fix(nubus): Fix udm-rest-api extended_attributes

fix(nubus): Better logging and fixes for keycloak-extensions
fix(provisioning): Point OX Connector to LDAP Server Primaries
2025-12-06 07:21:36 +01:00 · 2024-08-01 22:01:27 +02:00 · 2024-08-01 10:12:58 +02:00 · 2024-08-01 10:05:04 +02:00 · 2024-08-01 00:06:32 +02:00 · 2024-07-31 18:12:49 +02:00
27 changed files with 610 additions and 411 deletions
--- a/README.md
+++ b/README.md
@@ -33,12 +33,12 @@ openDesk currently features the following functional main components:
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                                 |
 | Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                                 |
 | File management      | Nextcloud                   | [28.0.5](https://nextcloud.com/de/changelog/#28-0-5)                                  | [Nextcloud 28](https://docs.nextcloud.com/)                                                                                                  |
-| Groupware            | OX App Suite                | [8.26](https://documentation.open-xchange.com/appsuite/releases/8.26/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
+| Groupware            | OX App Suite                | [8.23](https://documentation.open-xchange.com/appsuite/releases/8.23/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
 | Knowledge management | XWiki                       | [16.4.1](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.1/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                            |
 | Portal & IAM         | Nubus                       | Product Preview[^1]                                                                   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html)                                                    |
-| Project management   | OpenProject                 | [14.4.0](https://www.openproject.org/docs/release-notes/14-4-0/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
-| Videoconferencing    | Jitsi                       | [2.0.9646](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9646) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
-| Weboffice            | Collabora                   | [24.04.6.1.1](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
+| Project management   | OpenProject                 | [14.3.0](https://www.openproject.org/docs/release-notes/14-3-0/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
+| Videoconferencing    | Jitsi                       | [2.0.9457](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9457) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
+| Weboffice            | Collabora                   | [24.04.5.2.1](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |

 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -52,7 +52,7 @@ Below you will find some wrap-up notes when it comes to debugging openDesk by ad

 You can add a container by editing and updating an existing deployment, which is quite comfortable with tools like [Lens](https://k8slens.dev/).

- Select the container you want to make use of as debugging container, in the example below it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
+- Select the container you want to make use of as debugging container, in the example below it's `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
 - Ensure the `shareProcessNamespace` option is enabled for the Pod.
 - Reference the selected container within the `containers` array of the deployment.
 - In case you want to access another containers filesystem, ensure the user/group settings of both containers match.
@@ -121,7 +121,7 @@ Now you can add the ephemeral container with:
 ```
 kubectl -n ${NAMESPACE} debug -it --attach=false -c ${EPH_CONTAINER_NAME} --image={DEBUG_IMAGE} ${POD_NAME}
 ```
-and open its interactive terminal with
+and open it's interactive terminal with
 ```
 kubectl -n ${NAMESPACE} attach -it -c ${EPH_CONTAINER_NAME} ${POD_NAME}
 ```
--- a/docs/enhanced-configuration/idp-federation.md
+++ b/docs/enhanced-configuration/idp-federation.md
@@ -44,9 +44,9 @@ We will provide additional documents regarding user provisioning in the future,
  - UDM REST API:
    - Build a provisioning solution by yourself using the [UDM REST API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html).
    - The API gives you full control over the contents of the IAM in order to create, update or delete users and groups.
-  - Nubus Directory Importer:
+  - Directory Connector:
    - It is based on a Python one-way directory synchronization for users and groups.
-    - Please find more details in the [upstream product's documentation](https://docs.software-univention.de/nubus-kubernetes-operation/latest/en/howto-connect-external-iam.html).
+    - We will provide more details on this approach soon one the tool is made publicly available.
 - Ad-hoc provisioning (AHP)
  - This feature is currently not available in the openDesk Keycloak, but there are plans by the Supplier Univention to make it available.
  - Ad-hoc provisioning creates an user account on the fly during a users first login.
--- a/docs/enhanced-configuration/separate-mail-matrix-domain.md
+++ b/docs/enhanced-configuration/separate-mail-matrix-domain.md
@@ -9,10 +9,6 @@ SPDX-License-Identifier: Apache-2.0
 * [Example configuration](#example-configuration)
  * [Mail domain](#mail-domain)
  * [Matrix domain](#matrix-domain)
-    * [DNS](#dns)
-    * [Webserver](#webserver)
-      * [Content Security Policy](#content-security-policy)
-      * [.well-known](#well-known)

