f7d90699))
+* **openproject:** Update to 15.2.0 ([9d8e9c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d8e9c3ade9917fb8044331ebdea8d7bca4066b0))
+* **static-files:** Update Helm chart to use more generic `assets` over `theme.imagery.assets` ([63562c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63562c1aae6b2c33ea39b93c11e842c2ab1e2c25))
+* **static-files:** Update Helm chart to v4.0.1 to support longer domain names ([b0e665b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b0e665b031baf36c59eea85b3d575f1a49290bf1))
+* **xwiki:** Update Helm chart to v1.4.1 to fix support for custom `ingressClassName` values. Ref [#144](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/144) ([033cb55](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/033cb558ddc0b47d17b006cdc75c593c5c356147))
+
+# [1.1.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.0.0...v1.1.0) (2024-12-24)
+
+
+### Bug Fixes
+
+* **cassandra:** Prepare cassandra for openDesk Enterprise. ([508e286](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/508e28623258542a4082e79ed75ce1e5758ae2e0))
+* **cassandra:** Remove values in charts.yaml for enterprise components. ([c0cbb76](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c0cbb76921b5108d084640baf3e607e9fc6557c7))
+* **ci:** Explicitly set RELEASE_BRANCH (to `main`) for scan and release steps ([e5ad0bb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e5ad0bb2e028dafab0ba29fb2e9b0d207b8795fd))
+* **ci:** Reduce Kyverno linting issues ([e4d9106](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e4d9106c457e018922dcc730df0570d41f3ec2aa))
+* **collabora:** Add/update Helmfile for Collabora Controller to be used in EE deployments ([a63d7cb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a63d7cb8614bfa7d26d997ffdf3ea807ae187664))
+* **collabora:** Update to 24.04.9.2. ([407f2be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/407f2be2ad2d40813bb37e0ba302ef14e3a06bd9))
+* **docs:** Add `architecture.md` and `apis.md` ([7710858](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/77108587c71dee16ecf539608838c8c9064a66f8))
+* **docs:** Add GitOps / Argo CD documentation ([bbe7550](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bbe7550c4617b4799190192b5316ac04295e9e88))
+* **docs:** Update and streamline README.md and migrations.md. ([a86c0af](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a86c0afdbb7fa1230aa90cf210323969fd580431))
+* **element:** Add extensive database options ([9e102e2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9e102e2d1b9d6621b9c5d6ed0643432e8879f663))
+* **element:** Prepare element for openDesk Enterprise. ([00a1a93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/00a1a9394ee3544b1a0d7b3e975c36830ba8b13c))
+* **element:** Rename release opendesk-element to opendesk-element-web ([1213ecc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1213ecc425041ac4adba99a0ae2d8188932a7d9f))
+* **element:** Switch `element-web` base image to Alpine ([47ce294](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/47ce29440388370f7d63e373eeda90d067830ebd))
+* **element:** Toggle IPv4-only mode depending on cluster.networking.ipFamilies ([627b9c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/627b9c1e8464fd9529ddf50f171031053710323c))
+* **element:** Update Matrix Meetings Bot to 2.8.2 ([4403dfe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4403dfe720982a8339043951a4dfc88bfb0af57c))
+* **element:** Update Synapse to 1.120.2 and Element to 1.11.87 update also related containers ([9d7644d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d7644dc04c9ef97449680e5197f2129d62d56f8))
+* **helmfile:** Add `opendesk-static-files` to `opendesk-services` to serve favicons ([6438284](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6438284090f3e552843679c1ea62b5538be5dff9))
+* **helmfile:** Add Redis username and tls option ([564fb2d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/564fb2d7c7190a91446293ce21950701503ecbb7))
+* **helmfile:** Allow usage of pre-defined CA certificates. ([0738fa0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0738fa080d61f0e6c084dd8fd5e09635469b1dca))
+* **helmfile:** Auto-redirect user to login dialogue, please read migrations.md for more details ([a9c8dfe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a9c8dfeab125510a7d9a137e16b14685155aa441))
+* **helmfile:** Remove `default.user` and `default.admin` for new deployments. ([54f9e4c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/54f9e4c3f8fd425bde1272e3eec490efa30461f7))
+* **helmfile:** Remove `theme` subtree from the migration's `.Values` secret to avoid a bloated secret hitting limits in certain clusters setups and GitOps tools. ([b6725dd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b6725dddc19f22e142a214c02aef5139b2921d5a))
+* **helmfile:** Splitting the directory `./helmfile/apps/services` into `-external` and `opendesk-` services, please read migrations.md for more details ([277a1f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/277a1f5a65e340180feeb84cce2097be5a2157e1))
+* **helmfile:** Streamline `commonLabels.deployStage`. ([f969425](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f96942536f931e8f8eb714ce0503716b873b593b))
+* **helmfile:** Streamline `requests.cpu` in `resources.yaml` ([43f427e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/43f427e06a83aea8979e1b54f7ea7f2d24ab28cf))
+* **helmfile:** Streamline file extensions in `/helmfile/environments/default` to ([0e3b661](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0e3b6615653d7bbe30b09e57428b1f5c19f171f8))
+* **helmfile:** Unify templating name for Open-Xchange to `openxchange` and for OX App Suite to `oxAppSuite`. ([6ff1fcd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6ff1fcd438103534e78a5898f25fcea1080dfb86))
+* **helmfile:** Use dictionaries for defining `customization.yaml`, please read migrations.md for more details ([86ef0be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/86ef0be542b0e34d76a85cb226e223a3e7dbc76e))
+* **jitsi:** Update Jitsi Helm chart and images. ([5c691e4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5c691e450821c81b363040b68ffba96e38d1712b))
+* **jitsi:** Update to 2.0.9823 and chart to 2.1.1 ([56ce335](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/56ce3355fcedf60595f33609848f6c8bd8644914))
+* **jitsi:** Update to switch the colors of `Hang up` and `End meeting for all` buttons. ([9dbb2b7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9dbb2b755caa8e6bda80bed691c54e66b1a63eb9))
+* **migrations:** Cleanup of jobs ([539a302](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/539a30263c9ce25ab7c6aa6607fd41cd1099315b))
+* **migrations:** Update to support Nubus 1.5.1 ([7f60ab3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7f60ab3b7a155c8f95bfcf139fa896cbc41ca767))
+* **nextcloud:** Add Redis TLS option ([1402593](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1402593556af9cf039878a1261b656424fc45c88))
+* **nextcloud:** Fix templating for nextcloud database name ([7f1f6cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7f1f6cdcd4385d24cf13cdf9425b615337a131de))
+* **nextcloud:** Fix templating for nextcloud database user ([c8c12a2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c8c12a278e8d00f04c1c7b6dd7fbdf3826c89a19))
+* **nextcloud:** Support IPv4 only clusters ([b25ada1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b25ada1f603659cd551be23d62992e8fa6a0603d))
+* **nextcloud:** Trusted Proxy setting. ([bc0ca8b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc0ca8b4c1dfdcd046c9b4ddd1f63a28e6a5531a))
+* **nextcloud:** Update Chart to 3.6.1 and Image to 2.3.3 (including rollback to 29.0.8). Introducing setting for `functional.filestore.sharing.external.sendPasswordMail` ([18fcaa0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/18fcaa0331c9c94bb2f260f97fbadad44b019bb6))
+* **nextcloud:** Update to 29.0.9 incl. latest apps. ([c63cca7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c63cca72a35cdeb35b8ea48d98a5c5d55982d145))
+* **notes:** Add `favicon.ico` via `opendesk-static-files` ([669995b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/669995bb95235a56f7b2387c4c582d6e7250e4a9))
+* **notes:** Add https to all endpoints ([174951c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/174951cd5145e83d776a9b4bda4f091d5b827402))
+* **nubus:** Add nginx s3 proxy when minio disabled ([b3b6ab5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b3b6ab5a61dc5bca13c8b1f4e6b716bbcad64e8c))
+* **nubus:** Enable Keycloak debug mode logging; add Keycloak specific section to debugging.md ([3b3679b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3b3679bab150ece327ce1e132933820b1e3afa88))
+* **nubus:** Fix selfsigned certificate mounts ([b90bff3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b90bff30b35b91fff792f2d5d617de4cdba30f23))
+* **nubus:** Leader election on re-deployments ([b965677](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b9656772a9c743c9119a850e0b48cb39d68f48fa))
+* **nubus:** Start ums keycloak bootstrap already during Sync phase ([16dfd25](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/16dfd255c621b1da311fd6fee775f7397e5f6792))
+* **nubus:** Update external portal links and login screen background. ([901b1f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/901b1f529e7d16a8164511bebac1e7f9a475d111))
+* **nubus:** Update to 1.4.0 ([2a94f2d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2a94f2dd4bdfa039b4459b3711e171ee46172583))
+* **nubus:** Update to v1.5.1 ([4c7422a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4c7422a411a4fa1ddc36430d363ae06226efb31d))
+* **nubus:** Use favicon with transparent background for portal ([1b13c3e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1b13c3ea658786420d960c8e67aed81f40067c0a))
+* **open-xchange:** Extend Dovecot LDAP filter to also match OX-Resources ([31ea6e0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31ea6e0e08226afb8d9cba4370033fd6f742459b))
+* **open-xchange:** Fix truststore decrypt error on self-signed deployments ([8611d95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8611d95e5a4ab7b158ed8322676589c3d196b548))
+* **open-xchange:** Update AppSuite to 8.30, update Helm chart to 2.12.85 ([0c88699](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0c886999174f87030af268c7fdd0beee11f01346))
+* **opendesk-services:** Update minio to 2024.12.13 ([4cda827](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4cda827f5554ed7ff92a85fc62f6908183181f9b))
+* **opendesk-services:** Update otterize Network Policies ([4602396](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4602396583c454a23b3458c54cb40e259f245163))
+* **openproject:** Bump Helm chart to 9.2 ([718eb45](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/718eb45e9c9961f1f792b59e232fd7da66916c7d))
+* **openproject:** Bump version to 15.0.2 ([c06e0bb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c06e0bb8d4d04c8794dafddecc189d5f376d661e))
+* **openproject:** Update 15.1.0 image ([6d329e1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6d329e18cff8c6ebbbf1b0965801827079904f88))
+* **openproject:** Update branding and Helm chart to 9.0.1 ([d3b1916](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d3b191644b0bf20cac1cd9f85ed4b4dc7c6b549d))
+* **openproject:** Update to 14.6.3 incl. latest Helm chart (8.3.2). ([4c82adf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4c82adf668c7f90489bc4ae46426cf607e3425d8))
+* **postfix:** Added service type definition analogous to dovecot ([31ec100](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31ec1003c0874a2920132c61d48a1a88e5569cb8))
+* **services:** Add template for certificate issuerRef.kind ([df144fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/df144fe3d3ffd70ca0b7e5aa4c2894b96d0138f1))
+* **services:** Update MariaDB chart to v3.0.3 in preparation for the use of external secrets. ([08feab1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/08feab1cfcc099d9b8caed2c4db9a97d4542a5ac))
+* **services:** Update Redis to 7.4.1 as required by OX Appsuite, please read migrations.md for more details ([5e0b2e2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5e0b2e26fc33d7befcb3f94d748e8e9d6f93f383))
+* **xwiki:** Fix templating for xwiki database port ([de15071](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/de15071ae9d6194d93f9a5fbb0033650b266eaf9))
+* **xwiki:** Set superadmin password account only when debug is enabled ([e2b3bd5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e2b3bd543fab7be512cef58382c4d62c48cd79b4))
+
+
+### Features
+
+* **helmfile:** Add grafana dashboards ([1441c57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1441c5734f42b995505e6aa97f59bdb1eae32b1b))
+* **helmfile:** Add openDesk specific alerts ([f630a36](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f630a369da12ef7f19d5553c6dbd5955e414868f))
+* **helmfile:** Add template support for antivirus icap/milter ([83da87e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/83da87e9623be294753302686a8d8270c28bcc58))
+* **helmfile:** Allow custom/self-signed ca-certificates ([c71faf5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c71faf5e8011c42b02fd5025a9b1629300a4f1e3))
+* **jitsi:** Enable Jitsi room history by default. ([45add79](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/45add7981c3a50045caeadb7f2b0bc11254ae562))
+* Newsfeed in Portal based on XWiki blog feature ([3ad285a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3ad285a8695a32607c4bf0faea0747c7e685dcd6))
+* **notes:** Integrate Preview of Notes app ([96f1819](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/96f18196c53267dbd72cd28e6fbadf06448db93a))
+
+# [1.0.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.9.0...v1.0.0) (2024-10-14)
+
+
+### Bug Fixes
+
+* **ci:** Add TESTS_GRACE_PERIOD variable for run-tests job. ([1023f3d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1023f3d081a980a794850399f133cf817448c431))
+* **ci:** Re-enable e2e test trigger. ([603b102](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/603b102f41b8a7e3bfab1c7d45cd05da96c455f6))
+* **ci:** Remove K8s secret creation for `EXTERNAL_REGISTRY_USERNAME` / `EXTERNAL_REGISTRY_PASSWORD`. ([cbe6b1a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cbe6b1ae6c01beb68ae3bcc0d2444f4b48c8e2ea))
+* **ci:** Trigger e2e tests for multiple languages. ([9d7d89f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d7d89f74f49c384e9632b74cbe20a641725caa7))
+* **collabora:** Add ipFamilies cluster.networking option ([add2ab1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/add2ab1a41e422295ccd58c09aa9fab9b45f18cb))
+* **collabora:** Reduce Collabora's securityContext capabilities. ([a7ea701](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7ea701cc65ab230d269e4f6b91b39a03c126fad))
+* **collabora:** Set Nextcloud URL for custom font support. ([370c7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/370c7cd836b46fb31c79b59d76297abd8748a711))
+* **collabora:** Update to 24.04.6.1.1. ([97f7a1c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/97f7a1cafd743c5e91f9cce6d028c54281afda81))
+* **collabora:** Update to 24.04.6.2.1. ([3d44193](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d441933ca1c28911218ebc073e7b1d39e402325))
+* **collabora:** Update to 24.04.7.1.2. ([11ebb80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11ebb80494d181b8ef4793e3e59f3e6ac225b072))
+* **collabora:** Update to 24.04.7.2. ([5f72da4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5f72da4e579aeb749c045bb7f25355b3e12b411a))
+* **docs:** Update `replicas.yaml` and  `docs/scaling.md`. ([45715a2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/45715a20594dafe833041d5843c857bc0e23dcbc))
+* **docs:** Various updates. ([8aa1a7f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8aa1a7fa7d106d2e70b1e31b6bda5febb3afec66))
+* **element:** Feature toggle for user controlled updates of their Element display name; new default for generating MatrixID, check docs/migrations.md for details. ([efc41cb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/efc41cb3aa0294d79f6cad3d9e879380745fef57))
+* **element:** Set Synapse rate limit. ([4ff720d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4ff720d36fa30f5f3a7328edd3bfc7edf89cf48f))
+* **element:** Update 'capabilities_approved' for NeoBoard Widget ([ade8535](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ade8535c4456ef9db8c8ef7915bcc4c5ae215f6a))
+* **element:** Update NeoBoard to 1.20.0 and `synapse-guest-module` to 2.0.0. ([11b0d44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11b0d441e0c886b5360690d23bf266a4ccb57a10))
+* **element:** Update NeoDateFix translations. ([71f21dc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/71f21dc4333765f4bdaf7cfd8910b9b6982b0340))
+* **element:** Update Synapse to v0.1150. ([12680e5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/12680e5c1ae40a7722db0417751b014229bdd559))
+* **element:** Use Element upstream without widgets. ([bdc6ad2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bdc6ad286425e429c8195014251046ac0cfe6424))
+* **helmfile:** Add `cluster.networking.proxies`. Deployments need to set this if their load balancer or reverse proxy IPs are not part of the `cluster.networking.cidr`. ([a395759](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a3957595516e6864c762fbeedb9fdc50c02920cb))
+* **helmfile:** Add `sample.yaml.gotmpl` to `dev` and `prod` env directories. ([dd80abe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd80abe622fd824b8af358a8923d6fb47715825d))
+* **helmfile:** Add new settings to `functional.yaml` for fileshare expiry dates. ([6b88f73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6b88f731eb2b6c8ceebc9a7a0c96e63d13743b24))
+* **helmfile:** Check imagePullSecrets templates for all resources ([13e0bb8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13e0bb8d68df12b8451b7318059d35f7eaa018b8))
+* **helmfile:** Move Intercom-Service to Nubus component. ([ef1dad7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ef1dad7433bbf64b9d021bd581d9016ffc68e610))
+* **helmfile:** Move OX-Connector to Open-Xchange component. ([751f578](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/751f5783d05ec4577e563d135c04d2925a14da47))
+* **helmfile:** Remove NET_RAW capabilities ([e512486](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e512486e74545449a0e3dca5254ffb44f2d1790f))
+* **helmfile:** Remove some YAML linter warnings. ([d641359](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d641359c29c81c774880196febaf4e979b98e5d6))
+* **helmfile:** Remove toggle `functional.email.systemGenerated.useComponentInSenderdomain`. Mails will no longer use a component subdomain in their sender address. ([b60fe39](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b60fe39b5c7f6479180495eb76a52b77385fb92d))
+* **helmfile:** Switch fom dep5 to REUSE.toml. ([592f031](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/592f03135f226a18038dff534c5b8f8dfc327670))
+* **helmfile:** Update portal and branding. ([6ba6923](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6ba69236129e2176afd14d05060f6db1671df863))
+* **helmfile:** Update replicas.yaml. ([8ef69ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8ef69ecaf22a8cee51ea4029173d30ff5f1213a0))
+* **helmfile:** Update to support Helmfile 1.0.0-rc5. ([f4b9395](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f4b9395b4134b28eb969e71bc2321eae3054da00))
+* **intercom-service:** Customizable user mapper. ([a7e5f64](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7e5f64b50f102855bd15568ff698160f2b616e3))
+* **jitsi:** Improve handling of non authorized users. ([8bca56d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8bca56d4acb1e8baf1d9bd6e640080b15aac35df))
+* **jitsi:** Update chart for improved openDesk look & feel. ([f297d8c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f297d8c0b70bd923670a6107471dafe750d8a352))
+* **jitsi:** Update Helm chart and Keycloak Adapter image. ([3ad81e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3ad81e6b92ac652fbf20f56f2cc85e6d8eb5d0d4))
+* **jitsi:** Update images to `9646-stable`. ([49ad36e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/49ad36ef4e04640493373e0ba9f4d596968e5412))
+* **jitsi:** Updated branding and new option `functional.dataProtection.jitsiRoomHistory.enabled` defaulting to `[secure]`. ([67d52c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/67d52c771ef596e444d021886cf5554e12fc1a65))
+* **nextcloud:** Add support for secret keys for administrator and ldap credentials ([7aee88e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7aee88ec94be75f096c31bbb08246c563736b5bc))
+* **nextcloud:** Bump image to incorporate latest PHP fixes. ([c9ae039](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c9ae0391b07e18f22c91f4eb6ac746f43210a3f3))
+* **nextcloud:** Remove `/index.php`. ([3baf37c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3baf37c5097e763069ad66163362e19a90bd5d4e))
+* **nextcloud:** Update to 29.0.5 and support for new functional settings regarding sharing of files. See the options related to `functional.filestore.sharing` in `functional.yaml` and also `migrations.md` regarding their defaults that differ from the previous standard behaviour of openDesk. ([ac148d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ac148d0c28cf8382c8b96dbedddeccdd0fcd762b))
+* **nextcloud:** Update to 29.0.6 including latest app updates. ([9950b73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9950b73ae3789fbae31e98a6ad9845822797cb78))
+* **nubus:** Add interim ingress configuration fixing UMC in German ([6a60c6d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6a60c6dd43a31e6e972d7149977638d077cbe77b))
+* **nubus:** Only use one LDAP Primary and make replica count of Secondary and Proxy others configurable ([31753ff](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31753ffb19dcd4a82766ed39e7584cbba46b57b0))
+* **nubus:** Reduce lint failures, especially take care of pullSecrets ([e923468](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e923468cd6070615c5ba776bb223759988283ecd))
+* **nubus:** Remove duplicated "nubusPortalFrontend" ([8cd2f3a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8cd2f3a993af673eba3c931a2a9e5a9756943a5d))
+* **nubus:** Remove superfluous variables ([a7d3d25](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7d3d2585ca73543902d5240f3629bc4e1bc4fe8))
+* **nubus:** Update "openDesk Standard" OX profile. ([fdb37c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fdb37c3943b08a49badf15da93f4d07abf8f7706))
+* **nubus:** Update customization for improved UX. ([b9db81f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b9db81f69d19985571486aaa4cc11077e0a2abc2))
+* **nubus:** Update LDAP openDesk schemas and add related openDesk config options to user. ([e3238f9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e3238f96f74bfea0b52125d0b5c384aacb75287c))
+* **nubus:** Update LDAP to openLDAP 2.5. ([c63e725](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c63e7255254db140d622b658603b99dee5af9879))
+* **nubus:** Update opendesk-nubus to set default OXContext and improved OXProfile, update migrations to (optionally) ldap-patch OXContext for `Administrator`/`default.admin` as well as patch the OXProfile to 1.0 default state. ([e619db6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e619db6da20710a9c1f3df6d8777a370be90c697))
+* **nubus:** Update to 0.63.2 ([28dd762](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/28dd762db397f47f0741087fd376be9e3e194dbe))
+* **nubus:** Update to 0.64.2. ([fc7099a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fc7099a8a6d71f10be1e9ac92279cfdb5f0ebb7d))
+* **nubus:** Update to Nubus 0.62.2. ([8229949](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8229949b47b15933fd4bcc198ec8b27302e2ea32))
+* **nubus:** Update to version 0.57.3. ([11f750e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11f750e1d603c44fdcbc9711fbe66cbf15ff0c10))
+* **open-xchange:** DisplayName settings for OX-Connector. ([b7faa24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b7faa24d76d6078336d222b195fb83f0860e7e35))
+* **open-xchange:** Update cluster internal Nextcloud URL. ([b1946d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b1946d0c1df6a8825bb5ba6ce61bb8d51d8eefa5))
+* **open-xchange:** Update Migrations for OX-Connector. ([6325b69](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6325b69a9145d90328237c359315d057bb187fc5))
+* **open-xchange:** Update OpenXchange Appsuite Bootstrap to v2.1.0 ([fb8f7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fb8f7cd28a82025be5bdc1f9eb92cb2497e22e16))
+* **open-xchange:** Update OX AppSuite to 8.26 and improve configuration including server-side Element integration. ([61d7496](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/61d74966d0427ed9214858af2126f250117a8962))
+* **openproject:** Bump OpenProject to 14.5.1. ([deacbc9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/deacbc9db5f30a492e77eb1516182a40427b0c02))
+* **openproject:** Remove `OPENPROJECT_PER__PAGE__OPTIONS` to enable functional administration of the setting. ([df9380b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/df9380b92445b992dc3917c63f1d3ce02f9c6633))
+* **openproject:** Update Helm chart to v8.0.0 and explicitly template resources. ([91e34aa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/91e34aabaae8e72b0edb6afe466d4de028dc6a38))
+* **openproject:** Update to 14.6.0. ([560aa30](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/560aa30cba2e528094231cb41474a2554f535438))
+* **openproject:** Update to 14.6.1. ([cc4b359](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cc4b35912428b6f4f5541500020f7a4aaff1674e))
+* **openproject:** Updated bootstrap image does not fail on rerun. ([7d0d6ea](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7d0d6ea8d15a226d34a0605daf6d635f6c1caae9))
+* **services:** Bump Postfix Helm chart to 2.2.0. ([f194f24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f194f248459ac0bd39246c72f937672ed24e5f14))
+* **services:** Support application based connection limits and password updates for PostgreSQL and MariaDB. ([c03566d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c03566dd63afd0c66de4627880b33ae359cba54f))
+* **xwiki:** Disable check for local Office component. ([a91f181](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a91f181c463a5feaa3ac04b4b39fcd27a55fe4a1))
+* **xwiki:** Enable IAM controlled functional admin role. ([fa8572f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fa8572f785e59b0797c0e5fee12776d0fdc66361))
+* **xwiki:** Update to 16.4.4 - updated. ([6347966](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6347966765c3a1caeec0840d2132c8c41a5d1237))
+* **xwiki:** Update to 16.4.4. ([d693ff9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d693ff94f4f79ee26df661f738c843bd4d887716))
+
+
+### Features
+
+* **element:** Add feature flag `functional.dataProtection.matrixPresence.enabled` that defaults to `[secure]` to avoid that openDesk provides presence information on users unintended. We include the hardcoded configuration in openDesk Synapse that users cannot change their displayname. ([4b99357](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4b99357b21176f57b75b745a9e3fa04d3cba9d9a))
+* **helmfile:** Add customization.yaml to define custom files for helmfile releases ([180ccdd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/180ccddfaa71e6dcf5f0383bbf1175e6568fc7ee))
+* **helmfile:** Add fine-granular registry overwrites ([7348547](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7348547d9602edb2f52c73d26749c4a4d8aadd91))
+* **helmfile:** Add support for argocd git-ops deployment ([9f081d8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9f081d856724c06928dbb3d6119fd7a090bb4048))
+* **helmfile:** Change default subdomain names. Attention, consult docs/migrations.md for upgrade deployments. ([3d84e80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d84e804c2e93d758e42a477888faf681aa56e7e))
+* **helmfile:** Full ArgoCD support ([7bf8e69](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7bf8e6976a14a1bb3d1a06135c17211d6530a1c3))
+* **helmfile:** Support feature toggle `email.systemGenerated.useComponentInSenderdomain`. ([a46a632](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a46a6326164e2462cd95a7421c7785e7d529e9c0))
+* **nextcloud:** Use nextcloud image with bundled nginx ([81f5969](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/81f5969653388b6ce4ef4d15f4fe1cbd61a17e10))
+* **nubus:** Update IAM components. ([ce03400](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ce03400043414ce0d13e2a0f90909d65d7b6eb99))
+* **nubus:** Update to Nubus 0.39.2 chart ([7345563](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/73455630fdfada47d0f4895d3f2969c7e80b8847))
+* **open-xchange:** Support for email migration feature toggle enabling masterpassword authentication in Dovecot and AppSuite. Requires openDesk Enterprise. ([356d8df](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/356d8dfbfd3825f30fc6c0786551d239e1c5e02e))
+* **services:** [bmi/opendesk/deployment/opendesk[#66](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/66)] Add dkimpy-milter to sign outgoing emails with DKIM and use local postfix as mail relay in all components. ([fbe4909](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fbe4909a8e4c78fd541facea4bd052d10100ea71))
+
+
+### BREAKING CHANGES
+
+* **helmfile:** Upgrading from previous releases requires manual steps, read `./docs/migrations.md` carefully.
+
 # [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24)
 
 

README-EE.md

@@ -0,0 +1,102 @@
+<!--
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>openDesk Enterprise Edition</h1>
+
+<!-- TOC -->
+* [Components](#components)
+* [Enabling the Enterprise deployment](#enabling-the-enterprise-deployment)
+* [Configuring the oD EE deployment for self-hosted installations](#configuring-the-od-ee-deployment-for-self-hosted-installations)
+  * [Registry access](#registry-access)
+  * [License keys](#license-keys)
+<!-- TOC -->
+
+openDesk Enterprise Edition is recommended for production use. It receives support and patches from ZenDiS and the suppliers of the components due to the included product subscriptions.
+
+The document refers to openDesk Community Edition as "oD CE" and for the openDesk Enterprise Edition it is "oD EE".
+
+Please contact [ZenDiS](mailto:opendesk@zendis.de) to get openDesk Enterprise, either as SaaS offering or for you on-premise installation.
+
+# Components
+
+The following components using the same codebase and artifacts for their Enterprise and Community offering:
+- Cryptpad
+- Jitsi
+- Nubus
+- OpenProject
+- XWiki
+
+The following components have - at least partially - Enterprise specific artifacts:
+
+- Collabora: Collabora Online image version `<major>.<minor>.<patch>.3` will be used once available, at the same time the Collabora Development Edition image will be updated to `<major>.<minor>.<patch>.2` for oD CE.
+- Element: Some artifacts providing additional functionality are only available in oD EE. For the shared artifacts we keep the ones in oD CE and oD EE in sync.
+- Nextcloud: Specific enterprise image based on the NC Enterprise package is build based on the same release version as used in oD CE.
+- OX AppSuite: oD CE and EE are using the same release version, in EE an enterprise-built container of the AppSuite's Core-Middleware is being integrated.
+- OX Dovecot Pro 3: Dovecot Pro provides support for S3 storage and this feature is used by default.
+
+# Enabling the Enterprise deployment
+
+To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value that does not evaluate to boolean *false* for [Helm flow control](https://helm.sh/docs/chart_template_guide/control_structures/#ifelse), e.g. `"true"`, `"yes"` or `"1"`:
+
+```shell
+OPENDESK_ENTERPRISE=true
+```
+
+# Configuring the oD EE deployment for self-hosted installations
+
+## Registry access
+
+With openDesk EE you get access to the related artifact registry owned by ZenDiS.
+
+Three steps are required to access the registry - for step #1 and #2 you can set some variables. You can to define a `<your_name_for_the_secret>` freely, like `enterprise-secret`, as long as it consistent in step #1 and #3.
+
+```shell
+NAMESPACE=<your_namespace>
+NAME_FOR_THE_SECRET=<your_name_for_the_secret>
+YOUR_ENTERPRISE_REGISTRY_USERNAME=<your_registry_credential_username>
+YOUR_ENTERPRISE_REGISTRY_PASSWORD=<your_registry_credential_password>
+```
+
+1. Add your registry credentials as secret to the namespace you want to deploy openDesk to. Do not forget to create the namespace if it does not exist yet (`kubectl create namespace ${NAMESPACE}`).
+
+```shell
+kubectl create secret --namespace "${NAMESPACE}" \
+  docker-registry "${NAME_FOR_THE_SECRET}" \
+  --docker-server "registry.opencode.de" \
+  --docker-username "${YOUR_ENTERPRISE_REGISTRY_USERNAME}" \
+  --docker-password "${YOUR_ENTERPRISE_REGISTRY_PASSWORD}" \
+  --dry-run=client -o yaml | kubectl apply -f -
+```
+
+2. Docker login to the registry to access Helm charts for local deployments:
+
+```shell
+docker login registry.opencode.de -u ${YOUR_ENTERPRISE_REGISTRY_USERNAME} -p ${YOUR_ENTERPRISE_REGISTRY_PASSWORD}
+```
+
+3. Reference the secret from step #1 in the deployment as well as the registry itself for `images` and `helm` charts:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "<your_name_for_the_secret>"
+repositories:
+  image:
+    registryOpencodeDeEnterprise: "registry.opencode.de"
+  helm:
+    registryOpencodeDeEnterprise: "registry.opencode.de"
+```
+
+## License keys
+
+Some applications require license information for their Enterprise features to be enabled. With the aforementioned registry credentials you will also receive a file called `enterprise.yaml` containing the relevant license keys.
+
+Please place the file next your other `.yaml.gotmpl` file(s) that configure your deployment.
+
+Details regarding the scope/limitation of the component's licenses:
+
+- Nextcloud: Enterprise license to enable [Nextcloud Enterprise](https://nextcloud.com/de/enterprise/) specific features, can be used across multiple installations until the licensed number of users is reached.
+- OpenProject: Domain specific enterprise license to enable [OpenProject's Enterprise feature set](https://www.openproject.org/enterprise-edition/), domain matching can use regular expressions.
+- XWiki: Deployment specific enterprise license (key pair) to activate the [XWiki Pro](https://xwiki.com/en/offerings/products/xwiki-pro) apps.

README.md

@@ -8,17 +8,18 @@ SPDX-License-Identifier: Apache-2.0
 
 <!-- TOC -->
 * [Overview](#overview)
-* [Disclaimer](#disclaimer)
+* [Upgrades](#upgrades)
 * [Requirements](#requirements)
 * [Getting started](#getting-started)
 * [Advanced customization](#advanced-customization)
-* [Development](#development)
+* [Architecture](#architecture)
+* [Permissions](#permissions)
 * [Releases](#releases)
-* [Components](#components)
+* [Data Storage](#data-storage)
 * [Feedback](#feedback)
+* [Development](#development)
 * [License](#license)
 * [Copyright](#copyright)
-* [Footnotes](#footnotes)
 <!-- TOC -->
 
 # Overview
@@ -26,19 +27,21 @@ SPDX-License-Identifier: Apache-2.0
 openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the
 *Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH*.
 
+For production use the [openDesk Enterprise Edition](./README-EE.md) is required.
+
 openDesk currently features the following functional main components:
 
-| Function             | Functional Component        | Component<br/>Version                                                                 | Upstream Documentation                                                                                                                       |
-| -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
-| Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                                 |
-| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                                 |
-| File management      | Nextcloud                   | [28.0.5](https://nextcloud.com/de/changelog/#28-0-5)                                  | [Nextcloud 28](https://docs.nextcloud.com/)                                                                                                  |
-| Groupware            | OX App Suite                | [8.26](https://documentation.open-xchange.com/appsuite/releases/8.26/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
-| Knowledge management | XWiki                       | [16.4.1](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.1/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                            |
-| Portal & IAM         | Nubus                       | Product Preview[^1]                                                                   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html)                                                    |
-| Project management   | OpenProject                 | [14.3.0](https://www.openproject.org/docs/release-notes/14-3-0/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
-| Videoconferencing    | Jitsi                       | [2.0.9646](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9646) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
-| Weboffice            | Collabora                   | [24.04.6.1.1](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
+| Function             | Functional Component        | Component<br/>Version                                                                                | Upstream Documentation                                                                                                                |
+| -------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89)                       | [For the most recent release](https://element.io/user-guide)                                                                          |
+| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                                     | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
+| File management      | Nextcloud                   | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8)                                                 | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                           |
+| Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)                       | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
+| Portal & IAM         | Nubus                       | [1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
+| Project management   | OpenProject                 | [15.2.1](https://www.openproject.org/docs/release-notes/15-2-1/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
+| Weboffice            | Collabora                   | [24.04.9.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
 
 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
@@ -47,28 +50,23 @@ This documentation aims to give you all that is needed to set up your own instan
 
 Basic knowledge of Kubernetes and DevOps processes is required though.
 
-# Disclaimer
+# Upgrades
 
-openDesk will face breaking changes in the near future without upgrade paths before
-[technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
-v1.0.0 is reached.
+You want to upgrade an existing openDesk installation?
 
-While most components support upgrades, major configuration or component changes may occur, therefore we recommend
-from scratch installations for now.
-
-In the next months, we not only expect to integrate upstream updates of the functional components to include their
-most recent feature and security sets, but also to address operational topics like scalability for the openDesk
-platform.
-
-Of course, further development also includes enhancing the documentation itself.
+⟶ Visit our detailed documentation about [Updates & Upgrades](./docs/migrations.md).
 
 # Requirements
 
-⟶ Visit our detailed [Requirements](./docs/requirements.md) overview.
+You want to understand what is required to install openDesk yourself?
+
+⟶ Visit our [Requirements](./docs/requirements.md) overview.
 
 # Getting started
 
-⟶ Visit our detailed [Getting started](./docs/getting-started.md) guide.
+You would like to install openDesk in your own infrastructure?
+
+⟶ Visit our detailed [Getting started guide](./docs/getting-started.md).
 
 # Advanced customization
 
@@ -79,9 +77,13 @@ Of course, further development also includes enhancing the documentation itself.
 - [Monitoring](./docs/monitoring.md)
 - [Theming](./docs/theming.md)
 
-# Development
+# Architecture
 
-⟶ To understand the repository contents from a developer perspective please read the [Development](./docs/development.md) guide.
+More information on openDesk's architecture can be found in our [Architecture docs](./docs/architecture.md).
+
+# Permissions
+
+Find out more about the permission system in the[roles & permissions concept](./docs/permissions.md)
 
 # Releases
 
@@ -93,14 +95,15 @@ of this project.
 
 Please find a list of the artifacts related to the release either in the source code archive attached to the release or
 in the files from the release's git-tag:
-- `./helmfile/environments/default/images.yaml`
-- `./helmfile/environments/default/charts.yaml`
+- `./helmfile/environments/default/images.yaml.gotmpl`
+- `./helmfile/environments/default/charts.yaml.gotmpl`
 
-⟶ Visit our detailed [Workflow](./docs/workflow.md) docs.
+Find more information in our [Workflow documentation](./docs/workflow.md).
 
-# Components
+# Data Storage
 
-⟶ Visit our detailed [Component](./docs/components.md) docs.
+More information about different data storages used within openDesk are described in the
+[Data Storage documentation](./docs/data-storage.md).
 
 # Feedback
 
@@ -112,6 +115,10 @@ please use the [issues within this project](https://gitlab.opencode.de/bmi/opend
 If you want to address other topics, please check the section
 ["Rückmeldungen und Beteiligung" in the OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung) of the [openDesk Info Repository](https://gitlab.opencode.de/bmi/opendesk/info).
 
+# Development
+
+If you want to join or contribute to the development of openDesk please read the [Development guide](./docs/development.md).
+
 # License
 
 This project uses the following license: Apache-2.0
@@ -119,11 +126,3 @@ This project uses the following license: Apache-2.0
 # Copyright
 
 Copyright (C) 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-
-# Footnotes
-
-[^1]: Nubus is the Cloud Portal and IAM from Univention.
-It is currently integrated as a product preview within openDesk therefore, not all resources like documentation
-and structured release notes are available, while the
-[source code can already be found on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/component-code/crossfunctional/univention).
-Please find updates regarding the Nubus at https://nubus.io.

REUSE.toml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+
+version = 1
+
+[[annotations]]
+path = "cspell.json"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/gpg-pubkeys/*"
+SPDX-FileCopyrightText = "2023 Bundesministerium des Innern und für Heimat, PG ZenDiS \"Projektgruppe für Aufbau ZenDiS\""
+SPDX-License-Identifier = "CC0-1.0"
+
+[[annotations]]
+path = "helmfile/files/theme/**"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "docs/architecture/apis_images/*"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/portal-tiles/*"
+SPDX-FileCopyrightText = "2024 Google LLC"
+SPDX-License-Identifier = "Apache-2.0"

cspell.json

@@ -4,76 +4,82 @@
     "dictionaryDefinitions": [],
     "dictionaries": [],
     "words": [
-        "openDesk",
+        "Addressbooks",
         "AppSuite",
-        "Collabora",
-        "Digitale",
-        "Jitsi",
-        "Nextcloud",
-        "Öffentlichen",
-        "OpenProject",
-        "Souveränität",
-        "Verwaltung",
-        "Zentrum",
-        "Keycloak",
-        "NATS",
-        "slapadd",
-        "slapcat",
-        "RDBMS",
-        "Velero",
-        "Univention",
-        "OIDC",
-        "kcadmin",
-        "DMARC",
-        "homeserver",
-        "Bundesministerium",
-        "Innern",
-        "Heimat",
-        "Projektgruppe",
+        "Arbeitsplatz",
         "Aufbau",
-        "Filepicker",
-        "Weboffice",
-        "Xchange",
-        "opencode",
-        "seccomp",
-        "psql",
-        "databasename",
-        "helmfile",
-        "gotmpl",
-        "containerd",
-        "letsencrypt",
-        "CNCF",
-        "kubespray",
-        "ICAP",
+        "bootstrap",
+        "Bundesministerium",
         "Ceph",
+        "clamav",
+        "CNCF",
+        "Collabora",
+        "commandline",
+        "configurability",
+        "containerd",
         "Coturn",
-        "Minio",
-        "Kyverno",
-        "Otterize",
-        "IBAC",
-        "pubkeys",
-        "Grundschutz",
-        "Kubescape",
-        "Gitflow",
-        "hadolint",
+        "cryptpad",
+        "databasename",
+        "Digitale",
+        "DMARC",
         "explorative",
+        "Filepicker",
+        "filestore",
+        "Gitflow",
+        "gotmpl",
+        "Grundschutz",
+        "hadolint",
+        "Heimat",
+        "helmfile",
+        "helmfiles",
+        "homeserver",
+        "IBAC",
+        "ICAP",
+        "IMAPS",
+        "Innern",
+        "Jitsi",
+        "kcadmin",
+        "Keycloak",
+        "Kubescape",
+        "kubespray",
+        "Kyverno",
+        "letsencrypt",
+        "localpart",
+        "Minio",
+        "NATS",
+        "Nextcloud",
+        "nindent",
         "Nordeck",
         "Nubus",
-        "Souveräne",
-        "Arbeitsplatz",
-        "commandline",
-        "helmfiles",
+        "Öffentlichen",
+        "OIDC",
+        "opencode",
+        "openDesk",
+        "OpenProject",
+        "Otterize",
+        "Projektgruppe",
+        "psql",
+        "pubkeys",
+        "RDBMS",
+        "seccomp",
+        "selfsigned",
+        "slapadd",
+        "slapcat",
         "SMTPS",
-        "IMAPS",
-        "xwiki",
-        "cryptpad",
-        "clamav",
+        "Souveräne",
+        "Souveränität",
         "templating",
-        "localpart",
-        "Addressbooks",
-        "filestore",
         "trashbin",
-        "bootstrap"
+        "truststore",
+        "Univention",
+        "Velero",
+        "Verwaltung",
+        "Videokonferenz",
+        "Weboffice",
+        "Xchange",
+        "xwiki",
+        "Zentrum",
+        "analysed"
     ],
     "ignoreWords": [],
     "import": []

dev/README.md

@@ -7,30 +7,40 @@ SPDX-License-Identifier: Apache-2.0
 
 * [charts-local.py](#charts-localpy)
   * [Commandline parameter](#commandline-parameter)
-    * [`--branch`](#--branch)
+    * [`--match <your_string>`](#--match-your_string)
     * [`--revert`](#--revert)
+    * [`--branch` (deprecated)](#--branch-deprecated)
 
 # charts-local.py
 
-This script helps you on cloning the platform development Helm charts and referencing them directly in the openDesk
-Helmfile deployment for comfortable local test and development. The charts will be cloned into a directory
-parallel created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
-The name of the chart directory is derived from the branch name you are working with in this `opendesk` repo.
+This script helps you with cloning/pulling Helm charts and referencing them directly in the openDesk
+Helmfile deployment for comfortable local test and development. The charts will be cloned/pulled into a directory
+created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
 
-The script will create `.bak` copies of the helmfiles that have been touched.
+The name of the directory containing the charts is based on the (currently) selected branch of the openDesk
+repo prefixed with `charts-`.
+
+The script will create `.bak` copies of the helmfiles that have been touched that can easily be reverted to
+using the `--revert` option.
 
 Run the script with `-h` to get information about the script's parameter on commandline.
 
 ## Commandline parameter
 
-### `--branch`
+### `--match <your_string>`
+
+Will only fetch repos or pull images for charts which name matches `<your_string>`.
+
+### `--revert`
+
+Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
+scripts itself back to their original location.
+
+### `--branch` (deprecated)
 
 Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
 does not exist yet. Otherwise it will switch to defined branch.
 
 If parameter is omitted the current branch of the `opendesk` repo will be used.
 