 # Use case

@@ -63,9 +59,7 @@ or via environment variable
 export MATRIX_DOMAIN=my_organization.tld
 ```

-### DNS
-
-The following changes apply to the standard DNS:
+This setup requires also a different DNS setup:

 | Record name                      | Type | Value                                  | Comment                                                                            |
 | -------------------------------- | ---- | -------------------------------------- | ---------------------------------------------------------------------------------- |
@@ -73,14 +67,6 @@ The following changes apply to the standard DNS:

 *Note:* `matrix.opendesk.domain.tld` in the "Value" column can also be the IP address where synapse TLS port is listening to.

-### Webserver
-
-#### Content Security Policy
-
-The webserver of `my_organization.tld` should add `*.opendesk.domain.tld` to its CSP header.
-
-#### .well-known
-
 If you want to use other Matrix clients,
 e.g., Element Messenger for [iOS](https://apps.apple.com/de/app/element-messenger/id1083446067)
 or [Android](https://play.google.com/store/apps/details?id=im.vector.app),
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -52,7 +52,7 @@ files.
 > All configuration options and their default values can be found in files at `helmfile/environments/default/`

 For the following guide, we will use `dev` as environment, where variables can be set in
-`helmfile/environments/dev/values.yaml.gotmpl`.
+`helmfile/environments/dev/values.yaml`.

 ## DNS

@@ -115,13 +115,13 @@ All available apps and their default value can be found in `helmfile/environment
 | Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
 | MinIO                | `minio.enabled`             | `true`  | Object Storage                 |
 | Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
-| Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
 | OpenProject          | `openproject.enabled`       | `true`  | Project management             |
 | OX Appsuite          | `oxAppsuite.enabled`        | `true`  | Groupware                      |
 | Provisioning         | `oxConnector.enabled`       | `true`  | Backend provisioning           |
 | Postfix              | `postfix.enabled`           | `true`  | MTA                            |
 | PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
 | Redis                | `redis.enabled`             | `true`  | Cache Database                 |
+| Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
 | XWiki                | `xwiki.enabled`             | `true`  | Knowledge management           |

 Exemplary, Jitsi can be disabled like:
@@ -199,27 +199,18 @@ cluster:
      - "127.0.0.0/8"
 ```

-If your load balancer / reverse proxy IPs are not already covered by the above `cidr` you need to
-explicitly configure the related IPs or IP ranges:
-
-```yaml
-cluster:
-  networking:
-    incomingCIDR:
-      - "172.16.0.0/12"
-```
-
 ### Ingress

-By default, the `ingressClassName` is empty to choose your default ingress controller. You may want to customize it by
-setting the following attribute to the name of the currently only supported ingress controller `ingress-nginx` (see
-[requirements.md](./requirements.md)) for reference) within your deployment if that is not the clusters default ingress.
+By default, the `ingressClassName` is empty to choose your default ingress controller, you may want to customize it by
+setting:

 ```yaml
 ingress:
-  ingressClassName: "name-of-my-nginx-ingress"
+  ingressClassName: "cilium"
 ```

+**Note:** Please check the [requirements.md](./requirements.md) for the supported Ingress controllers.
+
 ### Container runtime

 Some apps require specific configuration for the container runtime. You can set your container runtime like `cri-o`,
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -6,17 +6,15 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Upgrade migrations</h1>

 * [Disclaimer](#disclaimer)
-* [Releases upgrades](#releases-upgrades)
 * [From v0.9.0](#from-v090)
+  * [Manual migrations](#manual-migrations)
  * [Automated migrations](#automated-migrations)
    * [Updated IAM component Nubus](#updated-iam-component-nubus)
-        * [Manual cleanup](#manual-cleanup)
 * [From v0.8.1](#from-v081)
  * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
+  * [Nubus LDAP PVCs](#nubus-ldap-pvcs)
  * [Updated customizable template attributes](#updated-customizable-template-attributes)
  * [`migrations` S3 bucket](#migrations-s3-bucket)
-* [Related components and artefacts](#related-components-and-artefacts)
-  * [Development](#development)

 # Disclaimer

@@ -24,44 +22,145 @@ We do not offer support for upgrades before we reach openDesk 1.0.

 Though we try to ease the pain when it comes to 0.x upgrades. That is what this document is for.

-Limitations:
- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was deleted and will cover an explicit delete for PVs.
+# From v0.9.0

-# Releases upgrades
+## Manual migrations

-## From v0.9.0
+None.

-### Automated migrations
+## Automated migrations

-#### Updated IAM component Nubus
+### Updated IAM component Nubus

-openDesk is integrating the latest [Nubus](https://www.univention.de/produkte/nubus/) development from Univention. The now redundant and scalable LDAP requires migration activities. These have been automated to avoid manual interaction. The `run_2` of the openDesk
-upgrade migrations executes the following steps:
+openDesk is integrating the latest [Nubus](https://www.univention.de/produkte/nubus/) development from Univention. The new redundant and scalable LDAP requires migration activities. These have been automated to avoid manual interaction. The `run_2` of the openDesk
+upgrade migrations executes the following steps

 - Stage PRE:
-  - Delete service `ums-keycloak`, as it will be recreated headless.
-  - Scale down `statefulset/ums-ldap-server` and `statefulset/ums-ldap-notifier` in preparation or the next step:
+  - Scale down `statefulset/ums-ldap-server` and `statefulset/ums-ldap-notifier`.
  - Create two new PVCs `shared-data-ums-ldap-server-primary-0` and `shared-data-ums-ldap-server-primary-1` for the new LDAP primary pods as copy from the existing `shared-data-ums-ldap-server-0`. The LDAP secondaries will sync from the primary nodes.
 - Stage POST:
+  - Delete the no longer used `shared-data-ums-ldap-server-0`.
  - Restart Keycloak.

-##### Manual cleanup
+**Note:** You should ensure you have a backup of the contents of `shared-data-ums-ldap-server-0` if something goes wrong during the
+upgrade migration.

-Currently we do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the no longer used PVCs after successful upgrade:
-```
-NAMESPACE=<your_namespace>
-kubectl -n ${NAMESPACE} delete pvc shared-data-ums-ldap-server-0
-kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
-```
+# From v0.8.1

-## From v0.8.1
-
-### Updated `cluster.networking.cidr`
+## Updated `cluster.networking.cidr`

 - Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1), please update your setup accordingly if you explicitly set this value.
 - Reference:[cluster.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/cluster.yaml)

-### Updated customizable template attributes
+## Nubus LDAP PVCs
+
+openDesk is integrating the latest [Nubus](https://www.univention.de/produkte/nubus/) development from Univention. The new redundant and scalable LDAP requires some manual action to upgrade from 0.8.1:
+
+- Action: Before the upgrade you have to prepare the PVCs for the LDAP primary Pods. First scale down the 0.8.1 LDAP Pod and pre-create and pre-populate the new PVCs with the data from the current LDAP PVC. You can do all this by running the following snippet on your commandline, after setting `NAMESPACE` to the appropriate value. The LDAP secondaries get sync'd from the primary to fill their own PVCs data.
+```
+export NAMESPACE=YOUR_NAMESPACE
+kubectl -n $NAMESPACE scale --replicas=0 statefulset/ums-ldap-notifier
+kubectl -n $NAMESPACE scale --replicas=0 statefulset/ums-ldap-server
+kubectl -n $NAMESPACE apply -f - <<EOF
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  # Target PVC name
+  name: shared-data-ums-ldap-server-primary-0
+spec:
+  dataSource:
+    # Source PVC name
+    name: shared-data-ums-ldap-server-0
+    kind: PersistentVolumeClaim
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      # Target PVC size (deployments default to 1Gi)
+      storage: 1Gi
+...
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  # Target PVC name
+  name: shared-data-ums-ldap-server-primary-1
+spec:
+  dataSource:
+    # Source PVC name
+    name: shared-data-ums-ldap-server-0
+    kind: PersistentVolumeClaim
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      # Target PVC size (deployments default to 1Gi)
+      storage: 1Gi
+...
+EOF
+```
+
+- Once you have verified that your upgrade was successful, you can delete the previous LDAP's PVC:
+```
+kubectl -n $NAMESPACE delete pvc shared-data-ums-ldap-server-0
+```
+
+## Nubus LDAP PVCs
+
+openDesk is integrating the latest [Nubus](https://www.univention.de/produkte/nubus/) development from Univention. The new redundant and scalable LDAP requires some manual action to upgrade from 0.8.1:
+
+- Action: Before the upgrade you have to prepare the PVCs for the LDAP primary Pods. First scale down the 0.8.1 LDAP Pod and pre-create and pre-populate the new PVCs with the data from the current LDAP PVC. You can do all this by running the following snippet on your commandline, after setting `NAMESPACE` to the appropriate value. The LDAP secondaries get sync'd from the primary to fill their own PVCs data.
+```
+export NAMESPACE=YOUR_NAMESPACE
+kubectl -n $NAMESPACE scale --replicas=0 statefulset/ums-ldap-notifier
+kubectl -n $NAMESPACE scale --replicas=0 statefulset/ums-ldap-server
+kubectl -n $NAMESPACE apply -f - <<EOF
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  # Target PVC name
+  name: shared-data-ums-ldap-server-primary-0
+spec:
+  dataSource:
+    # Source PVC name
+    name: shared-data-ums-ldap-server-0
+    kind: PersistentVolumeClaim
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      # Target PVC size (deployments default to 1Gi)
+      storage: 1Gi
+...
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  # Target PVC name
+  name: shared-data-ums-ldap-server-primary-1
+spec:
+  dataSource:
+    # Source PVC name
+    name: shared-data-ums-ldap-server-0
+    kind: PersistentVolumeClaim
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      # Target PVC size (deployments default to 1Gi)
+      storage: 1Gi
+...
+EOF
+```
+
+- Once you have verified that your upgrade was successful, you can delete the previous LDAP's PVC:
+```
+kubectl -n $NAMESPACE delete pvc shared-data-ums-ldap-server-0
+```
+
+## Updated customizable template attributes