-### `--revert`
-
-Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
-scripts itself back to their original location.
+As this parameter was used rarely, we might remove the support in a later version.

dev/charts-local.py

@@ -7,7 +7,7 @@ import logging
 import yaml
 import sys
 import shutil
-import re
+import subprocess
 import configargparse
 
 from pathlib import Path
@@ -17,15 +17,16 @@ p = configargparse.ArgParser()
 p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work with. Will be created by the script if it does not exist yet.')
 p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
 p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
+p.add('--match', default='', help="Clone/pull only charts that contain the given string in their name.")
 p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
 options = p.parse_args()
 
 script_path = os.path.dirname(os.path.realpath(__file__))
 # some static definitions
 log_path = script_path+'/../logs'
-charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml'
+charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml.gotmpl'
 base_repo_path = script_path+'/..'
-base_helmfile = base_repo_path+'/helmfile_generic.yaml'
+base_helmfile = base_repo_path+'/helmfile_generic.yaml.gotmpl'
 helmfile_backup_extension = '.bak'
 
 Path(log_path).mkdir(parents=True, exist_ok=True)
@@ -43,8 +44,8 @@ consoleHandler.setFormatter(logFormatter)
 rootLogger.addHandler(consoleHandler)
 
 logging.debug(f"Working with relative paths from script location: {script_path}")
-logging.debug(f"Log directory: {log_path}")
-logging.debug(f"charts.yaml  : {charts_yaml}")
+logging.debug(f"Log directory:      {log_path}")
+logging.debug(f"charts.yaml.gotmpl: {charts_yaml}")
 
 
 def create_or_switch_branch_base_repo():
@@ -68,40 +69,60 @@ def create_or_switch_branch_base_repo():
             base_repo.git.switch(branch)
     return branch
 
+def create_path_if_not_exists(path):
+    if os.path.isdir(path):
+        logging.warning(f"Path {path} already exists.")
+    else:
+        logging.debug(f"creating directory {path}.")
+        Path(path).mkdir(parents=True, exist_ok=True)
 
 def clone_charts_locally(branch, charts):
-    charts_clone_path = script_path+'/../../'+branch.replace('/', '_')
+    charts_path = script_path+'/../../charts-'+branch.replace('/', '_')
     charts_dict = {}
     doublette_dict = {}
-    if os.path.isdir(charts_clone_path):
-        logging.warning(f"Path {charts_clone_path} already exists, will not clone any charts.")
-    else:
-        logging.debug(f"creating directory {charts_clone_path} to clone charts into")
-        Path(charts_clone_path).mkdir(parents=True, exist_ok=True)
+    create_path_if_not_exists(charts_path)
 
     for chart in charts['charts']:
-        if 'opendesk/components/platform-development/charts' in charts['charts'][chart]['repository']:
-            tag = charts['charts'][chart]['version']
-            logging.debug(f"Working on {chart} / tag {tag}")
-            repository = charts['charts'][chart]['repository']
+        tag = charts['charts'][chart]['version']
+        repository = charts['charts'][chart]['repository']
+        registry = charts['charts'][chart]['registry']
+        name = charts['charts'][chart]['name']
+        logging.debug(f"Working on {chart} / tag {tag} / repo {repository}")
+        chart_local_path = charts_path+'/'+name
+        if not options.match in name:
+            logging.info(f"Chart name {name} does not match {options.match} - skipping...")
+            continue
+        elif registry == '':
+            logging.info("Empty registry definition - skipping...")
+            continue
+        if os.path.isdir(chart_local_path):
+            logging.debug(f"Found pre-existing {chart_local_path} skipping clone/pull, but will still reference chart in Helmfile...")
+            charts_dict[chart] = chart_local_path
+            continue
+        elif 'opendesk/components/platform-development/charts' in repository:
+            logging.info("Cloning the charts repo")
             git_url = options.git_hostname+':'+repository
-            chart_repo_path = charts_clone_path+'/'+charts['charts'][chart]['name']
             if git_url in doublette_dict:
                 logging.debug(f"{chart} located at {git_url} is already checked out to {doublette_dict[git_url]}")
                 charts_dict[chart] = doublette_dict[git_url]
             else:
-                if os.path.isdir(chart_repo_path):
-                    logging.debug(f"Already exists {chart_repo_path} leaving it unmodified")
-                else:
-                    logging.debug(f"Cloning into {chart_repo_path}")
-                    Repo.clone_from(git_url, chart_repo_path)
-                    chart_repo = Repo(path=chart_repo_path)
-                    chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
-                doublette_dict[git_url] = chart_repo_path
-                charts_dict[chart] = chart_repo_path
+                logging.debug(f"Cloning into {chart_local_path}")
+                Repo.clone_from(git_url, chart_local_path)
+                chart_repo = Repo(path=chart_local_path)
+                chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
+                doublette_dict[git_url] = chart_local_path
+                charts_dict[chart] = chart_local_path
+        else:
+            logging.info("Pulling the chart")
+            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_path}"
+            logging.debug(f"CLI command: {helm_command}")
+            try:
+                subprocess.check_output(helm_command, shell = True)
+            except subprocess.CalledProcessError:
+                sys.exit(f"! CLI command '{helm_command}' failed")
+            charts_dict[chart] = chart_local_path
     return charts_dict
 
-
 def grep_yaml(file):
     with open(file, 'r') as file:
         content = ''
@@ -131,7 +152,12 @@ def process_the_helmfiles(charts_dict, charts):
                     for chart_ident in charts_dict:
                         if '.Values.charts.'+chart_ident+'.name' in line:
                             logging.debug(f"found match with {chart_ident} in {line.strip()}")
-                            line = chart_def_prefix+charts_dict[chart_ident]+'/charts/'+charts['charts'][chart_ident]['name']+'" # replaced by local-dev script'+"\n"
+                            line = charts_dict[chart_ident]
+                            if os.path.isdir(line+'/charts/'+chart_ident):
+                                line += '/charts/'+charts['charts'][chart_ident]['name']
+                            elif not os.path.isdir(line):
+                                sys.exit(f"! Did not find directory to reference in Helmfile: '{line}'")
+                            line = chart_def_prefix+line+'" # replaced by local-dev script'+"\n"
                             child_helmfile_updated = True
                             break
                 output.append(line)

docs/architecture.md

@@ -0,0 +1,450 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Architecture</h1>
+
+<!-- TOC -->
+* [Overview](#overview)
+* [Nubus (IAM)](#nubus-iam)
+* [Authentication](#authentication)
+  * [Identity data flows](#identity-data-flows)
+  * [OpenID Connect (OIDC)](#openid-connect-oidc)
+  * [Keycloak](#keycloak)
+  * [Keycloak Extensions](#keycloak-extensions)
+  * [OpenLDAP](#openldap)
+* [Authorization](#authorization)
+  * [LDAP Group Synchronization](#ldap-group-synchronization)
+* [Provisioning](#provisioning)
+  * [OX Connector](#ox-connector)
+  * [SCIM](#scim)
+* [Component integration](#component-integration)
+  * [Intercom Service / Silent Login](#intercom-service--silent-login)
+  * [Central Contacts](#central-contacts)
+  * [Central Navigation](#central-navigation)
+  * [Filepicker](#filepicker)
+  * [Newsfeed](#newsfeed)
+  * [(OpenProject) File Store](#openproject-file-store)
+* [Applications vs. Services](#applications-vs-services)
+  * [Collabora (Office)](#collabora-office)
+  * [CryptPad Online (Diagrams)](#cryptpad-online-diagrams)
+  * [Element/Synapse (Chat \& Call)](#elementsynapse-chat--call)
+  * [Jitsi (Video Conferencing)](#jitsi-video-conferencing)
+  * [Nextcloud (Files)](#nextcloud-files)
+  * [Nubus (Identity and Access Management / Portal)](#nubus-identity-and-access-management--portal)
+  * [OpenProject (Project management)](#openproject-project-management)
+  * [OX App Suite (Groupware) with OX Dovecot (Mail backend)](#ox-app-suite-groupware-with-ox-dovecot-mail-backend)
+  * [XWiki (Knowledge management)](#xwiki-knowledge-management)
+* [Application specific user accounts](#application-specific-user-accounts)
+* [Footnotes](#footnotes)
+<!-- TOC -->
+
+openDesk is designed as a [Kubernetes](https://kubernetes.io) deployment.
+
+It consists of a set of [Helm charts](https://helm.sh/) orchestrated by [Helmfile](https://github.com/helmfile/helmfile).
+
+openDesk includes the functional applications, like file management, chat, and email. Other services such
+as databases and object storage are included for evaluation purposes only. In production, you must provide
+these services yourself.
+
+# Overview
+
+The following diagram shows a high-level overview of openDesk.
+
+```mermaid
+flowchart TD
+    A(User) -->|Log In| B[Keycloak]
+    subgraph Nubus
+        B -->C[Portal]
+        B -->|User Directory| OpenLDAP
+    end
+    C -->|Manage Files| NC[fa:fa-file Nextcloud]
+    C -->|Chat & Call| EL[fa:fa-comments Element]
+    C -->|Send/Receive E-Mails| OXE[fa:fa-envelope OX App Suite]
+    C -->|Manage Appointments| OXC[fa:fa-calendar OX App Suite]
+    NC -->|Edit Office Documents| CO[fa:fa-file-word Collabora Online]
+    NC -->|Edit diagram.net Documents| CP[fa:fa-chart-diagram CryptPad]
+    C -->|Manage Tasks| OP[fa:fa-diagram-project OpenProject]
+    C -->|Store Knowledge| XW[fa:fa-book XWiki]
+    C -->|Meet People| JI[fa:fa-video Jitsi]
+```
+
+openDesk includes a portal that allows navigation to the respective application. The portal is part of the
+Identity and Access Management (IAM) application shipped with openDesk: *Nubus*. Nubus includes OpenLDAP
+for storing users, groups, and permissions, and Keycloak for single sign-on with LDAP user federation
+configured to the aforementioned OpenLDAP.
+
+When the user is authenticated by Keycloak, the portal shows the applications the user is permitted to access.
+
+The user can now access applications and use the corresponding functionality without the need to authenticate to
+applications again. This is implemented using the OpenID Connect (OIDC) protocol.
+
+# Nubus (IAM)
+
+[Nubus](https://www.univention.de/products/nubus/) is a specialized IAM platform developed by Univention GmbH
+to centralize and simplify identity management in IT environments. It is typically used in contexts where
+user authentication, role-based access control, and integration with multiple systems are essential.
+
+In openDesk, Nubus serves the following purposes:
+
+1. Identity Provider (IdP)
+
+    Nubus acts as the central IdP in a federated authentication system, issuing and managing authentication tokens for applications.
+
+2. Access Control Layer
+
+    As a gateway, Nubus ensures that only authorized users can access specific systems, services, or APIs, enforcing RBAC policies.
+
+3. Integration Hub
+
+    Links applications by synchronizing identity and access data across them, ensuring consistency.
+
+4. User Provisioning
+
+    Automates the process of creating, updating, and deactivating user accounts across integrated systems based on organizational workflows.
+
+5. IAM Administration
+
+    The user, group and permission information which is stored in Nubus' OpenLDAP service is managed by IAM Admin(s)
+    using a stripped down version of the [UMC (Univention Management Console)](https://docs.software-univention.de/manual/5.0/de/central-management-umc/umc.html).
+
+6. Frontend Integration Authentication
+
+    A specialized component - the Intercom Service - acts according to the Backend-for-Frontend pattern when it comes to certain integration use cases requiring the frontend of one application to call the API of another service that also has the need for user authentication. See [Component integration](#component-integration) for more details.
+
+7. Portal
+
+   Nubus provides a Portal component for users to access the connected applications, that also includes a self service e.g. for password reset.
+
+For additional information, refer to the [Nubus for Kubernetes Architecture Manual](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/index.html).
+
+# Authentication
+
+openDesk uses the OpenID Connect (OIDC) protocol for authentication and authorization.
+
+## Identity data flows
+
+An overview of
+- components that consume the LDAP service.
+  - The components access the LDAP using a component-specific LDAP search account.
+- components using Univention Keycloak as an identity provider (IdP).
+  - The components should use OAuth2 / OIDC flows if not otherwise denoted.
+  - All components have a client configured in Keycloak.
+
+Some components trust others to handle authentication for them.
+
+```mermaid
+flowchart TD
+ K[IdP]-->L[LDAP]
+ N[Nextcloud]-->L
+ O[OpenProject] --> L
+ A[OX AppSuite]-->L
+ D[OX Dovecot]-->L
+ P[Portal/Admin]-->L
+ X[XWiki]-->L
+ A-->K
+ N-->K
+ D-->K
+ O-->K
+ X-->K
+ P-->|SAML|K
+ E[Element]-->K
+ J[Jitsi]-->K
+ I[IntercomService]-->K
+ C[Collabora]-->N
+ R[CryptPad]-->N
+ F[Postfix]-->D
+```
+
+## OpenID Connect (OIDC)
+
+[OIDC](https://openid.net/developers/how-connect-works/) is an identity layer on top of the OAuth 2.0 protocol, allowing clients (Relying Party (RP)) to verify the identity of end-users based on the authentication performed by an authorization server (OpenID Provider (OP)). In openDesk, Keycloak serves as the OIDC provider, managing user authentication and issuing tokens for secure access to applications.
+
+The following sequence diagram shows an OIDC flow of a user logging into openDesk's project management application. In openDesk, applications such as OpenProject take the role of the OIDC Relying Party, whereas Keycloak acts as the OIDC provider and OpenLDAP as the IdP.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant Browser as Browser
+    participant OpenProject as OpenProject<br/>OIDC Relying Party
+    participant Keycloak as Keycloak<br>OIDC Provider
+    participant LDAP as OpenLDAP<br>IdP
+    Browser->>OpenProject: GET https://projects.domain.tld
+    OpenProject-->>Browser: Redirect to OIDC provider authentication form (with request)
+    Browser->>Keycloak: Authenticate with username/password, optionally 2FA
+    Keycloak->>LDAP: Retrieve/update user information
+    LDAP->>Keycloak: Return user info
+    Keycloak-->>Browser: 302 Redirect https://projects.domain.tld/callback?[...]
+    Browser->>OpenProject: GET https://projects.domain.tld/callback?[...]
+    OpenProject->>Keycloak: POST https://id.domain.tld/oauth/token
+    Keycloak-->>OpenProject: Return JSON with token, signature
+    OpenProject->>OpenProject: Verify token signature valid, signed by Provider
+    OpenProject-->>Browser: 302 Redirect https://projects.domain.tld
+    Note over Browser: User is authenticated
+```
+
+> **Note:**<br>
+> Nubus' Portal and UMC still use [SAML 2.0](https://www.oasis-open.org/standard/saml/) to authenticate users. However, Nubus will switch to OIDC in an upcoming release, eliminating the use of SAML in openDesk altogether.
+
+## Keycloak
+
+[Keycloak](https://www.keycloak.org/) is an open-source identity and access management solution for web based applications and services. It provides features such as single sign-on, multi-factor authentication, user federation, and centralized user management.
+
+In openDesk, Keycloak serves as the [OIDC provider](#openid-connect-oidc), handling user authentication and issuing tokens for secure access to applications.
+
+For more information, see the [Keycloak Documentation](https://www.keycloak.org/documentation).
+
+## Keycloak Extensions
+
+Part of Nubus are the [Keycloak Extensions](https://docs.software-univention.de/nubus-kubernetes-operation/1.0/en/configuration/keycloak-extensions.html) used for
+
+- Login brute force protection: Blocking authentication requests upon too much failed attempts from a device or IP. The available [CAPTCHA](https://en.wikipedia.org/wiki/CAPTCHA) option is deactivated in openDesk.
+- New device notification: Sending the use an email after successful login from a new device.
+
+To address these use cases the Keycloak Extensions act as a proxy to Keycloak.
+
+## OpenLDAP
+
+[OpenLDAP](https://www.openldap.org) is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a central repository for user and group information. In openDesk, OpenLDAP is used as the user directory to store user and group data and manage access control policies across the applications.
+
+# Authorization
+
+## LDAP Group Synchronization
+
+LDAP group synchronization ensures that user group memberships are consistent across the applications in openDesk that make use of the IAM group information. Nubus uses OpenLDAP to store and manage user groups, which are synchronized with integrated applications to enforce access control policies.
+
+Beside Keycloak LDAP groups are available to the following applications, none of the application supports nested groups. It means that users must be direct members of a group, as members of sub groups are ignored.
+- Files / Nextcloud: Reads all groups that are enabled for Nextcloud twice a day based on the setting `background_sync_interval` in the `user_ldap` app.
+- Knowledge Management / XWiki: Reads all groups that are enabled for XWiki use, this is done nightly based the jobs `LDAP Group Import Job` and `Mapped groups daily updater` that admin users can access in `/bin/view/Scheduler`.
+- Project Management / OpenProject: Reads all groups that are enabled for OpenProject [hourly](https://www.openproject.org/docs/system-admin-guide/authentication/ldap-connections/ldap-group-synchronization/#create-a-synchronized-group).
+- Webmail / OX AppSuite: Requires a webmail user to be part of a group before the group is actively provisioned to OX AppSuite.
+
+# Provisioning
+
+Part of the already mentioned Nubus IAM is a [provisioning service](https://docs.software-univention.de/nubus-kubernetes-architecture/0.5/en/components/provisioning-service.html).
+
+Beside the Nubus internal user of the provisioning service the OX AppSuite is currently the only openDesk application that is getting data actively provisioned in contrast to scenarios where applications fetch the required information from the LDAP.
+
+## OX Connector
+
+As the OX AppSuite is using an application specific format to get e.g. users provisioned, there is also a specific connector component that links to provisioning service to the OX AppSuite, it is called the [OX Connector](https://docs.software-univention.de/manual/5.0/de/mail/ox-connector.html).
+
+The [OX SOAP API](https://oxpedia.org/wiki/index.php?title=Open-Xchange_Provisioning_using_SOAP) is used by the OX Connector to synchronize information about the follow OX AppSuite objects:
+- Contexts
+- Functional Mailboxes
+- Groups
+- (Managed) Resources
+- Users
+
+To find out more, see [Roles & Permissions](permissions.md).
+
+## SCIM
+
+[System for Cross-domain Identity Management](https://scim.cloud) (SCIM) is an open standard for automating the exchange of user identity information between identity domains or IT systems. SCIM is designed to make user provisioning and management easier by providing a standardized way to manage user identities in cloud-based applications and services.
+
+In openDesk, SCIM will be used in the future to automate the process of creating, updating, and deactivating user accounts across the applications. This ensures that user data is consistent and up-to-date across all applications, reducing the administrative overhead and potential for errors.
+
+> **Note:**<br>
+> SCIM support is planned in openDesk for 2025.
+
+# Component integration
+
+Important, especially from the end user perspective are the functional integrations between the different openDesk applications.
+
+```mermaid
+flowchart TD
+ OX-AppSuite_Frontend-->|Silent Login, Filepicker, Central Navigation|Intercom_Service
+ Element-->|Silent Login, Central Navigation|Intercom_Service
+ Intercom_Service-->|Silent Login, Token Exchange|IdP
+ Intercom_Service-->|Filepicker|Nextcloud
+ Intercom_Service-->|Central Navigations|Portal
+ Intercom_Service-->|Newsfeed|XWiki
+ OX-AppSuite_Backend-->|Filepicker|Nextcloud
+ OX-AppSuite_Backend-->|Videoconferences|Element
+ Nextcloud-->|Central Navigation|Portal
+ OpenProject-->|Central Navigation|Portal
+ OpenProject-->|File Store|Nextcloud
+ XWiki-->|Central Navigation|Portal
+ Nextcloud-->|Central Contacts|OX-AppSuite_Backend
+ OX-AppSuite_Frontend-->|Filepicker|OX-AppSuite_Backend
+ Portal-->|Newsfeed|Intercom_Service
+```
+
+Details can be found in the upstream documentation that is linked in the respective sections.
+
+## Intercom Service / Silent Login
+
+The Intercom Service is deployed in the context of Nubus. Its role is to enable cross-application integration
+based on the user's browser interaction as handling authentication when the frontend of an application has to call
+the API from another application is often a challenge.
+
+To establish a session with the Intercom Service, applications can use the silent login feature within an iframe.
+
+Currently, only OX AppSuite and Element are using the frontend-based integration.
+
+**Links**
+- [Intercom Service upstream documentation](https://docs.software-univention.de/intercom-service/latest/index.html).
+
+## Central Contacts
+
+OX App Suite is managing contacts in openDesk. Therefore, Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
+- create a new contact in the user's contacts folder when a file is shared with an unknown email address.
+- retrieve contacts from the user's contacts folder to support search-as-you-type when starting to share a file.
+
+**Links:**
+- Currently used [OX Contacts API (deprecated)](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Contacts).
+- New [OX Addressbooks API](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Addressbooks) the Central Contacts integration will switch to.
+
+## Central Navigation
+
+Central navigation is based on an API endpoint in the Nubus portal that returns a JSON containing the portal's contents for
+a given user. The response from the API endpoint is used in the openDesk applications to render the central navigation.
+
+The API can be called by
+- frontend services through the Intercom Service's `/navigation.json` endpoint or
+- backend services directly at the portal's `/univention/portal/navigation.json` endpoint.
+
+The central navigation expects the API caller to present a shared secret for authentication and the username for whom the portal
+contents should be returned for.
+
+A `curl` based request returning the navigation contents looks like this:
+
+```
+curl 'https://portal.<DOMAIN>/univention/portal/navigation.json?base=https%3A//portal.<DOMAIN>&language=de-DE' -u "<USERNAME>:<SHARED_SECRET>"
+```
+
+## Filepicker
+
+The Nextcloud Filepicker is integrated into the OX AppSuite, supporting the following use cases against the respective openDesk instance's Nextcloud:
+- Attach files from Nextcloud to emails.
+- Create and add links to Nextcloud files into emails.
+- Save attachments from emails into Nextcloud.
+- Attach files from Nextcloud to calendar entries.
+
+The Filepicker uses frontend and backend-based integration:
+- For frontend-based integration, the OX AppSuite frontend uses the Intercom Service.
+- Backend-based integration is coming from OX AppSuite middleware. The middleware communicates directly with Nextcloud
+when adding a file to an email or storing a file into Nextcloud to avoid passing these files through the user's browser.
+
+**Links**
+- [OX AppSuite Nextcloud Integration upstream documentation](https://gitlab.open-xchange.com/extensions/nextcloud-integration/-/tree/main/documentation).
+
+## Newsfeed
+
+The portal renders a newsfeed based on entries of a predefined openDesk blog in XWiki. It accesses the required XWiki
+service through the Intercom Service's `/wiki` endpoint, in combination with the previously described silent login.
+
+**Links:**
+- [XWiki Blog feature](https://extensions.xwiki.org/xwiki/bin/view/Extension/Blog%20Application)
+
+## (OpenProject) File Store
+
+While OpenProject allows you to attach files to work packages directly, it is often preferred that the files are
+stored within Nextcloud or to link an existing file from your openDesk Nextcloud to a work package.
+
+Therefore, openDesk pre-configures the trust between the openDesk instance's OpenProject and Nextcloud during the `openproject-boostrap` deployment step. As a prerequisite for that, openDesk's Nextcloud contains the `integration_openproject` app.
+
+The file store must still be enabled per project in OpenProject's project admin section.
+
+**Links:**
+- [OpenProject's documentation on Nextcloud integration](https://www.openproject.org/docs/system-admin-guide/integrations/nextcloud/)
+- [OpenProject Integration Nextcloud app](https://apps.nextcloud.com/apps/integration_openproject)
+
+# Applications vs. Services
+
+openDesk consists of a variety of open-source projects, please find an overview below:
+
+| Name                  | Description                      | Type        |
+| --------------------- | -------------------------------- | ----------- |
+| Certificates          | TLS certificates                 | Service     |
+| ClamAV (Distributed)  | Antivirus engine                 | Service     |
+| ClamAV (Simple)       | Antivirus engine                 | Service     |
+| Collabora             | Weboffice                        | Application |
+| CryptPad              | diagrams.net editor              | Application |
+| dkimpy-milter         | DKIM milter for Postfix          | Service     |
+| Element               | Secure communications platform   | Application |
+| Jitsi                 | Videoconferencing                | Application |
+| MariaDB               | Database                         | Service     |
+| Memcached             | Cache Database                   | Service     |
+| MinIO                 | Object Storage                   | Service     |
+| Nextcloud             | File share                       | Application |
+| Nubus (UMS)           | Identity Management & Portal     | Application |
+| OpenProject           | Project management               | Application |
+| OX Appsuite & Dovecot | Groupware with IMAP mail backend | Application |
+| Postfix               | MTA                              | Service     |
+| PostgreSQL            | Database                         | Service     |
+| Redis                 | Cache Database                   | Service     |
+| XWiki                 | Knowledge Management             | Application |
+
+The end user focussed components are called applications and provide the functional scope of openDesk, please find separate paragraphs on each of the applications below.
+
+Other components are of type "Service", these are used for development and evaluation purposes only, they need to be replaced in production deployments.
+
+For the APIs / Protocols supported by the applications, please read the [apis.md](./architecture/apis.md).
+
+## Collabora (Office)
+
+[Collabora](https://www.collaboraonline.com) is a powerful online document editing suite.
+
+In openDesk, Collabora is used for editing Office documents such as rich texts, spreadsheets and presentations.
+
+## CryptPad Online (Diagrams)
+
+[CryptPad](https://cryptpad.org/) is a collaborative editor framework supporting end-to-end encryption..
+
+In openDesk, CryptPad is for editing diagrams.net documents.
+
+## Element/Synapse (Chat & Call)
+
+[Element Web](https://github.com/element-hq/element-web) is the web frontend for [Synapse](https://github.com/element-hq/synapse), the reference implementation of the sovereign and secure [Matrix protocol](https://matrix.org).
+
+In openDesk, Element is used for chat and direct audio & video calling.
+
+## Jitsi (Video Conferencing)
+
+[Jitsi](https://jitsi.org) is an open-source video conferencing solution that allows users to hold secure video meetings.
+
+In openDesk, Jitsi is used for video conferencing and online meetings. It integrates with other applications to provide seamless communication capabilities.
+
+## Nextcloud (Files)
+
+[Nextcloud](https://nextcloud.com) is a file storage and sync platform with powerful collaboration capabilities with desktop, mobile and web interfaces.
+
+## Nubus (Identity and Access Management / Portal)
+
+[Nubus](https://www.univention.com/products/nubus/) is a unified Identity & Access Management, providing you with full control and digital sovereignty over your IAM processes and data.
+
+In openDesk Nubus is providing the management for user, groups and other IAM stored objects, as well as the portal, the Identity provider for Single Sign-On and federation scenarios and the
+
+## OpenProject (Project management)
+
+[OpenProject](https://www.openproject.org) is a project management tool that supports agile project management, team collaboration, issue tracking, and more.
+
+## OX App Suite (Groupware) with OX Dovecot (Mail backend)
+
+[OX App Suite](https://www.open-xchange.com/products/ox-app-suite) is a groupware application using [OX Dovecot](https://www.dovecot.org/) as its backend mail store.
+
+In openDesk, OX App Suite is used for email, calendar, address book and personal task management.
+
+## XWiki (Knowledge management)
+
+[XWiki](https://www.xwiki.org) is an open-source wiki platform for knowledge management and collaboration.
+
+# Application specific user accounts
+
+While the IAM managed users centrally, some applications come with local accounts for administrative purposes.
+
+| Application  | Account name                                  | Purpose                                                                                                                 | Password                                         |
+| ------------ | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
+| Collabora    | `collabora-internal-admin`                    | To access the Collabora admin dashboard                                                                                 | `secrets.collabora.adminPassword`                |
+| Element      | `uvs`                                         | The account for the "User Verification Service". It is used by Jitsi integrated into Element.                           | `secrets.matrixUserVerificationService.password` |
+|              | `meeting-bot`                                 | Used by the Nordeck Meeting-Bot to manage meeting rooms in Synapse.                                                     | `secrets.matrixNeoDateFixBot.password`           |
+| Nextcloud    | `nextcloud`                                   | Bootstrap the Nextcloud fileshare for OpenProject with `opendesk-openproject-bootstrap` job[^1].                        | `secrets.nextcloud.adminPassword`                |
+| OX App Suite | `admin`                                       | OX-Connector to provision context, users, groups etc.                                                                   | `secrets.oxAppsuite.adminPassword`               |
+| OpenProject  | set in `secrets.openproject.apiAdminUsername` | Bootstrap the Nextcloud fileshare for OpenProject with `opendesk-openproject-bootstrap` job[^1].                        | `secrets.openproject.apiAdminPassword`           |
+| XWiki        | `superadmin`                                  | Only available with `debug.enabled: true`, can be used for interactive login using `/bin/view/Main/?oidc.skipped=true`. | `secrets.xwiki.superadminpassword`               |
+
+# Footnotes
+
+[^1]: We are working on a new approach to provision the OpenProject filestore, therefore the accounts are planned to be deactivated/removed with openDesk 1.2.

docs/architecture/apis.md

@@ -0,0 +1,941 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>openDesk APIs</h1>
+
+This chapter presents APIs available in openDesk grouped by applications.
+
+* [IAM - Nubus](#iam---nubus)
+  * [UMC Python API](#umc-python-api)
+  * [UMC store API](#umc-store-api)
+  * [IntercomService (ICS) API](#intercomservice-ics-api)
+  * [High-level Listener modules API](#high-level-listener-modules-api)
+  * [UDM Simple API](#udm-simple-api)
+  * [UDM REST API](#udm-rest-api)
+  * [UCR Python API](#ucr-python-api)
+  * [LDAP](#ldap)
+  * [Nubus Provisioning Service (**TBD**)](#nubus-provisioning-service-tbd)
+  * [Nubus Authorization Service (**TBD**)](#nubus-authorization-service-tbd)
+* [Groupware - OX AppSuite / OX Dovecot](#groupware---ox-appsuite--ox-dovecot)
+  * [Usage of APIs within openDesk](#usage-of-apis-within-opendesk)
+  * [HTTP API](#http-api)
+  * [SOAP API](#soap-api)
+  * [REST API](#rest-api)
+  * [CardDAV](#carddav)
+  * [CalDAV](#caldav)
+  * [IMAP](#imap)
+  * [POP3](#pop3)
+* [Files - Nextcloud](#files---nextcloud)
+  * [Usage of APIs within openDesk](#usage-of-apis-within-opendesk-1)
+  * [OCS API](#ocs-api)
+  * [Notifications API](#notifications-api)
+  * [Activity API](#activity-api)
+  * [Remote wipe API](#remote-wipe-api)
+  * [WebDAV](#webdav)
+  * [CalDAV / CardDAV](#caldav--carddav)
+* [Weboffice - Collabora](#weboffice---collabora)
+  * [PostMessage API](#postmessage-api)
+  * [Conversion API](#conversion-api)
+* [Project management - OpenProject](#project-management---openproject)
+  * [HATEOAS API](#hateoas-api)
+  * [BCF API](#bcf-api)
+* [Video Conferencing - Jitsi](#video-conferencing---jitsi)
+  * [IFrame API](#iframe-api)
+  * [Lib-jitsi-meet API](#lib-jitsi-meet-api)
+  * [Jitsi Meet React SDK](#jitsi-meet-react-sdk)
+* [Chat - Element](#chat---element)
+  * [Matrix Application Service API](#matrix-application-service-api)
+  * [Matrix Client-Server API](#matrix-client-server-api)
+  * [Matrix Server-Server API](#matrix-server-server-api)
+  * [Matrix Push Gateway API](#matrix-push-gateway-api)
+  * [Matrix Identity Service API](#matrix-identity-service-api)
+  * [Matrix React SDK Module API](#matrix-react-sdk-module-api)
+  * [Matrix Widget API](#matrix-widget-api)
+  * [NeoBoard Data Model API](#neoboard-data-model-api)
+  * [NeoDateFix REST API](#neodatefix-rest-api)
+* [Knowledge management - XWiki](#knowledge-management---xwiki)
+  * [REST API](#rest-api-1)
+  * [Scripting API](#scripting-api)
+  * [Java API](#java-api)
+  * [JavaScript API](#javascript-api)
+
+# IAM - Nubus
+
+![High-level architecture of Univention part withAPIs/interfaces highlighted](./apis_images/IAM-overview.png)
+
+## UMC Python API
+
+![Composition of UMC component with APIs highlighted](./apis_images/IAM-umc-architecture.png)
+
+| Name                           | UMC Python API                                                                                                                                                                                                                                 |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        |                                                                                                                                                                                                                                                |
+| Versioning                     |                                                                                                                                                                                                                                                |
+| Authentication                 |                                                                                                                                                                                                                                                |
+| In openDesk provided by        | Nubus UMC                                                                                                                                                                                                                                      |
+| Transport protocol             |                                                                                                                                                                                                                                                |
+| Usage within component         |                                                                                                                                                                                                                                                |
+| Usage within openDesk          |                                                                                                                                                                                                                                                |
+| Usage for external integration |                                                                                                                                                                                                                                                |
+| Parallel access                | Allowed                                                                                                                                                                                                                                        |
+| Message protocol               | [Univention Management Console Protocol (UMCP)](https://docs.software-univention.de/ucs-python-api/univention.management.console.protocol.html). Format consisting of a single header line, one empty line and the body. The body can be JSON. |
+| Supported standards            |                                                                                                                                                                                                                                                |
+| Documentation                  | https://docs.software-univention.de/ucs-python-api/modules.html                                                                                                                                                                                |
+
+## UMC store API
+
+| Name                           | UMC store API (also named UMC JavaScript API or Dojo/UMC JavaScript API)                                  |
+| ------------------------------ | --------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Encapsulate and ease the access to module data from JavaScript                                            |
+| Versioning                     |                                                                                                           |
+| Authentication                 |                                                                                                           |
+| In openDesk provided by        | Nubus UMC                                                                                                 |
+| Transport protocol             |                                                                                                           |
+| Usage within component         |                                                                                                           |
+| Usage within openDesk          |                                                                                                           |
+| Usage for external integration |                                                                                                           |
+| Parallel access                | Allowed                                                                                                   |
+| Message protocol               |                                                                                                           |
+| Supported standards            |                                                                                                           |
+| Documentation                  | https://docs.software-univention.de/developer-reference/5.0/en/umc/local-system-module.html#umc-store-api |
+
+## IntercomService (ICS) API
+
+| Name                           | IntercomService API                                                                                                                                                                                                                 |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Encapsulate and ease the access to module data from JavaScript                                                                                                                                                                      |
+| Versioning                     |                                                                                                                                                                                                                                     |
+| Authentication                 | IdP based SSO                                                                                                                                                                                                                       |
+| In openDesk provided by        | Nubus UMC                                                                                                                                                                                                                           |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                             |
+| Usage within component         |                                                                                                                                                                                                                                     |
+| Usage within openDesk          | The ICS implements the BFF pattern for various openDesk inter-component integrations, see also [components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/components.md#component-integration) |
+| Usage for external integration |                                                                                                                                                                                                                                     |
+| Parallel access                | Allowed                                                                                                                                                                                                                             |
+| Message protocol               | Depends on the integration use case.                                                                                                                                                                                                |
+| Supported standards            |                                                                                                                                                                                                                                     |
+| Documentation                  | https://docs.software-univention.de/intercom-service/latest/architecture.html                                                                                                                                                       |
+
+## High-level Listener modules API
+
+| Name                           | High-level Listener modules API                                                                                                                                                                                                     |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Dispatching of LDAP events.                                                                                                                                                                                                         |
+| Versioning                     |                                                                                                                                                                                                                                     |
+| Authentication                 |                                                                                                                                                                                                                                     |
+| In openDesk provided by        | Univention Event Processing                                                                                                                                                                                                         |
+| Transport protocol             |                                                                                                                                                                                                                                     |
+| Usage within component         | The listener mechanism is used to dispatch events from the LDAP to the Nubus provisioning service. It should be replaced by another approach in the future.                                                                          |
+| Usage within openDesk          | The ICS implements the BFF pattern for various openDesk inter-component integrations, see also [components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/components.md#component-integration) |
+| Usage for external integration |                                                                                                                                                                                                                                     |
+| Parallel access                | Allowed                                                                                                                                                                                                                             |
+| Message protocol               | Depends on the integration use case.                                                                                                                                                                                                |
+| Supported standards            |                                                                                                                                                                                                                                     |
+| Documentation                  | https://docs.software-univention.de/developer-reference/5.0/en/listener/api.html                                                                                                                                                    |
+
+More details on the Nubus provisioning service can be found here: https://docs.software-univention.de/nubus-kubernetes-architecture/0.5/en/components/provisioning-service.html
+
+## UDM Simple API
+
+![Composition of UMC component with APIs highlighted](./apis_images/IAM-udm.png)
+
+| Name                           | UDM Simple API                                                    |
+| ------------------------------ | ----------------------------------------------------------------- |
+| Purpose                        | Allows to use capability and objects directly in Python programs. |
+| Versioning                     |                                                                   |
+| Authentication                 |                                                                   |
+| In openDesk provided by        | Univention Directory Manager                                      |
+| Transport protocol             |                                                                   |
+| Usage within component         |                                                                   |
+| Usage within openDesk          |                                                                   |
+| Usage for external integration |                                                                   |
+| Parallel access                | Allowed                                                           |
+| Message protocol               | Depends on the integration use case.                              |
+| Supported standards            |                                                                   |
+| Documentation                  |                                                                   |
+
+## UDM REST API
+
+| Name                           | UDM REST API                                                                                                                               |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| Purpose                        | Inspect, modify, create and delete objects through HTTP requests.                                                                          |
+| Versioning                     |                                                                                                                                            |
+| Authentication                 | Basic Auth                                                                                                                                 |
+| In openDesk provided by        | Univention Directory Manager                                                                                                               |
+| Transport protocol             | HTTP(S)                                                                                                                                    |
+| Usage within component         | The Nubus bootstrapping makes use of the API.                                                                                               |
+| Usage within openDesk          |                                                                                                                                            |
+| Usage for external integration | The [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) utilizes the API. |
+| Parallel access                | Allowed                                                                                                                                    |
+| Message protocol               | Depends on the integration use case.                                                                                                       |
+| Supported standards            |                                                                                                                                            |
+| Documentation                  | https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html                                                           |
+
+## UCR Python API
+
+![Composition of UCR component with APIs/interfaces highlighted](./apis_images/IAM-ucr.png)
+
+| Name                           | UCR Python API                                                                                      |
+| ------------------------------ | --------------------------------------------------------------------------------------------------- |
+| Purpose                        | Offers a programming interface for components and other Python programs.                            |
+| Versioning                     |                                                                                                     |
+| Authentication                 |                                                                                                     |
+| In openDesk provided by        | Nubus                                                                                               |
+| Transport protocol             |                                                                                                     |
+| Usage within component         | The Nubus bootstrapping makes use of the API.                                                       |
+| Usage within openDesk          |                                                                                                     |
+| Usage for external integration |                                                                                                     |
+| Parallel access                | Allowed                                                                                             |
+| Message protocol               |                                                                                                     |
+| Supported standards            |                                                                                                     |
+| Documentation                  | https://docs.software-univention.de/developer-reference/5.0/en/ucr/usage.html#using-ucr-from-python |
+
+## LDAP
+
+| Name                           | LDAP                                                                                                                   |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Read access to Nubus LDAP                                                                                              |
+| Versioning                     | n/a                                                                                                                    |
+| Authentication                 | LDAP user auth                                                                                                         |
+| In openDesk provided by        | Nubus openLDAP                                                                                                         |
+| Transport protocol             | LDAP                                                                                                                   |
+| Usage within component         | Data backend for Nubus                                                                                                 |
+| Usage within openDesk          | Used by multiple application to access user/group data, e.g. Nextcloud Server, OpenProject, OX AppSuite backend, XWiki |
+| Usage for external integration | No recommended                                                                                                         |
+| Parallel access                | Allowed                                                                                                                |
+| Message protocol               | LDAP                                                                                                                   |
+| Supported standards            | LDAP                                                                                                                   |
+| Documentation                  | https://docs.software-univention.de/manual/5.0/en/domain-ldap/ldap-directory.html                                      |
+
+## Nubus Provisioning Service (**TBD**)
+
+To be delivered.
+
+## Nubus Authorization Service (**TBD**)
+
+To be delivered.
+
+# Groupware - OX AppSuite / OX Dovecot
+
+![OX AppSuite APIs overview](./apis_images/Groupware-apis.png)
+
+![Use of OX AppSuite APIs by other components](./apis_images/Groupware-api-usage.png)
+
+## Usage of APIs within openDesk
+
+Following are APIs used by the Groupware application:
+
+| Used by                        | Accessed component | Service            | Purpose                                                     | Message format                   |
+| ------------------------------ | ------------------ | ------------------ | ----------------------------------------------------------- | -------------------------------- |
+| AppSuite Middleware            | Keycloak           | Authentication     | Single sign-on / sign-out                                   | OIDC                             |
+| Dovecot                        | Keycloak           | Authentication     | Authenticate user                                           | OIDC                             |
+| AppSuite Frontend (in Browser) | Intercom Service   | Silent Login       | Stablish Intercom Service session                           |                                  |
+| AppSuite Frontend (in Browser) | Intercom Service   | Central Navigation | Retrieve content for openDesk Navigation drop-down          | JSON                             |
+| AppSuite Frontend (in Browser) | Intercom Service   | Element Bot        | Manage (CUD) meetings in Element                            | Custom JSON (based on iCalender) |
+| AppSuite Frontend (in Browser) | Intercom Service   | Filepicker         | Read/write contents from/to Nextcloud or create share links | WebDAV & Nextcloud API           |
+| AppSuite Middleware            | Nextcloud          | Filepicker         | Read/write files from/to Nextcloud                          | WebDAV & Nextcloud API           |
+| AppSuite Middleware            | Element Bot        | Element Bot        | Update/delete meetings in Element                            | Custom JSON (based on iCalender) |
+| AppSuite Middleware            | LDAP               | Address book       | Search for global contacts and retrieve contact details     | LDAP                             |
+| Dovecot                        | LDAP               | Data retrieval     | Retrieve necessary user details to handle mailboxes         | LDAP                             |
+
+## HTTP API
+
+![Use of HTTP API in openDesk](./apis_images/Groupware-api-http-usage.png)
+
+| Name                           | HTTP API                                                                                                                                                                                                     |
+| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Login, accessing email, contacts, calendar, tasks, configs, email filtering, task automation, workflow automation, etc – most of the AppSuite's functionality that is available to the user through the Web-UI. |
+| Versioning                     | No API-specific versioning. The version can be considered identical with OX App Suite version, which is contained in URL of online documentation of API.                                                        |
+| Authentication                 |                                                                                                                                                                                                                 |
+| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                                                          |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                         |
+| Usage within component         | Used by OX Web-UI (Frontend)                                                                                                                                                                                    |
+| Usage within openDesk          | - Nextcloud used the SearchAPI to synchronize contacts<br>- Nordeck Meeting bot synchronizes OX meeting changes applied in Element.                                                                             |
+| Usage for external integration | Not used at the moment, but recommended way to integrate with OX AppSuite.                                                                                                                                      |
+| Parallel access                | Allowed                                                                                                                                                                                                         |
+| Message protocol               | JSON based, AppSuite specific format                                                                                                                                                                            |
+| Supported standards            | iCal, defined by RFC, fully implemented                                                                                                                                                                         |
+| Documentation                  | https://documentation.open-xchange.com/components/middleware/http/8/index.html                                                                                                                                  |
+
+## SOAP API
+
+| Name                           | SOAP API                                                                                  |
+| ------------------------------ | -------------------------------------------------------------------------------------------- |
+| Purpose                        | Management of users, groups, contexts, resources.                                            |
+| Versioning                     | n/a                                                                                          |
+| Authentication                 | Basic Auth                                                                                   |
+| In openDesk provided by        | OX AppSuite Middleware                                                                       |
+| Transport protocol             | HTTP(S)                                                                                      |
+| Usage within component         | none                                                                                         |
+| Usage within openDesk          | OX-Connector synchronizes the state of the objects (users, groups etc.) managed in the LDAP. |
+| Usage for external integration | none                                                                                         |
+| Parallel access                | Allowed                                                                                      |
+| Message protocol               | XML based, exactly following the format of Java RMI.                                         |
+| Supported standards            | SOAP                                                                                         |
+| Documentation                  | https://software.open-xchange.com/products/appsuite/doc/SOAP/admin/OX-Admin-SOAP.html        |
+
+> **Note**:
+> You will find a catalogue of the available services including links to the respective URLs at `/webservices/` within the AppSuite host of your openDesk installation, e.g. https://webmail.myopendesk.tld/webservices/
+
+## REST API
+
+| Name                           | REST API                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Delivers services in following functional groups:<br>- *Admin*: Interface for provisioning and other administrative operations<br>- *Advertisement*: The advertisement module<br>- *Health*: The health-check module<br>- *InternetFreeBusy*: Servlet for requesting free busy data<br>- *Metrics*: The metrics module<br>- *Preliminary*: This module contains preliminary endpoints which can change in the future<br>- *Push*: The push module<br>- *Userfeedback*: The user feedback module |
+| Versioning                     | No API-specific versioning. The version can be considered identical with OX App Suite version, which is contained in URL of online documentation of API.                                                                                                                                                                                                                                                                                                                                        |
+| Authentication                 | Basic Auth                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Usage within component         | Push module is used by OX Frontend.                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Usage within openDesk          | none                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Usage for external integration | none                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Parallel access                | Allowed                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Message protocol               | - Email Body RFC 822 is used by Push<br>- Prometheus format is used by Metrics API<br>- API iCal format is used by InternetFreeBusy                                                                                                                                                                                                                                                                                                                                                             |
+| Supported standards            | SOAP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Documentation                  | https://documentation.open-xchange.com/components/middleware/rest/8/index.html                                                                                                                                                                                                                                                                                                                                                                                                                  |
+## CardDAV
+
+| Name                           | CardDAV                                                                                                                                                                 |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Designed for rich clients. Synchronization of contact entries in both directions (i.e. as a server and as a client); vCard import and export are available via OX HTTP API |
+| Versioning                     | Yes, API version is specific to the version of underlying protocol                                                                                                         |
+| Authentication                 |                                                                                                                                                                            |
+| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                     |
+| Transport protocol             | HTTP(S)                                                                                                                                                                    |
+| Usage within component         | none                                                                                                                                                                       |
+| Usage within openDesk          | none                                                                                                                                                                       |
+| Usage for external integration | none                                                                                                                                                                       |
+| Parallel access                | Allowed                                                                                                                                                                    |
+| Message protocol               | vCard, defined by RFC, fully implemented                                                                                                                                   |
+| Supported standards            |                                                                                                                                                                            |
+| Documentation                  | https://documentation.open-xchange.com/8/middleware/miscellaneous/caldav_carddav.html                                                                                      |
+
+## CalDAV
+
+| Name                           | CalDAV                                                                                                                                                                  |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Designed for rich clients. Synchronization of contact entries in both directions (i.e. as a server and as a client); vCard import and export are available via OX HTTP API |
+| Versioning                     | Yes, API version is specific to the version of underlying protocol                                                                                                         |
+| Authentication                 |                                                                                                                                                                            |
+| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                     |
+| Transport protocol             | HTTP(S)                                                                                                                                                                    |
+| Usage within component         | none                                                                                                                                                                       |
+| Usage within openDesk          | none                                                                                                                                                                       |
+| Usage for external integration | none                                                                                                                                                                       |
+| Parallel access                | Allowed                                                                                                                                                                    |
+| Message protocol               | iCal, defined by RFC, fully implemented                                                                                                                                    |
+| Supported standards            | iTIP, iMIP                                                                                                                                                                 |
+| Documentation                  | https://documentation.open-xchange.com/8/middleware/miscellaneous/caldav_carddav.html                                                                                      |
+
+## IMAP
+
+| Name                           | IMAP                                                               |
+| ------------------------------ | ------------------------------------------------------------------ |
+| Purpose                        | Used for retrieval of emails, designed for rich clients            |
+| Versioning                     | Yes, API version is specific to the version of underlying protocol |
+| Authentication                 |                                                                    |
+| In openDesk provided by        | OX Dovecot                                                         |
+| Transport protocol             | TCP                                                                |
+| Usage within component         | Used by OX AppSuite middleware to read/write mail and folders      |
+| Usage within openDesk          | none                                                               |
+| Usage for external integration | Can be used by local IMAP clients (e.g. Thunderbird)               |
+| Parallel access                | Allowed                                                            |
+| Message protocol               | RFC 9051                                                           |
+| Supported standards            | IMAP                                                               |
+| Documentation                  | https://www.rfc-editor.org/rfc/rfc9051                             |
+
+## POP3
+
+| Name                           | POP3                                                               |
+| ------------------------------ | ------------------------------------------------------------------ |
+| Purpose                        | Used for retrieval of emails, designed for rich clients            |
+| Versioning                     | Yes, API version is specific to the version of underlying protocol |
+| Authentication                 |                                                                    |
+| In openDesk provided by        | OX Dovecot                                                         |
+| Transport protocol             | TCP                                                                |
+| Usage within component         | none                                                               |
+| Usage within openDesk          | none                                                               |
+| Usage for external integration | Can be used by local POP3 clients (e.g. Thunderbird)               |
+| Parallel access                | Allowed                                                            |
+| Message protocol               | RFC 1939                                                           |
+| Supported standards            | IMAP                                                               |
+| Documentation                  | https://www.rfc-editor.org/rfc/rfc1939                             |
+
+# Files - Nextcloud
+
+![Nextcloud APIs](./apis_images/Files-api.png)
+
+## Usage of APIs within openDesk
+
+Following are APIs used by the Files application:
+
+| Used by          | Accessed component     | Service                | Purpose                                            | Message format |
+| ---------------- | ---------------------- | ---------------------- | -------------------------------------------------- | -------------- |
+| Nextcloud Server | Keycloak               | Authentication         | Single sign-on / sign-out                          | OIDC           |
+| Nextcloud Server | Nubus Portal           | Central Navigation     | Retrieve content for openDesk Navigation drop-down | JSON           |
+| Nextcloud Server | OX AppSuite Middleware | OX HTTP API (Contacts) | Reading/writing personal contacts                  | JSON           |
+| Nextcloud Server | Nubus                  | LDAP                   | Read users and groups data                         | LDAP           |
+
+## OCS API
+
+| Name                           | OCS API                                                                                                                                                                                                                                |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Obtain and/or manage user status, user preferences, shares, sharees, recommendations. API is likely to be extended to other use cases in the future. Nextcloud apps can extend the functionality of OCS API by providing new endpoints |
+| Versioning                     | Identical with component release version                                                                                                                                                                                               |
+| Authentication                 | Basic Auth or by passing a set of valid session cookies                                                                                                                                                                                |
+| In openDesk provided by        | Nextcloud Server                                                                                                                                                                                                                       |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                |
+| Usage within component         | none                                                                                                                                                                                                                                   |
+| Usage within openDesk          | Filepicker is using the API to create share links.                                                                                                                                                                                     |
+| Usage for external integration | none                                                                                                                                                                                                                                   |
+| Parallel access                | Allowed                                                                                                                                                                                                                                |
+| Message protocol               | Requests in JSON, responses in JSON or XML                                                                                                                                                                                             |
+| Supported standards            |                                                                                                                                                                                                                                        |
+| Documentation                  | https://docs.nextcloud.com/server/latest/developer_manual/client_apis/OCS/index.html                                                                                                                                                   |
+
+## Notifications API
+
+| Name                           | Notifications API                                                                                                           |
+| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Fetch notifications                                                                                                         |
+| Versioning                     | See linked documentation (which also names the version), address via URL path, e.g. `/ocs/v2.php/apps/notifications/api/v2` |
+| Authentication                 |                                                                                                                             |
+| In openDesk provided by        | Nextcloud Server                                                                                                            |
+| Transport protocol             | HTTP(S)                                                                                                                     |
+| Usage within component         | none                                                                                                                        |
+| Usage within openDesk          | none                                                                                                                        |
+| Usage for external integration | none                                                                                                                        |
+| Parallel access                | Allowed                                                                                                                     |
+| Message protocol               | Requests in JSON, responses in JSON or XML                                                                                  |
+| Supported standards            |                                                                                                                             |
+| Documentation                  | https://github.com/nextcloud/notifications/blob/master/docs/ocs-endpoint-v2.md                                              |
+|                                |                                                                                                                             |
+
+## Activity API
+
+| Name                           | Activity API                                                                                                                                           |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Purpose                        | Allows to obtain the list of actions initiated or involving a specific user (files created, shared, deleted etc and other activities reported by apps) |
+| Versioning                     | Identical with component release version                                                                                                               |
+| Authentication                 | See linked documentation (which also names the version), address via URL path, e.g. `/ocs/v2.php/apps/activity/api/v2`                                 |
+| In openDesk provided by        | Nextcloud Server                                                                                                                                       |
+| Transport protocol             | HTTP(S)                                                                                                                                                |
+| Usage within component         | none                                                                                                                                                   |
+| Usage within openDesk          | none                                                                                                                                                   |
+| Usage for external integration | none                                                                                                                                                   |
+| Parallel access                | Allowed                                                                                                                                                |
+| Message protocol               | Requests in JSON, responses in JSON or XML                                                                                                             |
+| Supported standards            |                                                                                                                                                        |
+| Documentation                  | https://github.com/nextcloud/activity/blob/master/docs/endpoint-v2.md                                                                                  |
+
+## Remote wipe API
+
+| Name                           | Remote wipe API                                                                             |
+| ------------------------------ | ------------------------------------------------------------------------------------------- |
+| Purpose                        | Used to wipe storage remotely (e.g. on a lost device)                                       |
+| Versioning                     | Identical with component release version                                                    |
+| Authentication                 | Login flow token                                                                            |
+| In openDesk provided by        | Nextcloud Server                                                                            |
+| Transport protocol             | HTTP(S)                                                                                     |
+| Usage within component         | none                                                                                        |
+| Usage within openDesk          | none                                                                                        |
+| Usage for external integration | none                                                                                        |
+| Parallel access                | Allowed                                                                                     |
+| Message protocol               | JSON                                                                                        |
+| Supported standards            |                                                                                             |
+| Documentation                  | https://docs.nextcloud.com/server/latest/developer_manual/client_apis/RemoteWipe/index.html |
+
+## WebDAV
+
+| Name                           | WebDAV                                                                                  |
+| ------------------------------ | --------------------------------------------------------------------------------------- |
+| Purpose                        | Accessing files and folders, conducting search                                          |
+| Versioning                     | Identical with component release version                                                |
+| Authentication                 | Basic Auth or by passing a set of valid session cookies                                 |
+| In openDesk provided by        | Nextcloud Server                                                                        |
+| Transport protocol             | HTTP(S)                                                                                 |
+| Usage within component         | none                                                                                    |
+| Usage within openDesk          | Used by OX AppSuite to put/retrieve files (attachments)                                 |
+| Usage for external integration | none                                                                                    |
+| Parallel access                | Allowed                                                                                 |
+| Message protocol               | Requests in JSON, responses in JSON or XML                                              |
+| Supported standards            | RFC4918                                                                                 |
+| Documentation                  | https://docs.nextcloud.com/server/latest/developer_manual/client_apis/WebDAV/index.html |
+
+## CalDAV / CardDAV
+
+CalDAV and CardDAV APIs are available in Nextcloud, but as openDesk uses OX AppSuite for Calendar and Contacts these Nextcloud APIs do not provide relevant data in openDesk.
+
+# Weboffice - Collabora
+
+Following are APIs used by the Weboffice application:
+
+| Used by   | Accessed component | Service           | Purpose                                     | Message format |
+| --------- | ------------------ | ----------------- | ------------------------------------------- | -------------- |
+| Collabora | Nextcloud          | Document handling | Retrieve, store and manage office documents | WOPI           |
+
+Collabora is integrated with Nextcloud to read/write Office documents from/to Nextcloud. The integration uses the Web
+Application Open Interface ([WOPI](https://learn.microsoft.com/en-us/openspecs/office_protocols/ms-wopi/6a8bb410-68ad-47e4-9dc3-6cf29c6b046b)) protocol.
+
+Nextcloud acts as the WOPI server whereas Collabora Online is the WOPI client.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    Browser->>Nextcloud: Open document "digital-strategy.odt"<br>(which is fileid=123456)
+    Nextcloud-->>Browser: "Use COOL server to open document online<br>URL is https://office.domain.tld/?open"
+    Browser->>Collabora: GET "https://office.domain.tld/?open&file=https://files.domain.tld/index.php/apps/richdocuments/wopi/files/123456"
+    Collabora-->>Nextcloud: GET https://files.domain.tld/index.php/apps/richdocuments/wopi/files
+    Nextcloud-->>Browser: Edit document "digital-strategy.odt" (fileid=123456)
+```
+
+
+## PostMessage API
+
+| Name                           | PostMessage API                                                                                                                                 |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Interact with parent frame when Collabora browser part is enclosed in one, mostly based on WOPI specification with few extensions/modifications |
+| Versioning                     | N/A                                                                                                                                             |
+| Authentication                 | CSP rules protect unauthorized communication. In practice editor is embedded in an iframe and can communicate only with the iframe's parent.    |
+| In openDesk provided by        | Collabora                                                                                                                                       |
+| Transport protocol             | HTTP                                                                                                                                            |
+| Usage within component         | N/A                                                                                                                                             |
+| Usage within openDesk          | Query number of users in a document, query supported export formats, manage sessions, manage actions like save, insert image, print etc.        |
+| Usage for external integration | In openDesk Collabora Online is integrated with Nextcloud but other integrations exist and are possible, see the documentation.                 |
+| Parallel access                | Allowed                                                                                                                                         |
+| Message protocol               | JSON                                                                                                                                            |
+| Supported standards            | [WOPI](https://learn.microsoft.com/en-us/openspecs/office_protocols/ms-wopi/6a8bb410-68ad-47e4-9dc3-6cf29c6b046b)                               |
+| Documentation                  | https://sdk.collaboraonline.com/docs/postmessage_api.html                                                                                       |
+
+## Conversion API
+
+| Name                           | Conversion API                                                                                          |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Convert files between various file formats (e.g. to pdf, png, txt, or between OOXML and ODF etc.)       |
+| Versioning                     | N/A                                                                                                     |
+| Authentication                 | The `convert-to` endpoint is restricted to allowed host addresses that can be set in the configuration. |
+| In openDesk provided by        | Collabora                                                                                               |
+| Transport protocol             | HTTP (REST API)                                                                                         |
+| Usage within component         | N/A                                                                                                     |
+| Usage within openDesk          | To generate thumbnails in Nextcloud for supported document types.                                       |
+| Usage for external integration | It is possible to set up Collabora Online as a general document converter service.                      |
+| Parallel access                | Allowed                                                                                                 |
+| Message protocol               | text based, see the documentation                                                                                                        |
+| Supported standards            | N/A                                                                                                     |
+| Documentation                  | https://sdk.collaboraonline.com/docs/conversion_api.html                                                |
+
+# Project management - OpenProject
+
+Following are APIs used by the Project management application:
+
+| Used by         | Accessed component | Service            | Purpose                                            | Message format |
+| --------------- | ------------------ | ------------------ | -------------------------------------------------- | -------------- |
+| OpenProject-web | Keycloak           | Authentication     | Single sign-on / sign-out                          | OIDC           |
+| OpenProject-web | Nubus Portal       | Central Navigation | Retrieve content for openDesk Navigation drop-down | JSON           |
+| OpenProject-web | Nextcloud          | Various            | Integration of Nextcloud as OpenProject filestore  | JSON           |
+| OpenProject-web | Nubus              | LDAP               | Read users and groups data                         | LDAP           |
+
+## HATEOAS API
+
+| Name                           | HATEOAS (Hyperimages as the Engine of Application State) API                                                                                                                                                                                                                                                                                      |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Provides access for the frontend client of OpenProject and for third party use, i.e.:<br>- CRUD work packages, projects, time logging, users, queries (work package filters), and all related objects<br>- READ notifications, activities per work package<br>- READ capabilities (allowed actions of users throughout projects) does not address |
+| Versioning                     | URL based versioning scheme, e.g. `/api/v3/spec.json`                                                                                                                                                                                                                                                                                             |
+| Authentication                 | OAuth2, session based authentication, and basic auth                                                                                                                                                                                                                                                                                              |
+| In openDesk provided by        | OpenProject                                                                                                                                                                                                                                                                                                                                       |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                                                                                                                           |
+| Usage within component         | OpenProject Web-UI                                                                                                                                                                                                                                                                                                                                |
+| Usage within openDesk          | none                                                                                                                                                                                                                                                                                                                                              |
+| Usage for external integration | none                                                                                                                                                                                                                                                                                                                                              |
+| Parallel access                | Allowed                                                                                                                                                                                                                                                                                                                                           |
+| Message protocol               | [HAL](https://en.wikipedia.org/wiki/Hypertext_Application_Language) + JSON                                                                                                                                                                                                                                                                        |
+| Supported standards            | REST, [HATEOAS](https://en.wikipedia.org/wiki/HATEOAS)                                                                                                                                                                                                                                                                                            |
+| Documentation                  | https://www.openproject.org/docs/api/introduction/                                                                                                                                                                                                                                                                                                |
+
+**Additional Information:**
+
+*What does it not do that developers should know about?*
+- CRUD custom fields, time reports, wikis and wiki pages
+- Aggregated filterable activities/changes
+
+*What are the typical use cases?*
+- It powers all angular frontend components in OpenProject, mainly the work package table/view, boards, team planner etc., and supports all common use cases
+
+*How does it work? (What do users need to know about architecture an internal components?)*
+- HAL is a standard to define resources with embedding and links between them
+- HAL contains action links depending on the user’s permissions, allows to derive allowed actions from object keys in json
+
+*What knowledge prerequisites for the developer before using the API?*
+- Knowledge of REST
+- (Optional) Knowledge of HAL standard
+
+*Any extensions or APIs in development or in planning users should know about?*
+- Signaling to receive only selected attributes/nested resources from the API for performance improvements
+
+## BCF API
+
+| Name                           | BCF API                                                                                                                                                                            |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Implementation of subset of [BCF](https://en.wikipedia.org/wiki/BIM_Collaboration_Format) standard for [BIM](https://en.wikipedia.org/wiki/Building_information_modeling) projects |
+| Versioning                     | URL based versioning scheme, e.g. `/api/bcf/2.1`                                                                                                                                   |
+| Authentication                 | OAuth2                                                                                                                                                                             |
+| In openDesk provided by        | OpenProject                                                                                                                                                                        |
+| Transport protocol             | HTTP(S)                                                                                                                                                                            |
+| Usage within component         | none                                                                                                                                                                               |
+| Usage within openDesk          | none                                                                                                                                                                               |
+| Usage for external integration | none                                                                                                                                                                               |
+| Parallel access                | Allowed                                                                                                                                                                            |
+| Message protocol               | JSON                                                                                                                                                                               |
+| Supported standards            | [BCF 2.1](https://github.com/buildingSMART/BCF-API/blob/release_2_1/README.md)                                                                                                     |
+| Documentation                  | https://www.openproject.org/docs/api/bcf-rest-api/                                                                                                                                 |
+
+# Video Conferencing - Jitsi
+
+## IFrame API
+
+| Name                           | IFrame API                                                             |
+| ------------------------------ | ---------------------------------------------------------------------- |
+| Purpose                        | Embed Jitsi video conferencing features into existing application/site |
+| Versioning                     | Identical to the Jitsi release version                                 |
+| Authentication                 | Optional (JWT-based authentication in openDesk context)                |
+| In openDesk provided by        | Jitsi-Web                                                              |
+| Transport protocol             | HTTP(S)                                                                |
+| Usage within component         | none                                                                   |
+| Usage within openDesk          | Used by Element (Chat Web-UI)                                          |
+| Usage for external integration | none                                                                   |
+| Parallel access                | Allowed                                                                |
+| Message protocol               |                                                                        |
+| Supported standards            |                                                                        |
+| Documentation                  | https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-iframe/      |
+
+## lib-jitsi-meet API
+
+| Name                           | lib-jitsi-meet API                                                     |
+| ------------------------------ | ---------------------------------------------------------------------- |
+| Purpose                        | Create Jitsi video conferences with a custom GUI                       |
+| Versioning                     | Identical to the Jitsi release                                         |
+| Authentication                 | not required                                                           |
+| In openDesk provided by        | Jitsi-Web                                                              |
+| Transport protocol             | none (it works as a library)                                           |
+| Usage within component         | Used by Jitsi itself                                                   |
+| Usage within openDesk          | Used by Jitsi itself                                                   |
+| Usage for external integration | none                                                                   |
+| Parallel access                | Allowed                                                                |
+| Message protocol               |                                                                        |
+| Supported standards            |                                                                        |
+| Documentation                  | https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-ljm-api/     |
+
+## Jitsi Meet React SDK
+
+> **Note**<br>
+> Additional SDKs can be found at https://jitsi.github.io/handbook/docs/category/sdks/
+
+| Name                           | Meet React SDK                                                      |
+| ------------------------------ | ------------------------------------------------------------------- |
+| Purpose                        | Embed Jitsi video conferencing into apps using React                |
+| Versioning                     | https://github.com/jitsi/jitsi-meet-react-sdk/releases              |
+| Authentication                 | not required                                                        |
+| In openDesk provided by        | Jitsi                                                               |
+| Transport protocol             | none (it works as a module)                                         |
+| Usage within component         | none                                                                |
+| Usage within openDesk          | none                                                                |
+| Usage for external integration | none                                                                |
+| Parallel access                | Allowed                                                             |
+| Message protocol               |                                                                     |
+| Supported standards            |                                                                     |
+| Documentation                  | https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-react-sdk |
+
+# Chat - Element
+
+While Jitsi is available as standalone videoconferencing in openDesk, it is also used in [Element as videoconferencing backend](https://github.com/element-hq/element-web/blob/develop/docs/jitsi.md).
+
+```mermaid
+---
+  config:
+    class:
+      hideEmptyMembersBox: true
+---
+classDiagram
+    class CommunicationService["Communication Service"] {
+        <<interface>>
+    }
+
+    class MxChat["Element Matrix Chat"] {
+        <<interface>>
+    }
+    class JitsiVideoConference["Jitsi Video Conference"] {
+        <<interface>>
+    }
+
+    CommunicationService <|.. MxChat
+    CommunicationService <|.. JitsiVideoConference
+    MxChat <-- JitsiVideoConference
+
+    class MxAppServiceApi["Matrix Application Service API"]
+    class MxClientServerApi["Matrix Client Server API"]
+    class MxServerServerApi["Matrix Server Server API"]
+    class MxPushGatewayApi["Matrix Push Gateway API"]
+    class MxIdentityServiceApi["Matrix Identity Service API"]
+    class MxRtc["Matrix RTC"]
+    class MxElementWebModuleApi["Matrix React SDK Module API"]
+    class MxWidgetApi["Matrix Widget API"]
+    class NeoBoardDataModelApi["NeoBoard Data Model API"]
+    class NeoDateFixRestApi["NeoDateFix REST API"]
+
+    MxChat *-- MxAppServiceApi
+    MxChat *-- MxClientServerApi
+    MxChat *-- MxServerServerApi
+    MxChat *-- MxPushGatewayApi
+    MxChat *-- MxIdentityServiceApi
+    MxChat *-- MxRtc
+    MxChat *-- MxElementWebModuleApi
+    MxChat *-- MxWidgetApi
+
+    class JitsiIframeApi["Jitsi iFrame API"]
+    class JitsiMeetApi["Jitsi Meet API"]
+    class JitsiMeetReactSdk["Jitsi Meet React SDK"]
+
+    JitsiVideoConference *-- JitsiIframeApi
+    JitsiVideoConference *-- JitsiMeetApi
+    JitsiVideoConference *-- JitsiMeetReactSdk
+```
+
+Following are APIs used by the Chat application:
+
+| Used by         | Accessed component | Service            | Purpose                                            | Message format |
+| --------------- | ------------------ | ------------------ | -------------------------------------------------- | -------------- |
+| Element/Synapse | Keycloak           | Authentication     | Single sign-on / sign-out                          | OIDC           |
+| OpenProject-web | Intercom Service   | Central Navigation | Retrieve content for openDesk Navigation drop-down | JSON           |
+
+## Matrix Application Service API
+
+| Name                           | Matrix Application Service API                                                                                                               |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Implementation of custom server-side behavior in Matrix (e.g. gateways, filters, extensible hooks)                                           |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/app/v1`)                                                                    |
+| Authentication                 | HTTP-Authorization header with Bearer token                                                                                                  |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          | Nordeck Widgets                                                                                                                              |
+| Usage for external integration | none                                                                                                                                         |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/application-service-api/)                                                                            |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix Client-Server API
+
+| Name                           | Matrix Client-Server API                                                                                                                     |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Send messages, control rooms and synchronize conversation history, JSON objects over HTTP                                                    |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/client/v3`)                                                                 |
+| Authentication                 | HTTP-Authorization header with Bearer token                                                                                                  |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          | Used by Element (Chat Web-UI)                                                                                                                |
+| Usage for external integration | none                                                                                                                                         |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/client-server-api/)                                                                                  |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix Server-Server API
+
+| Name                           | Matrix Server-Server API                                                                                                                     |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Communication between Matrix server (also known as FederationAPIs)                                                                           |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/federation/v2`)                                                             |
+| Authentication                 | HTTP-Authorization header with Bearer token                                                                                                  |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          | none                                                                                                                                         |
+| Usage for external integration | Used when federation with other Matrix instances is enabled                                                                                  |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/client-server-api/)                                                                                  |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix Push Gateway API
+
+| Name                           | Matrix Push Gateway API                                                                                                                      |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Distribute notifications from the homeserver to clients (push)                                                                               |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/push/v2`)                                                                   |
+| Authentication                 |                                                                                                                                              |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          | Used by Element (Chat Web-UI)                                                                                                                |
+| Usage for external integration | none                                                                                                                                         |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/push-gateway-api/)                                                                                   |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix Identity Service API
+
+| Name                           | Matrix Identity Service API                                                                                                                  |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Validate, store, and answer questions about the identities of users                                                                          |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/identity/v2`)                                                               |
+| Authentication                 | HTTP-Authorization header with Bearer token                                                                                                  |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          |                                                                                                                                              |
+| Usage for external integration | none                                                                                                                                         |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/identity-service-api/)                                                                               |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix React SDK Module API
+
+| Name                           | Matrix React SDK Module API                                                                                                                                                                                                        |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | The module system in Element Web is a way to add or modify functionality of Element Web itself, bundled at compile time for the app.                                                                                               |
+| Versioning                     | [Releases in the Git repository](https://github.com/matrix-org/matrix-react-sdk-module-api/releases); [Dependency in `package.json` in Element (Chat Web-UI)](https://github.com/element-hq/element-web/blob/develop/package.json) |
+| Authentication                 | n/a - used as a library                                                                                                                                                                                                            |
+| In openDesk provided by        | Element (Chat Web-UI)                                                                                                                                                                                                              |
+| Transport protocol             | n/a - used as a library                                                                                                                                                                                                            |
+| Usage within component         | [Element (Chat-Web-UI) Modules](https://github.com/nordeck/element-web-modules/)                                                                                                                                                   |
+| Usage within openDesk          | none                                                                                                                                                                                                                               |
+| Usage for external integration | n/a - uses as a library                                                                                                                                                                                                            |
+| Parallel access                | Allowed                                                                                                                                                                                                                            |
+| Message protocol               | n/a - used as a library                                                                                                                                                                                                            |
+| Supported standards            | n/a - Element (Chat Web-UI) specific                                                                                                                                                                                               |
+| Documentation                  | [Element (Chat Web-UI) Documentation](https://github.com/element-hq/element-web/blob/develop/docs/modules.md); [matrix-react-sdk-module-api Git repository](https://github.com/matrix-org/matrix-react-sdk-module-api)             |
+
+## Matrix Widget API
+
+| Name                           | Matrix Widget API                                                                                                                                                                                                    |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Matrix Widgets are HTML and Javascript content / applications that can be embedded within, and communicate with Matrix clients.                                                                                      |
+| Versioning                     | n/a                                                                                                                                                                                                                  |
+| Authentication                 | Widgets request capabilities. They must be confirmed by a user or by the [Widget Lifecycle Module](https://github.com/nordeck/element-web-modules/blob/main/packages/element-web-widget-lifecycle-module/README.md). |
+| In openDesk provided by        | Element (Chat Web-UI)                                                                                                                                                                                                |
+| Transport protocol             | [HTML window.postMessage API](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage)                                                                                                                   |
+| Usage within component         | [NeoDateFix](https://github.com/nordeck/matrix-meetings/), [NeoBoard](https://github.com/nordeck/matrix-neoboard), [NeoChoice](https://github.com/nordeck/matrix-poll)                                                                                                    |
+| Usage within openDesk          | none                                                                                                                                                                                                                 |
+| Usage for external integration | none                                                                                                                                                                                                                 |
+| Parallel access                | Allowed                                                                                                                                                                                                              |
+| Message protocol               | JSON                                                                                                                                                                                                                 |
+| Supported standards            | [Matrix - MSC2764](https://github.com/matrix-org/matrix-spec-proposals/pull/2764)                                                                                                                                    |
+| Documentation                  | [Matrix - MSC2764](https://github.com/matrix-org/matrix-spec-proposals/pull/2764)                                                                                                                                    |
+
+## NeoBoard Data Model API
+
+| Name                           | NeoBoard Data Model API                                                                                                               |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | The NeoBoard data model can be used to generate whiteboard documents.                                                                 |
+| Versioning                     | `version` field in the [NeoBoard data model](https://github.com/nordeck/matrix-neoboard/blob/main/docs/model/export-format.md#fields) |
+| Authentication                 | n/a                                                                                                                                   |
+| In openDesk provided by        | [NeoBoard](https://github.com/nordeck/matrix-neoboard)                                                                                |
+| Transport protocol             | n/a                                                                                                                                   |
+| Usage within component         | [NeoBoard](https://github.com/nordeck/matrix-neoboard)                                                                                |
+| Usage within openDesk          | none                                                                                                                                  |
+| Usage for external integration | none                                                                                                                                  |
+| Parallel access                | n/a                                                                                                                                   |
+| Message protocol               | JSON                                                                                                                                  |
+| Supported standards            | n/a                                                                                                                                   |
+| Documentation                  | [NeoBoard data model](https://github.com/nordeck/matrix-neoboard/tree/main/docs/model)                                                |
+
+## NeoDateFix REST API
+
+| Name                           | NeoDateFix REST API                                                                                                                                |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Can be used to query and set up NeoDateFix Matrix meetings.                                                                                        |
+| Versioning                     | Path segment in the [Meetings Bot API](https://github.com/nordeck/matrix-meetings/blob/main/docs/data-model.md#http-api)                           |
+| Authentication                 | n/a                                                                                                                                                |
+| In openDesk provided by        | [NeoDateFix](https://github.com/nordeck/matrix-meetings)                                                                                           |
+| Transport protocol             | HTTP(S)                                                                                                                                            |
+| Usage within component         | [NeoDateFix](https://github.com/nordeck/matrix-meetings)                                                                                           |
+| Usage within openDesk          | Used by OX to sync calendar entries to NeoDateFix                                                                                                  |
+| Usage for external integration | none                                                                                                                                               |
+| Parallel access                | n/a                                                                                                                                                |
+| Message protocol               | JSON                                                                                                                                               |
+| Supported standards            | n/a                                                                                                                                                |
+| Documentation                  | [NeoDateFix ADR001](https://github.com/nordeck/matrix-meetings/blob/main/docs/adrs/adr001-use-the-widget-api-to-interact-with-the-meetings-bot.md) |
+
+# Knowledge management - XWiki
+
+Following are APIs used by the Knowledge management application:
+
+| Used by | Accessed component | Service            | Purpose                                            | Message format |
+| ------- | ------------------ | ------------------ | -------------------------------------------------- | -------------- |
+| Xwiki   | Keycloak           | Authentication     | Single sign-on / sign-out                          | OIDC           |
+| Xwiki   | Nubus Portal       | Central Navigation | Retrieve content for openDesk Navigation drop-down | JSON           |
+| Xwiki   | Nubus              | LDAP               | Read users and groups data                         | LDAP           |
+
+## REST API
+
+| Name                           | REST API                                                                                                                                                                                                                                                   |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Perform low level action, e.g. interact with XWiki stored data                                                                                                                                                                                             |
+| Versioning                     |                                                                                                                                                                                                                                                            |
+| Authentication                 | Anonymous or username/password on each request (stateless)                                                                                                                                                                                                 |
+| In openDesk provided by        | XWiki                                                                                                                                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                                    |
+| Usage within component         |                                                                                                                                                                                                                                                            |
+| Usage within openDesk          | none                                                                                                                                                                                                                                                       |
+| Usage for external integration | none                                                                                                                                                                                                                                                       |
+| Parallel access                | Allowed                                                                                                                                                                                                                                                    |
+| Message protocol               | JSON/XML                                                                                                                                                                                                                                                   |
+| Supported standards            |                                                                                                                                                                                                                                                            |
+| Documentation                  | - https://www.xwiki.org/xwiki/bin/view/Documentation/UserGuide/Features/XWikiRESTfulAPI<br>- https://github.com/xwiki/xwiki-platform/blob/master/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-model/src/main/resources/xwiki.rest.model.xsd |
+
+## Scripting API
+
+| Name                           | Scripting API                                                                                                                                                                 |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Feature-rich API to access any module, use any functionality, modify existing functionality; allows definition of new REST API endpoints - API scope is identical to Java API |
+| Versioning                     |                                                                                                                                                                               |
+| Authentication                 | Executed in context of (authenticated) user or anonymous - permissions (scripting rights, programming rights) of that context apply                                           |
+| In openDesk provided by        | XWiki                                                                                                                                                                         |
+| Transport protocol             |                                                                                                                                                                               |
+| Usage within component         |                                                                                                                                                                               |
+| Usage within openDesk          | none                                                                                                                                                                          |
+| Usage for external integration | Not supported                                                                                                                                                                 |
+| Parallel access                | Allowed                                                                                                                                                                       |
+| Message protocol               |                                                                                                                                                                               |
+| Supported standards            |                                                                                                                                                                               |
+| Documentation                  | https://extensions.xwiki.org/xwiki/bin/view/Extension/Scripting%20Documentation%20Application                                                                                 |
+
+## Java API
+
+| Name                           | Java API                                                                                                                                                                           |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Feature-rich API to access any module, use any functionality, modify existing functionality; allows definition of new REST API endpoints - API scope is identical to Scripting API |
+| Versioning                     |                                                                                                                                                                                    |
+| Authentication                 | Executed in context of (authenticated) user or anonymous - but without the permission check (in opposite to the Scripting API)                                                     |
+| In openDesk provided by        | XWiki                                                                                                                                                                              |
+| Transport protocol             |                                                                                                                                                                                    |
+| Usage within component         |                                                                                                                                                                                    |
+| Usage within openDesk          | none                                                                                                                                                                               |
+| Usage for external integration | none                                                                                                                                                                               |
+| Parallel access                | Allowed                                                                                                                                                                            |
+| Message protocol               |                                                                                                                                                                                    |
+| Supported standards            |                                                                                                                                                                                    |
+| Documentation                  | https://www.xwiki.org/xwiki/bin/view/Documentation/DevGuide/API/                                                                                                                   |
+
+## JavaScript API
+
+| Name                           | JavaScript API                                                                               |
+| ------------------------------ | -------------------------------------------------------------------------------------------- |
+| Purpose                        | Include dynamic components in XWiki/web pages                                                |
+| Versioning                     |                                                                                              |
+| Authentication                 | Executed in context of (authenticated) user or anonymous                                     |
+| In openDesk provided by        | Jitsi                                                                                        |
+| Transport protocol             |                                                                                              |
+| Usage within component         |                                                                                              |
+| Usage within openDesk          | none                                                                                         |
+| Usage for external integration | none                                                                                         |
+| Parallel access                | Allowed                                                                                      |
+| Message protocol               |                                                                                              |
+| Supported standards            |                                                                                              |
+| Documentation                  | https://www.xwiki.org/xwiki/bin/view/Documentation/DevGuide/FrontendResources/JavaScriptAPI/ |

docs/ci.md

@@ -2,6 +2,7 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>CI/CD</h1>
 
 This page covers openDesk deployment automation via Gitlab CI.
@@ -17,26 +18,22 @@ The project includes a `.gitlab-ci.yml` that allows you to execute the deploymen
 
 When starting the pipeline through the GitLab UI, you will be queried for some variables plus the following ones:
 
-- `DOMAIN`: Primary domain for your deployment making the openDesk services available e.g. as `https://portal.DOMAIN`.
-- `MAIL_DOMAIN`: (optional) Domain for the users mail addresses, defaults to `DOMAIN`.
-- `MATRIX_DOMAIN`: (optional) Domain for the users Matrix IDs, defaults to `DOMAIN`.
-- `NAMESPACE`: Namespace of your K8s cluster openDesk will be installed to.
+- `DOMAIN`: The primary domain for your deployment, making the openDesk services available, e.g., as `https://portal.DOMAIN`.
+- `MAIL_DOMAIN` (optional): The domain for the users' email addresses; it defaults to `DOMAIN`.
+- `MATRIX_DOMAIN` (optional): The domain for the users' Matrix IDs; it defaults to `DOMAIN`.
+- `NAMESPACE`: Namespace of your K8s cluster openDesk will be installed.
 - `MASTER_PASSWORD_WEB_VAR`: Overwrites value of `MASTER_PASSWORD`.
 
-Based on your input, the following variables will be set:
-- `MASTER_PASSWORD:`: `MASTER_PASSWORD_WEB_VAR`. If `MASTER_PASSWORD_WEB_VAR`
-  is not set, the default for `MASTER_PASSWORD` will be used, unless you set
-  `MASTER_PASSWORD` as a masked CI/CD variable in GitLab to supersede the default.
-
 You might want to set credential variables in the GitLab project at `Settings` > `CI/CD` > `Variables`.
 
 # Tests
 
 The GitLab CI pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another GitLab project.
-The `DEPLOY_`-variables are used to determine which components should be tested.
-In order for the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this GitLab project's CI variables
-that can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
+For the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this GitLab project's CI variables,
+which can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
 `<domain of gitlab>/api/v4/projects/<id>`.
-
-If the branch of the test pipeline is not `main` this can be set with the `.gitlab-ci.yml` variable
+To select the current test set, use the variable `TESTS_TESTSET`. Default: `Smoke`.
+If the branch of the test pipeline is not `main`, this can be set with the `.gitlab-ci.yml` variable
 `TESTS_BRANCH` while creating a new pipeline.
+
+The variable `testprofile` within the job is set to `Namespace`, which tells the e2e tests to use environment-specific settings that will be read from the cluster and namespace-specific file to be found in the project internal `opendesk-env` repository.

docs/components.md

@@ -1,190 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-SPDX-License-Identifier: Apache-2.0
--->
-<h1>Components</h1>
-
-This section covers the internal system requirements as well as external service requirements for productive use.
-
-<!-- TOC -->
-* [Overview](#overview)
-* [Component integration](#component-integration)
-  * [Intercom Service / Silent Login](#intercom-service--silent-login)
-  * [Filepicker](#filepicker)
-  * [Central Navigation](#central-navigation)
-  * [Central Contacts](#central-contacts)
-  * [File Store (OpenProject -\> Nextcloud)](#file-store-openproject---nextcloud)
-* [Identity data flows](#identity-data-flows)
-* [Provisioning](#provisioning)
-<!-- TOC -->
-
-# Overview
-
-openDesk consists out of a variety of open-source projects. Here is a list with the description and type.
-
-Components of type `Eval` are used for development and evaluation purposes only,
-they need to be replaced in production deployments.
-
-| Component                   | Description                    | Type       |
-|-----------------------------|--------------------------------|------------|
-| Certificates                | TLS certificates               | Eval       |
-| ClamAV (Distributed)        | Antivirus engine               | Eval       |
-| ClamAV (Simple)             | Antivirus engine               | Eval       |
-| Collabora                   | Weboffice                      | Functional |
-| CryptPad                    | Weboffice                      | Functional |
-| Element                     | Secure communications platform | Functional |
-| Intercom Service            | Cross service data exchange    | Functional |
-| Jitsi                       | Videoconferencing              | Functional |
-| MariaDB                     | Database                       | Eval       |
-| Memcached                   | Cache Database                 | Eval       |
-| MinIO                       | Object Storage                 | Eval       |
-| Nextcloud                   | File share                     | Functional |
-| OpenProject                 | Project management             | Functional |
-| OX Appsuite                 | Groupware                      | Functional |
-| OX Dovecot                  | Mail backend (IMAP)            | Functional |
-| Provisioning (OX Connector) | Groupware provisioning         | Functional |
-| Postfix                     | MTA                            | Eval       |
-| PostgreSQL                  | Database                       | Eval       |
-| Redis                       | Cache Database                 | Eval       |
-| Univention Management Stack | Identity Management & Portal   | Functional |
-| XWiki                       | Knowledge Management           | Functional |
-
-# Component integration
-
-Some use cases require inter component integration.
-
-```mermaid
-flowchart TD
-  OX-AppSuite_Frontend-->|Silent Login, Filepicker, Central Navigation|Intercom_Service
-  Element-->|Silent Login, Central Navigation|Intercom_Service
-  Intercom_Service-->|Silent Login, Token Exchange|IdP
-  Intercom_Service-->|Filepicker|Nextcloud
-  Intercom_Service-->|Central Navigation|Portal
-  OX-AppSuite_Backend-->|Filepicker|Nextcloud
-  Nextcloud-->|Central Navigation|Portal
-  OpenProject-->|Central Navigation|Portal
-  OpenProject-->|File Store|Nextcloud
-  XWiki-->|Central Navigation|Portal
-  Nextcloud-->|Central Contacts|OX-AppSuite_Backend
-  OX-AppSuite_Frontend-->|Filepicker|OX-AppSuite_Backend
-```
-
-Most details can be found in the upstream documentation that is linked in the respective sections.
-
-## Intercom Service / Silent Login
-
-The Intercom Service's role is to enable cross-application integration based on the user's browser interaction as handling
-authentication when the frontend of an application has to call the API from another application is often a
-challenge.
-
-To establish a session with the Intercom Service an application can use the silent login feature within an iframe.
-
-Currently only OX AppSuite and Element are using the frontend based integration.
-
-**Links**
-- [Intercom Service upstream documentation](https://docs.software-univention.de/intercom-service/latest/index.html).
-
-## Filepicker
-
-The Nextcloud filepicker is integrated into the OX AppSuite supporting the following use cases against the respective openDesk instance's Nextcloud:
-- Attaching files from Nextcloud to emails.
-- Adding links of Nextcloud files to emails.
-- Saving attachments from emails into Nextcloud.
-- Attaching files from Nextcloud to calendar entries.
-
-The filepicker is using frontend and backend based integration:
-- For frontend based integration the OX AppSuite frontend uses the Intercom Service.
-- Backend based integration is coming from OX AppSuite middleware. The middleware is communicating directly with Nextcloud,
-which is used when adding a file to an email or storing a file into Nextcloud, to avoid passing these files through the user's browser.
-
-**Links**
-- [OX AppSuite Nextcloud Integration upstream documentation](https://gitlab.open-xchange.com/extensions/nextcloud-integration/-/tree/main/documentation).
-
-## Central Navigation
-
-Central navigation is based on an API endpoint in the Nubus portal that returns a JSON containing the contents of the portal for
-a given user. The response from the API endpoint is used in the openDesk applications to render the central navigation.
-
-The API can be called by
-- frontend services through the Intercom Service's `/navigation.json` endpoint or
-- backend services directly at the portal's `/univention/portal/navigation.json` endpoint.
-
-The central navigation expects the API caller to present a shared secret for authentication and the username for whom the portal
-contents should be returned for.
-
-A `curl` based request returning the navigation contents looks like this:
-
-```
-curl 'https://portal.<DOMAIN>/univention/portal/navigation.json?base=https%3A//portal.<DOMAIN>&language=de-DE' -u "<USERNAME>:<SHARED_SECRET>"
-```
-
-## Central Contacts
-
-OX App Suite is managing contacts in openDesk. Therefore Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
-- create a new contact in the user's contacts folder when a file is shared with a yet unknown email address.
-- retrieve contacts from the user's contacts folder to support search-as-you-type when starting to share a file.
-
-**Links:**
-- Currently used [OX Contacts API (deprecated)](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Contacts).
-- New [OX Addressbooks API](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Addressbooks) the Central Contacts integration will switch to.
-
-## File Store (OpenProject -> Nextcloud)
-
-While OpenProject allows you to attach files to work packages directly, it is often preferred that the files are
-stored within Nextcloud or to link an existing file from your openDesk Nextcloud to a work package.
-
-Therefore openDesk pre-configures the trust between the openDesk instance's OpenProject and Nextcloud during the `openproject-boostrap` deployment step. As prerequisite for that openDesk's Nextcloud contains the `integration_openproject` app.
-
-The file store still needs to be enabled on a per-project level in OpenProject's project admin section.
-
-**Links:**
-- [OpenProject's documentation on Nextcloud integration](https://www.openproject.org/docs/system-admin-guide/integrations/nextcloud/)
-- [OpenProject Integration Nextcloud app](https://apps.nextcloud.com/apps/integration_openproject)
-
-# Identity data flows
-
-An overview of
-- components that consume the LDAP service.
-  - The components accessing the LDAP using a component specific LDAP search account.
-- components using Univention Keycloak as identity provider (IdP).
-  - If not otherwise denoted the components make use of OAuth2 / OIDC flows.
-  - All components have a client configured in Keycloak, except for Jitsi which is using authentication with the
-    [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) that does not
-    require an OIDC client to be configured in Keycloak.
-
-Some components trust others to handle authentication for them.
-
-```mermaid
-flowchart TD
-    K[IdP]-->L[LDAP]
-    N[Nextcloud]-->L
-    O[OpenProject] --> L
-    A[OX AppSuite]-->L
-    D[OX Dovecot]-->L
-    P[Portal/Admin]-->L
-    X[XWiki]-->L
-    A-->K
-    N-->K
-    D-->K
-    O-->K
-    X-->K
-    P-->|SAML|K
-    E[Element]-->K
-    J[Jitsi]-->K
-    I[IntercomService]-->K
-    C[Collabora]-->N
-    R[CryptPad]-->N
-    F[Postfix]-->D
-```
-
-# Provisioning
-
-Currently, active provisioning is only done for OX AppSuite. The OX-Connector is synchronizing, creating, modifying and
-deleting activities for the following objects to the OX AppSuite using the AppSuite's SOAP API:
-
-- Contexts
-- Users
-- Groups
-- Functional Mailboxes
-- Resources