 - Action: Please ensure you update you custom deployment values according with the updated default value structure.
 - References:
@@ -70,28 +169,7 @@ kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
  - `monitoring.` prefix for `prometheus.*` and `graphana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
  - `smtp.` prefix for `localpartNoReply`, see [smtp.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/smtp.yaml).

-### `migrations` S3 bucket
+## `migrations` S3 bucket

 - Action: For self managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
 - Reference: `objectstores.migrations` in [objectstores.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/objectstores.yaml)
-
-# Related components and artefacts
-
-openDesk comes with two upgrade steps as part of the deployment, they can be found in the folder [/helmfile/apps](../helmfile/apps/) as all other components:
-
- `migrations-pre`: Is the very first app that gets deployed.
- `migrations-post`: Is the last app that gets deployed.
-
-Both migrations have to be deployed exclusively at their first/last position and not in parallel with other components.
-
-The status of the upgrade migrations is tracked in the ConfigMap `migrations-status`, more details can be found in the [README.md of the related container image](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/README.md).
-
-## Development
-
-When a new upgrade migration is required, ensure to address the following list:
-
- Update the generated release version file [`global.generated.yaml`](../helmfile/environments/default/global.generated.yaml) at least on the patch level to test the upgrade in your feature branch as well as trigger it in the `develop` branch after the feature branch was merged. The set value gets overwritten during the release process with the release's actual version number.
- You have to implement the migration logic as a runner script in the [`opendesk-migrations`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations) image. Please find more instructions in the linked repository.
- You most likely have to update the [`opendesk-migrations` Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations) within the `rules` section of the [`role.yaml`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/templates/role.yaml) to provide the permissions required for the execution of your migration's logic.
- You have to set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
- Update the [`charts.yaml`](../helmfile/environments/default/charts.yaml) and [`images.yaml`](../helmfile/environments/default/images.yaml) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -39,8 +39,6 @@ The following minimal requirements are thought for initial evaluation deployment
 | RAM  | 32 GB, more recommended                               |
 | Disk | HDD or SSD, >10 GB                                    |

-Check [`scaling.md`](./scaling.md) for more details on resource requirements and scalability.
-
 # Kubernetes

 Any self-hosted or managed K8s cluster >= 1.24 listed in
--- a/docs/scaling.md
+++ b/docs/scaling.md
@@ -7,17 +7,55 @@ SPDX-License-Identifier: Apache-2.0

 This document should cover the abilities to scale apps.

-# Horizontal scalability
+<!-- TOC -->
+* [Replicas](#replicas)
+<!-- TOC -->

-We are working on generating this document automatically based on the file
-[`replicas.yaml`](../helmfile/environments/default/replicas.yaml) that contains necessary annotations.
-In the meantime this file can be used to check the components scaling support / capabilities.
+# Replicas

-# Upstream information
+The Replicas can be increased of almost any component, but is only effective for high-availability or load-balancing for
+apps with a check-mark in `Scaling (effective)` column.