docs/data-storage.md

@@ -0,0 +1,117 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Application Data Storages</h1>
+
+To provide a feasible backup and restore concept, a thorough overview of all openDesk
+applications and their related data storages (ephemeral & persistent) is provided in the
+following subsection.
+
+<!-- TOC -->
+* [Overview](#overview)
+* [Details](#details)
+<!-- TOC -->
+
+# Overview
+
+The provided diagram shows all relevant openDesk applications on the left and
+their utilized data storages on the right. For more detailed information about each
+application refer to the table show in Section [Details](#details)
+
+```mermaid
+---
+config:
+  sankey:
+    showValues: false
+    linkColor: target
+---
+sankey-beta
+
+ClamAV,PersistentVolume,1
+
+Dovecot,PersistentVolume,1
+
+Element/Synapse,PostgreSQL,1
+Element/Synapse,PersistentVolume,1
+
+Intercom-Service,Redis,1
+
+Jitsi,PersistentVolume,1
+
+Nextcloud,MariaDB,1
+Nextcloud,S3,1
+Nextcloud,Redis,1
+
+Nubus,PostgreSQL,1
+Nubus,S3,1
+Nubus,PersistentVolume,1
+Nubus,Memcached,1
+
+OpenProject,PostgreSQL,1
+OpenProject,S3,1
+OpenProject,PersistentVolume,1
+OpenProject,Memcached,1
+
+Open-Xchange,MariaDB,1
+Open-Xchange,PersistentVolume,1
+Open-Xchange,Redis,1
+
+Postfix,PersistentVolume,1
+
+XWiki,MariaDB,1
+XWiki,PersistentVolume,1
+```
+
+# Details
+
+| Application          | Data Storage | Backup   | Content                                                                                    | Identifier                                     | Details                                               |
+| -------------------- | ------------ | -------- | ------------------------------------------------------------------------------------------ | ---------------------------------------------- | ----------------------------------------------------- |
+| **ClamAV**           | PVC          | No       | ClamAV Database                                                                            | `clamav-database-clamav-simple-0`              | `/var/lib/clamav`                                     |
+| **Dovecot**          | PVC          | Yes      | User mail directories (openDesk CE only, openDesk EE uses Dovecot Pro with Object Storage) | `dovecot`                                      | `/srv/mail`                                           |
+| **Element/Synapse**  | PostgreSQL   | Yes      | Application's main database                                                                | `matrix`                                       |                                                       |
+|                      | PVC          | Yes      | Attachments                                                                                | `media-opendesk-synapse-0`                     | `/media`                                              |
+|                      |              | Yes      | Sync and state data                                                                        | `matrix-neodatefix-bot`                        | `/app/storage`                                        |
+| **Intercom-Service** | Redis        | No       | Shared session data                                                                        |                                                |                                                       |
+| **Jitsi**            | PVC          | Optional | Meeting recordings (feature not enabled in openDesk)                                       | `prosody-data-jitsi-prosody-0`                 | `/config/data`                                        |
+| **Nextcloud**        | MariaDB      | Yes      | Application's main database Meta-Data                                                      | `nextcloud`                                    |                                                       |
+|                      | S3           | Yes      | The Nextcloud managed user files                                                           | `nextcloud`                                    |                                                       |
+|                      | Redis        | No       | Distributed caching, as well as transactional file locking                                 |                                                |                                                       |
+| **Nubus**            | PostgreSQL   | Yes      | Main database for Nubus' IdP Keycloak                                                      | `keycloak`                                     |                                                       |
+|                      |              | Yes      | Login actions and device-fingerprints                                                      | `keycloak_extensions`                          |                                                       |
+|                      |              | Optional | Store of the temporary password reset token                                                | `selfservice`                                  |                                                       |
+|                      |              | No       | Notification features are not used in openDesk 1.1                                         | `notificationsapi`                             |                                                       |
+|                      |              | No       | Guardian features are currently not used in openDesk 1.1                                   | `guardianmanagementapi`                        |                                                       |
+|                      | S3           | No       | Static files for Portal                                                                    | `ums`                                          |                                                       |
+|                      | PVC          | Yes      | openLDAP database (primary R/W Pods), when restore select the one from the leader          | `shared-data-ums-ldap-server-primary-0`        | `/var/lib/univention-ldap`                            |
+|                      |              | Yes      | openLDAP process data                                                                      | `shared-run-ums-ldap-server-primary-0`         | `/var/run/slapd`                                      |
+|                      |              | No       | openLDAP database (secondary R/O Pods), secondaries can sync from the primary              | `shared-data-ums-ldap-server-secondary-0`      | `/var/lib/univention-ldap`                            |
+|                      |              | No       | openLDAP process data                                                                      | `shared-run-ums-ldap-server-secondary-0`       | `/var/run/slapd`                                      |
+|                      |              | Yes      | The state of the listener                                                                  | `data-ums-provisioning-listener-0`             | `/var/log/univention` and two others                  |
+|                      |              | No       | Cache                                                                                      | `group-membership-cache-ums-portal-consumer-0` | `/usr/share/univention-group-membership-cache/caches` |
+|                      |              | Yes      | Queued provisioning objects                                                                | `nats-data-ums-provisioning-nats-0`            | `/data`                                               |
+|                      | Memcached    | No       | Cache for UMC Server                                                                       |                                                |                                                       |
+| **OpenProject**      | PostgreSQL   | Yes      | Application's main database                                                                | `openproject`                                  |                                                       |
+|                      | S3           | Yes      | Attachments, custom styles                                                                 | `openproject`                                  |                                                       |
+|                      | Memcached    | No       | Cache                                                                                      |                                                |                                                       |
+|                      | PVC          | No       | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs               | `openproject-<web/worker>-*-tmp`               | `/tmp`                                                |
+|                      |              | No       | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs               | `openproject-<web/worker>-app-*-tmp`           | `/app/tmp`                                            |
+| **Open-Xchange**     | MariaDB      | Yes      | Application's control database to coordiate dynamically created ones                       | `configdb`                                     |                                                       |
+|                      |              | Yes      | Dynamically creates databases of schema `PRIMARYDB_n`containing multiple contexts          | `PRIMARYDB_*`                                  |                                                       |
+|                      |              | Yes      | OX Guard related settings                                                                  | `oxguard*`                                     |                                                       |
+|                      | Redis        | Optional | Cache, session related data, distributed maps                                              |                                                |                                                       |
+|                      | PVC          | Yes      | OX-Connector: OXAPI access details                                                         | `ox-connector-appcenter-ox-connector-0`        | `/var/lib/univention-appcenter/apps/ox-connector`     |
+|                      |              | Yes      | OX-Connector: Application's meta data                                                      | `ox-connector-ox-contexts-ox-connector-0`      | `/etc/ox-secrets`                                     |
+| **Postfix**          | PVC          | Yes      | Mail spool                                                                                 | `postfix`                                      | `/var/spool/postfix`                                  |
+| **XWiki**            | Database     | Yes      | Application's main database                                                                | `xwiki`                                        |                                                       |
+|                      | PVC          | Yes      | Attachments                                                                                | `xwiki-data-xwiki-0`                           | `/usr/local/xwiki/data`                               |
+
+Additionally, the following persistent volumes are mounted by pods that serve as a data storage for the applications mentioned above.
+
+| Service    | Pod              | Volume Name  | PVC                         | MountPath             |
+| ---------- | ---------------- | ------------ | --------------------------- | --------------------- |
+| MariaDB    | `mariadb-*`      | `data`       | `data-mariadb-0`            | `/var/lib/mysql`      |
+| MinIO      | `minio-*-*`      | `data`       | `minio`                     | `/bitnami/minio/data` |
+| PostgreSQL | `postgresql-*`   | `data`       | `data-postgresql-0`         | `/mnt/postgresql`     |
+| Redis      | `redis-master-*` | `redis-data` | `redis-data-redis-master-0` | `/data`               |

docs/debugging.md

@@ -2,65 +2,80 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Debugging</h1>
 
+<!-- TOC -->
 * [Disclaimer](#disclaimer)
 * [Enable debugging](#enable-debugging)
 * [Adding containers to a pod for debugging purposes](#adding-containers-to-a-pod-for-debugging-purposes)
   * [Adding a container to a pod/deployment - Dev/Test only](#adding-a-container-to-a-poddeployment---devtest-only)
   * [Temporary/ephemeral containers](#temporaryephemeral-containers)
 * [Components](#components)
+  * [Helmfile](#helmfile)
   * [MariaDB](#mariadb)
   * [Nextcloud](#nextcloud)
   * [OpenProject](#openproject)
   * [PostgreSQL](#postgresql)
+  * [Keycloak](#keycloak)
+<!-- TOC -->
 
 # Disclaimer
 
-This document collects information how to deal with debugging an openDesk deployment.
+This document collects information on how to deal with debugging an openDesk deployment.
 
-It will be extended over time as we have to deal with debugging cases.
+It will be extended over time as we deal with debugging cases.
 
 We for sure do not want to reinvent the wheel, so we might link to external sources that contain helpful
 information where available.
 
-**Note:** You should never enable debug in production environments! By looking up `debug.enable` in the deployment you
-will find the various places changes are applied when enabling debugging. So outside of development and test
-environments you may want to make use of them in a very thoughtful and selective manner if needed.
+> **Warning**<br>
+> You should never enable the debug option in production environments! By looking up `debug.enabled` in the deployment, you
+will find the various places changes are applied when enabling debugging. So, outside of development and test
+environments, you should use them thoughtfully and carefully if needed.
 
 # Enable debugging
 
-Set `debug.enable` to `true` in [`debug.yaml`](../helmfile/environments/default/debug.yaml) to set the
-component's log level to debug and it get some features like:
-- The `/admin` console is routed for Keycloak.
-- An ingress for `http://minio-console.<your_domain>` is configured.
-and set the log level for components to "Debug".
+Check the openDesk [`debug.yaml.gotmpl`](../helmfile/environments/default/debug.yaml.gotmpl) and set for your deployment
+```
+debug:
+  enabled: true
+```
 
-**Note:** All containers should write their log output to STDOUT, if you find (valuable) logs inside a container, please let us know!
+This will result in:
+- setting most component's log level to debug
+- making the Keycloak admin console available by default at `https://id.<your_domain>/admin/`
+- configured the ingress for `http://minio-console.<your_domain>`
+
+> **Note**<br>
+> When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.
+
+> **Note**<br>
+> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container, please let us know!
 
 # Adding containers to a pod for debugging purposes
 
-During test or development you come across the need to execute tools, browse or even change things in the filesystem of another container.
+During testing or development, you may need to execute tools, browse, or even change things in the filesystem of another container.
 
-This can be a challenge the more security hardened container images are, because there are no debugging tools available and sometimes not even a shell.
+This can be a challenge the more security-hardened the container images are because there are no debugging tools available, and sometimes, there is not even a shell.
 
 Adding a container to a Pod can ease the pain.
 
-Below you will find some wrap-up notes when it comes to debugging openDesk by adding debug containers. Of course there are a lot of more detailed resources out in the wild.
+Below are some wrap-up notes on debugging openDesk by adding debug containers. Of course, there are many more detailed resources out there.
 
 ## Adding a container to a pod/deployment - Dev/Test only
 
 You can add a container by editing and updating an existing deployment, which is quite comfortable with tools like [Lens](https://k8slens.dev/).
 
-- Select the container you want to make use of as debugging container, in the example below it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
+- Select the container you want to make use of as a debugging container; in the example below, it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
 - Ensure the `shareProcessNamespace` option is enabled for the Pod.
 - Reference the selected container within the `containers` array of the deployment.
-- In case you want to access another containers filesystem, ensure the user/group settings of both containers match.
+- If you want to access another container's filesystem, ensure both containers' user/group settings match.
 - Save & update the deployment.
 
-The following example can e.g. be used to debug the `openDesk-Nextcloud-PHP` container, in case you want to modify files, don't forget to set `readOnlyRootFilesystem` to `true` on the PHP container.
+The following example can be used to debug the `openDesk-Nextcloud-PHP` container; if you want to modify files, remember to set `readOnlyRootFilesystem` to `true` on the PHP container.
 
-```
+```yaml
       shareProcessNamespace: true
       containers:
         - name: debugging
@@ -80,36 +95,36 @@ The following example can e.g. be used to debug the `openDesk-Nextcloud-PHP` con
               type: RuntimeDefault
 ```
 
-- After the deployment was reloaded open the shell of the debugging container.
-- When you've been successful you will see the processes of both/all containers in the pod when doing a `ps aux`.
-- To access another containers filesystem just select the PID of a process from the other container an do a `cd /proc/<selected_process_id>/root`
+- After the deployment has been reloaded, open the shell of the debugging container.
+- When you've succeeded, you will see the processes of both/all containers in the Pod when doing a `ps aux`.
+- To access other containers' filesystems, select the PID of a process from the other container and do a `cd /proc/<selected_process_id>/root`.
 
 ## Temporary/ephemeral containers
 
-Interesting read we picked most of the details below from: https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/
+An interesting read we picked most of the details below from: https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/
 
-Sometimes you do not want to add a container permanently to your existing deployment. In that case you could use [ephemeral containers](https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/).
+Sometimes, you do not want to add a container permanently to your existing deployment. In that case, you could use [ephemeral containers](https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/).
 
-For the commands further down this section we set some environment variables first:
-- `NAMESPACE`: The namespace the Pod you want to inspects is running in.
-- `DEPLOYMENT_NAME`: The name of the deployment responsible for spawning the Pod you want to inspect within the pre-mentioned namespace.
+For the commands further down this section, we set some environment variables first:
+- `NAMESPACE`: The namespace in which the Pod you want to inspect is running.
+- `DEPLOYMENT_NAME`: The deployment's name responsible for spawning the Pod you want to inspect within the pre-mentioned namespace.
 - `POD_NAME`: The name of the Pod you want to inspect within the pre-mentioned namespace.
-- `EPH_CONTAINER_NAME`: Chose the name for the container, "debugging" seem obvious.
-- `DEBUG_IMAGE`: The image you want to make use of for debugging purposes.
+- `EPH_CONTAINER_NAME`: Choose the name for the container, and "debugging" seems obvious.
+- `DEBUG_IMAGE`: The image you want to use for debugging purposes.
 
 e.g.
 
-```
+```shell
 export EPH_CONTAINER_NAME=debugging
 export NAMESPACE=my_test_deployment
 export DEPLOYMENT_NAME=opendesk-nextcloud-php
 export POD_NAME=opendesk-nextcloud-php-6686d47cfb-7642f
-export DEBUG_IMAGE=registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:1.0.0
+export DEBUG_IMAGE=registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest
 ```
 
 You still need to ensure that your deployment supports process namespace sharing:
 
-```
+```shell
 kubectl -n ${NAMESPACE} patch deployment ${DEPLOYMENT_NAME} --patch '
 spec:
   template:
@@ -117,22 +132,31 @@ spec:
       shareProcessNamespace: true'
 ```
 
-Now you can add the ephemeral container with:
-```
+Now, you can add the ephemeral container with:
+```shell
 kubectl -n ${NAMESPACE} debug -it --attach=false -c ${EPH_CONTAINER_NAME} --image={DEBUG_IMAGE} ${POD_NAME}
 ```
 and open its interactive terminal with
-```
+```shell
 kubectl -n ${NAMESPACE} attach -it -c ${EPH_CONTAINER_NAME} ${POD_NAME}
 ```
 
 # Components
 
+## Helmfile
+
+When refactoring the Helmfile structure you want to ensure that there are not unintended mistakes by e.g. `diff`
+comparing the output of Helmfile from before and after the change by calling:
+
+```shell
+helmfile template -e dev >output_to_compare.yaml
+```
+
 ## MariaDB
 
-When using the openDesk bundled MariaDB you can explore database(s) using the MariaDB interactive terminal from the pod's command line: `mariadb -u root -p`. As password provide the value for `MARIADB_ROOT_PASSWORD` set in the pod's environment.
+When using the openDesk bundled MariaDB, you can explore the database(s) using the MariaDB interactive terminal from the Pod's command line: `mariadb -u root -p`. On the password prompt, provide the value for `MARIADB_ROOT_PASSWORD` found in the Pod's environment.
 
-While you will find all details for the CLI tool in [the online documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some quick commands are:
+While you will find all the details for the CLI tool in [the online documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some quick commands are:
 
 - `help`: Get help on the psql command set
 - `show databases`: Lists all databases
@@ -142,28 +166,27 @@ While you will find all details for the CLI tool in [the online documentation](h
 
 ## Nextcloud
 
-`occ` is the CLI for Nextcloud, all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
+`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
 
-You can run occ commands in the `opendesk-nextcloud-php` pod like this: `php /var/www/html/occ config:list`
+You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`
 
 ## OpenProject
 
-OpenProject is a Ruby on Rails application. Therefore you can make use of the Rails console from the pod's command line `bundle exec rails console`
-
+OpenProject is a Ruby on Rails application. Therefore, you can make use of the Rails console from the Pod's command line `bundle exec rails console`
 and run debug code like this:
 
 ```
-uri = URI('https://nextcloud.url/index.php/apps/integration_openproject/check-config')
+uri = URI('https://nextcloud.url/apps/integration_openproject/check-config')
 Net::HTTP.start(uri.host, uri.port,
-  :use_ssl => uri.scheme == 'https') do |http|
-  request = Net::HTTP::Get.new uri
-  response = http.request request # Net::HTTPResponse object
+ :use_ssl => uri.scheme == 'https') do |http|
+ request = Net::HTTP::Get.new uri
+ response = http.request request # Net::HTTPResponse object
 end
 ```
 
 ## PostgreSQL
 
-When using the openDesk bundled PostgreSQL you can explore database(s) using the PostgreSQL interactive terminal from the pod's command line: `psql -U postgres`.
+Using the openDesk bundled PostgreSQL, you can explore database(s) using the PostgreSQL interactive terminal from the Pod's command line: `psql -U postgres`.
 
 While you will find all details in the [psql subsection](https://www.postgresql.org/docs/current/app-psql.html)) of the PostgreSQL documentation, some quick commands are:
 
@@ -172,3 +195,22 @@ While you will find all details in the [psql subsection](https://www.postgresql.
 - `\c <databasename>`: Connect to `<databasename>`
 - `\dt`: List (describe) tables within the currently connected database
 - `\q`: Quit the client
+
+## Keycloak
+
+Keycloak is the gateway to integrate other authentication management systems or applications. It can be desired to
+avoid enabling debug mode for the whole platform when you just need to look into Keycloak.
+
+That can easily be achieved in two steps:
+
+1. Updating the value for `KC_LOG_LEVEL` in the related configmap `ums-keycloak`.
+```shell
+export NAMESPACE=<your_namespace>
+export CONFIGMAP_NAME=ums-keycloak
+kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"data":{"KC_LOG_LEVEL":"DEBUG"}}'
+```
+
+2. Restart the Keycloak Pod(s).
+
+> **Note**<br>
+> As the `ums-keycloak-extensions-handler` is performing frequent (one per second) requests to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.

docs/development.md

@@ -7,71 +7,72 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Developing openDesk deployment automation</h1>
 
 Active development on the deployment is currently only available for project members.
-But contributions will be possible soon once the CLA process is sorted out.
+However, contributions are possible using the [CLA](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md?ref_type=heads) process.
 
+<!-- TOC -->
 * [Overview](#overview)
 * [Default branch, `develop` and other branches](#default-branch-develop-and-other-branches)
-* [External artifacts - `charts.yaml` and `images.yaml`](#external-artifacts---chartsyaml-and-imagesyaml)
+* [External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`](#external-artifacts---chartsyamlgotmpl-and-imagesyamlgotmpl)
   * [Linting](#linting)
     * [Disable linting selectively](#disable-linting-selectively)
   * [Renovate](#renovate)
   * [Mirroring](#mirroring)
     * [Get new artifacts mirrored](#get-new-artifacts-mirrored)
-* [Creating new charts / images](#creating-new-charts--images)
+* [Creating new charts/images](#creating-new-chartsimages)
+<!-- TOC -->
 
 # Overview
 
-The following sketch provides an high level overview to get a basic understanding of the deployment relevant
-structure of this repository. An understanding of that structure is vital if you want to contribute to
-the development of the deployment automation of openDesk.
+The following sketch provides a high-level overview to get a basic understanding of the deployment-relevant
+structure of this repository. Understanding that structure is vital if you want to contribute to
+developing the openDesk platform.
 
 ```mermaid
 flowchart TD
-    J[helmfile.yaml\nor a helmfile outside of this repository]-->A
-    J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor any an environment values file]
-    A[./helmfile_generic.yaml]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml\nReferences the relevant app Helm\ncharts using details from 'charts.yaml']
-    B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml`]
-    A-->D[./helmfile/environments/default/*\nwith just some examples below]
-    D-->F[charts.yaml]
-    D-->G[images.yaml]
-    D-->H[global.*]
-    D-->I[secrets.yaml\nreplicas.yaml\nresources.yaml\n...]
-    A-->|overwrite defaults with your\ndeployment/environment specific values|E[./helmfile/environments/default/values.yaml.gotmpl]
+ J[helmfile.yaml.gotmpl\nor a helmfile outside of this repository]-->A
+ J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor any an environment values file]
+ A[./helmfile_generic.yaml.gotmpl]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml.gotmpl\nReferences the relevant app Helm\ncharts using details from 'charts.yaml.gotmpl']
+ B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml.gotmpl`]
+ A-->D[./helmfile/environments/default/*\nwith just some examples below]
+ D-->F[charts.yaml.gotmpl]
+ D-->G[images.yaml.gotmpl]
+ D-->H[global.*]
+ D-->I[secrets.yaml.gotmpl\nreplicas.yaml.gotmpl\nresources.yaml.gotmpl\n...]
+ A-->|overwrite defaults with your\ndeployment/environment specific values|E[./helmfile/environments/default/values.yaml.gotmpl]
 ```
 
-The `helmfile.yaml` file in the root folder serves as the foundation
-for the entire deployment. It references the `helmfile_generic.yaml`
-file, which includes app-specific `helmfile.yaml` files, as well as
+The `helmfile.yaml.gotmpl` file in the root folder is the foundation
+for the entire deployment. It references the `helmfile_generic.yaml.gotmpl`
+file, which includes app-specific `helmfile.yaml.gotmpl` files and
 global values files located in `./environments/default`.
 
-`helmfile.yaml` also refers to three predefined environments: `dev`,
+`helmfile.yaml.gotmpl` also refers to three predefined environments: `dev`,
 `test`, and `prod`.
 
-The `helmfile_generic.yaml` file is designed to be referenced from
+The `helmfile_generic.yaml.gotmpl` file is designed to be referenced from
 external repositories, where custom environments may be defined. An
-example is demonstrated in the `helmfile.yaml` file.
+example is demonstrated in the `helmfile.yaml.gotmpl` file.
 
-Before you look into any app specific configuration it is recommended to review the contents of `./environments/default` to get an understanding of what
-details are maintained in there, as they are usually referenced by the app configurations.
+Before you investigate any app-specific configuration, it is recommended that you review the contents of `./helmfile/environments/default` to understand what configuration details are set there, as the app deployments reference them.
 
 # Default branch, `develop` and other branches
 
 The `main` branch is configured to be the default branch, as visitors of the project on Open CoDE should see that
 branch by default.
 
-Please use the `develop` branch to diverge your own branch(es) from. See the [workflow guide](./workflow.md)
+Please use the `develop` branch to diverge your branch(es) from. See the [workflow guide](./workflow.md)
 for more details on naming conventions.
 
-There is a CI bot that automatically creates a merge request once you initially pushed your branch to Open CoDE.
-The merge request will of course target the `develop` branch, be in status `draft` and have you as assignee.
+There is a CI bot that automatically creates a merge request once you initially push your branch to Open CoDE.
+Of course, the merge request will target the `develop` branch, be in status `draft`, and you are set as the assignee.
 
-In case you do not plan to actually merge from the branch you have pushed, please close or delete the auto-created MR.
+If you do not plan to merge from the branch you have pushed, please close the auto-created MR.
 
-# External artifacts - `charts.yaml` and `images.yaml`
+# External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`
 
-The `charts.yaml` and `images.yaml` are the central place to reference external artifacts that are used for the deployment.
+The `charts.yaml.gotmpl` and `images.yaml.gotmpl` files are the central place to reference external artifacts used for the deployment.
 
-Beside the deployment automation itself some tools work with the contents of the files:
+Besides the deployment automation itself, some tools work with the contents of the files:
 
 - **Linting**: Ensures consistency of the file contents for the other tools.
 - **Renovate**: Automatically create MRs that update the components to their latest version.
@@ -81,35 +82,35 @@ Please find details on these tools below.
 
 ## Linting
 
-In the project's CI there is a step dedicated to lint the two yaml files, as we want them to be in
+In the project's CI, there is a step dedicated to lint the two yaml files, as we want them to be in
 - alphabetical order regarding the components and
 - in a logical order regarding the non-commented lines (registry > repository > tag).
 
-In the linting step the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
-just mentioned sorting and the result is compared with the unsorted version. If there is a delta the linting fails and you probably
-want to fix it by running the CLI tool locally.
+In the linting step, the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
+just mentioned sorting, and the result is compared with the unsorted version. If there is a delta, the linting fails, and you can fix it by running the CLI tool locally, verifying and applying the result to your branch.
 
-**Note**: Please ensure that in component blocks you use comments only at the beginning of the block or at its end. Ideally you just stick
+> **Note**<br>
+> Please ensure that in component blocks, you use comments only at the beginning of the block or at its end. Ideally, you stick
 with the many available examples in the yaml files.
 
 Example:
-```
-  synapse:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Element"
-    # upstreamRegistry: "https://registry-1.docker.io"
-    # upstreamRepository: "matrixdotorg/synapse"
-    # upstreamMirrorTagFilterRegEx: '^v(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["1", "91", "2"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse"
-    tag: "v1.91.2@sha256:1d19508db417bb2b911c8e086bd3dc3b719ee75c6f6194d58af59b4c32b11322"
+```yaml
+ synapse:
+ # providerCategory: "Supplier"
+ # providerResponsible: "Element"
+ # upstreamRegistry: "https://registry-1.docker.io"
+ # upstreamRepository: "matrixdotorg/synapse"
+ # upstreamMirrorTagFilterRegEx: '^v(\d+)\.(\d+)\.(\d+)$'
+ # upstreamMirrorStartFrom: ["1", "91", "2"]
+ registry: "registry.opencode.de"
+ repository: "BMI/opendesk/components/supplier/element/images-mirror/synapse"
+ tag: "v1.91.2@sha256:1d19508db417bb2b911c8e086bd3dc3b719ee75c6f6194d58af59b4c32b11322"
 ```
 
 ### Disable linting selectively
 
-If you follow the "push early, push often" paradigm to save your work to the central Git instance or you just fix a typo in the text
-of an existing documentation you might want to avoid the CI with its linting to be executed, as it might not offer additional value.
+If you follow the "push early, push often" paradigm to save your work to the central Git instance, or you just fix a typo in
+existing documentation, you can avoid the CI and its linting being executed, as it might not offer additional value.
 
 GitLab offers two options to skip the CI on a commit/push:
 - Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
@@ -124,40 +125,42 @@ Uses a regular expression to match the values of the following attributes:
 - `# upstreamRepository` *required*
 - `tag` *required*
 
-Checks for newer versions of the given artefact and creates a MR containing the newest version's tag (and digest).
+Checks for newer versions of the given artifact and creates an MR containing the newest version's tag (and digest).
 
 ## Mirroring
 
 - See also: https://gitlab.opencode.de/bmi/opendesk/tooling/oci-pull-mirror
 
-**Note:** The mirror is scheduled to run every hour at 42 minutes past the hour.
+> **Note:**<br>
+> The mirror is scheduled to run every hour at 42 minutes past the hour.
 
-openDesk strives to make all relevant artifacts available on Open CoDE so there is the mirroring process
+openDesk strives to make all relevant artifacts available on Open CoDE so there is a mirroring process
 configured to pull artifacts that do not originate from Open CoDE into projects called `*-Mirror` within the
 [openDesk Components section](https://gitlab.opencode.de/bmi/opendesk/components).
 
 The mirror script takes the information on what artifacts to mirror from the annotation inside the two yaml files:
 - `# upstreamRegistry` *required*: To identify the source registry
+- `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public, the access credentials have to be specified as ENV variables containing the value of this key in their name, so you want to specify that key all uppercase:
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORD`
 - `# upstreamRepository` *required*: To identify the source repository
-- `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set it activates the mirror for the component. Only tags are being mirrored that match the given regular expression. **Note:** You have to use single quotes for this attribute's value in case you use backslash leading regex notation like `\d`.
-- `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing groups
-  in `# upstreamMirrorTagFilterRegEx` to identify the single numeric elements of the version within the tag and use per capturing group (left to right) one numeric array
-  element here to define the version the mirror should start with.
+- `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set, the mirror for the component will be activated. Only tags that match the given regular expression are being mirrored. **Note:** You must use single quotes for this attribute's value if you use backslash leading regex notation like `\d`.
+- `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing group
+ in `# upstreamMirrorTagFilterRegEx` to identify the single numeric elements of the version within the tag and use per capturing group (left to right) one numeric array
+ element here to define the version the mirror should start with.
 
 ### Get new artifacts mirrored
 
-If you want new images or charts to be mirrored that are not yet included in one of the yaml files there are two options:
+If you want new images or charts mirrored that are not yet included in one of the yaml files, you can add them in your branch, including the aforementioned mirror annotations, and ask somebody from the platform development team to trigger the mirror's CI based on your branch.
 
-You include them in your branch with all required annotations and either
-1. ask somebody from the platform development team to trigger the mirror's CI based on your branch or
-2. you get your branch merged to `develop` already.
+Once your branch is merged into develop, your artifacts are mirrored hourly.
 
-# Creating new charts / images
+# Creating new charts/images
 
-When you create new Helm charts please check out the
+When you create new Helm charts, please check out the
 [openDesk Best Practices](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-best-practises)
 for Helm charts.
 
 You may also want to make use of our [standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) to
-easily get Charts and Images that are signed, linted, scanned and released.
+quickly get Helm charts and container images that are signed, linted, scanned, and released.
 Check out the `.gitlab-ci.yaml` files in the project's [Charts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts) or [Images](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images) to get an idea how little you need to do yourself.

docs/enhanced-configuration.md

@@ -9,6 +9,9 @@ SPDX-License-Identifier: Apache-2.0
 
 The following enhanced configuration use cases are described in separate documents.
 
-- [Separate mail & Matrix domain](enhanced-configuration/separate-mail-matrix-domain.md)
-- [Federation with external identity provider](enhanced-configuration/idp-federation.md)
-- [Matrix federation](enhanced-configuration/matrix-federation.md)
+- [Separate mail & Matrix domain](./enhanced-configuration/separate-mail-matrix-domain.md)
+- [Federation with external identity provider](./enhanced-configuration/idp-federation.md)
+- [Matrix federation](./enhanced-configuration/matrix-federation.md)
+- [Groupware migration from M365 to openDesk](./enhanced-configuration/groupware-migration.md)
+- [Self-signed certificate and custom Certificate Authority (CA)](./enhanced-configuration/self-signed-certificates.md)
+- [GitOps deployments using Argo CD](./enhanced-configuration/gitops.md)

docs/enhanced-configuration/gitops.md

@@ -0,0 +1,60 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>GitOps Deployment</h1>
+
+<!-- TOC -->
+* [Considerations](#considerations)
+* [ArgoCD](#argocd)
+  * [Option 1: Use YAML manifests](#option-1-use-yaml-manifests)
+  * [Option 2: Helmfile plugin](#option-2-helmfile-plugin)
+<!-- TOC -->
+
+The recommended deployment method for openDesk is via Helmfile. This can be done "by hand", via CI/CD (Gitlab) or using
+the [GitOps](https://about.gitlab.com/topics/gitops/) approach with tools like [Argo CD](https://argoproj.github.io/cd/).
+
+This documentation will use Argo CD to explain how to deploy openDesk GitOps-style.
+
+# Considerations
+
+- openDesk consists of multiple applications which have to be deployed in order.
+- During upgrades, migrations have to run before and after applications.
+
+# ArgoCD
+
+We are continuously improving our Argo CD support, please share you experience with Argo CD deployments e.g. by [creating
+at ticket](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues).
+
+There are two options to deploy openDesk via Argo CD described in the following sections.
+
+## Option 1: Use YAML manifests
+
+This option requires a preprocessing step before using Argo CD. This step requires you to compile the Helmfile based
+deployment into Kubernetes YAML manifest, to do so you need to execute the helmfile binary:
+
+```shell
+helmfile template > opendesk.yaml
+```
+
+References:
+- [Helmfile CLI documentation](https://helmfile.readthedocs.io/en/latest/#cli-reference)
+- [Generate K8s YAML Manifests for openDesk](https://gitlab.opencode.de/bmi/opendesk/deployment/options/generate-k8s-yaml-manifests)
+
+Afterwards, you can use the resulting manifests within an standard Argo CD workflow.
+
+> **Note**<br>
+> When creating the Argo CD application based on the resulting manifests you must not use the `Automated Sync Policy`
+> offered by Argo CD, as you have to manually ensure the applications are updated in the required sequence.
+
+## Option 2: Helmfile plugin
+
+It is possible to deploy openDesk via Argo CD with community developed
+[Helmfile plugin](https://github.com/travisghansen/argo-cd-helmfile).
+
+You can find an example for this approach in the
+[Argo CD Deployments](https://gitlab.opencode.de/bmi/opendesk/deployment/options/argocd-deploy) repository.
+It contains an example Helm chart (`opendesk-parent`) to create Argo CD Applications via a Helm chart (`opendesk`)
+according to `app of apps pattern` and is using sync waves to ensure to required deployment and update sequence
+for openDesk is met.

docs/enhanced-configuration/groupware-migration.md

@@ -0,0 +1,184 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Migration from M365 with audriga migration service and master authentication</h1>
+
+<!-- TOC -->
+* [Prerequisites](#prerequisites)
+  * [Prepare M365 tenant for access](#prepare-m365-tenant-for-access)
+  * [Provisioning user accounts in openDesk](#provisioning-user-accounts-in-opendesk)
+  * [Deploy openDesk with master authentication](#deploy-opendesk-with-master-authentication)
+* [Migration configuration](#migration-configuration)
+  * [Select the source provider and configure your openDesk instance](#select-the-source-provider-and-configure-your-opendesk-instance)
+  * [Adding accounts](#adding-accounts)
+    * [Add user accounts individually](#add-user-accounts-individually)
+    * [Add multiple user accounts via CSV file](#add-multiple-user-accounts-via-csv-file)
+  * [Start the migration](#start-the-migration)
+  * [Monitor migration status](#monitor-migration-status)
+<!-- TOC -->
+
+Most organizations already have email accounts on various platforms that need to be migrated to openDesk. This document describes the migration from M365 accounts to openDesk using the [audriga Migration Service](https://www.audriga.com) in combination with the master authentication option in openDesk. Other source platforms are also supported, and their migrations work in a similar manner.
+
+The migration can be configured on audriga's self-service website, accessed with most common web browsers (e.g. IE, Firefox, Safari or Chrome). No software needs to be installed on your machine. The service connects to your mailbox similarly to what your email client does. Emails, attachments, folders, and, depending on the source systems, contacts, tasks, notes, and calendar data are being copied to your destination account. See [M365 to OX Migration Guide](https://audriga.com/fileadmin/guides/en/MS365-OX.pdf) for the scope and limitations of the process.
+
+The data in the source mailbox will not be deleted or altered. To configure a migration, only three simple steps in audriga's self-service portal have to be completed. After the migration has started, its status can be continuously monitored on the website.
+
+It may not be possible to complete especially large or complex migrations with only this guide. If you identify issues related to I/O, bandwidth, timeline constraints, or anything else that makes the migration more complicated than you feel comfortable handling on your own using the self-service, please get in touch with contact [audriga's support](mailto:support@audriga.com).
+
+# Prerequisites
+
+## Prepare M365 tenant for access
+
+The following instructions provide information on how to authenticate Microsoft 365 / Exchange Online accounts in the audriga migration service with "modern authentication" using a service account without the need to provide a username and password for each mailbox that will be migrated.
+
+You will have to select an existing user account that will be used as a service account for the migration. You have to register the audriga application and create an M365 email group known only to you as described in the following steps:
+
+***1. Select one account to serve as a service account***
+
+Please note that the account that shall serve as the service account requires a Microsoft 365/Exchange online license (mailbox).
+
+> **Notes**<br>
+> If you want to designate your admin account as a service account, you have to provide the admin with a license.
+
+***2. Register the audriga app in your tenant***
+
+To register the audriga app in your tenant, log into your admin account and access the following URL:
+
+ https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=3cd27a72-a19e-4945-9715-fc24d940428f&redirect_uri=https://umzug.audriga.com/SMESwitchWebApp/oauth_complete.jsp&scope=https://outlook.office.com/.default
+
+- Accept the App "audriga CloudMovr migration"
+- You will be redirected to an audriga page, which you can close without requiring additional interaction.
+
+> **Note**<br>
+> The audriga application is created under the "Enterprise application" tab in the AzureAD console.
+
+***3. Create a "secret" group in the M365 tenant***
+
+Create a "secret" group in the customer tenant.
+
+- Go to <https://aad.portal.azure.com> > Azure Active Directory > Groups > New Group
+- Choose a group name and group email address that includes the word "audriga" in lowercase ("Audriga" will not work), like *audriga-migration@your-maildomain.tld*
+- Choose the group type "Microsoft 365"
+- Appoint your service account (see 1.) as the owner of this group
+
+
+## Provisioning user accounts in openDesk
+
+In openDesk, you have to have all user accounts with mailboxes pre-defined before running the migration. You can either manually create your accounts using an IAM administrator or use the [user import tool](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) to batch import user accounts to your openDesk deployment.
+
+## Deploy openDesk with master authentication
+
+With openDesk 1.0 Enterprise, you can set openDesk's email components (OX AppSuite and OX Dovecot) into master authentication mode to run the migration as described in this document using the following two settings for your deployment:
+
+```
+secrets:
+  oxAppSuite:
+    adminPassword: "your_temporary_master_password"
+functional:
+  migration:
+    oxAppSuite:
+      enabled: true
+```
+
+1. You must specify the master password referenced in the document's following sections.
+2. You need to enable the actual master authentication mode.
+
+Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppSuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppSuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
+
+> **Note**<br>
+> For the changes to take effect, it is sufficient to deploy the `open-xchange` component.
+
+> **Note**<br>
+> While in master authentication mode, regular users cannot log in to the webmail module of openDesk or access the mail using IMAP, as it is not recommended that users interact with the target mail infrastructure during the migration scenario described in this document.
+
+# Migration configuration
+
+The migration is configured in 3 steps using the [audriga migration self-service](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware).
+
+Ensure you meet the prerequisites. For example, this document does not support using the standard username/password-based authentication option for M365.
+
+## Select the source provider and configure your openDesk instance
+
+Choose [Microsoft 365 / Exchange Online (Admin)](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware#src=onmicrosoft.com) as your current provider.
+
+> **Note**<br>
+> You may need to start typing in "Microsoft Office 365/Exchange Online" for it to appear in the list.
+
+Configure openDesk as your destination server:
+- Select "Configure provider or server" in the provider selection box of the migration application.
+- In the following dialog, select "Open-Xchange" as protocol.
+- On the tab "IMAP"
+  - For "Mailserver (host name or IP address)" enter your IMAP host, e.g. "webmail.your-opendesk-domain.tld".
+  - If your IMAP server is not running on default port 993, enter your nonstandard IMAP port under Details -> Port.
+  - Press check.
+- On the tab "Open-Xchange"
+  - Set the hostname of your OX AppSuite installation, e.g. "webmail.your-opendesk-domain.tld".
+  - Press check.
+- If you receive a green checkmark on both tabs, click "Save". Otherwise, check your settings until you get the green checkmark.
+
+## Adding accounts
+
+You can add accounts one by one, which seems only feasible for test scenarios, or when you migrate a handful of mailboxes, or you can add accounts using CSV upload. Both options are described in the following subsections.
+
+### Add user accounts individually
+
+By default, you will enter the "Add Mailbox" tab where you can add individual accounts for M365:
+
+```
+Username:             enter the username of the service account, e.g. eva@your-maildomain.tld
+Password:             enter the particular group email address, e.g. audriga-migration@your-maildomain.tld
+Details -> mailbox:   enter the user's mailbox you want to migrate, e.g. pia@your-maildomain.tld
+```
+
+On the openDesk site, please provide:
+```
+Username:             enter the username of the mailbox you want to migrate to, e.g. pia@your-maildomain.tld
+Password:             enter the master password
+```
+
+Click on check to verify the credentials. If the data is correct, a green checkmark will appear. A red cross will be displayed if the credentials need to be corrected.
+
+After checking and confirming, you can use the same procedure to add further mailboxes.
+
+Alternatively, you can add multiple accounts via CSV upload. Find information in the following.
+
+### Add multiple user accounts via CSV file
+
+Prepare a CSV file with all necessary information. Unsurprisingly, this is the same information as described in the "Add User Accounts Individually" section above.
+
+The CSV requires the following column order with a closing semicolon after the last value - but no headline is expected; the first line must be your migration data already:
+```
+M365ServiceAccount;M365GroupEmailAddress;M365Mailbox;openDeskMailbox;openDeskMasterPassword;
+```
+
+Example CSV:
+```
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;eva@your-maildomain.tld;eva;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;max@your-maildomain.tld;max;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;pia@your-maildomain.tld;pia;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;ida@your-maildomain.tld;ida;YourMasterPassword;
+```
+
+Select the "Add multiple accounts" tab to configure up to 50 user accounts by uploading a CSV file. If you need to migrate more accounts, you can execute the migration multiple times.
+
+Click "Check" and save afterwards.
+
+## Start the migration
+
+You will see a summary of the migration, including the number of accounts and the amount of data. Even if the analysis of the source accounts has not yet been completed, you can proceed.
+
+Ensure you have a valid voucher; otherwise, you must complete the payment process.
+
+Press "Start Migration" to proceed.
+
+## Monitor migration status
+
+The migration process may take some time to start. For large amounts of data, it may take a couple of hours.
+
+Click on "Details" to get further information about the migration.
+
+You can access a detailed log for each account by clicking "Protocol" on the right-hand side. Here, you can see detected duplicates or encountered errors (e.g., if emails cannot be transferred due to your provider's size limitations).
+
+You will receive status emails for the migration job's submission and start, as well as when the migration job is finished. The emails are sent to the email address you have entered during the configuration. Those emails include a link to the status website so you can easily track and monitor your migration. Once the migration has been started, you can safely close the status website and shut down your computer; the migration will continue. You can re-open the status website anytime.

docs/enhanced-configuration/idp-federation.md

@@ -5,7 +5,8 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Federation with external identity provider (IdP)</h1>
 
-* [Context](#context)
+<!-- TOC -->
+* [References](#references)
 * [Prerequisites](#prerequisites)
   * [User accounts](#user-accounts)
   * [External IdP with OIDC](#external-idp-with-oidc)
@@ -17,112 +18,118 @@ SPDX-License-Identifier: Apache-2.0
     * [Separate realm](#separate-realm)
     * [OIDC Client](#oidc-client)
   * [openDesk IdP](#opendesk-idp)
+<!-- TOC -->
 
-# Context
+Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on to internal or external web applications.
 