-While scaling services horizontally is the ideal solution, information about vertical scaling is helpful
-when it comes to defining the applications resources, see [`resources.yaml`](../helmfile/environments/default/resources.yaml) for references.
+Verified positive effects are marked with a check-mark in `Scaling (verified)` column, apps which are not yet tested are
+marked with a gear.

-Please find below links to the application's upstream resources about scaling:

- [OpenProject system requirements](https://www.openproject.org/docs/installation-and-operations/system-requirements/)
+| Component                   | Name                                     | Scaling (effective) | Scaling (verified) |
+|-----------------------------|------------------------------------------|:-------------------:|:------------------:|
+| ClamAV                      | `replicas.clamav`                        | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.clamd`                         | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.freshclam`                     |         :x:         |        :x:         |
+|                             | `replicas.icap`                          | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.milter`                        | :white_check_mark:  | :white_check_mark: |
+| Collabora                   | `replicas.collabora`                     | :white_check_mark:  |       :gear:       |
+| CryptPad                    | `replicas.cryptpad`                      | :white_check_mark:  |       :gear:       |
+| Dovecot                     | `replicas.dovecot`                       |         :x:         |       :gear:       |
+| Element                     | `replicas.element`                       | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.matrixNeoBoardWidget`          | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixNeoChoiceWidget`         | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixNeoDateFixBot`           | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixNeoDateFixWidget`        | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixUserVerificationService` | :white_check_mark:  |       :gear:       |
+|                             | `replicas.synapse`                       |         :x:         |       :gear:       |
+|                             | `replicas.synapseWeb`                    | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.wellKnown`                     | :white_check_mark:  | :white_check_mark: |
+| Intercom Service            | `replicas.intercomService`               | :white_check_mark:  | :white_check_mark: |
+| Jitsi                       | `replicas.jibri`                         | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jicofo`                        | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jitsi `                        | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jitsiKeycloakAdapter`          | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jvb `                          |         :x:         |        :x:         |
+| Keycloak                    | `replicas.keycloak`                      | :white_check_mark:  |       :gear:       |
+| Memcached                   | `replicas.memcached`                     |       :gear:        |       :gear:       |
+| Minio                       | `replicas.minioDistributed`              | :white_check_mark:  | :white_check_mark: |
+| Nextcloud                   | `replicas.nextcloudApache2`              | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.nextcloudExporter`             | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.nextcloudPHP`                  | :white_check_mark:  | :white_check_mark: |
+| OpenProject                 | `replicas.openproject`                   | :white_check_mark:  | :white_check_mark: |
+| Postfix                     | `replicas.postfix`                       |         :x:         |       :gear:       |
+| Redis                       | `replicas.redis`                         |       :gear:        |       :gear:       |
+| Univention Management Stack |                                          |       :gear:        |       :gear:       |
+|                             | `replicas.umsPortalFrontend`             | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.umsPortalServer`               | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.umsUdmRestApi`                 | :white_check_mark:  | :white_check_mark: |
+| XWiki                       | `replicas.xwiki`                         |         :x:         |       :gear:       |
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -40,21 +40,11 @@ configuration:
              regex: "@.*"
        url: null
        sender_localpart: intercom-service
-      - as_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
-        hs_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
-        id: ox-appsuite
-        namespaces:
-          users:
-            - exclusive: false
-              regex: "@.*"
-        url: null
-        sender_localpart: ox-appsuite
-
    presence: 
      enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
    
    smtp:
-      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.element }}.{{ end }}{{ .Values.global.domain }}"
+      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}"
      host: {{ .Values.smtp.host | quote }}
      port: {{ .Values.smtp.port }}
      username: {{ .Values.smtp.username | quote }}
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -37,7 +37,7 @@ configuration:
    port: {{ .Values.cache.nextcloud.port | quote }}
  collabora:
    # internalWopiUrl: ""
-    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
+    wopiAllowlist: {{ join " " .Values.cluster.networking.cidr | quote }}
  database:
    host: {{ .Values.databases.nextcloud.host | quote }}
    port: {{ .Values.databases.nextcloud.port | quote }}
@@ -82,7 +82,7 @@ configuration:
    host: {{ .Values.smtp.host | quote }}
    port: {{ .Values.smtp.port | quote }}
    fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
-    mailDomain: "{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.nextcloud }}.{{ end }}{{ .Values.global.domain }}"
+    mailDomain: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
  quota:
    default: "{{ .Values.functional.filestore.quota.default }} GB"
    retentionObligation:
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -25,31 +25,7 @@ global:
      defaultAdminPassword: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote}}
      defaultUserPassword: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote}}