-Most organizations already have an Identity and Access Management (IAM) of their own that includes an identity provider (IdP) for single-sign-on to internal or external web applications.
+This document shows how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk single sign-on based on your organization's login.
 
-This document shows how to configure your organizations IdP as well as the openDesk IdP to allow account federation to support single-sign-on to openDesk based on your organization's login.
+# References
+
+We would like to list successful IdP federation scenarios, so we are also happy about input from the community:
+
+| External IdP                                                        | last openDesk version tested |
+| ------------------------------------------------------------------- | ---------------------------- |
+| [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0                       |
+| [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                       |
 
 # Prerequisites
 
 ## User accounts
 
-Beside the configuration it is required that the user accounts with the same name exist within openDesk. This prerequisite is outside the scope of this document.
-
-We will provide additional documents regarding user provisioning in the future, so here's just an overview regarding potential scenarios:
+In addition to the configuration, it is required that user accounts with the same name exist within openDesk. While this prerequisite is outside the scope of this document, the following approaches are feasible:
 
 - Manual user management
-  - That is a lightweight way for testing your IdP federation setup or in case you just have a small amount of users to manage.
-  - Just create and maintain you user(s) in openDesk and ensure the username in your IAM and openDesk is identical.
+  - A lightweight option to test your IdP federation setup or if you have only a small number of users to manage.
+  - Create and maintain your user(s) in openDesk and ensure the username in your IAM and openDesk is identical.
 - User import
-  - If you need to create more than just a couple of test accounts you can use the [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/tooling/user-import) that utilizes the UDM REST API for user account creation.
+  - If you need to create more than just a couple of test accounts, you can use the [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) that utilizes the UDM REST API for user account creation.
   - Downsides: Managing groups and deleting accounts needs to be done manually.
 - Automated Pre-provisioning:
-  - Pre-provisioning users and groups including de-provisioning (deleting) accounts is the best practice as it ensures that openDesk is in sync with your organization's IAM.
+  - Pre-provisioning users and groups, including de-provisioning (deleting) accounts, is the best practice to ensure that openDesk is in sync with your organization's IAM.
   - There are at least two ways of implementing the pre-provisioning:
   - UDM REST API:
-    - Build a provisioning solution by yourself using the [UDM REST API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html).
-    - The API gives you full control over the contents of the IAM in order to create, update or delete users and groups.
+    - Build a provisioning solution using the [UDM REST API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html).
+    - The API gives you complete control over the contents of the IAM to create, update, or delete users and groups.
   - Nubus Directory Importer:
     - It is based on a Python one-way directory synchronization for users and groups.
     - Please find more details in the [upstream product's documentation](https://docs.software-univention.de/nubus-kubernetes-operation/latest/en/howto-connect-external-iam.html).
 - Ad-hoc provisioning (AHP)
-  - This feature is currently not available in the openDesk Keycloak, but there are plans by the Supplier Univention to make it available.
-  - Ad-hoc provisioning creates an user account on the fly during a users first login.
-  - While AHP this is a nice approach for a quick start with openDesk it has various downsides:
-    - Users are just created after their first login, so you cannot find your colleagues in the openDesk apps unless they already logged in.
+  - This feature is currently unavailable in openDesk's Keycloak, but Univention plans to make it available in the future.
+  - Ad-hoc provisioning creates a user account on the fly during a user's first login.
+  - While ad-hoc provisioning is an excellent approach for a quick start with openDesk, it has various downsides:
+    - Users are created after their first login, so you cannot find your colleagues in the openDesk apps unless they have already logged in.
     - A user account would never be deactivated or deleted in openDesk.
     - Group memberships are not transferred.
 
 ## External IdP with OIDC
 
-This document focusses on the OIDC federation between an external IdP and the openDesk IdP. It makes use of the OpenID Connect (OIDC) protocol, so your external IdP must support OIDC.
+This document focuses on the OIDC federation between an external IdP and the openDesk IdP. It uses the OpenID Connect (OIDC) protocol, so your external IdP must support OIDC.
 
 # Example configuration
 
 ## Versions
 
-The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3, as external IdP we also used an openDesk deployment of the same version but created a separate realm for proper separation of the configuration.
+The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3. As external IdP, we also used an openDesk deployment of the same version but created a separate realm for proper configuration separation.
 
 ## Example values
 
-The following values are used in this example documentation. Please ensure when you come across such a value even if it is part of a URL hostname or path that you adapt it where needed to your setup:
+The following values are used in this example documentation. Please ensure when you come across such a value, even if it is part of a URL hostname or path, that you adapt it where needed to your setup:
 
-- `idp.organization.tld`: hostname for your organization's IdP
-- `id.opendesk.tld`: hostname for the openDesk IdP, so openDesk is obviously deployed at `opendesk.tld`
-- `fed-test-idp-realm`: realm name for your organizations IdP
-- `opendesk-federation-client`: OIDC client for the openDesk federation that is defined in your organizations IdP
-- `auto-federate-idp`: Identifier of your organizations IdP's configuration within the openDesk Keycloak.
+- `idp.organization.tld`: hostname for your organization's IdP.
+- `id.opendesk.tld`: hostname for the openDesk IdP, so openDesk is deployed at `opendesk.tld`.
+- `fed-test-idp-realm`: realm name for your organization's IdP.
+- `opendesk-federation-client`: OIDC client for the openDesk federation defined in your organization's IdP.
+- `auto-federate-idp`: Identifier of your organization IdP's configuration within the openDesk Keycloak.
 - `auto-federate-flow`: Identifier of the required additional login flow to be created and referenced in the openDesk Keycloak.
 
 ## Keycloak admin console access
 
-To access the admin console of Keycloak in an openDesk deployment you need to add a route for `/admin` to the Keycloak's ingress. This is done automatically if you deploy openDesk with `debug.enabled: true` but beware that this will also cause a lot of log output across all openDesk pods.
+To access Keycloak's admin console in an openDesk deployment, you must add a route for `/admin` to the Keycloak's ingress. This is done automatically if you deploy openDesk with `debug.enabled: true`, but beware that this will also cause a lot of log output across all openDesk pods.
 
 The admin console will be available at:
 - Organization's IdP: https://idp.organization.tld/admin/master/console/
 - openDesk IdP: https://id.opendesk.tld/admin/master/console/
 
-For the following configuration steps login with user `kcadmin` and grab the password from the `ums-keycloak` pod's `KEYCLOAK_ADMIN_PASSWORD` variable.
+For the following configuration steps, log in with user `kcadmin` and grab the password from the `ums-keycloak` pod's `KEYCLOAK_ADMIN_PASSWORD` variable.
 
 ## Your organizations IdP
 
-As we use the Keycloak of another openDesk instance to simulate your organization's IdP in this example, especially URL paths within the Keycloak might differ if you use different products.
+In this example, we use the Keycloak of another openDesk instance to simulate your organization's IdP. However, URL paths differ if you use another product.
 
 Please let us know about your experiences or differences you came across.
 
 ### Separate realm
 
-To not interfere with an existing configuration for our test scenario we create a separate realm:
+To not interfere with an existing configuration for our test scenario, we create a separate realm:
 
-- `Create realm` (from realm selection drop down menu in the left upper corner)
+- `Create realm` (from the realm selection drop-down menu in the left upper corner)
 - *Realm name*: `fed-test-idp-realm`
 - `Create`
 
 ### OIDC Client
 
-If you just created the `fed-test-idp-realm` your are already in the admin screen for the realm, if not use the realm selection drop down menu in the left upper corner to switch to the realm.
+If you just created the `fed-test-idp-realm`, you are already in the admin screen for the realm; if not, use the realm selection drop-down menu in the upper left corner to switch to the realm.
 
 - *Clients* > *Create Client*
   - Client create wizard page 1:
     - *Client type*: `OpenID Connect`
     - *Client-ID*: `opendesk-federation-client`
-    - *Name*: `openDesk @ your organization` (is the descriptive text of the client that might show up in you IdP's UI and therefore should explain what the client is used for)
+    - *Name*: `openDesk @ your organization` (is the descriptive text of the client that might show up in your IdP's UI and therefore should explain what the client is used for)
   - Client create wizard page 2:
     - *Client authentication*: `On`
     - *Authorization*: `Off` (default)
     - *Authentication flow*: leave defaults
-	    - `Standard flow`
-	    - `Direct access grants`
+      - `Standard flow`
+      - `Direct access grants`
   - Client create wizard page 3:
     - *Valid Redirect URLs*: `https://id.opendesk.tld/realms/opendesk/broker/auto-federate-idp/endpoint`
-  - When completed with *Save* you get to the detailed client configured that also needs some updates:
+  - When completed with *Save*, you get to the detailed client configured that also needs some updates:
     - Tab *Settings* > Section *Logout settings*
       - *Front channel logout*: `Off`
       - *Back channel logout URL*: `https://id.opendesk.tld/realms/opendesk/protocol/openid-connect/logout/backchannel-logout`
     - Tab *Credentials*
-      - Copy the *Client Secret* as we need it for the configuration of the openDesk IdP to be used in the openDesk IdP, as well as the *Client-ID*.
+      - Copy the *Client Secret* and the *Client-ID* as we need them to configure the openDesk IdP.
 
 ## openDesk IdP
 
@@ -137,20 +144,19 @@ The following configuration is taking place in the Keycloak realm `opendesk`.
 
 - *Identity providers* > *User-defined* > *OpenID Connect 1.0*
   - *Alias*: `auto-federate-idp` (used in our example)
-  - *Display Name*: Descriptive Name in case you do not forcefully redirect the user to the IdP that name is shown in the login screen for manual selection.
+  - *Display Name*: A descriptive Name, in case you do not forcefully redirect the user to the IdP, that name is shown on the login screen for manual selection.
   - *Use discovery endpoint*: `On` (default)
   - *Discovery endpoint*: `https://idp.organization.tld/realms/fed-test-idp-realm/.well-known/openid-configuration` - this URL may look different if you do not use Keycloak or a different Keycloak version as IdP in your organization
-    - In case the IdP metadata could not be auto-discovered you will get an error.
-    - If everything is fine you can review the discovered metadata for your IdP by clicking on *Show metadata*.
+    - You will get an error if the IdP metadata cannot be auto-discovered.
+    - If everything is fine, you can review the discovered metadata for your IdP by clicking on *Show metadata*.
   - *Client authentication*: `Client secret sent as post` (default)
-  - *Client ID*: Use the client ID you took form your organization's IdP config (`opendesk-federation-client` in this example)
-  - *Client Secret*: Use the secret you took form your organization's IdP config
-  - When completed with *Add* you get to the detailed IdP configured that also needs some updates (you may need to open the *Advanced* section to access some settings)
-    - *Back-channel logout*: `On`
-    - *Disable user info*: `On`
+  - *Client ID*: Use the client ID you took from your organization's IdP config (`opendesk-federation-client` in this example)
+  - *Client Secret*: Use the secret you took from your organization's IdP config
+  - When completed with *Add*, you get to the detailed IdP configuration that at least needs some the following update:
     - *First login flow override*: `auto-federate-flow`
+    - Depending on your organizations IdP and process preferences additional setting may be required
 
-- In case you want to forcefully redirect all users to your organizations IdP (disabling login with local openDesk accounts):
+- In case you want to forcefully redirect all users to your organization's IdP (disabling login with local openDesk accounts):
   - *Authentication* > `2fa-browser`
     - Click on the cogwheel next to the *Identity Provider Re-director*
       - *Alias*: `auto-federate-idp`

docs/enhanced-configuration/matrix-federation.md

@@ -6,20 +6,18 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Matrix federation</h1>
 
 <!-- TOC -->
-* [Use case](#use-case)
+* [Context](#context)
 * [Example configuration](#example-configuration)
   * [Disable federation](#disable-federation)
   * [Separate Matrix domain](#separate-matrix-domain)
 <!-- TOC -->
 
-# Use case
-
 The Element chat application and its server component Synapse are based on the Matrix protocol,
 that supports federation with other Matrix servers to communicate with the users with accounts on these servers.
 
-By default, you can chat with users that have an account within your openDesk installation and federate with other
+By default, you can chat with users who have an account within your openDesk installation and federate with other
 matrix-based servers.
-Federation support can be disabled.
+Federation support can be turned off.
 
 # Example configuration
 
@@ -28,36 +26,35 @@ Please ensure when you come across such a value,
 even if it is part of a URL hostname or path, that you adapt it where needed to your setup:
 
 - `opendesk.domain.tld`: the mandatory `DOMAIN` setting for your deployment resulting in
-`https://chat.opendesk.domain.tld` to access the Element chat.
+`https://chat.opendesk.domain.tld` for access to the Element chat.
 - `my_organization.tld`: an optional alternative domain used for mail and/or Matrix.
-If not used it is also set to `opendesk.domain.tld`.
+It is also set to `opendesk.domain.tld` if not used.
 
 ## Disable federation
 
-The following setting can disable federation:
+The following setting can turn off federation:
 
 ```yaml
 functional:
-  externalServices:
-    matrix:
-      federation:
-        enabled: false
+  externalServices:
+    matrix:
+      federation:
+        enabled: false
 ```
 
 ## Separate Matrix domain
 
 If you want to federate with other Matrix instances and use a separate Matrix domain, you need to provide a JSON file on
-the Matrix domain to use delegation.
-This is not included inside openDesk.
+the Matrix domain to use delegation. It is not part of your openDesk deployment.
 
 Domain path: `https://my_organization.tld/.well-known/matrix/server`
 
 Content:
 ```JSON
 {
-    "m.server": "matrix-federation.opendesk.domain.tld:443"
+    "m.server": "matrix-federation.opendesk.domain.tld:443"
 }
 ```
 
 More detailed information can be found in Matrix/Synapse documentation:
-[Matrix Delegation](https://matrix-org.github.io/synapse/v1.98/delegate.html)
+[Matrix Delegation](https://element-hq.github.io/synapse/latest/delegate.html)

docs/enhanced-configuration/self-signed-certificates.md

@@ -0,0 +1,109 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Self-signed certificate and custom Certificate Authority (CA)</h1>
+
+<!-- TOC -->
+* [Configuration](#configuration)
+  * [Option 1: Bring Your Own Certificate](#option-1-bring-your-own-certificate)
+  * [Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate](#option-2a-use-cert-managerio-with-auto-generated-namespace-based-root-certificate)
+  * [Option 2b: Use cert-manager.io with pre-defined/shared root-certificate](#option-2b-use-cert-managerio-with-pre-definedshared-root-certificate)
+<!-- TOC -->
+
+Deploying openDesk into an environment with custom public key infrastructure (PKI) that is usually not part of
+public certificate authority chains or deploying openDesk into a local cluster without ACME challenge.
+
+# Configuration
+
+There are two options to address the use case.
+
+## Option 1: Bring Your Own Certificate
+
+This option is useful, when you have your own PKI in your environment which is trusted by all clients that should
+access openDesk.
+
+1. Disable cert-manager.io certificate resource creation:
+
+    ```yaml
+    certificates:
+      enabled: false
+    ```
+
+1. Enable mount of self-signed certificates:
+
+    ```yaml
+    certificate:
+      selfSigned: true
+    ```
+
+1. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
+wildcard certificate or a certificate with [all required subdomains](../../helmfile/environments/default/global.yaml.gotmpl)
+set as SANs (Subject Alternative Name).
+
+1. Create a Kubernetes secret with name `opendesk-certificates-ca-tls` of type `kubernetes.io/tls` containing the custom
+CA certificate as X.509 encoded (`ca.crt`) and as jks trust store (`truststore.jks`).
+
+1. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
+trust store password.
+
+## Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate
+
+This option is useful, when you do not have a trusted certificate available and can't fetch a certificate from
+Let’s Encrypt. It will result in a cert-manager managed root certificate in the namespace you deploy openDesk into.
+
+1. Create self-signed cert-manager.io Cluster Issuer:
+    ```yaml
+    apiVersion: "cert-manager.io/v1"
+    kind: "ClusterIssuer"
+    metadata:
+      name: "selfsigned-issuer"
+    spec:
+      selfSigned: {}
+    ```
+
+1. Enable mount and creation of self-signed certificates:
+    ```yaml
+    certificate:
+      issuerRef:
+        name: "selfsigned-issuer"
+      selfSigned: true
+    ```
+
+## Option 2b: Use cert-manager.io with pre-defined/shared root-certificate
+
+Use this approach if you like to use a pre-created CA root certificate that can be "shared" (as copy) between
+multiple namespaces in a cluster.
+
+1. Create self-signed cert-manager.io Cluster Issuer root certificate the same was as in *Option 2a*.
+
+1. Create the root certificate for the previously created CA, in the example it is placed into the namespace `cert-manager`.
+    ```yaml
+    apiVersion: cert-manager.io/v1
+    kind: Certificate
+    metadata:
+      name: opendesk-root
+      namespace: cert-manager
+    spec:
+      isCA: true
+      commonName: opendesk.eu
+      secretName: opendesk-root-cert-secret
+      subject:
+        organizations: [ "openDesk cluster root certificate organization" ]
+      privateKey:
+        algorithm: ECDSA
+        size: 256
+      issuerRef:
+        name: selfsigned-issuer
+        kind: ClusterIssuer
+        group: cert-manager.io
+      duration: 87600h # 10y
+      renewBefore: 87599h
+    ```
+
+1. Copy this cert's secret into the/each namespace you want to make use of the cert.
+
+1. Create issuer in the/each namespace you want to make use of the cert.
+
+The latter two steps are part of the `env-start:` section within [`.gitlab-ci.yml`](../../.gitlab-ci.yml).

docs/enhanced-configuration/separate-mail-matrix-domain.md

@@ -3,9 +3,10 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 -->
 
-<h1>Separate domains for mail and or matrix</h1>
+<h1>Separate domains for mail and or Matrix </h1>
 
-* [Use case](#use-case)
+<!-- TOC -->
+* [Context](#context)
 * [Example configuration](#example-configuration)
   * [Mail domain](#mail-domain)
   * [Matrix domain](#matrix-domain)
@@ -13,25 +14,24 @@ SPDX-License-Identifier: Apache-2.0
     * [Webserver](#webserver)
       * [Content Security Policy](#content-security-policy)
       * [.well-known](#well-known)
+<!-- TOC -->
 
-# Use case
-
-As communication over mail and chat can go beyond the borders of your openDesk installation you may want to use different domains for the mail and/or matrix.
+As communication over mail and chat can go beyond the borders of your openDesk installation, you may want to use different domains for the mail and/or Matrix.
 
 # Example configuration
 
-The following values are used in this example documentation. Please ensure when you come across such a value even if it is part of a URL hostname or path that you adapt it where needed to your setup:
+The following values are used in this example documentation. Please ensure when you come across such a value, even if it is part of a URL hostname or path, that you adapt it where needed to your setup:
 
 - `opendesk.domain.tld`: the mandatory `DOMAIN` setting for your deployment resulting in `https://mail.opendesk.domain.tld` to access emails and `https://chat.opendesk.domain.tld` to access the Element chat that is based on the Matrix protocol.
 - `my_organization.tld`: the alternative domain used for mail and/or Matrix.
 
 ## Mail domain
 
-By default all email addresses in openDesk are created based on the `DOMAIN` you specified for your deployment. In our example resulting in the users having `<username>@opendesk.domain.tld` as mail addresses. In case you prefer the users to send and receive emails with another domain you can set that one using the optional `MAIL_DOMAIN` in the deployment:
+By default, all email addresses in openDesk are created based on the `DOMAIN` you specified for your deployment. In our example, the users have `<username>@opendesk.domain.tld` as their mail addresses. In case you prefer the users to send and receive emails with another domain, you can set that one using the optional `MAIL_DOMAIN` in the deployment:
 
 ```yaml
 global:
-  mailDomain: "my_organization.tld"
+  mailDomain: "my_organization.tld"
 ```
 
 or via environment variable
@@ -40,21 +40,21 @@ or via environment variable
 export MAIL_DOMAIN=my_organization.tld
 ```
 
-This of course requires the MX record for the domain to point to the mail host for your openDesk deployment. Optionally add the SPF and DMARC records.
+Of course, this requires the domain's MX record to point to the mail host for your openDesk deployment. You can optionally add the SPF and DMARC records.
 
-| Record name                | Type | Value                                            |
+| Record name                | Type | Value                                            |
 | -------------------------- | ---- | ------------------------------------------------ |
-| my_organization.tld        | MX   | `10 mail.opendesk.domain.tld`                    |
-| my_organization.tld        | TXT  | `v=spf1 +a +mx +a:mail.opendesk.domain.tld ~all` |
-| _dmarc.my_organization.tld | TXT  | `v=DMARC1; p=quarantine`                         |
+| my_organization.tld        | MX   | `10 mail.opendesk.domain.tld` |
+| my_organization.tld        | TXT  | `v=spf1 +a +mx +a:mail.opendesk.domain.tld ~all` |
+| _dmarc.my_organization.tld | TXT  | `v=DMARC1; p=quarantine` |
 
 ## Matrix domain
 
-Similar to the specific domain for email addresses you may want to specify a domain that differs from your deployment's default `DOMAIN` to define your users Matrix IDs. Use the `MATRIX_DOMAIN` to do so:
+Similar to the specific domain for email addresses, you may want to specify a domain that differs from your deployment's default `DOMAIN` to define your user's Matrix IDs. Use the `MATRIX_DOMAIN` to do so:
 
 ```yaml
 global:
-  matrixDomain: "my_organization.tld"
+  matrixDomain: "my_organization.tld"
 ```
 
 or via environment variable
@@ -67,17 +67,17 @@ export MATRIX_DOMAIN=my_organization.tld
 
 The following changes apply to the standard DNS:
 
-| Record name                      | Type | Value                                  | Comment                                                                            |
-| -------------------------------- | ---- | -------------------------------------- | ---------------------------------------------------------------------------------- |
-| _matrix._tcp.my_organization.tld | SRV  | `1 10 PORT matrix.opendesk.domain.tld` | `PORT` is your NodePort/LoadBalancer port of `opendesk-synapse-federation` service |
+| Record name                      | Type | Value                                  | Comment                                                                                |
+| -------------------------------- | ---- | -------------------------------------- | -------------------------------------------------------------------------------------- |
+| _matrix._tcp.my_organization.tld | SRV  | `1 10 PORT matrix.opendesk.domain.tld` | `PORT` is your NodePort/LoadBalancer port of the `opendesk-synapse-federation` service |
 
-*Note:* `matrix.opendesk.domain.tld` in the "Value" column can also be the IP address where synapse TLS port is listening to.
+*Note:* `matrix.opendesk.domain.tld` in the "Value" column can also be the IP address synapse TLS port listens to.
 
 ### Webserver
 
 #### Content Security Policy
 
-The webserver of `my_organization.tld` should add `*.opendesk.domain.tld` to its CSP header.
+The `my_organization.tld` webserver should add `*.opendesk.domain.tld` to its CSP header.
 
 #### .well-known
 
@@ -89,11 +89,11 @@ you need to create a JSON file with the following contents that is served from
 
 ```json
 {
-  "m.homeserver": {
-    "base_url": "https://matrix.opendesk.domain.tld"
+  "m.homeserver": {
+    "base_url": "https://matrix.opendesk.domain.tld"
   }
 }
 ```
 
-This ensures clients know where to find the Matrix protocol endpoint when users specify `my_organization.tld`
+The above configuration ensures clients know where to find the Matrix protocol endpoint when users specify `my_organization.tld`
 as their homeserver.

docs/external-services.md

@@ -5,76 +5,106 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>External services</h1>
 
-This document will cover the additional configuration to use external services like databases, caches or buckets.
+This document will cover the additional configuration for external services like databases, caches, or buckets.
 
 <!-- TOC -->
 * [Database](#database)
 * [Object storage](#object-storage)
 * [Cache](#cache)
+* [Footnotes](#footnotes)
 <!-- TOC -->
 
 # Database
 
-When deploying this suite to production, you need to configure the applications to use your production grade database
+When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.
 
-| Component   | Name               | Type       | Parameter | Key                                      | Default                    |
-|-------------|--------------------|------------|-----------|------------------------------------------|----------------------------|
-| Element     | Synapse            | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
-|             |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
-|             |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
-|             |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
-|             |                    |            | Password  | `databases.synapse.password`             |                            |
-| Keycloak    | Keycloak           | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
-|             |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
-|             |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
-|             |                    |            | Password  | `databases.keycloak.password`            |                            |
-|             | Keycloak Extension | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
-|             |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
-|             |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
-|             |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
-| UMS         | Notifications API  | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
-|             |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
-|             |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
-|             |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
-|             |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
-|             | Self Service       | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
-|             |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
-|             |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
-|             |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
-|             |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
-| Nextcloud   | Nextcloud          | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
-|             |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
-|             |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
-|             |                    |            | Password  | `databases.nextcloud.password`           |                            |
-| OpenProject | OpenProject        | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
-|             |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
-|             |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
-|             |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
-|             |                    |            | Password  | `databases.openproject.password`         |                            |
-| OX Appsuite | OX Appsuite        | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.oxAppsuite.name`              | `CONFIGDB`                 |
-|             |                    |            | Host      | `databases.oxAppsuite.host`              | `mariadb`                  |
-|             |                    |            | Username  | `databases.oxAppsuite.username`          | `root`                     |
-|             |                    |            | Password  | `databases.oxAppsuite.password`          |                            |
-| XWiki       | XWiki              | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
-|             |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
-|             |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
-|             |                    |            | Password  | `databases.xwiki.password`               |                            |
+> **Note**<br>
+> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely become the preferred option/default in the future and MariaDB might be deprecated at a later point requiring migrations[^1] if you do not select PostgreSQL for new installations.
+
+| Component        | Name               | Parameter | Key                                           | Default                      |
+| ---------------- | ------------------ | --------- | --------------------------------------------- | ---------------------------- |
+| Element          | Synapse            |           |                                               |                              |
+|                  |                    | Type      | `databases.synapse.type`                      | `postgresql`                 |
+|                  |                    | Name      | `databases.synapse.name`                      | `matrix`                     |
+|                  |                    | Host      | `databases.synapse.host`                      | `postgresql`                 |
+|                  |                    | Port      | `databases.synapse.port`                      | `5432`                       |
+|                  |                    | Username  | `databases.synapse.username`                  | `matrix_user`                |
+|                  |                    | Password  | `databases.synapse.password`                  |                              |
+| Nubus            | Guardian Mgmt API  |           |                                               |                              |
+|                  |                    | Type      | `databases.umsGuardianManagementApi.type`     | `postgresql`                 |
+|                  |                    | Name      | `databases.umsGuardianManagementApi.name`     | `guardianmanagementapi`      |
+|                  |                    | Host      | `databases.umsGuardianManagementApi.host`     | `postgresql`                 |
+|                  |                    | Port      | `databases.umsGuardianManagementApi.port`     | `5432`                       |
+|                  |                    | Username  | `databases.umsGuardianManagementApi.username` | `guardianmanagementapi_user` |
+|                  |                    | Password  | `databases.umsGuardianManagementApi.password` |                              |
+|                  | Keycloak           |           |                                               |                              |
+|                  |                    | Type      | `databases.keycloak.type`                     | `postgresql`                 |
+|                  |                    | Name      | `databases.keycloak.name`                     | `keycloak`                   |
+|                  |                    | Host      | `databases.keycloak.host`                     | `postgresql`                 |
+|                  |                    | Port      | `databases.keycloak.port`                     | `5432`                       |
+|                  |                    | Username  | `databases.keycloak.username`                 | `keycloak_user`              |
+|                  |                    | Password  | `databases.keycloak.password`                 |                              |
+|                  | Keycloak Extension |           |                                               |                              |
+|                  |                    | Type      | `databases.keycloakExtension.type`            | `postgresql`                 |
+|                  |                    | Name      | `databases.keycloakExtension.name`            | `keycloak_extensions`        |
+|                  |                    | Host      | `databases.keycloakExtension.host`            | `postgresql`                 |
+|                  |                    | Port      | `databases.keycloakExtension.port`            | `5432`                       |
+|                  |                    | Username  | `databases.keycloakExtension.username`        | `keycloak_extensions_user`   |
+|                  |                    | Password  | `databases.keycloakExtension.password`        |                              |
+|                  | Notifications API  |           |                                               |                              |
+|                  |                    | Type      | `databases.umsNotificationsApi.type`          | `postgresql`                 |
+|                  |                    | Name      | `databases.umsNotificationsApi.name`          | `notificationsapi`           |
+|                  |                    | Host      | `databases.umsNotificationsApi.host`          | `postgresql`                 |
+|                  |                    | Port      | `databases.umsNotificationsApi.port`          | `5432`                       |
+|                  |                    | Username  | `databases.umsNotificationsApi.username`      | `notificationsapi_user`      |
+|                  |                    | Password  | `databases.umsNotificationsApi.password`      |                              |
+|                  | Self Service       |           |                                               |                              |
+|                  |                    | Type      | `databases.umsSelfservice.type`               | `postgresql`                 |
+|                  |                    | Name      | `databases.umsSelfservice.name`               | `selfservice`                |
+|                  |                    | Host      | `databases.umsSelfservice.host`               | `postgresql`                 |
+|                  |                    | Port      | `databases.umsSelfservice.port`               | `5432`                       |
+|                  |                    | Username  | `databases.umsSelfservice.username`           | `selfservice_user`           |
+|                  |                    | Password  | `databases.umsSelfservice.password`           |                              |
+| Nextcloud        | Nextcloud          |           |                                               |                              |
+|                  |                    | Type      | `databases.nextcloud.type`                    | `mariadb`                    |
+|                  |                    | Name      | `databases.nextcloud.name`                    | `nextcloud`                  |
+|                  |                    | Host      | `databases.nextcloud.host`                    | `mariadb`                    |
+|                  |                    | Port      | `databases.nextcloud.port`                    | `3306`                       |
+|                  |                    | Username  | `databases.nextcloud.username`                | `nextcloud_user`             |
+|                  |                    | Password  | `databases.nextcloud.password`                |                              |
+| Notes            | Notes              |           |                                               |                              |
+|                  |                    | Type      | `databases.notes.type`                        | `postgresql`                 |
+|                  |                    | Name      | `databases.notes.name`                        | `notes`                      |
+|                  |                    | Host      | `databases.notes.host`                        | `postgresql`                 |
+|                  |                    | Port      | `databases.notes.port`                        | `5432`                       |
+|                  |                    | Username  | `databases.notes.username`                    | `notes_user`                 |
+|                  |                    | Password  | `databases.notes.password`                    |                              |
+| OpenProject      | OpenProject        |           |                                               |                              |
+|                  |                    | Type      | `databases.openproject.type`                  | `postgresql`                 |
+|                  |                    | Name      | `databases.openproject.name`                  | `openproject`                |
+|                  |                    | Host      | `databases.openproject.host`                  | `postgresql`                 |
+|                  |                    | Port      | `databases.openproject.port`                  | `5432`                       |
+|                  |                    | Username  | `databases.openproject.username`              | `openproject_user`           |
+|                  |                    | Password  | `databases.openproject.password`              |                              |
+| OX App Suite[^2] | OX App Suite       |           |                                               |                              |
+|                  |                    | Type      | `databases.oxAppSuite.type`                   | `mariadb`                    |
+|                  |                    | Name      | `databases.oxAppSuite.name`                   | `openxchange`                |
+|                  |                    | Host      | `databases.oxAppSuite.host`                   | `mariadb`                    |
+|                  |                    | Port      | `databases.oxAppSuite.port`                   | `3306`                       |
+|                  |                    | Username  | `databases.oxAppSuite.username`               | `root`                       |
+|                  |                    | Password  | `databases.oxAppSuite.password`               |                              |
+| XWiki[^3]        | XWiki              |           |                                               |                              |
+|                  |                    | Type      | `databases.xwiki.type`                        | `mariadb`                    |
+|                  |                    | Name      | `databases.xwiki.name`                        | `xwiki`                      |
+|                  |                    | Host      | `databases.xwiki.host`                        | `mariadb`                    |
+|                  |                    | Port      | `databases.xwiki.port`                        | `3306`                       |
+|                  |                    | Username  | `databases.xwiki.username`                    | `root`                       |
+|                  |                    | Password  | `databases.xwiki.password`                    |                              |
 
 # Object storage
 
-When deploying this suite to production, you need to configure the applications to use your production grade object
+When deploying this suite to production, you need to configure the applications to use your production-grade object
 storage service.
 
 | Component   | Name        | Parameter       | Key                                      | Default            |
@@ -91,7 +121,7 @@ storage service.
 
 # Cache
 
-When deploying this suite to production, you need to configure the applications to use your production grade cache
+When deploying this suite to production, you need to configure the applications to use your production-grade cache
 service.
 
 | Component        | Name             | Type      | Parameter | Key                          | Default          |
@@ -108,3 +138,15 @@ service.
 | UMS              | Self Service     | Memcached |           |                              |                  |
 |                  |                  |           | Host      | `cache.umsSelfservice.host`  | `memcached`      |
 |                  |                  |           | Port      | `cache.umsSelfservice.port`  | `11211`          |
+
+# Footnotes
+
+[^1] The upstream product provide some valuable information regarding database migrations:
+- Nextcloud: https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
+- XWiki:
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
+
+[^2] OX App Suite only supports MariaDB and requires root access, as it manages its databases itself.
+
+[^3] XWiki requires root access when using MariaDB as sub-wikis are using separate databases that are managed by XWiki. When using PostgreSQL with XWiki no root user is required as the sub-wikis are managed within multiple schemes within a single database.

docs/getting-started.md

@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Getting started</h1>
 
-This documentation should enable you to create your own evaluation instance of openDesk on your Kubernetes cluster.
+This documentation lets you create an openDesk evaluation instance on your Kubernetes cluster.
 
 <!-- TOC -->
 * [Requirements](#requirements)
@@ -22,7 +22,7 @@ This documentation should enable you to create your own evaluation instance of o
     * [Volumes](#volumes)
   * [Connectivity](#connectivity)
     * [Ports](#ports)
-      * [Web based user interface](#web-based-user-interface)
+      * [Web-based user interface](#web-based-user-interface)
       * [Mail clients](#mail-clients)
     * [Mail/SMTP configuration](#mailsmtp-configuration)
     * [TURN configuration](#turn-configuration)
@@ -36,44 +36,43 @@ This documentation should enable you to create your own evaluation instance of o
 * [Uninstall](#uninstall)
 <!-- TOC -->
 
-Thanks for looking into the openDesk Getting started guide. This documents covers essentials configuration steps to
-deploy openDesk onto your kubernetes infrastructure.
+Thanks for looking into the openDesk Getting Started guide. This document covers essential configuration steps to
+deploy openDesk onto your Kubernetes infrastructure.
 
 # Requirements
 
-Detailed system requirements are covered on [requirements](requirements.md) page.
+Detailed system requirements are covered on the [requirements](./docs/requirements.md) page.
 
 # Customize environment
 
-Before deploying openDesk, you have to configure the deployment to suit your environment.
-To keep your deployment up to date, we recommend customizing in `dev`, `test` or `prod` and not in `default` environment
+Before deploying openDesk, you must configure the deployment to fit your environment.
+To keep your deployment up to date, we recommend customizing in `dev`, `test`, or `prod` and not in `default` environment
 files.
 
-> All configuration options and their default values can be found in files at `helmfile/environments/default/`
+> All configuration options and their default values can be found in files at [`helmfile/environments/default/`](../helmfile/environments/default/)
 
-For the following guide, we will use `dev` as environment, where variables can be set in
+For the following guide, we will use `dev` as environment where variables can be set in
 `helmfile/environments/dev/values.yaml.gotmpl`.
 
 ## DNS
 
 The deployment is designed to deploy each application/service under a dedicated subdomain.
-For your convenience, we recommend to create a `*.domain.tld` A-Record to your cluster ingress controller,
-otherwise you need to create an A-Record for each subdomain.
+For your convenience, we recommend creating a `*.domain.tld` A-Record to your cluster ingress controller; otherwise, you must create an A-Record for each subdomain.
 
-| Record name             | Type | Value                                              | Additional information                                                             |
-| ----------------------- | ---- | -------------------------------------------------- | ---------------------------------------------------------------------------------- |
-| *.domain.tld            | A    | IPv4 address of your Ingress Controller            |                                                                                    |
-| *.domain.tld            | AAAA | IPv6 address of your Ingress Controller            |                                                                                    |
-| mail.domain.tld         | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| mail.domain.tld         | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| domain.tld              | MX   | `10 mail.domain.tld`                               |                                                                                    |
-| domain.tld              | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                                         |
-| _dmarc.domain.tld       | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                                           |
-| _matrix._tcp.domain.tld | SRV  | `1 10 PORT matrix.domain.tld`                      | `PORT` is your NodePort/LoadBalancer port of `opendesk-synapse-federation` service |
+| Record name                   | Type | Value                                              | Additional information                                           |
+| ----------------------------- | ---- | -------------------------------------------------- | ---------------------------------------------------------------- |
+| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                  |
+| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                  |
+| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                  |
+| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                       |
+| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                         |
+| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional DKIM settings                                           |
 
 ## Domain
 
-A list of all subdomains can be found in `helmfile/environments/default/global.yaml`.
+A list of all subdomains can be found in `helmfile/environments/default/global.gotmpl`.
 
 All subdomains can be customized. For example, _Nextcloud_ can be changed to `files.domain.tld` in `dev` environment:
 
@@ -83,7 +82,7 @@ global:
     nextcloud: "files"
 ```
 
-The domain have to be set either via `dev` environment
+The domain has to be set either via `dev` environment
 
 ```yaml
 global:
@@ -98,7 +97,7 @@ export DOMAIN=domain.tld
 
 ### Apps
 
-All available apps and their default value can be found in `helmfile/environments/default/workplace.yaml`.
+All available apps and their default value are in `helmfile/environments/default/opendesk_main.gotmpl`.
 
 | Component            | Name                        | Default | Description                    |
 | -------------------- | --------------------------- | ------- | ------------------------------ |
@@ -107,9 +106,10 @@ All available apps and their default value can be found in `helmfile/environment
 | ClamAV (Simple)      | `clamavSimple.enabled`      | `true`  | Antivirus engine               |
 | Collabora            | `collabora.enabled`         | `true`  | Weboffice                      |
 | CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
+| dkimpy               | `dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
 | Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
 | Element              | `element.enabled`           | `true`  | Secure communications platform |
-| Intercom Service     | `intercom.enabled`          | `true`  | Cross service data exchange    |
+| Home                 | `home.enabled`              | `true`  | Base domain portal redirect    |
 | Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
 | MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
 | Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
@@ -117,8 +117,7 @@ All available apps and their default value can be found in `helmfile/environment
 | Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
 | Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
 | OpenProject          | `openproject.enabled`       | `true`  | Project management             |
-| OX Appsuite          | `oxAppsuite.enabled`        | `true`  | Groupware                      |
-| Provisioning         | `oxConnector.enabled`       | `true`  | Backend provisioning           |
+| OX App Suite         | `oxAppSuite.enabled`        | `true`  | Groupware                      |
 | Postfix              | `postfix.enabled`           | `true`  | MTA                            |
 | PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
 | Redis                | `redis.enabled`             | `true`  | Cache Database                 |
@@ -133,16 +132,16 @@ jitsi:
 
 ## Private registries
 
-By default Helm charts and container images are fetched from OCI registries. These registries can be found for most cases
+By default, Helm charts and container images are fetched from OCI registries. These registries can be found in most cases
 in the [openDesk/component section on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/components).
 
-For untouched upstream artifacts that do not belong to a functional component's core we use upstream registries
+For untouched upstream artifacts that do not belong to a functional component's core, we use upstream registries
 like Docker Hub.
 
-Doing a test deployment will most likely be fine with this setup. In case you want to deploy multiple times a day
-and fetch from the same IP address you might run into rate limits at Docker Hub. In that case and in cases you
-prefer the use of a private image registry anyway you can configure such for
-[your target environment](./../helmfile/environments/dev/values.yaml.gotmpl.sample) by setting
+Doing a test deployment will be fine with this setup. In case you want to deploy multiple times a day
+and fetch from the same IP address, you might run into rate limits at Docker Hub. In that case and in cases you
+prefer the use of a private image registry, you can configure such for
+[your target environment](../helmfile/environments/dev/values.yaml.gotmpl.sample) by setting
 - `global.imageRegistry` for a private image registry and
 - `global.helmRegistry` for a private Helm chart registry.
 
@@ -151,13 +150,22 @@ global:
   imageRegistry: "my_private_registry.domain.tld"
 ```
 
-alternatively you can use an environment variable:
+alternatively, you can use an environment variable:
 
 ```shell
 export PRIVATE_IMAGE_REGISTRY_URL=my_private_registry.domain.tld
 ```
 
-If authentication is required, you can reference imagePullSecrets as following:
+or control repository override fine-granular per registry:
+
+```yaml
+repositories:
+  image:
+    dockerHub: "my_private_registry.domain.tld/docker.io/"
+    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
+```
+
+If authentication is required, you can reference `imagePullSecrets` as follows:
 
 ```yaml
 global:
@@ -171,7 +179,7 @@ global:
 
 Some apps, like Jitsi or Dovecot, require HTTP and external TCP connections.
 These apps create a Kubernetes service object.
-You can configure, whether `NodePort` (for on-premise), `LoadBalancer` (for cloud) or `ClusterIP` (to disable) should be
+You can configure whether `NodePort` (for on-premise), `LoadBalancer` (for cloud), or `ClusterIP` (to disable) should be
 used:
 
 ```yaml
@@ -190,7 +198,7 @@ cluster:
     domain: "acme.internal"
 ```
 
-If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via:
+If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via the following:
 
 ```yaml
 cluster:
@@ -211,9 +219,9 @@ cluster:
 
 ### Ingress
 
-By default, the `ingressClassName` is empty to choose your default ingress controller. You may want to customize it by
+By default, the `ingressClassName` is empty to select your default ingress controller. You may want to customize it by
 setting the following attribute to the name of the currently only supported ingress controller `ingress-nginx` (see
-[requirements.md](./requirements.md)) for reference) within your deployment if that is not the clusters default ingress.
+[requirements.md](requirements.md)) for reference) within your deployment if that is not the cluster's default ingress.
 
 ```yaml
 ingress:
@@ -222,7 +230,7 @@ ingress:
 
 ### Container runtime
 
-Some apps require specific configuration for the container runtime. You can set your container runtime like `cri-o`,
+Some apps require specific configurations for the container runtime. You can set your container runtime like `cri-o`,
 `containerd` or `docker` by:
 
 ```yaml
@@ -232,17 +240,7 @@ cluster:
 ```
 
 ### Volumes
-
-When your cluster has a `ReadWriteMany` volume provisioner, you can benefit from distributed or scaling of apps. By
-default, only `ReadWriteOnce` is enabled. To enable `ReadWriteMany` you can set:
-
-```yaml
-cluster:
-  persistence:
-    readWriteMany: true
-```
-
-The **StorageClass** can be set by:
+The **StorageClass** must be set by:
 
 ```yaml
 persistence:
@@ -251,18 +249,32 @@ persistence:
     RWO: "my-read-write-once-class"
 ```
 
+`RWX` is optional and requires that your cluster has a `ReadWriteMany` volume provisioner. If you can make use
+of it it benefits the distribution or scaling of apps. By default, only `ReadWriteOnce` is enabled.
+To enable `ReadWriteMany` you have to set:
+
+```yaml
+cluster:
+  persistence:
+    readWriteMany: true
+```
+
+
+
 ## Connectivity
 
 ### Ports
 
-**Note:** If you use `NodePort` for service exposure, you need to check your deployment for the actual ports.
+**Note:** If you use `NodePort` for service exposure, you must check your deployment for the actual ports.
 
-#### Web based user interface
+#### Web-based user interface
 
-To use the openDesk functionality with its web based user interface you need to publicly expose the following ports:
+To use the openDesk functionality with its web-based user interface, you need to expose the following ports publicly:
 
 | Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
+| openDesk           | Kubernetes Ingress      |    80 |  TCP |
+| openDesk           | Kubernetes Ingress      |   443 |  TCP |
 | Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
 
 #### Mail clients
@@ -278,7 +290,7 @@ To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), t
 
 ### Mail/SMTP configuration
 
-To use the full potential of the openDesk, you need to set up an SMTP relay which allows sending emails from
+To use the full potential of the openDesk, you need to set up an SMTP relay that allows sending emails from
 the whole subdomain.
 