-  # -- Extensions to load. Add entries to load additional extensions into Nubus.
-  extensions:
-    - name: "ox"
-      image:
-        registry: {{ .Values.images.nubusOxExtension.registry }}
-        repository: {{ .Values.images.nubusOxExtension.repository }}
-        tag: {{ .Values.images.nubusOxExtension.tag }}
-        imagePullPolicy: "IfNotPresent"
-    - name: "opendesk"
-      image:
-        registry: "registry.opencode.de"
-        repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-        imagePullPolicy: "IfNotPresent"
-        tag: "1.1.0"

-  # -- Allows to configure the system extensions to load. This is intended for
-  # internal usage, prefer to use `global.extensions` for user configured
-  # extensions.
-  systemExtensions:
-    - name: "portal"
-      image:
-        registry: {{ .Values.images.nubusPortalExtension.registry }}
-        repository: {{ .Values.images.nubusPortalExtension.repository }}
-        tag: {{ .Values.images.nubusPortalExtension.tag }}
-        imagePullPolicy: "IfNotPresent"

 # Nubus bundled services
 postgresql:
@@ -71,7 +47,7 @@ keycloak:
  postgresql:
    connection:
      host: {{ .Values.databases.keycloak.host | quote }}
-      port: {{ .Values.databases.keycloak.port | quote }}
+      port: {{ .Values.databases.keycloak.port }}
    auth:
      username: {{ .Values.databases.keycloak.username | quote }}
      database: {{ .Values.databases.keycloak.name | quote }}
@@ -163,7 +139,7 @@ nubusKeycloakExtensions:
    appConfig:
      logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
      newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
-      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.keycloak }}.{{ end }}{{ .Values.global.domain }}"
+      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"

 nubusPortalListener:
  portalListener:
@@ -193,8 +169,6 @@ nubusUdmListener:
  enabled: false
 nubusSelfServiceListener:
  enabled: true
-  selfserviceListener:
-    umcAdminUser: "default.admin"

 # Nubus services
 nubusStackDataUms:
@@ -234,7 +208,6 @@ nubusStackDataSwp:
    portalFileshareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.nextcloud .Values.global.domain }}
    portalTitleDE: "openDesk Portal"
    portalTitleEN: "openDesk Portal"
-    oxDefaultContext: "1"

 nubusUmcServer:
  postgresql:
--- a/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl
@@ -119,6 +119,26 @@ nubusLdapServer:
  persistence:
    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
    size: {{ .Values.persistence.size.nubus.ldapServerData | quote }}
+  extraVolumes:
+    - name: "opendesk-schemas"
+      configMap:
+        name: "{{ .Release.Name }}-stack-data-swp-schemas"
+  extraVolumeMounts:
+    - name: "opendesk-schemas"
+      mountPath: "/var/lib/univention-ldap-local/local-schema/opendeskFileshare.schema"
+      subPath: "opendeskFileshare.schema"
+    - name: "opendesk-schemas"
+      mountPath: "/var/lib/univention-ldap-local/local-schema/opendeskKnowledgemanagement.schema"
+      subPath: "opendeskKnowledgemanagement.schema"
+    - name: "opendesk-schemas"
+      mountPath: "/var/lib/univention-ldap-local/local-schema/opendeskLearnmanagement.schema"
+      subPath: "opendeskLearnmanagement.schema"
+    - name: "opendesk-schemas"
+      mountPath: "/var/lib/univention-ldap-local/local-schema/opendeskLivecollaboration.schema"
+      subPath: "opendeskLivecollaboration.schema"
+    - name: "opendesk-schemas"
+      mountPath: "/var/lib/univention-ldap-local/local-schema/opendeskProjectmanagement.schema"
+      subPath: "opendeskProjectmanagement.schema"

 nubusPortalFrontend:
  additionalAnnotations:
@@ -166,6 +186,17 @@ nubusUdmRestApi:
  initResources:
    {{ .Values.resources.umsUdmRestApiInit | toYaml | nindent 4 }}
  replicaCount: {{ .Values.replicas.umsUdmRestApi }}
+  extraVolumes:
+    - name: "attribute-to-group-mapper-hook"
+      configMap:
+        name: "ums-stack-data-swp-attribute-to-group-mapper-hook"
+  extraVolumeMounts:
+    - name: "attribute-to-group-mapper-hook"
+      mountPath: "/usr/lib/python3/dist-packages/univention/admin/hooks.d/AttributeToGroupMapper.py"
+      subPath: "AttributeToGroupMapper.py"
+    - name: "attribute-to-group-mapper-hook"
+      mountPath: "/usr/share/attribute-to-group-mapper/flag_to_group_mapping.json"
+      subPath: "flag_to_group_mapping.json"