 ```yaml
@@ -288,9 +300,22 @@ smtp:
   password: "secret"
 ```
 
+Enabling DKIM signing of emails helps to reduce spam and increases trust.
+openDesk ships dkimpy-milter as Postfix milter for signing emails.
+
+```yaml
+dkimpy:
+  enable: true
+  dkim:
+    key:
+      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
+    selector: "default"
+    useED25519: true # when false, RSA is used
+```
+
 ### TURN configuration
 
-Some components (Jitsi, Element) use for direct communication a TURN server. You can configure your own TURN server with
+Some components (Jitsi, Element) use a TURN server for direct communication. You can configure your own TURN server with
 these options:
 
 ```yaml
@@ -307,9 +332,9 @@ turn:
 
 ### Certificate issuer
 
-As mentioned in [requirements](requirements.md#certificate-management) you can provide your own valid certificate. A TLS
-secret with name `opendesk-certificates-tls` needs to be present in application namespace. For deployment, you can
-disable `Certificate` resource creation by:
+As mentioned in [requirements](requirements.md#certificate-management), you can provide your own valid certificate. A TLS
+secret named `opendesk-certificates-tls` must be present in the application namespace. For deployment, you can
+turn off `Certificate` resource creation by:
 
 ```yaml
 certificates:
@@ -334,16 +359,16 @@ certificate:
 
 ## Password seed
 
-All secrets are generated from a single master password via Master Password (algorithm).
-To prevent others from using your openDesk instance, we highly recommend setting an individual master password via:
+All secrets are generated from a master password via [Master Password (algorithm)](https://en.wikipedia.org/wiki/Master_Password_(algorithm)).
+To prevent others from using your openDesk instance, you must set your individual master password via:
 
 ```shell
-export MASTER_PASSWORD="openDesk"
+export MASTER_PASSWORD="your_individual_master_password"
 ```
 
 ## Install
 
-After setting your environment specific values in `dev` environment, you can start deployment by:
+After setting your environment-specific values in `dev` environment, you can start deployment by:
 
 ```shell
 helmfile apply -e dev -n <NAMESPACE> [-l <label>] [--suppress-diff]
@@ -373,7 +398,7 @@ helmfile apply -e dev -n <NAMESPACE>
 
 ## Install single release/chart
 
-Instead of iteration through all services, you can also deploy a single release like mariadb by:
+Instead of iteration through all services, you can also deploy a single release like `mariadb` by:
 
 ```shell
 helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
@@ -381,38 +406,52 @@ helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
 
 # Access deployment
 
-When all apps are successfully deployed and pod status' went to `Running` or `Succeeded`, you can navigate to
+When all apps are successfully deployed, and their Pod's status is `Running` or `Succeeded`, you can navigate to
 
 ```text
 https://portal.domain.tld
 ```
 
-If you change the subdomain of `nubus`, you need to replace `portal` by your specified subdomain.
+If you change the subdomain of `nubus`, you must replace `portal` with the specified subdomain.
 
 **Credentials:**
 
-```shell
-# Replace with your namespace
-NAMESPACE=your-namespace
+openDesk deploys with the standard user account `Administrator`, which password you get retrieved as follows:
 
-# Get ConfigMap with credentials
-kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}'
+```shell
+# Set your namespace
+NAMESPACE=<your_namespace>
+
+# Get password for IAM "Administrator" account
+kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.administrator_password}' | base64 -d
 ```
 
-Renders you a two part ConfigMap where the `username` and `password` attributes in the `properties`
-section provide you with the desired information to login with the two default user roles:
+Using the aforementioned account, you can either create new accounts manually or make use of the
+[openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import/)
+script or container.
 
-| Username        | Password                                   | Description      |
-|-----------------|--------------------------------------------|------------------|
-| `default.user`  | `40615..............................e9e2f` | Application user |
-| `default.admin` | `17027..............................04db6` | Administrator    |
+For example you get a `default` and `default-admin` account by running the following snippet, after settings the
+appropriate values in the first three lines.
+
+```shell
+ADMINISTRATOR_PASSWORD=<your_administrator_password_see_above>
+DOMAIN=<your_domain>
+DEFAULT_USERS_PASSWORD=<password_for_the_created_default_accounts>
+docker run --rm registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0 \
+  ./user_import_udm_rest_api.py \
+    --import_domain ${DOMAIN} \
+    --udm_api_password ${ADMINISTRATOR_PASSWORD} \
+    --set_default_password ${DEFAULT_USERS_PASSWORD} \
+    --import_filename template.ods \
+    --create_admin_accounts True
+```
 
 ## Using from external repository
 
-It is possible to refer to `./helmfile_generic.yaml` from an external
-directory or repository. The `helmfile.yaml` that refers to
-`./helmfile_generic.yaml` may define custom environments. These custom
-environments may overwrite certain configuration values. These
+Referring to `./helmfile_generic.yaml.gotmpl` from an external
+directory or repository is possible. The `helmfile.yaml.gotmpl` that refers to
+`./helmfile_generic.yaml.gotmpl` may define custom environments. These custom
+environments may overwrite specific configuration values. These
 configuration values are:
 
 * `global.domain`
@@ -427,8 +466,8 @@ You can uninstall the deployment by:
 helmfile destroy -n <NAMESPACE>
 ```
 
-> **Note**
-> Not all Jobs, PersistentVolumeClaims or Certificates are deleted; you have to delete them manually
+> **Note**<br>
+> Not all Jobs, PersistentVolumeClaims, or Certificates are deleted; you have to delete them manually
 
 **'Sledgehammer destroy'** - for fast development turn-around times (at your own risk):
 
@@ -443,7 +482,8 @@ done
 # Delete leftover resources
 kubectl delete pvc --all --namespace ${NAMESPACE};
 kubectl delete jobs --all --namespace ${NAMESPACE};
+kubectl delete configmaps --all --namespace ${NAMESPACE};
 ```
 
-> **Warning**
+> **Warning**<br>
 > Without specifying or empty `--namespace` flag, cluster-wide components get deleted!

docs/migrations.md

@@ -3,86 +3,635 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 -->
 
-<h1>Upgrade migrations</h1>
+<h1>Updates & Upgrades</h1>
 
+<!-- TOC -->
 * [Disclaimer](#disclaimer)
-* [Releases upgrades](#releases-upgrades)
+* [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
+* [Manual checks/actions](#manual-checksactions)
+  * [From v1.1.1](#from-v111)
+    * [Pre-upgrade from v1.1.1](#pre-upgrade-from-v111)
+      * [Helmfile feature update: App settings wrapped in `apps.` element](#helmfile-feature-update-app-settings-wrapped-in-apps-element)
+  * [From v1.1.0](#from-v110)
+    * [Pre-upgrade from v1.1.0](#pre-upgrade-from-v110)
+      * [Helmfile feature update: Component specific `storageClassName`](#helmfile-feature-update-component-specific-storageclassname)
+      * [Helmfile new secret: `secrets.nubus.masterpassword`](#helmfile-new-secret-secretsnubusmasterpassword)
+  * [From v1.0.0](#from-v100)
+    * [Pre-upgrade from v1.0.0](#pre-upgrade-from-v100)
+      * [Helmfile cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
+      * [Helmfile cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
+      * [Helmfile cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
+      * [Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
+      * [Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names](#helmfile-cleanup-streamlining-openxchange-and-oxappsuite-attribute-names)
+      * [Helmfile feature update: Dicts to define `customization.release`](#helmfile-feature-update-dicts-to-define-customizationrelease)
+      * [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
+      * [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
+      * [External requirements: Redis 7.4](#external-requirements-redis-74)
+    * [Post-upgrade from v1.0.0](#post-upgrade-from-v100)
+      * [XWiki fix-ups](#xwiki-fix-ups)
   * [From v0.9.0](#from-v090)
-    * [Automated migrations](#automated-migrations)
-      * [Updated IAM component Nubus](#updated-iam-component-nubus)
-        * [Manual cleanup](#manual-cleanup)
+    * [Pre-upgrade from v0.9.0](#pre-upgrade-from-v090)
+      * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
+      * [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
+      * [Changed openDesk defaults: Matrix presence status disabled](#changed-opendesk-defaults-matrix-presence-status-disabled)
+      * [Changed openDesk defaults: Matrix ID](#changed-opendesk-defaults-matrix-id)
+      * [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
+      * [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
+      * [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
+    * [Post-upgrade from v0.9.0](#post-upgrade-from-v090)
+      * [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
+      * [Optional Cleanup](#optional-cleanup)
   * [From v0.8.1](#from-v081)
-    * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
-    * [Updated customizable template attributes](#updated-customizable-template-attributes)
-    * [`migrations` S3 bucket](#migrations-s3-bucket)
-* [Related components and artefacts](#related-components-and-artefacts)
+    * [Pre-upgrade from v0.8.1](#pre-upgrade-from-v081)
+      * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
+      * [Updated customizable template attributes](#updated-customizable-template-attributes)
+      * [`migrations` S3 bucket](#migrations-s3-bucket)
+* [Automated migrations - Details](#automated-migrations---details)
+  * [From v1.0.0 (automated)](#from-v100-automated)
+  * [From v0.9.0 (automated)](#from-v090-automated)
+  * [Related components and artifacts](#related-components-and-artifacts)
   * [Development](#development)
+<!-- TOC -->
 
 # Disclaimer
 
-We do not offer support for upgrades before we reach openDesk 1.0.
+Starting with openDesk 1.0, we aim to offer hassle-free updates/upgrades.
 
-Though we try to ease the pain when it comes to 0.x upgrades. That is what this document is for.
+Therefore openDesk contains automated migrations between versions to lower the requirements for manual interaction. These automated migrations can have limitations in the way that they need a certain openDesk version to be installed causing a mandatory upgrade path that is described in the section [Automated migrations](#automated-migrations).
 
-Limitations:
-- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was deleted and will cover an explicit delete for PVs.
+Manual checks and possible activities are also required by openDesk updates, they are described in the section [Manual update steps](#manual-update-steps).
 
-# Releases upgrades
+> **Note**<br>
+> Please be sure you read / follow the requirements before you update / upgrade thoroughly.
+
+> **Known limitations**<br>
+> We assume that the PV reclaim policy is set to `delete`, resulting in PVs getting deleted as soon as the related PVC was deleted; we will not address explicit deletion for PVs.
+
+# Automated migrations - Overview and mandatory upgrade path
+
+The following table gives an overview of the mandatory upgrade path of openDesk for the automated migrations to work as expected.
+
+To upgrade existing deployments, you cannot skip any version mentioned in the column *Mandatory version*. When a version number is not fully defined (e.g. `v1.1.x`), you can install any version matching the given schema.
+
+| Mandatory version |
+| ----------------- |
+| v1.1.x            |
+| v1.0.0            |
+| v0.9.0            |
+| v0.8.1            |
+
+> **Note**<br>
+> Be sure you check out the table in the release version you are going to install, an not the one that is currently installed.
+
+When interested in more details about the automated migrations, please read section [Automated migrations - Details](#automated-migrations---details).
+
+# Manual checks/actions
+
+Be sure you check all the sections for the releases your are going to update your current deployment from.
+
+## From v1.1.1
+
+### Pre-upgrade from v1.1.1
+
+#### Helmfile feature update: App settings wrapped in `apps.` element
+
+We require now [Helmfile v1.0.0-rc.8](https://github.com/helmfile/helmfile/releases/tag/v1.0.0-rc.8) for the deployment. This enables openDesk to lay the foundation for some significant cleanups where the information for the different apps especially on their `enabled` state is needed.
+
+Therefore it was required to introduce the `apps` level in [`opendesk_main.yaml.gotmpl`](../helmfile/environments/default/opendesk_main.yaml.gotmpl).
+
+If you have a deployment where you specify settings that can be found in the aforementioned file, usually to disable components or enable others, please ensure you insert the top-level attribute `apps` like shown in the following example:
+
+So a setting of:
+
+```
+certificates:
+  enabled: false
+notes:
+  enabled: true
+```
+
+needs to be changed to:
+
+```
+apps:
+  certificates:
+    enabled: false
+  notes:
+    enabled: true
+```
+
+## From v1.1.0
+
+### Pre-upgrade from v1.1.0
+
+#### Helmfile feature update: Component specific `storageClassName`
+
+With openDesk 1.1.1 we support component specific `storageClassName` definitions beside the global ones, but we had to adapt the structure that can be found in `persistence.yaml.gotmpl` to achieve this in a clean manner.
+
+If you have set custom `persistence.size.*`-values for your deployment, please continue reading as you need to adapt your `persistence` settings to the new structure.
+
+When comparing the [old 1.1.0 structure](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.0/helmfile/environments/default/persistence.yaml.gotmpl) with the [new one](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.1/helmfile/environments/default/persistence.yaml.gotmpl) you can spot the changes:
+
+- We replaced `persistence.size` with `persistence.storages`.
+- Below each component you can define now the `size` and the optional component specific `storageClassName`.
+- We streamlined all components to be on the same level, as Nubus had an additional level of nesting before.
+
+So a setting of:
+
+```yaml
+persistence:
+  size:
+    synapse: "1Gi"
+```
+
+needs to be changed to:
+
+```yaml
+persistence:
+  storages:
+    synapse:
+      size: "1Gi"
+```
+
+or for the Nubus related entries, the following:
+
+```yaml
+persistence:
+  size:
+    nubus:
+      ldapServerData: "1Gi"
+```
+
+needs to be changed to:
+
+```yaml
+persistence:
+  storages:
+    nubusLdapServerData:
+      size: "1Gi"
+```
+
+#### Helmfile new secret: `secrets.nubus.masterpassword`
+
+A not yet templated secret was discovered in the Nubus deployment that is now defined in [`secrets.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl) with the key `secrets.nubus.masterpassword`. If you define your own secrets, please be sure this new secret is set to the value of the `MASTER_PASSWORD` environment variable used in your deployment.
+
+## From v1.0.0
+
+### Pre-upgrade from v1.0.0
+
+#### Helmfile cleanup: Restructured `/helmfile/files/theme` folder
+
+If you make use of the [theme folder](../helmfile/files/theme/) or the [`theme.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl), e.g. to applying your own imagery, please ensure you adhere to the new structure of the folder and the yaml-file.
+
+#### Helmfile cleanup: Consistent use of `*.yaml.gotmpl`
+
+In v1.0.0 the files in [`/helmfile/environments/default`](../helmfile/environments/default/) had mixed extensions,
+we have streamlined them to consistently use `*.yaml.gotmpl`.
+
+This change requires manual action likely in two situations:
+
+1. You are referencing our upstream files from the aforementioned directory, e.g. in your Argo CD deployment. Please update your references to use the filenames with the new extension.
+2. You have custom files containing configuration information that are named just `*.yaml`: Please rename them to `*.yaml.gotmpl`.
+
+#### Helmfile cleanup: Prefixing certain app directories with `opendesk-`
+
+To make it more obvious that some elements from below the [`apps`](../helmfile/apps/) directory are completely
+provided by openDesk, we have prefixed these app directories with `opendesk-`.
+
+Affected are the following directories, here listed directly with the new prefix:
+
+- [`./helmfile/apps/opendesk-migrations-pre`](../helmfile/apps/opendesk-migrations-pre)
+- [`./helmfile/apps/opendesk-migrations-post`](../helmfile/apps/opendesk-migrations-post)
+- [`./helmfile/apps/opendesk-openproject-bootstrap`](../helmfile/apps/opendesk-openproject-bootstrap)
+
+The described changes most likely require manual action in the following situation:
+
+- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+
+#### Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services
+
+In v1.0.0 there was a directory `/helmfile/apps/services` that was intended to contain all the services an operator had to provide externally for production deployments.
+
+As some services that are actually part of openDesk snuck in there, so we had to split the directory into two separate ones:
+
+- [`./helmfile/apps/opendesk-services`](../helmfile/apps/opendesk-services)
+- [`./helmfile/apps/services-external`](../helmfile/apps/services-external)
+
+The described changes most likely require manual action in the following situation:
+
+- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+
+#### Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names
+
+We have updated some attribute names around Open-Xchange / OX App Suite to be consistent within our Helmfile
+deployment and to aligning with the actual brand names as well as with our rule of thumb for brand based
+attribute names[^1].
+
+In case you are using any of the customizations below (`WAS`), please update as shown (`NOW`):
+
+```
+WAS: oxAppsuite: ...
+NOW: oxAppSuite: ...
+```
+
+```
+WAS: cache.oxAppsuite: ...
+NOW: cache.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuite: ...
+NOW: charts.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuiteBootstrap: ...
+NOW: charts.oxAppSuiteBootstrap: ...
+```
+
+```
+WAS: customization.release.openXchange: ...
+NOW: customization.release.openxchange: ...
+```
+
+```
+WAS: customization.release.opendeskOpenXchangeBootstrap: ...
+NOW: customization.release.opendeskOpenxchangeBootstrap: ...
+```
+
+```
+WAS: databases.oxAppsuite: ...
+NOW: databases.oxAppSuite: ...
+```
+
+```
+WAS: ingress.parameters.openXchangeAppSuite: ...
+NOW: ingress.parameters.oxAppSuite: ...
+```
+
+```
+WAS: ingress.bodyTimeout.openXchangeAppSuite: ...
+NOW: ingress.bodyTimeout.oxAppSuite: ...
+```
+
+```
+WAS: migration.oxAppsuite: ...
+NOW: migration.oxAppSuite: ...
+```
+
+```
+WAS: secrets.oxAppsuite: ...
+NOW: secrets.oxAppSuite: ...
+```
+
+#### Helmfile feature update: Dicts to define `customization.release`
+
+If you make use of the `customization.release` option, you have to switch to a dictionary based definition of customization files e.g. from
+
+```yaml
+customization:
+  release:
+    collaboraOnline: "./my_custom_templating.yaml.gotmpl"
+```
+
+to
+
+```yaml
+customization:
+  release:
+    collaboraOnline:
+      file1: "./my_custom_templating.yaml.gotmpl"
+```
+
+You can freely choose the `file1` dictionary key used in the example above, but it should start with a letter.
+
+#### openDesk defaults (new): Enforce login
+
+Users accessing the openDesk portal are now automatically redirected to the login screen as a default.
+
+In case you want to keep the previous behavior you need to set the following `functional` flag:
+
+```yaml
+functional:
+  portal:
+    enforceLogin: false
+```
+
+#### openDesk defaults (changed): Jitsi room history enabled
+
+The default to store the Jitsi room history in the local storage of a user's browser has changed.
+
+It is now enabled and therefore stored by default.
+
+To preserve the 1.0.0 behavior of not storing the room history you have to explicitly configure it:
+
+```yaml
+functional:
+  dataProtection:
+    jitsiRoomHistory:
+      enabled: false
+```
+
+#### External requirements: Redis 7.4
+
+The update from openDesk 1.0.0 contains Redis 7.4.1, like the other openDesk bundled services the bundled Redis is as well not meant to be used in production.
+
+Please ensure for the Redis you are using that it is updated to at least 7.4 to support the requirement of OX App Suite.
+
+### Post-upgrade from v1.0.0
+
+#### XWiki fix-ups
+
+Unfortunately XWiki does not upgrade itself as expected. A bug with the supplier has already been filed. The following additional steps are required:
+
+1. To enforce re-indexing of the now fixed full-text search access the XWiki Pod and run the following commands to delete two search related directories. To complete this you need to restart the XWiki Pod, but that is anyway part of the next step:
+   ```
+   rm -rf /usr/local/xwiki/data/store/solr/search_9
+   rm -rf /usr/local/xwiki/data/cache/solr/search_9
+   ```
+
+2. This is necessary if the openDesk single sign-on does not longer work and you get a standard XWiki login dialogue instead.
+   - Find the XWiki ConfigMap `xwiki-init-scripts` and find in its `entrypoint` key data the lines beginning with `xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg"`
+   - Before those lines add the following line, of course setting `<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>` to a value you are happy with.
+     ```
+         xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg" 'xwiki.superadminpassword' '<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>'
+     ```
+   - Restart the XWiki Pod.
+   - Access XWiki's web UI and login with `superadmin` and the above set password.
+   - Once XWiki UI is fully rendered, remove the line with the temporary `superadmin` password from the aforementioned ConfigMap.
+   - Restart the XWiki Pod.
+
+You should have now a properly working XWiki instance with single sign-on and full-text search.
 
 ## From v0.9.0
 
-### Automated migrations
+### Pre-upgrade from v0.9.0
 
-#### Updated IAM component Nubus
+#### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus
 
-openDesk is integrating the latest [Nubus](https://www.univention.de/produkte/nubus/) development from Univention. The now redundant and scalable LDAP requires migration activities. These have been automated to avoid manual interaction. The `run_2` of the openDesk
-upgrade migrations executes the following steps:
+> **Warning**<br>
+> The upgrade will fail if you do not address this section for your current deployment.
 
-- Stage PRE:
-  - Delete service `ums-keycloak`, as it will be recreated headless.
-  - Scale down `statefulset/ums-ldap-server` and `statefulset/ums-ldap-notifier` in preparation or the next step:
-  - Create two new PVCs `shared-data-ums-ldap-server-primary-0` and `shared-data-ums-ldap-server-primary-1` for the new LDAP primary pods as copy from the existing `shared-data-ums-ldap-server-0`. The LDAP secondaries will sync from the primary nodes.
-- Stage POST:
-  - Restart Keycloak.
+The update will remove unnecessary OX-Profiles in Nubus, but it can not as long as these profiles are in use.
 
-##### Manual cleanup
+So please ensure that only the following two supported profiles are assigned to your users:
+- `opendesk_standard`: "opendesk Standard"
+- `none`: "Login disabled"
 
-Currently we do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the no longer used PVCs after successful upgrade:
+You can review and update other accounts as follows:
+- Login as IAM admin.
+- Open the user module.
+- Open the extended search by clicking the funnel (DE: "Trichter") icon next to the search input field.
+- Open the "Property" (DE: "Eigenschaft") list and select "OX Access" (DE: "OX-Berechtigung").
+- Enter an asterisk (*) in the input field next to the list.
+- Start the search by clicking once more on the funnel icon.
+- Sort the result list for the "OX Access" column.
+- Edit every user that has a value different to `opendesk_standard` or `none`:
+  - Open the user.
+  - Go to section "OX App Suite".
+  - Change the value in the dropdown "OX Access" to either:
+    - "openDesk Standard" if the user should be able to use the Groupware module or
+    - "Login disabled" if the user should not use the Groupware module.
+  - Update the user account with the green "SAVE" button at the top of the page.
+
+#### Configuration Cleanup: Updated `global.imagePullSecrets`
+
+Without using a custom registry, you can pull all the openDesk images without authentication.
+Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them.
+
+You can keep the current settings by setting the `external-registry` in your custom environment values:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "external-registry"
 ```
+
+#### Changed openDesk defaults: Matrix presence status disabled
+
+Show other user's Matrix presence status is now disabled by default to comply with data protection requirements.
+
+To enable it or keep the v0.9.0 default please set:
+
+```yaml
+functional:
+  dataProtection:
+    matrixPresence:
+      enabled: true
+```
+
+#### Changed openDesk defaults: Matrix ID
+
+Until 0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's Matrix ID. Due to restrictions on the
+Matrix protocol, an update of a Matrix ID is not possible; therefore, it was technically convenient to use the UUID
+as it is immutable (see https://de.wikipedia.org/wiki/Universally_Unique_Identifier for more details on UUIDs.)
+
+From the user experience perspective, that was a flawed approach, so from openDesk 1.0 on, by default, the username which
+is also used for logging into openDesk is used to define the localpart of the Matrix ID.
+
+For existing installations: The changed setting only affects users who log in to Element for the first time. Existing
+user accounts will not be harmed. If you want existing users to get new Matrix IDs based on the new setting, you
+must update their external ID in Synapse and deactivate the old user afterward. The user will get a new
+Matrix account from scratch, losing the existing contacts, chats, and rooms.
+
+The following Admin API calls are helpful:
+- `GET /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` to get the user's existing external_id (auth_provider: "oidc")
+- `PUT /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` to update user's external_id with JSON payload:
+  `{ "external_ids": [ { "auth_provider": "oidc", "external_id": "<old_id>+deprecated" } ] }`
+- `POST /_synapse/admin/v1/deactivate/@<entryuuid>:<matrixdomain>` to deactivate old user with JSON payload:
+  `{ "erase": true }`
+
+For more details, check the Admin API documentation:
+https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html
+
+You can enforce the old standard with the following setting:
+```yaml
+functional:
+ chat:
+   matrix:
+     profile:
+       useImmutableIdentifierForLocalpart: true
+```
+
+#### Changed openDesk defaults: File-share configurability
+
+Now, we provide some configurability regarding the sharing capabilities of the Nextcloud component.
+
+See the settings under `functional.filestore` in [functional.yaml](../helmfile/environments/default/functional.yaml).
+
+For the following settings, the default in openDesk 1.0 has changed, so you might want to update
+the settings for your deployment to keep its current behavior:
+
+```yaml
+functional:
+ filestore:
+   sharing:
+     external:
+       enabled: true
+       expiry:
+         activeByDefault: false
+```
+
+#### Changed openDesk defaults: Updated default subdomains in `global.hosts`
+
+We have streamlined the subdomain names in openDesk to be more user-friendly and to avoid the use of specific
+product names.
+
+This results in the following changes to the default subdomain naming:
+
+- **collabora**: `collabora` → `office`
+- **cryptpad**: `cryptpad` → `pad`
+- **minioApi**: `minio` → `objectstore`
+- **minioConsole**: `minio-console` → `objectstore-ui`
+- **nextcloud**: `fs` → `files`
+- **openproject**: `project` → `projects`
+
+Existing deployments should keep the old subdomains cause URL/link changes are not supported through all components.
+
+If you have not already defined the entire `global.hosts` dictionary in your custom environments values, please set it
+to the defaults that were used before the upgrade:
+
+```yaml
+global:
+  hosts:
+    collabora: "collabora"
+    cryptpad: "cryptpad"
+    element: "chat"
+    intercomService: "ics"
+    jitsi: "meet"
+    keycloak: "id"
+    matrixNeoBoardWidget: "matrix-neoboard-widget"
+    matrixNeoChoiceWidget: "matrix-neochoice-widget"
+    matrixNeoDateFixBot: "matrix-neodatefix-bot"
+    matrixNeoDateFixWidget: "matrix-neodatefix-widget"
+    minioApi: "minio"
+    minioConsole: "minio-console"
+    nextcloud: "fs"
+    openproject: "project"
+    openxchange: "webmail"
+    synapse: "matrix"
+    synapseFederation: "matrix-federation"
+    univentionManagementStack: "portal"
+    whiteboard: "whiteboard"
+    xwiki: "wiki"
+```
+
+In case you would like to update an existing deployment to the new hostnames, please check the following list:
+
+- Do this at your own risk.
+- Some of your user's bookmarks and links will stop working.
+- Portal links are getting updated automatically.
+- The update of the OpenProject <-> Nextcloud file integration needs to be updated manually as follows:
+  - Use an account with functional admin permissions on both components
+  - In OpenProject: *Administration* > *Files* > *External file storages* > Select `Nextcloud at [your_domain]`
+    - Edit *Details* - *General Information* - *Storage provider* and update the *hostname* to `files.<your_domain>`
+  - In Nextcloud: *Administration* > *OpenProject* > *OpenProject server*
+    - Update the *OpenProject host* to `projects.<your_domain>`
+
+#### Changed openDesk defaults: Dedicated group for access to the UDM REST API
+
+Prerequisite: You allow the use of the [IAM's API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html)
+with the following settings:
+
+```yaml
+functional:
+  externalServices:
+    nubus:
+      udmRestApi:
+        enabled: true
+```
+
+With 0.9.0, all members of the group "Domain Admins" could successfully authenticate with the API.
+
+With openDesk 1.0, we introduced a specific group for permission to use the API: `IAM API - Full Access`.
+
+The IAMs admin account `Administrator` is a member of this group by default, but no other user is.
+
+If you need other accounts to use the API, please assign them to the aforementioned group.
+
+### Post-upgrade from v0.9.0
+
+#### Configuration Improvement: Separate user permission for using Video Conference component
+
+With openDesk 1.0 the user permission for authenticated access to the Chat and Video Conference components was split into two separate permissions.
+
+Therefore the newly added *Video Conference* permission has to be added to users that should have continued access to the component.
+
+This can be done as IAM admin:
+- Open the *user* module.
+- Select all users that should get the permission for *Video Conference* using the select box left from the users entry.
+- In top bar of the user table click on *Edit*.
+- Select the *openDesk* section the the left-hand menu.
+- Check the check box for *Video Conference* and the directly below check box for *Overwrite*.
+- Click on the green *Save* button on top of the screen to apply the change.
+
+> **Hint**<br>
+> If you have a lot of users andd want to update (almost) all them, you can select all users by clicking the check box in the user's table header and then de-selecting the users you do not want to update.
+
+#### Optional Cleanup
+
+We do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the no longer used PVCs after a successful upgrade:
+
+```shell
 NAMESPACE=<your_namespace>
 kubectl -n ${NAMESPACE} delete pvc shared-data-ums-ldap-server-0
 kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
+kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
 ```
 
 ## From v0.8.1
 
-### Updated `cluster.networking.cidr`
+### Pre-upgrade from v0.8.1
 
-- Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1), please update your setup accordingly if you explicitly set this value.
+#### Updated `cluster.networking.cidr`
+
+- Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1); please update your setup accordingly if you explicitly set this value.
 - Reference:[cluster.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/cluster.yaml)
 
-### Updated customizable template attributes
+#### Updated customizable template attributes
 
-- Action: Please ensure you update you custom deployment values according with the updated default value structure.
+- Action: Please update your custom deployment values according to the updated default value structure.
 - References:
   - `functional.` prefix for `authentication.*`, `externalServices.*`, `admin.*` and `filestore.*`, see [functional.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/functional.yaml).
   - `debug.` prefix for `cleanup.*`, see [debug.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/debug.yaml).
   - `monitoring.` prefix for `prometheus.*` and `graphana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
   - `smtp.` prefix for `localpartNoReply`, see [smtp.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/smtp.yaml).
 
-### `migrations` S3 bucket
+#### `migrations` S3 bucket
 
-- Action: For self managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
+- Action: For self-managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
 - Reference: `objectstores.migrations` in [objectstores.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/objectstores.yaml)
 
-# Related components and artefacts
+# Automated migrations - Details
 
-openDesk comes with two upgrade steps as part of the deployment, they can be found in the folder [/helmfile/apps](../helmfile/apps/) as all other components:
+## From v1.0.0 (automated)
+
+With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.
+
+openDesk's automated migrations takes care of this upgrade requirement described here for
+[Nubus 1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.5.1/en/changelog.html#migrate-existing-ldap-server-to-mirror-mode-readiness),
+creating the config map with the mentioned label.
+
+> **Note**<br>
+> Details can be found in [run_3.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
+
+## From v0.9.0 (automated)
+
+The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.
+
+The permissions required to execute the migrations can be found in the migration's Helm chart [`role.yaml'](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/v1.3.5/charts/opendesk-migrations/templates/role.yaml?ref_type=tags#L29)
+
+> **Note**<br>
+> Details can be found in [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
+
+## Related components and artifacts
+
+openDesk comes with two upgrade steps as part of the deployment; they can be found in the folder [/helmfile/apps](../helmfile/apps/) as all other components:
 
 - `migrations-pre`: Is the very first app that gets deployed.
 - `migrations-post`: Is the last app that gets deployed.
 
-Both migrations have to be deployed exclusively at their first/last position and not in parallel with other components.
+Both migrations must be deployed exclusively at their first/last position and not parallel with other components.
 
 The status of the upgrade migrations is tracked in the ConfigMap `migrations-status`, more details can be found in the [README.md of the related container image](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/README.md).
 
@@ -90,8 +639,11 @@ The status of the upgrade migrations is tracked in the ConfigMap `migrations-sta
 
 When a new upgrade migration is required, ensure to address the following list:
 
-- Update the generated release version file [`global.generated.yaml`](../helmfile/environments/default/global.generated.yaml) at least on the patch level to test the upgrade in your feature branch as well as trigger it in the `develop` branch after the feature branch was merged. The set value gets overwritten during the release process with the release's actual version number.
+- Update the generated release version file [`global.generated.yaml.gotmpl`](../helmfile/environments/default/global.generated.yaml.gotmpl) at least on the patch level to test the upgrade in your feature branch and trigger it in the `develop` branch after the feature branch was merged. During the release process, the value is overwritten by the release's version number.
 - You have to implement the migration logic as a runner script in the [`opendesk-migrations`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations) image. Please find more instructions in the linked repository.
 - You most likely have to update the [`opendesk-migrations` Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations) within the `rules` section of the [`role.yaml`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/templates/role.yaml) to provide the permissions required for the execution of your migration's logic.
-- You have to set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
-- Update the [`charts.yaml`](../helmfile/environments/default/charts.yaml) and [`images.yaml`](../helmfile/environments/default/images.yaml) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
+- You must set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
+- Update the [`charts.yaml.gotmpl`](../helmfile/environments/default/charts.yaml.gotmpl) and [`images.yaml.gotmpl`](../helmfile/environments/default/images.yaml.gotmpl) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
+
+[^1]: We do not follow a brand name's specific spelling when it comes to upper and lower case and only use new word
+uppercase when names consist of multiple, space divided words.

docs/monitoring.md

@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Monitoring</h1>
 
-This document will cover how you can enable observability with Prometheus based monitoring and Grafana dashboards, as
+This document will cover how you can enable observability with Prometheus-based monitoring and Grafana dashboards as
 well as the overall status of monitoring integration.
 
 <!-- TOC -->
@@ -19,39 +19,42 @@ well as the overall status of monitoring integration.
 
 # Technology
 
-We provide integration into the Prometheus based monitoring.
+We provide integration into the Prometheus-based monitoring.
 Together with
 [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) you
-easily leverage the full potential of open-source cloud-native observability stack.
+easily leverage the full potential of the open-source cloud-native observability stack.
 
 Before enabling the following options, you need to install the respective CRDs from the kube-prometheus-stack
-repository or prometheus operator.
+repository or Prometheus operator.
 
 # Defaults
 
 All configurable options and their defaults can be found in
-[`monitoring.yaml`](../helmfile/environments/default/monitoring.yaml).
+[`monitoring.yaml.gotmpl`](../helmfile/environments/default/monitoring.yaml.gotmpl).
 
 # Metrics
 
-To deploy podMonitor and serviceMonitor custom resources, enable it by:
+To deploy `podMonitor` and `serviceMonitor` custom resources, enable it by:
 
 ```yaml
 prometheus:
-  serviceMonitors:
-    enabled: true
-  podMonitors:
-    enabled: true
+  serviceMonitors:
+    enabled: true
+  podMonitors:
+    enabled: true
 ```
 
 # Alerts
 
-Some helm-charts provide a default set of prometheusRules for alerting, enable it by:
+openDesk ships with a set of Prometheus alerting rules that are specific to the operation of openDesk.
+Some of these are created by our partners while others are defined in [opendesk-alerts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts).
+
+All alert rules are deployed as [PrometheusRule](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PrometheusRule) and can be enabled like this:
 
 ```yaml
 prometheus:
-  prometheusRules:
-    enabled: true
+  prometheusRules:
+    enabled: true
 ```
 
 # Dashboards for Grafana
@@ -60,13 +63,13 @@ To deploy optional ConfigMaps with Grafana dashboards, enable it by:
 
 ```yaml
 grafana:
-  dashboards:
-    enabled: true
+  dashboards:
+    enabled: true
 ```
 
 # Components
 
-| Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
+| Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
 |:----------|-----------------------------------|-------------------------|---------------------|
-| Collabora | :white_check_mark:                | :white_check_mark:      | :white_check_mark:  |
-| Nextcloud | :white_check_mark:                | :x:                     | :x:                 |
+| Collabora | :white_check_mark:                | :white_check_mark:      | :white_check_mark:  |
+| Nextcloud | :white_check_mark:                | :x:                     | :x:                 |

docs/permissions.md

@@ -0,0 +1,202 @@
+<!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Roles & Permissions</h1>
+
+openDesk uses role-based access control (RBAC) to manage permissions. This system ensures that users have access only to the resources necessary for their role.
+
+<!-- TOC -->
+* [Identity and Access Management (IAM)](#identity-and-access-management-iam)
+  * [Permissions](#permissions)
+  * [Roles](#roles)
+    * [Application usage](#application-usage)
+    * [Application administration](#application-administration)
+  * [Groups](#groups)
+    * [Global groups](#global-groups)
+    * [Application groups](#application-groups)
+      * [Standard access to applications](#standard-access-to-applications)
+      * [Administrative access to applications](#administrative-access-to-applications)
+    * [Custom groups](#custom-groups)
+  * [Assigning roles/groups and permissions](#assigning-rolesgroups-and-permissions)
+  * [Predefined roles / user templates](#predefined-roles--user-templates)
+    * [*openDesk User*](#opendesk-user)
+    * [*openDesk Administrator*](#opendesk-administrator)
+  * [Managing permissions](#managing-permissions)
+  * [Hierarchies and delegation](#hierarchies-and-delegation)
+  * [Audit/Logging](#auditlogging)
+  * [Reporting](#reporting)
+  * [Delegation](#delegation)
+  * [Regular review](#regular-review)
+* [Applications](#applications)
+  * [Roles/groups](#rolesgroups)
+<!-- TOC -->
+
+# Identity and Access Management (IAM)
+
+Within openDesk's Identity and Access Management component Nubus the openDesk user accounts are managed, as well as some core roles and permissions.
+
+## Permissions
+
+A permission represents a specific authorization that defines an action a user is allowed to perform on a resource.
+
+As openDesk consists of multiple applications, each application may have different needs regarding its fine-grained internal permissions, usually these permissions are manged within each component.
+
+The overall permissions to access the application as well as group membership of users is managed in the IAM.
+
+## Roles
+
+Roles are defined sets of permissions that can be assigned to users. Each role corresponds to a specific set of tasks and responsibilities within the system. In openDesk's IAM, two roles are defined by default:
+
+- **openDesk Administrator**: Manages openDesk-global settings, such as users and groups.
+- **openDesk User**: Can login to openDesk to make use of defined openDesk applications.
+
+> **Note**<br>
+> It is strongly recommended that a user account is not granted both roles at the same time to address the segregation of duties, though it is not enforced by openDesk.
+
+### Application usage
+
+To access and use applications in openDesk and to address [the principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), a user needs to have the necessary permissions set. openDesk defines the following permissions to access applications:
+
+- **Groupware**: Use email, calendar and address book applications.
+- **Chat**: Use the chat application.
+- **Knowledge Management**: Use the wiki application.
+- **Project Management**: Use the project management application.
+- **File Sharing**: Use the file sharing application.
+- **Video Conference**: Use the video conferencing application.
+
+### Application administration
+
+For applications that provide application-specific administrative settings, openDesk defines the following permissions:
+
+- **Knowledge Management Admin**: Manage the wiki application.
+- **Project Management Admin**: Manage the project management application settings.
+- **File Sharing Admin**: Manage the file sharing administrative settings.
+
+## Groups
+
+Groups help in clustering users with similar responsibilities and enable easier assignment of roles or permissions. It is often the case that a group maps directly to a role.
+
+openDesk predefines the following groups.
+
+### Global groups
+
+- **Domain Users**: Members of this group are *openDesk Users*.
+- **Domain Admins**: Members of this group are *openDesk IAM Administrators*. By default this group is also enable for two-factor authentication (2FA).
+- **2fa-users**: Members of this group that are forced to use two-factor authentication (2FA).
+- **IAM API - Full Access**: Members of this group have full (read and write) access to the IAM's REST API.
+
+### Application groups
+
+When editing a user in the IAM you can select if a user can access or get elevated admin permission for a specific application within the "openDesk" tab. The selection is stored as an attribute on the user object, but for other applications it is helpful to also expose the information as a group membership. Therefore openDesk comes with the following [groups](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/63-groups.yaml).
+
+To easily identify these groups all of them are prefixed with `managed-by-Attribute-`.
+
+> **Note**<br>
+> The membership of these groups is automatically managed, based on the user's attributes from the "openDesk" tab. So any changes directly to the groups will be overwritten, please always use the "openDesk" of the respective user. The IAM supports to edit user attributes in multiple accounts at once.
+
+#### Standard access to applications
+
+Unless a user is member of a group the respective application is not shown in the portal.
+
+> **Note**<br>
+> In openDesk's identity provider the required OIDC claims to access an application are only granted when the respective group membership is available. So even if a user who is not a member of an application group, knows the link to the application and calls it directly, the single sign-on will not be successful.
+
+- **managed-by-Attribute-Groupware**: Members of this group have access to the groupware applications.
+- **managed-by-Attribute-Fileshare**: Members of this group have access to the file sharing application.
+- **managed-by-Attribute-Projectmanagement**: Members of this group have access to the project management application.
+- **managed-by-Attribute-Knowledgemanagement**: Members of this group have access to the wiki application.
+- **managed-by-Attribute-Livecollaboration**: Members of this group have access to the chat application.
+- **managed-by-Attribute-Videoconference**: Members of this group have access to the video conferencing application.
+
+#### Administrative access to applications
+
+Within some applications it is possible to grant users elevated permissions, these are also primarily managed by attributes from the "openDesk" tab when editing a user, but are also automatically mapped to the following groups:
+
+- **managed-by-Attribute-FileshareAdmin**: Members of this group can administrate the file sharing application.
+- **managed-by-Attribute-ProjectmanagementAdmin**: Members of this group can administrate the project management application.
+- **managed-by-Attribute-KnowledgemanagementAdmin**: Members of this group can administrate the wiki application.
+
+### Custom groups
+
+While openDesk ships with predefined groups, additional groups can be [created](https://docs.opendesk.eu/administration/gruppen/) by an *IAM Administrator*.
+
+## Assigning roles/groups and permissions
+
+Users get roles assigned based on their responsibilities and the tasks they need to perform. This assignment can be done by an admin through the [administration portal](https://docs.opendesk.eu/administration/).
+
+## Predefined roles / user templates
+
+openDesk defines [templates](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/65-usertemplate.yaml) for the *User* and *Administrator* roles. The templates can be used to create users with these roles by an *openDesk Administrator* using the [administration portal](https://docs.opendesk.eu/administration/).
+
+> **Notes**<br>
+> Additional/custom templates can be created using the UDM REST API.
+
+### *openDesk User*
+
+The *openDesk User* template sets the primary group to *Domain Users* and initially sets the following permissions:
+
+- **Groupware**: Enabled
+- **Chat**: Enabled
+- **Knowledge Management**: Enabled
+- **Project Management**: Enabled
+- **File Sharing**: Enabled
+- **Video Conference**: Enabled
+- **Knowledge Management Admin**: Disabled
+- **Project Management Admin**: Disabled
+- **File Sharing Admin**: Disabled
+
+### *openDesk Administrator*
+
+The *openDesk Administrator* template sets the primary group to *Domain Admins* and initially sets the following permissions:
+
+- **Groupware**: Disabled
+- **Chat**: Disabled
+- **Knowledge Management**: Disabled
+- **Project Management**: Disabled
+- **File Sharing**: Disabled
+- **Video Conference**: Disabled
+- **Knowledge Management Admin**: Disabled
+- **Project Management Admin**: Disabled
+- **File Sharing Admin**: Disabled
+
+## Managing permissions
+
+*Administrators* can manage permissions of *Users* using the [administration portal](https://docs.opendesk.eu/administration/).
+
+By using roles and permissions, openDesk ensures that users have the appropriate level of access, enhancing both security and efficiency.
+
+## Hierarchies and delegation
+
+The IAM allows the nesting of groups, in that case a group has no or not only users as members but other groups.
+
+## Audit/Logging
+
+Univention is about to provide an audit logging which brings the idea of the [UCS based directory logger](https://docs.software-univention.de/manual/5.0/en/domain-ldap/ldap-directory.html#audit-proof-logging-of-ldap-changes) to Nubus. openDesk will offer this feature as soon as it is made available in Nubus.
+
+## Reporting
+
+The IAM webinterface supports the export of reports for users and groups, which are the essential objects when it comes to permissions. These data exports can be subject to custom data analysis.
+
+## Delegation
+
+Currently the temporary assignment of roles is not supported. Role membership must be managed at the time of granting / revoking the membership.
+
+## Regular review
+
+While the overall role and permission setup must be checked by the customer including the respective custom roles, the openDesk team is challenging and improving the role and permission management on a regular basis, e.g. to address the need for a distinct "support" role.
+
+# Applications
+
+As managing all the application permissions within the IAM would require a superset of permissions to be available in the IAM causing a high level of administrative complexity, the permissions are usually managed within an application itself and mapped to roles/groups that are managed in the IAM.
+
+## Roles/groups
+
+For each IAM group it can be configured for which openDesk application the group should be visible. Like with users this is done in the "openDesk" tab of the [group administration](https://docs.opendesk.eu/administration/gruppen/).
+
+> **Note**<br>
+> Currently the openDesk applications do not support nested groups. As a result only direct group memberships of users are processed in the application.<br>
+> The plan is to enable the openDesk applications to either support nested groups or to actively provision users into an application while resolving the nested group memberships for the application.
+
+Within an application each available group can get a set of application specific permissions assigned.

docs/requirements.md

@@ -2,9 +2,10 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Requirements</h1>
 
-This section covers the internal system requirements as well as external service requirements for productive use.
+This section covers the internal system requirements and external service requirements for productive use.
 
 <!-- TOC -->
 * [tl;dr](#tldr)
@@ -18,13 +19,15 @@ This section covers the internal system requirements as well as external service
 <!-- TOC -->
 
 # tl;dr
-openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s) cluster.
+
+openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s) cluster.
 
 - K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
-- Ingress controller (Ingress NGINX)
+- Ingress controller (Ingress NGINX) == [4.11.x/1.11.x](https://github.com/kubernetes/ingress-nginx/releases) - tested with 1.11.1 up to 1.11.4
+  - **Note**: We are working on support for more recent versions, as issues have been reported with 1.12.x.
 - [Helm](https://helm.sh/) >= v3.9.0
-- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v0.157.0**
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc8**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
 - Volume provisioner supporting RWO (read-write-once)
 - Certificate handling with [cert-manager](https://cert-manager.io/)
@@ -33,13 +36,11 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)
 
 The following minimal requirements are thought for initial evaluation deployment:
 
-| Spec | Value                                                 |
+| Spec | Value                                                 |
 | ---- | ----------------------------------------------------- |
-| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
-| RAM  | 32 GB, more recommended                               |
-| Disk | HDD or SSD, >10 GB                                    |
-
-Check [`scaling.md`](./scaling.md) for more details on resource requirements and scalability.
+| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
+| RAM  | 32 GB, more recommended                               |
+| Disk | HDD or SSD, >10 GB                                    |
 
 # Kubernetes
 
@@ -48,57 +49,59 @@ Any self-hosted or managed K8s cluster >= 1.24 listed in
 
 The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/kubespray) based clusters.
 
-> **Note:** The deployment is not tested against OpenShift.
+> **Note**<br>
+> The deployment is not tested against OpenShift.
 
 # Ingress controller
 
-The deployment is intended to use only over HTTPS via a configured FQDN, therefor it is required to have a proper
+The deployment is intended to be used only over HTTPS via a configured FQDN, therefore it is required to have a proper
 configured ingress controller deployed.
 
 **Supported controllers:**
 - [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx)
 
-Note: The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/).
-If you have feedback on that topic, please share it with us.
+> **Note**<br>
+> The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/). If you have feedback on that topic, please share it with us.
 
 # Volume provisioner
 
-Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment a local- or hostPath-
+Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment, a local- or hostPath-
 provisioner is sufficient.
 
-> **Note:** Some components requiring a `ReadWriteMany` volume provisioner for distributed mode or scaling.
+> **Note**<br>
+> Some components require a `ReadWriteMany` volume provisioner for distributed mode or scaling.
 
 # Certificate management
 
 This deployment leverages [cert-manager](https://cert-manager.io/) to generate valid certificates. This is **optional**,
 but a secret containing a valid TLS certificate is required.
 
-Only `Certificate` resources will be deployed, the `cert-manager` including its CRD must be installed prior to this or
-openDesk certificate management disabled.
+Only `Certificate` resources will be deployed; the `cert-manager`, including its CRD must be installed before this or
+openDesk certificate management switched off.
 
 # External services
 
-For development and evaluation of openDesk we bundle some service to start with. Be aware that for production
-deployments you need to make use of your own production grade services, see the
+For the development and evaluation of openDesk, we bundle some services. Be aware that for production
+deployments, you need to make use of your own production-grade services; see the
 [external-services.md](./external-services.md) for configuration details.
 
-| Group    | Type                | Version | Tested against        |
+| Group    | Type                | Version | Tested against        |
 | -------- | ------------------- | ------- | --------------------- |
-| Cache    | Memcached           | `1.6.x` | Memcached             |
-|          | Redis               | `7.x.x` | Redis                 |
-| Database | MariaDB             | `10.x`  | MariaDB               |
-|          | PostgreSQL          | `15.x`  | PostgreSQL            |
-| Mail     | Mail Transfer Agent |         | Postfix               |
-|          | PKI/CI (S/MIME)     |         |                       |
-| Security | AntiVirus/ICAP      |         | ClamAV                |
-| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
-|          | K8s ReadWriteMany   |         | Ceph / NFS            |
-|          | Object Storage      |         | MinIO                 |
-| Voice    | TURN                |         | Coturn                |
+| Cache    | Memcached           | `1.6.x` | Memcached             |
+|          | Redis               | `7.x.x` | Redis                 |
+| Database | MariaDB             | `10.x` | MariaDB               |
+|          | PostgreSQL          | `15.x` | PostgreSQL            |
+| Mail     | Mail Transfer Agent |         | Postfix               |
+|          | PKI/CI (S/MIME)     |         |                       |
+| Security | AntiVirus/ICAP      |         | ClamAV                |
+| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
+|          | K8s ReadWriteMany   |         | Ceph / NFS            |
+|          | Object Storage      |         | MinIO                 |
+| Voice    | TURN                |         | Coturn                |
 
 # Deployment
 
-The deployment of each individual component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
+The deployment of each component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
 templated via [Helmfile](https://helmfile.readthedocs.io/en/latest/) to provide a streamlined deployment experience.
 
-Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare desired against deployed state.
+Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare the desired against the deployed state.

docs/scaling.md

@@ -5,18 +5,18 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Scaling</h1>
 
-This document should cover the abilities to scale apps.
+This document covers the ability to scale applications.
 
 # Horizontal scalability
 
 We are working on generating this document automatically based on the file
-[`replicas.yaml`](../helmfile/environments/default/replicas.yaml) that contains necessary annotations.
-In the meantime this file can be used to check the components scaling support / capabilities.
+[`replicas.yaml.gotmpl`](../helmfile/environments/default/replicas.yaml.gotmpl) that contains necessary annotations.
+In the meantime, this file can be used to check the components scaling support/capabilities.
 
 # Upstream information
 
 While scaling services horizontally is the ideal solution, information about vertical scaling is helpful
-when it comes to defining the applications resources, see [`resources.yaml`](../helmfile/environments/default/resources.yaml) for references.
+when defining the application's resources, see [`resources.yaml.gotmpl`](../helmfile/environments/default/resources.yaml.gotmpl) for references.
 
 Please find below links to the application's upstream resources about scaling:
 

docs/security-context.md

@@ -1,9 +1,10 @@
 <!--
-SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
 <h1>Kubernetes Security Context</h1>
 
+<!-- TOC -->
 * [Container Security Context](#container-security-context)
   * [allowPrivilegeEscalation](#allowprivilegeescalation)
   * [capabilities](#capabilities)
@@ -14,6 +15,7 @@ SPDX-License-Identifier: Apache-2.0
   * [readOnlyRootFilesystem](#readonlyrootfilesystem)
   * [runAsNonRoot](#runasnonroot)
 * [Status quo](#status-quo)
+<!-- TOC -->
 
 # Container Security Context
 
@@ -60,7 +62,7 @@ containerSecurityContext:
 ## privileged
 
 
-Privileged Pods disable most security mechanisms and must be disallowed.
+Privileged Pods eliminate most security mechanisms and must be disallowed.
 
 ```yaml
 containerSecurityContext:
@@ -90,7 +92,7 @@ containerSecurityContext:
 ## seccompProfile
 
 
-Seccomp profile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
+The seccompProfile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
 
 ```yaml
 containerSecurityContext:
@@ -110,7 +112,7 @@ containerSecurityContext:
 ## readOnlyRootFilesystem
 
 
-Containers should have an immutable file systems, so that attackers could not modify application code or download malicious code.
+Containers should have an immutable file systems, so that attackers can not modify application code or download malicious code.
 
 ```yaml
 containerSecurityContext:
@@ -130,10 +132,10 @@ containerSecurityContext:
 # Status quo
 
 
-openDesk aims to achieve that all security relevant settings are explicitly templated and comply with security recommendations.
+openDesk aims to ensure that all security relevant settings are explicitly templated and comply with security recommendations.
 
 
-The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are also properly templated by the given Helm charts.
+The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are properly templated by the Helm charts.
 
 
 This list gives you an overview of templated security settings and if they comply with security standards:
@@ -141,11 +143,11 @@ This list gives you an overview of templated security settings and if they compl
 
  - **yes**: Value is set to `true`
  - **no**: Value is set to `false`
- - **n/a**: No explicitly templated in openDesk and default is used.
+ - **n/a**: Not explicitly templated in openDesk; default is used.
 
 | process | status | allowPrivilegeEscalation | privileged | readOnlyRootFilesystem | runAsNonRoot | runAsUser | runAsGroup | seccompProfile | capabilities |
 | ------- | ------ | ------------------------ | ---------- | ---------------------- | ------------ | --------- | ---------- | -------------- | ------------ |
-| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT","MKNOD"] |
+| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","FOWNER","SYS_CHROOT"] |
 | **cryptpad**/cryptpad | :x: | no | no | no | yes | 4001 | 4001 | yes | yes |
 | **element**/matrix-neoboard-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/matrix-neochoice-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
@@ -158,18 +160,44 @@ This list gives you an overview of templated security settings and if they compl
 | **element**/opendesk-synapse | :white_check_mark: | no | no | yes | yes | 10991 | 10991 | yes | yes |
 | **element**/opendesk-synapse-web | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-well-known | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
-| **intercom-service**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **jitsi**/jitsi | :white_check_mark: | no | no | yes | yes | 1993 | 1993 | yes | yes |
 | **jitsi**/jitsi/jitsi/jibri | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no ["SYS_ADMIN"] |
 | **jitsi**/jitsi/jitsi/jicofo | :x: | no | no | no | no | 0 | 0 | yes | no |
+| **jitsi**/jitsi/jitsi/jigasi | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/jvb | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/prosody | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/web | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/patchJVB | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 65532 | 65532 | yes | yes |
-| **nextcloud**/opendesk-nextcloud/apache2 | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 101 | 101 | yes | yes |
+| **nextcloud**/opendesk-nextcloud/aio | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
-| **nextcloud**/opendesk-nextcloud/php | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **notes**/impress/backend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **notes**/impress/frontend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **notes**/impress/yProvider | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **nubus**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/intercom-service/provisioning | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/keycloak | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/authorizationApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/managementApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/managementUi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/openPolicyAgent | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusKeycloakBootstrap | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusKeycloakExtensions/handler | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusKeycloakExtensions/proxy | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusLdapNotifier | :x: | no | n/a | yes | yes | 101 | 102 | yes | yes |
+| **nubus**/ums/nubusNotificationsApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusPortalConsumer | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusPortalFrontend | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusPortalServer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusProvisioning | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusProvisioning/nats | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusSelfServiceConsumer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusStackDataUms | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUdmListener | :x: | no | n/a | yes | yes | 102 | 65534 | yes | yes |
+| **nubus**/ums/nubusUdmRestApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUmcGateway | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUmcServer | :x: | no | n/a | yes | no | 0 | 0 | yes | yes |
 | **open-xchange**/dovecot | :x: | no | n/a | yes | n/a | n/a | n/a | yes | no ["CHOWN","DAC_OVERRIDE","KILL","NET_BIND_SERVICE","SETGID","SETUID","SYS_CHROOT"] |
 | **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
@@ -181,33 +209,26 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/appsuite/guard-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/nextcloud-integration-ui | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/opendesk-open-xchange-bootstrap | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-migrations-post**/opendesk-migrations-post | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-migrations-pre**/opendesk-migrations-pre | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-services**/opendesk-static-files | :x: | no | n/a | yes | yes | 101 | 101 | yes | yes |
 | **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **provisioning**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
-| **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/minio | :x: | no | no | no | yes | 1000 | 0 | yes | yes |
-| **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
-| **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/ldap-notifier | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
-| **univention-management-stack**/ums/portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
-| **univention-management-stack**/ums/stack-gateway | :x: | no | no | no | yes | 1001 | 0 | yes | yes |
-| **univention-management-stack**/ums/umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **services-external**/cassandra | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
+| **services-external**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/minio | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/opendesk-dkimpy-milter | :x: | yes | no | yes | yes | 1000 | 1000 | yes | no |
+| **services-external**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
+| **services-external**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |
 
 

docs/security.md

@@ -15,37 +15,37 @@ This document should cover the current status of security measurements.
 
 # Helm Chart Trust Chain
 
-Helm charts are signed and validated against GPG keys which can be found in `helmfile/files/gpg-pubkeys`.
+Helm charts are signed and validated against GPG keys in `helmfile/files/gpg-pubkeys`.
 
-For more details on Chart validation please visit: https://helm.sh/docs/topics/provenance/
+For more details on Chart validation, please visit: https://helm.sh/docs/topics/provenance/
 
 All charts except the ones mentioned below are verifiable:
 
-| Repository        | Verifiable |
+| Repository        | Verifiable |
 |-------------------|:----------:|
-| open-xchange-repo |     no     |
+| open-xchange-repo |     no     |
 
 # Kubernetes Security Enforcements
 
-This list gives you an overview of default security settings and if they comply with security standards:
+This list gives you an overview of default security settings and whether they comply with security standards:
 
 ⟶ Visit our generated detailed [Security Context](./security-context.md) overview.
 
 # NetworkPolicies
 
-Kubernetes NetworkPolicies are an important measure to secure your kubernetes apps and clusters.
+Kubernetes NetworkPolicies are an essential measure to secure your Kubernetes apps and clusters.
 When applied, they restrict the traffic to your services.
-This protects other deployments in your cluster or other services in your deployment to get compromised when one
+This protects other deployments in your cluster or other services in your deployment from getting compromised when one
 component is compromised.
 
 We ship a default set of Otterize ClientIntents via
 [Otterize intents operator](https://github.com/otterize/intents-operator) which translates intent-based access control
-(IBAC) into kubernetes native NetworkPolicies.
+(IBAC) into Kubernetes native NetworkPolicies.
 
 This requires the Otterize intents operator to be installed.
 
 ```yaml
 security:
-  otterizeIntents:
-    enabled: true
+  otterizeIntents:
+    enabled: true
 ```

docs/theming.md

@@ -5,53 +5,26 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Theming</h1>
 
-This document will cover the theming and customization of your openDesk deployment.
+This document covers the theming options for an openDesk deployment.
 
 <!-- TOC -->
-* [Strings and texts](#strings-and-texts)
-* [Colors](#colors)
-  * [Images and Logos](#images-and-logos)
-* [Known limits](#known-limits)
+* [Settings](#settings)
+* [Known limitations](#known-limitations)
 <!-- TOC -->
 
-# Strings and texts
+# Settings
 
-The deployment name can be changed by:
+All default settings can be found in the [`theme.gotmpl`](../helmfile/environments/default/theme.gotmpl). Most of the components adhere to these settings.
 
-```yaml
-theme:
-  texts:
-    productName: "openDesk Cloud"
-```
+Please review the default configuration that is applied to understand your customization options.
 
-# Colors
+You can just update the files in:
+- [helmfile/files/theme](../helmfile/files/theme): To change logos, favicons etc.
+- [helmfile/files/portal-tiles](../helmfile/files/portal-tiles): To change the icons in the portal.
 
-The primary color and their derives with lesser opacity be customized by:
-
-```yaml
-theme:
-  colors:
-    primary: "#5e27dd"
-    primary65: "#9673e9"
-    primary35: "#c7b3f3"
-    primary15: "#e7dffa"
-```
-
-## Images and Logos
-
-You can customize the logo and favicon by providing SVG or icon as inline value:
-
-```yaml
-theme:
-  imagery:
-    logoHeaderSvg: '<?xml version="1.0" encoding="UTF-8"?>...</svg>'
-    logoHeaderSvgWhite: '<?xml version="1.0" encoding="UTF-8"?>...</svg>'
-    logoPortalBackgroundSvg: '<?xml version="1.0" encoding="UTF-8"?>...</svg>'
-    faviconIco: "..."
-```
-
-# Known limits
+# Known limitations
 
 Not all applications support theming. Known exceptions are:
-  - OpenProject
-  - Jitsi
+- OpenProject, comes with a build in openDesk theming that can be modified in the Enterprise version's OpenProject web interface.
+- The portal background logo can (currently) only be set on initial deployment.
+- Portal and Keycloak screen styles must be applied in the [`portalStylesheets.css`](../helmfile/files/theme/portalStylesheet.css).

docs/workflow.md

@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Technical development and release workflow</h1>
 
+<!-- TOC -->
 * [Scope](#scope)
 * [Roles and responsibilities](#roles-and-responsibilities)
 * [Deployment automation](#deployment-automation)
@@ -29,6 +30,7 @@ SPDX-License-Identifier: Apache-2.0
       * [Commit messages / Conventional Commits](#commit-messages--conventional-commits)
       * [Verified commits](#verified-commits)
 * [Footnotes](#footnotes)
+<!-- TOC -->
 
 # Scope
 
@@ -63,7 +65,7 @@ The following section should provide a high-level view of the involved parties i
 - **Operator**
   - Focus areas
     - Providing production-grade required services (e.g. persistence layer) to operate openDesk
-    - Rollout, operate, and support openDesk
+    - Rollout, operate and support openDesk
     - Further develop the deployment automation to meet extended operational requirements, ideally providing these developments upstream to openDesk platform development to adopt them into the standard
   - The operator can either use a self-operated Kubernetes cluster to deploy openDesk or make use of managed Kubernetes offerings of a **Cloud Provider**.
 
@@ -71,52 +73,53 @@ The following section should provide a high-level view of the involved parties i
 
 The openDesk deployment automation is the core outcome of the platform development process.
 
-The openDesk platform development team created and maintains the deployment automation to allow interested parties to deploy openDesk into their cloud infrastructure with a low entry barrier. The core technology for the automation are [Helm charts](https://helm.sh/) which are orchestrated using [Helmfile](https://github.com/helmfile/helmfile). Of course this deployment is also used in the everyday work by the suppliers and the platform team.
+The openDesk platform development team created and maintains the deployment automation to allow interested parties to deploy openDesk into their cloud infrastructure with a low entry barrier. The core technology for the automation is [Helm](https://helm.sh/), which is orchestrated using [Helmfile](https://github.com/helmfile/helmfile). Of course, this deployment is also used by the suppliers and the platform team in everyday work.
 
-Please find the deployment automation including the relevant documentation here: https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace
+Please find the deployment automation, including its documentation, in the following project: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk
 
-The automation supports Gitlab CI/CD execution as well as local execution triggering the Helmfile deployment for the whole platform or single applications.
+The automation supports Gitlab CI/CD and local execution, triggering the Helmfile deployment for the whole platform or single applications.
 
 ## openDesk technical component classes
 
 The below rendering in class diagram notation shows the three component classes openDesk consists of. In each of these:
-- the first section below the name of the class shows the required **characteristics** of each component of the given class, and
-- the second section shows the **methods** like linting that have to be applied to artifacts of that class.
+- the first section below the name of the class shows the required **characteristics** of each component of the given class and
+- the second section shows the **methods** like linting that must be applied to that class's artifacts.
 
-**Note:** The methods prefixed with '-' are not yet available in `gitlab-config` you will learn about them later.
+> **Note**<br>
+> The methods prefixed with '-' are not yet available in `gitlab-config`. You will learn about them later.
 
 ```mermaid
 classDiagram
-    Images <|-- Helm_charts
-    Images <|-- Helmfile_based_deployment_automation
-    Helm_charts <|-- Helmfile_based_deployment_automation
-    class Images{
-        SBOM
-        SBOM signature
-        Image signature
-        reuseLint()
-        CVE analysis()
-        hadolint()
-        Malware scan()
-    }
-    class Helm_charts{
-        HelmDocs
-        Helm chart signature
-        reuseLint()
-        KubeLinter()
-        YamlLint()
-        -Kubescape()
-    }
-    class Helmfile_based_deployment_automation{
-        reuseLint()
-        YamlLint()
-        -markdownlint()
-    }
+ Images <|-- Helm_charts
+ Images <|-- Helmfile_based_deployment_automation
+ Helm_charts <|-- Helmfile_based_deployment_automation
+ class Images{
+ SBOM
+ SBOM signature
+ Image signature
+ reuseLint()
+ CVE analysis()
+ hadolint()
+ Malware scan()
+ }
+ class Helm_charts{
+ HelmDocs
+ Helm chart signature
+ reuseLint()
+ KubeLinter()
+ YamlLint()
+ -Kubescape()
+ }
+ class Helmfile_based_deployment_automation{
+ reuseLint()
+ YamlLint()
+ -markdownlint()
+ }
 ```
 
 ## Functional vs. service components
 
-The focus of openDesk is to provide an integrated functional productivity platform based on the functional components (products) of the involved suppliers. These functional components usually rely on certain service components, e.g. database services for persistence. When running openDesk in production the operator is responsible for providing these services production grade. For evaluation and development purposes the openDesk deployment automation includes these services.
+The focus of openDesk is to provide an integrated functional productivity platform based on the involved suppliers' functional components (products). These functional components usually rely on specific service components, e.g. database services for persistence. When running openDesk in production, the operator is responsible for providing these services in production-grade. For evaluation and development purposes, the openDesk deployment automation includes these services.
 
 Find the list of functional and service components in the [deployment automation's components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/blob/main/docs/components.md).
 
@@ -124,9 +127,9 @@ Find the list of functional and service components in the [deployment automation
 
 The openDesk platform consolidates the technical components from various origins:
 
-1) Supplier - for functional components: Provide their upstream product including sometimes openDesk-specific builds or extensions and also the deployment of the product (Helm charts).
-2) 3rd party upstream - for service components: The platform development tries to use as many as possible community upstream components for the services they have to provide within openDesk.
-3) Platform development - filling the gap: Some suppliers might not provide Helm charts or images for their product that fit the needs of openDesk and some 3rd party upstream components are not built to fit into openDesk. In these cases, the platform development team creates their own Helm charts and images.
+1) *Supplier* for functional components: Provide their upstream product, sometimes including openDesk-specific builds or extensions and product deployment (Helm charts).
+2) *Third-party upstream* for service components: The platform development team tries to use as many community upstream components as possible for the services they have to provide within openDesk.
+3) Platform development* filling the gap: Some suppliers might not provide Helm charts or images for their products that fit the needs of openDesk, and some third-party upstream components are not built to fit into openDesk. In these cases, the platform development team creates its own Helm charts and images.
 
 ## Reference CI for creating Images and Helm charts (gitlab-config)
 
@@ -143,9 +146,10 @@ openDesk uses Apache 2.0 as the license for their work. A typical reuse copyrigh
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ```
-As the way to mark the license header as a comment differs between the various filetypes, please find matching examples for the types all across the [deployment automation repository](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace).
+The way to mark the license header as a comment differs between the various file types. Please find matching examples for all types across the [deployment automation repository](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace).
 
-**Remark**: If there is already an existing `SPDX-FileCopyrightText` please just add the one from the above example.
+> **Note**<br>
+> If an `SPDX-FileCopyrightText` already exists, do not replace but add an additional line based on the above example.
 
 ## Development workflow
 
@@ -153,11 +157,11 @@ As the way to mark the license header as a comment differs between the various f
 
 openDesk consists only of community products, so there is no SLA to receive service updates or backport of critical security fixes. This has two consequences:
 - In production scenarios, you should replace the community versions of the functional components with supported, SLA-backed paid versions.
-- openDesk aims to always update to the latest available releases of the community components and we therefore have rolling technical releases.
+- openDesk aims to update the community components' latest available releases continually; therefore, we have rolling technical releases.
 
 ### Workflow
 
-This chapter describes the development workflow of the deployment automation. The suppliers have their development processes and workflows. While we aim to update always to the most recent community version(s) available, openDesk also sponsors development done by the suppliers. As the openDesk team has to take a closer look at these sponsored features, they are referred to as *supplier deliverables* within the platform development workflow.
+This chapter describes the deployment automation's development workflow. The suppliers have their own development processes and workflows. While we aim to always update to the most recent community version(s) available, openDesk also sponsors the development done by the suppliers. As the openDesk team has to take a closer look at these sponsored features, they are referred to as *supplier deliverables* within the platform development workflow.
 
 #### Branching concept
 
@@ -165,7 +169,7 @@ The picture below uses Gitflow notation to give an overview of the different typ
 
 The basic facts for the flow are:
 - When the `develop` branch is merged into `main` a technical release is created (except when the merge commit(s) are of type `chore` or `docs`)
-- Changes that will be applied to openDesk have to branch off from `develop`, we call these branches *feature* branches.
+- Changes that will be applied to openDesk have to branch off from `develop`; we call these branches *feature* branches.
   - Developers can create sub-branches from their feature branch(es) as needed.
 - When a *feature* branch gets pushed a Merge Request in `Draft` state is automatically created.
 - We know three types of *feature* branches:
@@ -175,53 +179,53 @@ The basic facts for the flow are:
     - supplier deliverables and
     - configurational changes that have a significant impact on openDesk users or require migrations[^1]
 - The *QG* entries in the workflow refer to quality gates that are explained in more detail later
-- All merges into `develop` or `main` require two approvals from the platform development team[^2]. The approvers have to ensure that the defined quality gates have been passed successfully.
+- All merges into `develop` or `main` require two approvals from the platform development team[^2]. The approvers must ensure that the defined quality gates have been passed successfully.
 
 ```mermaid
 gitGraph
-    commit id: "QA 'nightly main'"
-    commit id: " "
-    branch "develop"
-    checkout "develop"
-    commit id: "QA 'nightly develop'"
-    commit id: "  "
-    branch "docs"
-    checkout "docs"
-    commit id: "Documentation commits" type: HIGHLIGHT
-    checkout "develop"
-    merge "docs"
-    checkout "main"
-    merge "develop" tag: "No release"
-    checkout "develop"
-    commit id: "   "
-    branch "fix"
-    checkout "fix"
-    commit id: "Maintenance commits" type: HIGHLIGHT
-    commit id: "QG 'fix'" type: REVERSE
-    checkout "develop"
-    merge "fix"
-    commit id: "QA 'release merge'" type: REVERSE
-    checkout "main"
-    merge "develop" tag: "Patch or minor release"
-    checkout "develop"
-    commit id: "    "
-    branch "feat"
-    checkout "feat"
-    commit id: "Feature commits" type: HIGHLIGHT
-    commit id: "QG 'feat'" type: REVERSE
-    commit id: "Manual Feature QA" type: REVERSE
-    commit id: "Develop Tests"
-    commit id: "Documentation"
-    checkout "develop"
-    merge "feat"
-    commit id: "QA 'release merge' " type: REVERSE
-    checkout "main"
-    merge "develop" tag: "Minor or major release"
-    checkout "develop"
-    checkout "main"
-    commit id: "     "
-    commit id: "Manual Functional Release Activities" type: HIGHLIGHT
-    commit id: "      "
+ commit id: "QA 'nightly main'"
+ commit id: " "
+ branch "develop"
+ checkout "develop"
+ commit id: "QA 'nightly develop'"
+ commit id: "  "
+ branch "docs"
+ checkout "docs"
+ commit id: "Documentation commits" type: HIGHLIGHT
+ checkout "develop"
+ merge "docs"
+ checkout "main"
+ merge "develop" tag: "No release"
+ checkout "develop"
+ commit id: "   "
+ branch "fix"
+ checkout "fix"
+ commit id: "Maintenance commits" type: HIGHLIGHT
+ commit id: "QG 'fix'" type: REVERSE
+ checkout "develop"
+ merge "fix"
+ commit id: "QA 'release merge'" type: REVERSE
+ checkout "main"
+ merge "develop" tag: "Patch or minor release"
+ checkout "develop"
+ commit id: "    "
+ branch "feat"
+ checkout "feat"
+ commit id: "Feature commits" type: HIGHLIGHT
+ commit id: "QG 'feat'" type: REVERSE
+ commit id: "Manual Feature QA" type: REVERSE
+ commit id: "Develop Tests"
+ commit id: "Documentation"
+ checkout "develop"
+ merge "feat"
+ commit id: "QA 'release merge' " type: REVERSE
+ checkout "main"
+ merge "develop" tag: "Minor or major release"
+ checkout "develop"
+ checkout "main"
+ commit id: "     "
+ commit id: "Manual Functional Release Activities" type: HIGHLIGHT
+ commit id: "      "
 ```
 
 #### Standard Quality Gate (SQG)
@@ -231,8 +235,8 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
 1. Linting
    - Blocking
      - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
-     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in [development.md](./development.md).
-   - Non Blocking
+     - openDesk specific: Especially `images.yaml.gotmpl` and `charts.yaml.gotmpl`, find more details in [development.md](./development.md).
+   - Non-Blocking
      - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
      - Formal: Yaml
 1. Deploy the full openDesk stack from scratch:
@@ -247,26 +251,26 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
    - CVE check[^5]
    - Kubescape scan[^5]
 
-Steps #1 to #3 from above are executed as GitLab CI and therefore documented within GitLab.
+Steps #1 to #3 from above are executed as GitLab CI and documented within GitLab.
 
-Step #4 is focussed on security and was not fully implemented yet. Its main objective is to check for regressions. That step is just the second step of a security check and monitoring chain as shown below. While some checks can be executed against the static artifacts (e.g. container images) other might require an up-and-running instance. These are especially located in the third step below which is not yet implemented.
+Step #4 is focused on security and has not been fully implemented yet. Its main objective is to check for regressions. That step is just the second step of a security check and monitoring chain, as shown below. While some checks can be executed against static artifacts (e.g., container images), others might require an up-and-running instance. These are especially located in the third step below, which has not yet been implemented.
 
 ```mermaid
 flowchart TD
-    A[<u><b>Container image</b></u>
-    checks during build time
-    e.g. based on openDesk
-    reference implementation 'gitlab-config'.
-    >> Can the artefact be integrated? <<
-    ] -->|integrate artifacts| B[<u><b>Deployment automation</b></u> SQG
-    based on GitLab CI during
-    technical release process.
-    >> Can the platform be released? <<
-    ]
-    B-->|release| C[<u><b>openDesk release</b></u> monitoring
-    on a regular e.g. daily or live basis.
-    >> Do we need to fix something? <<
-    ]
+ A[<u><b>Container image</b></u>
+ checks during build time
+ e.g. based on openDesk
+ reference implementation 'gitlab-config'.
+ >> Can the artifact be integrated? <<
+ ] -->|integrate artifacts| B[<u><b>Deployment automation</b></u> SQG
+ based on GitLab CI, during
+ technical release process.
+ >> Can the platform be released? <<
+ ]
+ B-->|release| C[<u><b>openDesk release</b></u> monitoring
+ on a regular e.g. daily or live basis.
+ >> Do we need to fix something? <<
+ ]
 ```
 
 #### Branch workflows
@@ -276,55 +280,54 @@ This section will explain the workflow for each branch (type) based on the Gitfl
 ##### `main`
 
 - `QA 'nightly main'`: Execute the SQG based on the most recent release. The upgrade test environment should be a long-standing environment that only gets built from scratch with the previous technical release when something breaks the environment.
-- Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release) which itself is based on the [Semantic Versioning (SemVer) notation](https://semver.org) to automatically create technical releases on the merge points.
-  - "No release": When a merge from `develop` includes only changes from `docs` branches the merge into `main` will only consist of `docs` or `chore` commits. No new release will be generated by that merge.
-  - "Patch or minor release": When changes from `fix` branches get merged these might contain `fix` or `feat` commits causing a new technical release to be built with an updated version on Patch or Minor level.
-  - "Minor or major release": When changes from `feat` branches get merged these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on Minor or Major level.
+Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release), which is based on the [Semantic Versioning (SemVer) notation](https://semver.org), to automatically create technical releases on the merge points.
+  - "No release": When a merge from `develop` includes only changes from `docs` branches, the merge into `main` will only consist of `docs` or `chore` commits. That merge will generate no new release.
+  - "Patch or minor release": When changes from `fix` branches get merged, these might contain `fix` or `feat` commits, causing a new technical release to be built with an updated version on the Patch or Minor level.
+  - "Minor or major release": When changes from `feat` branches get merged, these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on the Minor or Major level.
 - "Manual Functional Release Activities": Technical releases are loosely coupled to functional releases. The additional activities for a functional release select an existing technical release as a basis to generate the artifacts required for a functional release, for example:
   - Conduct additional manual explorative and regression tests.
   - Perform checks like IT Grundschutz, Accessibility, or Data Protection.
 
 ##### `develop`
 
-- `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based in this case on the head revision of the `develop` branch.
+- `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based on the head revision of the `develop` branch.
 - `QA 'release merge'`: The Merge Request for this merge has to be created manually by members of the platform development team. It should document:
   - That the SQG was successfully executed upon the to-be merged state - it could be done explicitly or based on a `QA 'nightly develop'`
-  - In case of `fix` changes that usually how no test automation: Changes have been verified by a member of the platform development team.
-  - That the changes have been reviewed by at least two members of the platform development team giving their approval on the Merge Request.
+  - In case of `fix` changes that usually have no test automation, Changes have been verified by a member of the platform development team.
+  - That the changes have been reviewed by at least two members of the platform development team, giving their approval on the Merge Request.
 - Merge points (from `docs`, `fix`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.
 
 ##### `docs`
 
-Branches of type `docs` only contain the commits themselves and have to adhere to the workflow basic fact that:
-> All merges into `develop` or `main` require two approvals from the platform development team.
+Branches of type `docs` only contain the commits themselves and have to adhere to the workflow basic fact that: All merges into `develop` or `main` require two approvals from the platform development team.
 
 ##### `fix`
 
-Besides the actual changes being committed in an `fix` branch there is only the:
-- `QG 'fix'`: In addition to validating the actual change the owner of the branch has to ensure the successful execution of the SQG.
+Besides the actual changes being committed in an `fix` branch, there is only the:
+- `QG 'fix'`: Besides validating the actual change, the branch's owner has to ensure the successful execution of the SQG.
 
 ##### `feat`
 
 This branch type requires the most activities on top of the actual development:
-- `QG 'feat'`: The owner of the branch has to validate the implemented functionality and has to ensure the SQG is passed successfully.
+- `QG 'feat'`: The branch owner has to validate the implemented functionality and ensure the SQG is passed successfully.
 - `Manual Feature QA`:
-  - This is the actual interface between the platform development workflow and the supplier work package workflow.
+  - This is the interface between the platform development workflow and the supplier work package workflow.
   - The openDesk QA team validates the change, ideally based on the acceptance criteria defined in the supplier's work package definition.
-    - If improvements are needed QA passes on the feedback to the developer/supplier.
-    - If the QA was successful test cases for the test automation of the feature are defined.
+    - QA passes on the feedback to the developer/supplier if improvements are needed.
+    - Test cases for the feature's test automation are defined if the QA was successful.
     - QA should also evaluate if there is a need for end-user documentation of the feature.
 - `Develop Test`: The test cases are implemented by the openDesk platform development and added to the openDesk end-to-end test suite.
-- `Documentation`: When required the documentation team has to update the end-user documentation.
+- `Documentation`: When required, the documentation team has to update the end-user documentation.
 
 #### Branch names
 
-Branches created from the `develop` branch have to adhere to the following notation: `<type>/<responsible_developer>/<details>`:
+Branches created from the `develop` branch have to adhere to the following notation: `<responsible_developer>/<type>_<details>`:
 
+- `<responsible_developer>`: Something that makes you identifiable as the owner of the branch, e.g. the first letter of your first name followed by your family name.
 - `<type>`: From the list of branch types explained above:
   - `docs`
   - `fix`
   - `feat`
-- `<responsible_developer>`: Something that makes you identifiable as owner of the branch, e.g. the first letter of your first name followed by your family name.
 - `<details>`: A very short note about what is going to happen in the branch and ideally what component is affected from the following list of components:
   - `helmfile`
   - `ci`
@@ -340,9 +343,10 @@ Branches created from the `develop` branch have to adhere to the following notat
   - `services`
   - `xwiki`
 
-Example: `feat/tmueller/bump_nextcloud_to_29.0.0`.
+Example: `tmueller/fix_jitsi_theming`.
 
-**Note**: The above naming convention is not enforced yet, but please ensure you make use of it.
+> **Note**<br>
+> The above naming convention has yet to be enforced, but please ensure you use it.
 
 #### Commit messages / Conventional Commits
 
@@ -350,23 +354,24 @@ Commit messages must adhere to the [Conventional Commit standard](https://www.co
 