 nubusUmcGateway:
  replicaCount: {{ .Values.replicas.umsUmcGateway }}
@@ -176,10 +207,19 @@ nubusUmcGateway:
      configMap:
        name: "ums-stack-data-swp-umc-gateway-entrypoint"
        defaultMode: 0555
+    - name: "announcements-customization"
+      configMap:
+        name: "ums-stack-data-swp-umc-server-announcements"
+        defaultMode: 0444
  extraVolumeMounts:
    - name: "entrypoint-swp-patches"
      mountPath: "/entrypoint.d/90-swp.sh"
      subPath: "90-swp.sh"
+    - name: "announcements-customization"
+      mountPath:
+        "/usr/share/univention-management-console-frontend/js/dijit/themes\
+        /umc/icons/16x16/udm-portals-announcement.png"
+      subPath: "udm-portals-announcement.png"

 nubusKeycloakBootstrap:
  podAnnotations:
--- a/helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl
@@ -149,21 +149,10 @@ nubusUdmListener:
    tag: {{ .Values.images.nubusProvisioningUdmListener.tag }}

 nubusSelfServiceListener:
-  selfserviceListener:
-    image:
-      registry: {{ .Values.images.nubusSelfserviceListener.registry }}
-      repository: {{ .Values.images.nubusSelfserviceListener.repository }}
-      tag: {{ .Values.images.nubusSelfserviceListener.tag }}
-  selfserviceInvitation:
  image:
    registry: {{ .Values.images.nubusSelfserviceInvitation.registry }}
    repository: {{ .Values.images.nubusSelfserviceInvitation.repository }}
    tag: {{ .Values.images.nubusSelfserviceInvitation.tag }}
-  waitForDependency:
-    image:
-      registry: {{ .Values.images.nubusWaitForDependency.registry }}
-      repository: {{ .Values.images.nubusWaitForDependency.repository }}
-      tag: {{ .Values.images.nubusWaitForDependency.tag }}