 ```text
 <type>(<scope>): [path/to/issue#1] <short summary>.
-  │       │              │                │
-  │       │              |                └─> Summary in present tense, sentence case, with no period at the end
-  │       │              |
-  │       │              └─> Issue reference (optional)
-  │       │
-  │       └─> Commit Scope: helmfile, docs, collabora, intercom-service, ...
-  │
-  └─> Commit Type: chore, ci, docs, feat, fix
+ │       │              │                │
+ │       │              |                └─> Summary in present tense, sentence case, with no period at the end
+ │       │              |
+ │       │              └─> Issue reference (optional)
+ │       │
+ │       └─> Commit Scope: helmfile, docs, collabora, nextcloud, open-xchange, etc.
+ │
+ └─> Commit Type: chore, ci, docs, feat, fix
 ```
 
 Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`
 
-**Beware**: The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.
+> **Note**<br>
+> The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.
 
 #### Verified commits
 
-We only allow verified commits, please read on about the options you have to make your commits verified:
+We only allow verified commits; please read on about the options you have to make your commits verified:
 - https://docs.gitlab.com/ee/user/project/repository/ssh_signed_commits/
 - https://docs.gitlab.com/ee/user/project/repository/gpg_signed_commits/
 - https://docs.gitlab.com/ee/user/project/repository/x509_signed_commits/
@@ -375,10 +380,10 @@ We only allow verified commits, please read on about the options you have to mak
 
 [^1]: Migrations are in general not supported before openDesk hits [technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) v1.0.0
 
-[^2]: These approval rules are not available in the Gitlab Free Tier which is one of the main reasons why the deployment automation is not developed on Open CoDE.
+[2]: These approval rules are not available in the Gitlab Free Tier, which is one of the main reasons why deployment automation is not developed on Open CoDE.
 
 [^3]: As long as migrations/upgrade paths are not provided - see also footnote #1 - this step is optional.
 
-[^4]: The SBOM process is currently executed asynchronously to the development process and tests the most current technical release from main. The process is not fully automated yet.
+[^4]: The SBOM process is executed asynchronously with the development process and tests the most current technical release from the `main` branch. The process still needs to be fully automated.
 
-[^5]: The quality gate is not yet implemented especially when it comes to identifying regressions.
+[^5]: The quality gate needs to be implemented primarily when identifying regressions.

helmfile.yaml.gotmpl

@@ -15,14 +15,14 @@ environments:
 ---
 # yamllint disable
 helmfiles:
-  - path: "./helmfile_generic.yaml"
+  - path: "./helmfile_generic.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 # {{/*
 #
 #   Use this format from a remote repository
 #
-#   - path: "git::https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git@helmfile_generic.yaml?ref=v0.7.1"
+#   - path: "git::https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git@helmfile_generic.yaml.gotmpl?ref=v0.7.1"
 #     values:
 #       - {{ toYaml .Values | nindent 8 }}
 # */}}

helmfile/apps/collabora/helmfile-child.yaml

@@ -1,27 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
----
-repositories:
-  # Collabora Online
-  # Source: https://github.com/CollaboraOnline/online
-  - name: "collabora-online-repo"
-    keyring: "../../files/gpg-pubkeys/collaboraoffice-com.gpg"
-    verify: {{ .Values.charts.collabora.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/\
-      {{ .Values.charts.collabora.repository }}"
-
-releases:
-  - name: "collabora-online"
-    chart: "collabora-online-repo/{{ .Values.charts.collabora.name }}"
-    version: "{{ .Values.charts.collabora.version }}"
-    values:
-      - "values.yaml.gotmpl"
-    installed: {{ .Values.collabora.enabled }}
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "collabora"
-...

helmfile/apps/collabora/helmfile-child.yaml.gotmpl

@@ -0,0 +1,53 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # Collabora Online
+  # Source: https://github.com/CollaboraOnline/online
+  - name: "collabora-online-repo"
+    keyring: "../../files/gpg-pubkeys/collaboraoffice-com.gpg"
+    verify: {{ .Values.charts.collabora.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
+
+  # Collabora Controller - Enterprise Only
+  # Source: https://github.com/CollaboraOnline/online
+  - name: "collabora-controller-repo"
+    keyring: "../../files/gpg-pubkeys/collaboraoffice-com.gpg"
+    verify: {{ .Values.charts.collaboraController.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"
+
+releases:
+  - name: "collabora-online"
+    chart: "collabora-online-repo/{{ .Values.charts.collabora.name }}"
+    version: "{{ .Values.charts.collabora.version }}"
+    values:
+      - "values.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.collaboraOnline }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.collabora.enabled }}
+  - name: "collabora-controller"
+    chart: "collabora-controller-repo/{{ .Values.charts.collaboraController.name }}"
+    version: "{{ .Values.charts.collaboraController.version }}"
+    values:
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-coco-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.collaboraController }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.collaboraController.enabled }}
+
+commonLabels:
+  deployStage: "050-components"
+  component: "collabora"
+...

helmfile/apps/collabora/helmfile.yaml.gotmpl

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl

@@ -0,0 +1,63 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+controller:
+  enableHashmapParallelization: true
+  ingressUrl: "https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
+  namespacedRole: true
+  # CoolController uses `app.kubernetes.io/name` label to find deployment resource
+  # openDesk uses `fullnameOverride` in Collabora Deployment that updates `metadata.name` not the `app.kubernetes.io/name`
+  # Therefore we use the default of `collabora-online` for the `resourceName`
+  resourceName: "collabora-online"
+  statsInterval: 2000
+  watchNamespace: {{ (.Values.apps.collabora.namespace | default .Release.Namespace | quote) }}
+
+  documentMigrator:
+    enabled: true
+    coolMemoryUtilization: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}
+    coolMemoryLimit: {{ .Values.resources.collabora.limits.memory }}
+
+  leaderElection:
+    enabled: {{ if gt .Values.replicas.collaboraController 1 }}true{{ else }}false{{ end }}
+
+image:
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collaboraController.registry }}/{{ .Values.images.collaboraController.repository }}"
+  tag: {{ .Values.images.collaboraController.tag | quote }}
+imagePullSecrets:
+  {{- range .Values.global.imagePullSecrets }}
+  - name: {{ . | quote }}
+  {{- end }}
+
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  className: {{ .Values.ingress.ingressClassName | quote }}
+  hosts:
+    - host: "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
+      paths:
+        - path: "/controller"
+          pathType: "Prefix"
+
+podAnnotations: {}
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+    - ALL
+  privileged: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsGroup: 2000
+  runAsUser: 1000
+  seccompProfile:
+    type: "RuntimeDefault"
+  seLinuxOptions:
+
+replicaCount: {{ .Values.replicas.collaboraController }}
+
+resources:
+  {{ .Values.resources.collaboraController | toYaml | nindent 2 }}
+
+...

helmfile/apps/collabora/values-enterprise.yaml.gotmpl

@@ -0,0 +1,15 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
+autoscaling:
+  enabled: {{ .Values.apps.collaboraController.enabled }}
+  minReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.maxReplicas }}
+  targetMemoryUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}
+  targetCPUUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetCPUUtilizationPercentage }}
+  scaleDownDisabled: {{ .Values.enterpriseFeatures.collabora.autoscaling.scaleDownDisabled }}
+...

helmfile/apps/collabora/values.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,24 +8,37 @@ autoscaling:
   enabled: false
 
 collabora:
-  extra_params: "--o:ssl.enable=false --o:ssl.termination=true --o:fetch_update_check=0"
-  username: "collabora-internal-admin"
-  password: {{ .Values.secrets.collabora.adminPassword | quote }}
   aliasgroups:
     - host: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
+  env:
+    - name: "POD_NAME"
+      valueFrom:
+        fieldRef:
+          fieldPath: "metadata.name"
+  extra_params: >
+    --o:ssl.enable=false
+    --o:ssl.termination=true
+    --o:fetch_update_check=0
+    --o:num_prespawn_children={{ .Values.technical.collabora.numPrespawnChildren }}
+    --o:remote_font_config.url=https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/richdocuments/settings/fonts.json
+    --o:net.proto={{ if eq .Values.cluster.networking.ipFamilies "DualStack" }}all{{ else }}{{ .Values.cluster.networking.ipFamilies }}{{ end }}
+    {{- if .Values.debug.enabled }}
+    --o:logging.level=debug
+    {{- else }}
+    --o:logging.anonymize.anonymize_user_data=true
+    {{- end }}
+    {{- if .Values.apps.collaboraController.enabled }}
+    --o:indirection_endpoint.url=https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/routeToken
+    --o:monitors.monitor[0]=wss://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/ws
+    --o:monitors.monitor[0][@retryInterval]=5
+    {{- end }}
+  username: "collabora-internal-admin"
+  password: {{ .Values.secrets.collabora.adminPassword | quote }}
 
 fullnameOverride: "collabora"
 
-grafana:
-  dashboards:
-    enabled: {{ .Values.monitoring.grafana.dashboards.enabled }}
-    labels:
-      {{ .Values.monitoring.grafana.dashboards.labels | toYaml | nindent 6 }}
-    annotations:
-      {{ .Values.monitoring.grafana.dashboards.annotations | toYaml | nindent 6 }}
-
 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
   tag: {{ .Values.images.collabora.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
@@ -35,8 +49,11 @@ imagePullSecrets:
 
 ingress:
   annotations:
-    # Ingress NGINX
+    {{- if .Values.apps.collaboraController.enabled }}
+    nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_RouteToken"
+    {{- else }}
     nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
+    {{- end }}
     nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.collabora }}"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}"
@@ -45,32 +62,6 @@ ingress:
       location /cool/getMetrics { deny all; return 403; }
       location /cool/adminws/ { deny all; return 403; }
       location /browser/dist/admin/admin.html { deny all; return 403; }
-    # NGINX
-    nginx.org/websocket-services: "collabora"
-    nginx.org/lb-method: "hash $arg_WOPISrc consistent"
-    nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
-    nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
-    nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.collabora }}"
-    nginx.org/server-snippets: |
-      # block admin and metrics endpoint from outside by default
-      location /cool/getMetrics { deny all; return 403; }
-      location /cool/adminws/ { deny all; return 403; }
-      location /browser/dist/admin/admin.html { deny all; return 403; }
-    # HAProxy
-    haproxy.org/timeout-tunnel: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
-    haproxy.org/backend-config-snippet: |
-       balance url_param WOPISrc check_post
-       hash-type consistent
-    # HAProxy - Community: https://haproxy-ingress.github.io/
-    haproxy-ingress.github.io/timeout-tunnel: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
-    haproxy-ingress.github.io/balance-algorithm: "url_param WOPISrc check_post"
-    haproxy-ingress.github.io/config-backend: |
-      hash-type consistent
-      # block admin urls from outside
-      acl admin_url path_beg /cool/getMetrics
-      acl admin_url path_beg /cool/adminws/
-      acl admin_url path_beg /browser/dist/admin/admin.html
-      http-request deny if admin_url
   enabled: {{ .Values.ingress.enabled }}
   className: {{ .Values.ingress.ingressClassName | quote }}
   hosts:
@@ -83,6 +74,8 @@ ingress:
       hosts:
         - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
 
+podAnnotations: {}
+
 podSecurityContext:
   fsGroup: 100
 
@@ -115,17 +108,9 @@ securityContext:
       - "ALL"
     add:
       - "CHOWN"
-      - "DAC_OVERRIDE"
       - "FOWNER"
-      - "FSETID"
-      - "KILL"
-      - "SETGID"
-      - "SETUID"
-      - "SETPCAP"
-      - "NET_BIND_SERVICE"
-      - "NET_RAW"
       - "SYS_CHROOT"
-      - "MKNOD"
+
   seLinuxOptions:
     {{ .Values.seLinuxOptions.collabora | toYaml | nindent 4 }}
 serviceAccount:

helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/\
-      {{ .Values.charts.cryptpad.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
 
 releases:
   - name: "cryptpad"
@@ -19,9 +18,12 @@ releases:
     version: "{{ .Values.charts.cryptpad.version }}"
     values:
       - "values.yaml.gotmpl"
-    installed: {{ .Values.cryptpad.enabled }}
+      {{- range .Values.customization.release.cryptpad }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.cryptpad.enabled }}
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "cryptpad"
 ...

helmfile/apps/cryptpad/helmfile.yaml.gotmpl

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/cryptpad/values.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/README.md or
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/values.yaml
@@ -23,7 +26,7 @@ enableEmbedding: true
 fullnameOverride: "cryptpad"
 
 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
   tag: {{ .Values.images.cryptpad.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
@@ -50,6 +53,8 @@ ingress:
 persistence:
   enabled: false
 
+podAnnotations: {}
+
 podSecurityContext:
   fsGroup: 4001
 

helmfile/apps/element/helmfile-child.yaml

@@ -1,184 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-repositories:
-  # openDesk Element
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
-  - name: "element-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.element.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/\
-      {{ .Values.charts.element.repository }}"
-  - name: "element-well-known-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.elementWellKnown.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/\
-      {{ .Values.charts.elementWellKnown.repository }}"
-  - name: "synapse-web-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.synapseWeb.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/\
-      {{ .Values.charts.synapseWeb.repository }}"
-  - name: "synapse-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.synapse.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/\
-      {{ .Values.charts.synapse.repository }}"
-  - name: "synapse-create-account-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.synapseCreateAccount.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/\
-      {{ .Values.charts.synapseCreateAccount.repository }}"
-
-  # openDesk Matrix Widgets
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
-  - name: "matrix-user-verification-service-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixUserVerificationService.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/\
-      {{ .Values.charts.matrixUserVerificationService.repository }}"
-  - name: "matrix-neoboard-widget-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
-      {{ .Values.charts.matrixNeoboardWidget.repository }}"
-  - name: "matrix-neochoice-widget-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
-      {{ .Values.charts.matrixNeoboardWidget.repository }}"
-  - name: "matrix-neodatefix-widget-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/\
-      {{ .Values.charts.matrixNeodatefixWidget.repository }}"
-  - name: "matrix-neodatefix-bot-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/\
-      {{ .Values.charts.matrixNeodatefixBot.repository }}"
-
-
-releases:
-  - name: "opendesk-element"
-    chart: "element-repo/{{ .Values.charts.element.name }}"
-    version: "{{ .Values.charts.element.version }}"
-    values:
-      - "values-element.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-well-known"
-    chart: "element-well-known-repo/{{ .Values.charts.elementWellKnown.name }}"
-    version: "{{ .Values.charts.elementWellKnown.version }}"
-    values:
-      - "values-well-known.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-synapse-web"
-    chart: "synapse-web-repo/{{ .Values.charts.synapseWeb.name }}"
-    version: "{{ .Values.charts.synapseWeb.version }}"
-    values:
-      - "values-synapse-web.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-synapse"
-    chart: "synapse-repo/{{ .Values.charts.synapse.name }}"
-    version: "{{ .Values.charts.synapse.version }}"
-    values:
-      - "values-synapse.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-matrix-user-verification-service-bootstrap"
-    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
-    version: "{{ .Values.charts.synapseCreateAccount.version }}"
-    values:
-      - "values-matrix-user-verification-service-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-matrix-user-verification-service"
-    chart: "matrix-user-verification-service-repo/{{ .Values.charts.matrixUserVerificationService.name }}"
-    version: "{{ .Values.charts.matrixUserVerificationService.version }}"
-    values:
-      - "values-matrix-user-verification-service.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neoboard-widget"
-    chart: "matrix-neoboard-widget-repo/{{ .Values.charts.matrixNeoboardWidget.name }}"
-    version: "{{ .Values.charts.matrixNeoboardWidget.version }}"
-    values:
-      - "values-matrix-neoboard-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neochoice-widget"
-    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiseWidget.name }}"
-    version: "{{ .Values.charts.matrixNeochoiseWidget.version }}"
-    values:
-      - "values-matrix-neochoice-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neodatefix-widget"
-    chart: "matrix-neodatefix-widget-repo/{{ .Values.charts.matrixNeodatefixWidget.name }}"
-    version: "{{ .Values.charts.matrixNeodatefixWidget.version }}"
-    values:
-      - "values-matrix-neodatefix-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neodatefix-bot-bootstrap"
-    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
-    version: "{{ .Values.charts.synapseCreateAccount.version }}"
-    values:
-      - "values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neodatefix-bot"
-    chart: "matrix-neodatefix-bot-repo/{{ .Values.charts.matrixNeodatefixBot.name }}"
-    version: "{{ .Values.charts.matrixNeodatefixBot.version }}"
-    values:
-      - "values-matrix-neodatefix-bot.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "element"
-...

helmfile/apps/element/helmfile-child.yaml.gotmpl

@@ -0,0 +1,317 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # openDesk Element
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
+  - name: "element-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.element.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
+  - name: "element-well-known-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.elementWellKnown.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
+  - name: "synapse-web-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseWeb.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
+  - name: "synapse-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapse.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+  - name: "synapse-create-account-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseCreateAccount.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
+
+  # openDesk Matrix Widgets
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
+  - name: "matrix-user-verification-service-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.matrixUserVerificationService.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
+  - name: "matrix-neoboard-widget-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+  - name: "matrix-neochoice-widget-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+  - name: "matrix-neodatefix-widget-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
+  - name: "matrix-neodatefix-bot-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
+
+  # openDesk Enterprise Repositories
+
+  # openDesk Element
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
+  - name: "synapse-admin-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseAdmin.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
+  - name: "synapse-adminbot-web-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseAdminbotWeb.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
+  - name: "synapse-groupsync-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseGroupsync.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
+  - name: "synapse-pipe-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapsePipe.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
+
+releases:
+  - name: "opendesk-element"
+    chart: "element-repo/{{ .Values.charts.element.name }}"
+    version: "{{ .Values.charts.element.version }}"
+    values:
+      - "values-element.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskElement }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "opendesk-well-known"
+    chart: "element-well-known-repo/{{ .Values.charts.elementWellKnown.name }}"
+    version: "{{ .Values.charts.elementWellKnown.version }}"
+    values:
+      - "values-well-known.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskWellKnown }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-web"
+    chart: "synapse-web-repo/{{ .Values.charts.synapseWeb.name }}"
+    version: "{{ .Values.charts.synapseWeb.version }}"
+    values:
+      - "values-synapse-web.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseWeb }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse"
+    chart: "synapse-repo/{{ .Values.charts.synapse.name }}"
+    version: "{{ .Values.charts.synapse.version }}"
+    values:
+      - "values-synapse.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapse }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "opendesk-matrix-user-verification-service-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      - "values-matrix-user-verification-service-bootstrap.yaml.gotmpl"
+      {{- range .Values.customization.release.matrixUserVerificationServiceBootstrap }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "opendesk-matrix-user-verification-service"
+    chart: "matrix-user-verification-service-repo/{{ .Values.charts.matrixUserVerificationService.name }}"
+    version: "{{ .Values.charts.matrixUserVerificationService.version }}"
+    values:
+      - "values-matrix-user-verification-service.yaml.gotmpl"
+      {{- range .Values.customization.release.matrixUserVerificationService }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "matrix-neoboard-widget"
+    chart: "matrix-neoboard-widget-repo/{{ .Values.charts.matrixNeoboardWidget.name }}"
+    version: "{{ .Values.charts.matrixNeoboardWidget.version }}"
+    values:
+      - "values-matrix-neoboard-widget.yaml.gotmpl"
+      {{- range .Values.customization.release.matrixNeoboardWidget }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "matrix-neochoice-widget"
+    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiceWidget.name }}"
+    version: "{{ .Values.charts.matrixNeochoiceWidget.version }}"
+    values:
+      - "values-matrix-neochoice-widget.yaml.gotmpl"
+      {{- range .Values.customization.release.matrixNeochoiceWidget }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "matrix-neodatefix-widget"
+    chart: "matrix-neodatefix-widget-repo/{{ .Values.charts.matrixNeodatefixWidget.name }}"
+    version: "{{ .Values.charts.matrixNeodatefixWidget.version }}"
+    values:
+      - "values-matrix-neodatefix-widget.yaml.gotmpl"
+      {{- range .Values.customization.release.matrixNeodatefixWidget }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "matrix-neodatefix-bot-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      - "values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl"
+      {{- range .Values.customization.release.matrixNeodatefixBotBootstrap }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  - name: "matrix-neodatefix-bot"
+    chart: "matrix-neodatefix-bot-repo/{{ .Values.charts.matrixNeodatefixBot.name }}"
+    version: "{{ .Values.charts.matrixNeodatefixBot.version }}"
+    values:
+      - "values-matrix-neodatefix-bot.yaml.gotmpl"
+      {{- range .Values.customization.release.matrixNeodatefixBot }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
+    timeout: 900
+
+  # openDesk Enterprise Releases
+  - name: "opendesk-synapse-admin"
+    chart: "synapse-admin-repo/{{ .Values.charts.synapseAdmin.name }}"
+    version: "{{ .Values.charts.synapseAdmin.version }}"
+    values:
+      - "values-synapse-admin.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAdmin }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      - "values-synapse-adminbot-bootstrap.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-pipe"
+    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
+    version: "{{ .Values.charts.synapsePipe.version }}"
+    values:
+      - "values-synapse-adminbot-pipe.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAdminbotPipe }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-web"
+    chart: "synapse-adminbot-web-repo/{{ .Values.charts.synapseAdminbotWeb.name }}"
+    version: "{{ .Values.charts.synapseAdminbotWeb.version }}"
+    values:
+      - "values-synapse-adminbot-web.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAdminbotWeb }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-auditbot-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      - "values-synapse-auditbot-bootstrap.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-auditbot-pipe"
+    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
+    version: "{{ .Values.charts.synapsePipe.version }}"
+    values:
+      - "values-synapse-auditbot-pipe.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAuditbotPipe }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-groupsync"
+    chart: "synapse-groupsync-repo/{{ .Values.charts.synapseGroupsync.name }}"
+    version: "{{ .Values.charts.synapseGroupsync.version }}"
+    values:
+      - "values-synapse-groupsync.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseGroupsync }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.elementGroupsync.enabled }}
+    timeout: 900
+
+commonLabels:
+  deployStage: "050-components"
+  component: "element"
+...

helmfile/apps/element/helmfile.yaml.gotmpl

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/element/values-element.yaml.gotmpl

@@ -1,11 +1,13 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   endToEndEncryption: true
   additionalConfiguration:
-    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=opendesk-matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
 
     "net.nordeck.element_web.module.opendesk":
       config:
@@ -42,6 +44,8 @@ configuration:
             - org.matrix.msc3819.send.to_device:net.nordeck.whiteboard.connection_signaling
             - org.matrix.msc3819.receive.to_device:net.nordeck.whiteboard.connection_signaling
             - town.robin.msc3846.turn_servers
+            - org.matrix.msc4039.upload_file
+            - org.matrix.msc4039.download_file
         "https://{{ .Values.global.hosts.matrixNeoChoiceWidget }}.{{ .Values.global.domain }}/*":
           preload_approved: true
           capabilities_approved:
@@ -94,7 +98,7 @@ configuration:
             - org.matrix.msc2762.receive.event:net.nordeck.meetings.sub_meetings.send_message
             - org.matrix.msc3973.user_directory_search
 
-  welcomeUserId: "@meetings-bot:{{ .Values.global.domain }}"
+  welcomeUserId: "@meetings-bot:{{ .Values.global.matrixDomain | default .Values.global.domain }}"
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -121,7 +125,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.element.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.element.registry | quote }}
   repository: {{ .Values.images.element.repository | quote }}
   tag: {{ .Values.images.element.tag | quote }}
 
@@ -133,6 +137,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -143,6 +149,7 @@ resources:
   {{ .Values.resources.element | toYaml | nindent 2 }}
 
 theme:
+  title: "Chat - {{ .Values.theme.texts.productName }}"
   {{ .Values.theme | toYaml | nindent 2 }}
 
 ...

helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -26,7 +29,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoBoardWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoBoardWidget.registry | quote }}
   repository: {{ .Values.images.matrixNeoBoardWidget.repository | quote }}
   tag: {{ .Values.images.matrixNeoBoardWidget.tag | quote }}
 
@@ -37,6 +40,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -49,4 +54,7 @@ resources:
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 
+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...

helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -26,7 +29,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoChoiceWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoChoiceWidget.registry | quote }}
   repository: {{ .Values.images.matrixNeoChoiceWidget.repository | quote }}
   tag: {{ .Values.images.matrixNeoChoiceWidget.tag | quote }}
 
@@ -37,6 +40,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -49,4 +54,7 @@ theme:
 resources:
   {{ .Values.resources.matrixNeoChoiceWidget | toYaml | nindent 2 }}
 
+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...

helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
@@ -16,13 +19,15 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
   url: {{ .Values.images.synapseCreateUser.repository | quote }}
   tag: {{ .Values.images.synapseCreateUser.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 fullnameOverride: "matrix-neodatefix-bot-bootstrap"
 
+podAnnotations: {}
+
 securityContext:
   allowPrivilegeEscalation: false
   capabilities:

helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -11,7 +14,7 @@ global:
 configuration:
   bot:
     username: "meetings-bot"
-    displayname: "Terminplaner Bot"
+    display name: "Terminplaner Bot"
   openxchangeBaseUrl: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
   strings:
     breakoutSessionWidgetName: "Breakoutsessions"
@@ -44,10 +47,26 @@ extraEnvVars:
       secretKeyRef:
         name: "matrix-neodatefix-bot-account"
         key: "access_token"
+{{- if .Values.certificate.selfSigned }}
+  - name: "NODE_EXTRA_CA_CERTS"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixBot.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoDateFixBot.registry | quote }}
   repository: {{ .Values.images.matrixNeoDateFixBot.repository | quote }}
   tag: {{ .Values.images.matrixNeoDateFixBot.tag | quote }}
 
@@ -58,12 +77,14 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
-livenessProbe:
+liveness sample:
   enabled: true
 
 persistence:
-  size: {{ .Values.persistence.size.matrixNeoDateFixBot | quote }}
-  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.storages.matrixNeoDateFixBot.size | quote }}
+  storageClass: {{ coalesce .Values.persistence.storages.matrixNeoDateFixBot.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+
+podAnnotations: {}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   bot:
@@ -31,7 +34,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoDateFixWidget.registry | quote }}
   repository: {{ .Values.images.matrixNeoDateFixWidget.repository | quote }}
   tag: {{ .Values.images.matrixNeoDateFixWidget.tag | quote }}
 
@@ -42,6 +45,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -54,4 +59,7 @@ resources:
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 
+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...

helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
@@ -16,13 +19,15 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
   url: {{ .Values.images.synapseCreateUser.repository | quote }}
   tag: {{ .Values.images.synapseCreateUser.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 fullnameOverride: "opendesk-matrix-user-verification-service-bootstrap"
 
+podAnnotations: {}
+
 securityContext:
   allowPrivilegeEscalation: false
   capabilities:

helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -35,10 +38,12 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixUserVerificationService.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixUserVerificationService.registry | quote }}
   repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
   tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101

helmfile/apps/element/values-synapse-admin.yaml.gotmpl

@@ -0,0 +1,87 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  adminBot:
+    backupPhrase: {{ .Values.secrets.matrixAdminBot.backupPassphrase | quote }}
+    #name: "adminbot"
+    #secretName: "matrix-adminbot-account"
+    #secretKey: "access_token"
+  auditBot:
+    backupPhrase: {{ .Values.secrets.matrixAuditBot.backupPassphrase | quote }}
+    #name: "auditbot"
+  database:
+    host: {{ .Values.databases.synapse.host | quote }}
+    port: {{ .Values.databases.synapse.port }}
+    name: {{ .Values.databases.synapse.name | quote }}
+    user: {{ .Values.databases.synapse.username | quote }}
+    password:
+      value: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    requireAuth: {{ .Values.databases.synapse.requireAuth }}
+    channelBinding: {{ .Values.databases.synapse.channelBinding | quote }}
+    connectTimeout: {{ .Values.databases.synapse.connectTimeout }}
+    clientEncoding: {{ .Values.databases.synapse.clientEncoding | quote }}
+    keepalives: {{ .Values.databases.synapse.keepalives }}
+    keepalivesIdle: {{ .Values.databases.synapse.keepalivesIdle }}
+    keepalivesInterval: {{ .Values.databases.synapse.keepalivesInterval }}
+    keepalivesCount: {{ .Values.databases.synapse.keepalivesCount }}
+    replication: {{ .Values.databases.synapse.replication }}
+    gssencmode: {{ .Values.databases.synapse.gssencmode | quote }}
+    sslmode: {{ .Values.databases.synapse.sslmode | quote }}
+    sslcompression: {{ .Values.databases.synapse.sslcompression }}
+    sslMinProtocolVersion: {{ .Values.databases.synapse.sslMinProtocolVersion | quote }}
+    connectionPoolMin: {{ .Values.databases.synapse.connectionPoolMin }}
+    connectionPoolMax: {{ .Values.databases.synapse.connectionPoolMax }}
+  # Settings regarding homeserver.
+  homeserver:
+    # -- URL of synapse deployment. As default the url of synapse will be used.
+    #baseUrl: ""
+    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
+  ldap:
+    base: {{ .Values.ldap.baseDn | quote }}
+    bind_dn: "uid=ldapsearch_element,cn=users,{{ .Values.ldap.baseDn }}"
+    bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
+    filter: "(memberOf=cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }})"
+    uri: {{ printf "ldap://%s:389" .Values.ldap.host | quote }}
+cron:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSyncAdmins.registry | quote }}
+    repository: {{ .Values.images.elementSyncAdmins.repository | quote }}
+    tag: {{ .Values.images.elementSyncAdmins.tag | quote }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+#fullnameOverride: "opendesk-synapse-admin"
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSynapseAdmin.registry | quote }}
+  repository: {{ .Values.images.elementSynapseAdmin.repository | quote }}
+  tag: {{ .Values.images.elementSynapseAdmin.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  tls:
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "NODE_EXTRA_CA_CERTS"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+...

helmfile/apps/element/values-synapse-adminbot-bootstrap.yaml.gotmpl

@@ -0,0 +1,33 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  username: "adminbot"
+  pod: "opendesk-synapse-0"
+  secretName: "matrix-adminbot-account"
+  password: {{ .Values.secrets.matrixAdminBot.password | quote }}
+  pipeConfig:
+    enabled: true
+    type: "admin"
+    secretName: "matrix-adminbot-config"
+    asToken: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
+    hsToken: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
+    serviceUrl: "http://opendesk-synapse-web:8008"
+    backupPassphrase: {{ .Values.secrets.matrixAdminBot.backupPassphrase | quote }}
+    homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
+image:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
+  url: {{ .Values.images.synapseCreateUser.repository | quote }}
+  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+fullnameOverride: "matrix-adminbot-bootstrap"
+...

helmfile/apps/element/values-synapse-adminbot-pipe.yaml.gotmpl

@@ -0,0 +1,21 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  secretName: "matrix-adminbot-config"
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
+  url: {{ .Values.images.elementPipe.repository | quote }}
+  tag: {{ .Values.images.elementPipe.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+fullnameOverride: "opendesk-synapse-adminbot-pipe"
+...

helmfile/apps/element/values-synapse-adminbot-web.yaml.gotmpl

@@ -0,0 +1,25 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  homeserver:
+    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementAdminBot.registry | quote }}
+  repository: {{ .Values.images.elementAdminBot.repository | quote }}
+  tag: {{ .Values.images.elementAdminBot.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  tls:
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+...

helmfile/apps/element/values-synapse-auditbot-bootstrap.yaml.gotmpl

@@ -0,0 +1,33 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  username: "auditbot"
+  pod: "opendesk-synapse-0"
+  secretName: "matrix-auditbot-account"
+  password: {{ .Values.secrets.matrixAuditBot.password | quote }}
+  pipeConfig:
+    enabled: true
+    type: "admin"
+    secretName: "matrix-auditbot-config"
+    asToken: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
+    hsToken: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
+    serviceUrl: "http://opendesk-synapse-web:8008"
+    backupPassphrase: {{ .Values.secrets.matrixAuditBot.backupPassphrase | quote }}
+    homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
+image:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
+  url: {{ .Values.images.synapseCreateUser.repository | quote }}
+  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+fullnameOverride: "matrix-auditbot-bootstrap"
+...

helmfile/apps/element/values-synapse-auditbot-pipe.yaml.gotmpl

@@ -0,0 +1,21 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  secretName: "matrix-auditbot-config"
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
+  url: {{ .Values.images.elementPipe.repository | quote }}
+  tag: {{ .Values.images.elementPipe.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+fullnameOverride: "opendesk-synapse-auditbot-pipe"
+...

helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl

@@ -0,0 +1,56 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  asToken: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
+  dryRun: false
+  hsToken: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
+  id: "gps"
+  homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
+  registrationSharedSecret: {{ .Values.secrets.synapse.registrationSharedSecret | quote }}
+  runOnce: false
+  username: "groupsyncbot"
+  ldap:
+    attributes:
+      name: "description"
+      uid: "uid"
+    base: {{ .Values.ldap.baseDn | quote }}
+    bind_dn: "uid=ldapsearch_element,cn=users,{{ .Values.ldap.baseDn }}"
+    bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
+    check_interval_seconds: 60
+    type: mapped-ldap
+    uri: "ldap://ums-ldap-server:389"
+  spaces:
+    - groups:
+        - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
+          powerLevel: 50
+        - externalId: "cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}"
+      id: "c3122e32-4e05-4bf8-8a5d-66679076ed36"
+      name: "openDesk"
+      subspaces:
+        - groups:
+            - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
+              powerLevel: 50
+          id: "e7889d96-5baa-4e21-be6e-12c66b2e9565"
+          name: "openDesk Element Admins"
+  provisionerDefaultRooms:
+    - id: "c3122e32-4e05-4bf8-8a5d-66679076ed36"
+      properties:
+        name: "openDesk"
+  # Name of group sync service (default opendesk-synapse-groupsync)
+  groupSyncService: "opendesk-synapse-groupsync"
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementGroupsync.registry | quote }}
+  url: {{ .Values.images.elementGroupsync.repository | quote }}
+  tag: {{ .Values.images.elementGroupsync.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+...

helmfile/apps/element/values-synapse-web.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 clusterDomain: {{ .Values.cluster.networking.domain }}
 
@@ -29,7 +32,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseWeb.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseWeb.registry | quote }}
   repository: {{ .Values.images.synapseWeb.repository | quote }}
   tag: {{ .Values.images.synapseWeb.tag | quote }}
 
@@ -48,6 +51,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101

helmfile/apps/element/values-synapse.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   additionalConfiguration:
@@ -11,8 +14,8 @@ configuration:
         - "m.space.parent"
         - "net.nordeck.meetings.metadata"
         - "m.room.power_levels"
-    # When a user logs into Element a parallel request is done through Intercom Service to allow Synapse API
-    # interaction, to avoid (temporary) blocking of the user for followup logins we want to raise the limits.
+    # To allow intercom service logins for the users and also allow proper testautomation we want to raise the
+    # ratelimit in a reasonable manner.
     # https://matrix-org.github.io/synapse/v1.59/usage/configuration/config_documentation.html#ratelimiting
     rc_login:
       account:
@@ -24,9 +27,26 @@ configuration:
 
   database:
     host: {{ .Values.databases.synapse.host | quote }}
+    port: {{ .Values.databases.synapse.port }}
     name: {{ .Values.databases.synapse.name | quote }}
     user: {{ .Values.databases.synapse.username | quote }}
-    password: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    password:
+      value: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    requireAuth: {{ .Values.databases.synapse.requireAuth }}
+    channelBinding: {{ .Values.databases.synapse.channelBinding | quote }}
+    connectTimeout: {{ .Values.databases.synapse.connectTimeout }}
+    clientEncoding: {{ .Values.databases.synapse.clientEncoding | quote }}
+    keepalives: {{ .Values.databases.synapse.keepalives }}
+    keepalivesIdle: {{ .Values.databases.synapse.keepalivesIdle }}
+    keepalivesInterval: {{ .Values.databases.synapse.keepalivesInterval }}
+    keepalivesCount: {{ .Values.databases.synapse.keepalivesCount }}
+    replication: {{ .Values.databases.synapse.replication }}
+    gssencmode: {{ .Values.databases.synapse.gssencmode | quote }}
+    sslmode: {{ .Values.databases.synapse.sslmode | quote }}
+    sslcompression: {{ .Values.databases.synapse.sslcompression }}
+    sslMinProtocolVersion: {{ .Values.databases.synapse.sslMinProtocolVersion | quote }}
+    connectionPoolMin: {{ .Values.databases.synapse.connectionPoolMin }}
+    connectionPoolMax: {{ .Values.databases.synapse.connectionPoolMax }}
 
   homeserver:
     serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
@@ -40,8 +60,8 @@ configuration:
               regex: "@.*"
         url: null
         sender_localpart: intercom-service
-      - as_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
-        hs_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+      - as_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
         id: ox-appsuite
         namespaces:
           users:
@@ -49,21 +69,81 @@ configuration:
               regex: "@.*"
         url: null
         sender_localpart: ox-appsuite
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{- if .Values.apps.elementAdmin.enabled }}
+      - as_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
+        id: "element-adminbot-pipe"
+        namespaces:
+          rooms:
+            - exclusive: false
+              regex: "!.*:{{ .Values.global.domain }}"
+          users:
+            - exclusive: false
+              regex: "@.*:.*"
+            - exclusive: true
+              regex: "@adminbot:{{ .Values.global.domain }}"
+        de.sorunome.msc2409.push_ephemeral: true
+        org.matrix.msc3202: true
+        url: "http://opendesk-synapse-adminbot-pipe:9995"
+        rate_limited: false
+        sender_localpart: "adminbot-sendernotinuse"
+      - as_token: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
+        id: "element-auditbot-pipe"
+        namespaces:
+          rooms:
+            - exclusive: false
+              regex: "!.*:{{ .Values.global.domain }}"
+          users:
+            - exclusive: false
+              regex: "@.*:.*"
+            - exclusive: true
+              regex: "@auditbot:{{ .Values.global.domain }}"
+        de.sorunome.msc2409.push_ephemeral: true
+        org.matrix.msc3202: true
+        url: "http://opendesk-synapse-auditbot-pipe:9995"
+        rate_limited: false
+        sender_localpart: "auditbot-sendernotinuse"
+      {{- end }}
+      {{- if .Values.apps.elementGroupsync.enabled }}
+      - as_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
+        id: "gps"
+        namespaces:
+          rooms:
+            - exclusive: false
+              regex: "!.*:{{ .Values.global.domain }}"
+          users:
+            - exclusive: false
+              regex: '@.*:{{ .Values.global.domain }}'
+        url: "http://opendesk-synapse-groupsync:10010"
+        rate_limited: false
+        sender_localpart: "groupsyncbot"
+      {{- end }}
+    registrationSharedSecret: {{ .Values.secrets.synapse.registrationSharedSecret | quote }}
+    {{- end }}
 
     presence:
       enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
 
+    profile:
+      allowUsersToUpdateDisplayname: {{ .Values.functional.chat.matrix.profile.allowUsersToUpdateDisplayname }}
+
     smtp:
-      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.element }}.{{ end }}{{ .Values.global.domain }}"
-      host: {{ .Values.smtp.host | quote }}
-      port: {{ .Values.smtp.port }}
-      username: {{ .Values.smtp.username | quote }}
-      password: {{ .Values.smtp.password | quote }}
+      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      port: 25
+      tls: false
+      starttls: false
+      username: ""
+      password: ""
 
     oidc:
       clientId: "opendesk-matrix"
       clientSecret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
       issuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+      matrixIdLocalpart: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
       scopes:
         - "openid"
         - "opendesk-matrix-scope"
@@ -85,7 +165,7 @@ configuration:
       enabled: true
       image:
         imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-        registry: {{ .Values.global.imageRegistry | default .Values.images.synapseGuestModule.registry | quote }}
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapseGuestModule.registry | quote }}
         repository: {{ .Values.images.synapseGuestModule.repository | quote }}
         tag: {{ .Values.images.synapseGuestModule.tag | quote }}
 
@@ -105,6 +185,27 @@ containerSecurityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.synapse | toYaml | nindent 4 }}
 
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "REQUESTS_CA_BUNDLE"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  - name: "SSL_CERT_FILE"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  - name: "SSL_CERT_DIR"
+    value: "/etc/ssl/certs"
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 federation:
   enabled: {{ .Values.functional.externalServices.matrix.federation.enabled }}
   ingress:
@@ -124,13 +225,15 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapse.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapse.registry | quote }}
   repository: {{ .Values.images.synapse.repository | quote }}
   tag: {{ .Values.images.synapse.tag | quote }}
 
 persistence:
-  size: {{ .Values.persistence.size.synapse | quote }}
-  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.storages.synapse.size | quote }}
+  storageClass: {{ coalesce .Values.persistence.storages.synapse.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+
+podAnnotations: {}
 
 podSecurityContext:
   enabled: true

helmfile/apps/element/values-well-known.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   e2ee:
@@ -30,7 +33,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.wellKnown.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.wellKnown.registry | quote }}
   repository: {{ .Values.images.wellKnown.repository | quote }}
   tag: {{ .Values.images.wellKnown.tag | quote }}
 
@@ -42,6 +45,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101

helmfile/apps/intercom-service/helmfile-child.yaml

@@ -1,27 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
----
-repositories:
-  # Intercom Service
-  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
-  - name: "intercom-service-repo"
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.intercomService.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/\
-      {{ .Values.charts.intercomService.repository }}"
-
-releases:
-  - name: "intercom-service"
-    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
-    version: "{{ .Values.charts.intercomService.version }}"
-    values:
-      - "values.yaml.gotmpl"
-    installed: {{ .Values.intercom.enabled }}
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "intercom-service"
-...

helmfile/apps/intercom-service/values.yaml.gotmpl

@@ -1,80 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  enabled: true
-  privileged: false
-  runAsUser: 1000
-  runAsGroup: 1000
-  seccompProfile:
-    type: "RuntimeDefault"
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.intercom | toYaml | nindent 4 }}
-
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-ics:
-  secret: {{ .Values.secrets.intercom.secret | quote }}
-  issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
-  originRegex: "{{ .Values.global.domain }}"
-  keycloak:
-    realm: {{ .Values.platform.realm | quote }}
-  default:
-    domain: {{ .Values.global.domain | quote }}
-  oidc:
-    id: "opendesk-intercom"
-    secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
-  matrix:
-    asSecret: {{ .Values.secrets.intercom.synapseAsToken | quote }}
-    subdomain: {{ .Values.global.hosts.synapse | quote }}
-    serverName: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
-  nordeck:
-    subdomain: {{ .Values.global.hosts.matrixNeoDateFixBot | quote }}
-  portal:
-    apiKey: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-  redis:
-    host: {{ .Values.cache.intercomService.host | quote }}
-    port: {{ .Values.cache.intercomService.port }}
-    password: {{ .Values.cache.intercomService.password | default .Values.secrets.redis.password | quote }}
-  openxchange:
-    oci: true
-    url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
-    audience: "opendesk-oxappsuite"
-  nextcloud:
-    audience: "opendesk-nextcloud"
-image:
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.intercom.registry | quote }}
-  repository: {{ .Values.images.intercom.repository | quote }}
-  tag: {{ .Values.images.intercom.tag | quote }}
-
-ingress:
-  host: "{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
-  enabled: {{ .Values.ingress.enabled }}
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
-  tls:
-    enabled: {{ .Values.ingress.tls.enabled }}
-    secretName: {{ .Values.ingress.tls.secretName | quote }}
-
-podSecurityContext:
-  enabled: true
-  fsGroup: 1000
-  fsGroupChangePolicy: "Always"
-
-replicaCount: {{ .Values.replicas.intercomService }}
-
-resources:
-  {{ .Values.resources.intercomService | toYaml | nindent 2 }}
-
-...

helmfile/apps/jitsi/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/\
-      {{ .Values.charts.jitsi.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
 
 releases:
   - name: "jitsi"
@@ -19,10 +18,13 @@ releases:
     version: "{{ .Values.charts.jitsi.version }}"
     values:
       - "values-jitsi.yaml.gotmpl"
-    installed: {{ .Values.jitsi.enabled }}
+      {{- range .Values.customization.release.jitsi }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.jitsi.enabled }}
     timeout: 900
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "jitsi"
 ...

helmfile/apps/jitsi/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/jitsi/helmfile.yaml.gotmpl

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/jitsi/values-jitsi.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -9,6 +10,7 @@ global:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations: {}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -26,21 +28,42 @@ containerSecurityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.jitsiKeycloakAdapter | toYaml | nindent 4 }}
 
+
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "DENO_CERT"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiKeycloakAdapter.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsiKeycloakAdapter.registry | quote }}
   repository: {{ .Values.images.jitsiKeycloakAdapter.repository | quote }}
   tag: {{ .Values.images.jitsiKeycloakAdapter.tag | quote }}
 
 settings:
-  jwtAppSecret: {{ .Values.secrets.jitsi.jwtAppSecret | quote }}
+  jwtAppSecret:
+    value: {{ .Values.secrets.jitsi.jwtAppSecret | quote }}
   keycloakRealm: {{ .Values.platform.realm | quote }}
   keycloakClientId: "opendesk-jitsi"
 
 theme:
+  title: "Videokonferenz - {{ .Values.theme.texts.productName }}"
   {{ .Values.theme | toYaml | nindent 2 }}
 
 jitsi:
@@ -48,8 +71,9 @@ jitsi:
   web:
     replicaCount: {{ .Values.replicas.jitsi }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
       tag: {{ .Values.images.jitsi.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     ingress:
       enabled: {{ .Values.ingress.enabled }}
       ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -61,6 +85,8 @@ jitsi:
         - secretName: {{ .Values.ingress.tls.secretName | quote }}
           hosts:
             - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
+    extraConfig:
+      doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
     extraEnvs:
       TURN_ENABLE: "1"
     resources:
@@ -79,8 +105,9 @@ jitsi:
         {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
   prosody:
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
       tag: {{ .Values.images.prosody.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     imagePullSecrets:
     {{- range .Values.global.imagePullSecrets }}
       - name: {{ . | quote }}
@@ -111,8 +138,8 @@ jitsi:
     resources:
       {{ .Values.resources.prosody | toYaml | nindent 6 }}
     persistence:
-      size: {{ .Values.persistence.size.prosody | quote }}
-      storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
+      size: {{ .Values.persistence.storages.prosody.size | quote }}
+      storageClassName: {{ coalesce .Values.persistence.storages.prosody.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
     securityContext:
       allowPrivilegeEscalation: false
       capabilities: {}
@@ -128,8 +155,9 @@ jitsi:
   jicofo:
     replicaCount: {{ .Values.replicas.jicofo }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
       tag: {{ .Values.images.jicofo.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     xmpp:
       password: {{ .Values.secrets.jitsi.jicofoAuthPassword | quote }}
       componentSecret: {{ .Values.secrets.jitsi.jicofoComponentPassword | quote }}
@@ -147,17 +175,51 @@ jitsi:
         type: "RuntimeDefault"
       seLinuxOptions:
         {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
+  jigasi:
+    replicaCount: {{ .Values.replicas.jigasi }}
+    enabled: {{ .Values.sip.jigasi.enabled }}
+    image:
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jigasi.registry }}/{{ .Values.images.jigasi.repository }}"
+      tag: {{ .Values.images.jigasi.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    extraEnvs:
+      JIGASI_SIP_PASSWORD: {{ .Values.sip.jigasi.password | quote }}
+      JIGASI_SIP_PORT: {{ .Values.sip.jigasi.port | quote }}
+      JIGASI_SIP_SERVER: {{ .Values.sip.jigasi.server | quote }}
+      JIGASI_SIP_TRANSPORT: {{ .Values.sip.jigasi.transport | quote }}
+      JIGASI_SIP_URI: {{ .Values.sip.jigasi.uri | quote }}
+    xmpp:
+      password: {{ .Values.secrets.jitsi.jigasiXmppPassword | quote }}
+    resources:
+      {{ .Values.resources.jigasi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities: {}
+      privileged: false
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.jigasi | toYaml | nindent 8 }}
   jvb:
     replicaCount: {{ .Values.replicas.jvb }}
+    # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
+    # upstream charts v1.4.0 a value for `publicIPs` is required. We set a dummy value as we anyway update it
+    # later with the `patchJVB` job.
+    publicIPs: [ 0.0.0.0 ]
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
       tag: {{ .Values.images.jvb.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     xmpp:
       password: {{ .Values.secrets.jitsi.jvbAuthPassword | quote }}
     resources:
       {{ .Values.resources.jvb | toYaml | nindent 6 }}
     service:
-      type: {{ .Values.cluster.service.type | quote }}
+      type: {{ coalesce .Values.service.type.jitsiVideoBridge .Values.cluster.service.type | quote }}
     securityContext:
       allowPrivilegeEscalation: false
       capabilities: {}
@@ -173,8 +235,9 @@ jitsi:
   jibri:
     replicaCount: {{ .Values.replicas.jibri }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
       tag: {{ .Values.images.jibri.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     recorder:
       password: {{ .Values.secrets.jitsi.jibriRecorderPassword | quote }}
     xmpp:
@@ -211,9 +274,12 @@ patchJVB:
       {{ .Values.seLinuxOptions.jitsiPatchJVB | toYaml | nindent 6 }}
   image:
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiPatchJVB.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.jitsiPatchJVB.registry | quote }}
     repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
     tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
+
+podAnnotations: {}
+
 replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}
 
 resources:

helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl

@@ -10,16 +10,14 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/\
-      {{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
   - name: "nextcloud-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.nextcloud.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/\
-      {{ .Values.charts.nextcloud.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
 
 releases:
   - name: "opendesk-nextcloud-management"
@@ -27,20 +25,32 @@ releases:
     version: "{{ .Values.charts.nextcloudManagement.version }}"
     values:
       - "values-nextcloud-mgmt.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-nextcloud-mgmt-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.opendeskNextcloudManagement }}
+      - {{ . }}
+      {{- end }}
     waitForJobs: true
     wait: true
-    installed: {{ .Values.nextcloud.enabled }}
+    installed: {{ .Values.apps.nextcloud.enabled }}
     timeout: 900
   - name: "opendesk-nextcloud"
     chart: "nextcloud-repo/{{ .Values.charts.nextcloud.name }}"
     version: "{{ .Values.charts.nextcloud.version }}"
     values:
       - "values-nextcloud.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-nextcloud-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.opendeskNextcloud }}
+      - {{ . }}
+      {{- end }}
     needs:
       - "opendesk-nextcloud-management"
-    installed: {{ .Values.nextcloud.enabled }}
+    installed: {{ .Values.apps.nextcloud.enabled }}
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "nextcloud"
 ...

helmfile/apps/nextcloud/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/nextcloud/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml.gotmpl"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/nextcloud/values-nextcloud-enterprise.yaml.gotmpl

@@ -0,0 +1,9 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+aio:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
+...

helmfile/apps/nextcloud/values-nextcloud-mgmt-enterprise.yaml.gotmpl

@@ -0,0 +1,12 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
+configuration:
+  enterprise:
+    subscriptionKey: {{ if .Values.enterpriseKeys.nextcloud.subscriptionKey }}{{ .Values.enterpriseKeys.nextcloud.subscriptionKey | quote }}{{ end }}
+    subscriptionData: {{ if .Values.enterpriseKeys.nextcloud.subscriptionData}}{{ .Values.enterpriseKeys.nextcloud.subscriptionData | quote }}{{ end }}
+...