 nubusUdmRestApi:
  # oxPlugin:
--- a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -26,9 +26,6 @@ config:
      {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
    clients:
      {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
-  managed:
-    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
-    clients: [ 'UMC', 'guardian-management-api', 'guardian-scripts', 'guardian-ui', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
  keycloak:
    adminUser: "kcadmin"
    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
@@ -42,7 +39,8 @@ config:
    # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
    # to LDAP group membership to ensure a user cannot access an application without the required
    # group membership.
-    # ToDo: Ensure all applications verify the token's signature to ensure it is not tampered.
+    # ToDo:
+    # - Jitsi does currently not care if it gets scopes/claims as long as the user is authenticated.
    clientScopes:
      - name: "read_contacts"
        protocol: "openid-connect"
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -241,11 +241,6 @@ appsuite:
      com.openexchange.file.storage.nextcloud.oauth.url: "http://opendesk-nextcloud-apache2/"
      com.openexchange.file.storage.nextcloud.oauth.webdav.username.strategy: "user"
      com.openexchange.nextcloud.filepicker.includeAccessToken: "false"
-      # Element integration
-      com.openexchange.conference.element.enabled: "true"
-      com.openexchange.conference.element.meetingHostUrl: http://matrix-neodatefix-bot
-      com.openexchange.conference.element.matrixLoginUrl: http://opendesk-synapse-web:8008/_matrix/client/v3/login
-      com.openexchange.conference.element.matrixUuidClaimName: opendesk_useruuid
      # GDPR
      com.openexchange.gdpr.dataexport.enabled: "false"
      com.openexchange.gdpr.dataexport.active: "false"
@@ -264,7 +259,6 @@ appsuite:
      com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
      com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
      com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
-      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
    propertiesFiles:
      /opt/open-xchange/etc/AdminDaemon.properties:
        MASTER_ACCOUNT_OVERRIDE: "true"
@@ -332,13 +326,12 @@ appsuite:
      oxguardpass: |
        {{ .Values.secrets.oxAppsuite.oxguardMC }}
        {{ .Values.secrets.oxAppsuite.oxguardRC }}
-    redis: &redisConfiguration
+    redis:
      enabled: true
      mode: "standalone"
      hosts:
-        - "redis-master:6379"
+        - "redis-master"
      auth:
-        enabled: true
        password: {{ .Values.secrets.redis.password | quote }}
    image:
      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreMW.registry | quote }}
@@ -403,7 +396,15 @@ appsuite:
      tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    overrides: {}
-    redis: *redisConfiguration
+    redis:
+      mode: "standalone"
+      hosts:
+        - "redis-master:6379"
+      auth:
+        enabled: true
+        password: {{ .Values.secrets.redis.password | quote }}
+        # Workaround for a bug in 8.23
+        ca: ""
    resources:
      {{ .Values.resources.openxchangeCoreUIMiddleware | toYaml | nindent 6 }}
    updater:
@@ -440,7 +441,6 @@ appsuite:
      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeDocumentConverter.registry | quote }}
      repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
      tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
-    redis: *redisConfiguration
    resources:
      {{- .Values.resources.openxchangeCoreDocumentConverter | toYaml | nindent 6 }}
    securityContext:
@@ -519,7 +519,6 @@ appsuite:
          endpoint: "."
          accessKey: "."
          secretKey: "."
-    redis: *redisConfiguration
    resources:
      {{- .Values.resources.openxchangeCoreImageConverter | toYaml | nindent 6 }}
    securityContext:
@@ -546,8 +545,7 @@ appsuite:
      - name: {{ . | quote }}
    {{- end }}
    image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeGuardUI.registry | quote }}
-      repository: {{ .Values.images.openxchangeGuardUI.repository | quote }}
+      repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGuardUI.registry }}/{{ .Values.images.openxchangeGuardUI.repository }}"
      tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    resources:
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -67,7 +67,7 @@ environment:
  OPENPROJECT_SMTP__AUTHENTICATION: "plain"
  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
-  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.openproject }}.{{ end }}{{ .Values.global.domain }}"
+  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.nubus .Values.global.domain | quote }}
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
--- a/helmfile/apps/provisioning/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/provisioning/values-oxconnector.yaml.gotmpl
@@ -19,7 +19,7 @@ oxConnector:
  caCert: "ucctempldapstring"
  debugLevel: {{ if .Values.debug.enabled }}"4"{{ else }}"1"{{ end }}
  domainName: {{ .Values.global.domain | quote }}
-  ldapHost: "{{ .Values.ldap.host }}-primary"
+  ldapHost: "{{ .Values.ldap.host | quote }}-primary"
  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
  ldapPassword: {{ .Values.secrets.nubus.ldapSecret | quote }}
  ldapBaseDn: "dc=swp-ldap,dc=internal"
--- a/helmfile/apps/xwiki/values.yaml.gotmpl
+++ b/helmfile/apps/xwiki/values.yaml.gotmpl
@@ -137,7 +137,7 @@ properties:
  "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.server": "{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
  "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.port": 443
  ## SMTP settings
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.xwiki }}.{{ end }}{{ .Values.global.domain }}"
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ .Values.smtp.host | quote }}
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.port": {{ .Values.smtp.port | quote }}
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.username": {{ .Values.smtp.username | quote }}
--- a/helmfile/environments/default/charts.yaml
+++ b/helmfile/environments/default/charts.yaml
@@ -120,7 +120,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
    name: "opendesk-jitsi"
-    version: "1.9.2"
+    version: "1.7.9"
    verify: true
  mariadb:
    # providerCategory: "Platform"
@@ -200,7 +200,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
    name: "opendesk-migrations"
-    version: "1.2.2"
+    version: "1.1.1"
    verify: true
  minio:
    # providerCategory: "Community"
@@ -254,7 +254,7 @@ charts:
    registry: "artifacts.software-univention.de"
    repository: "nubus-dev/charts"
    name: "nubus"
-    version: "0.36.0-pre-jbornhold-update-stack-data"
+    version: "0.29.2-pre-jconde-fix-udm-rest-api"
    verify: true
  opendeskKeycloakBootstrap:
    # providerCategory: "Platform"
@@ -264,7 +264,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
    name: "opendesk-keycloak-bootstrap"
-    version: "2.1.1"
+    version: "2.1.0"
    verify: true
  openproject:
    # providerCategory: "Supplier"
@@ -298,7 +298,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
    name: "appsuite-public-sector"
-    version: "2.8.78"
+    version: "2.5.3"
    verify: false
  openXchangeAppSuiteBootstrap:
    # providerCategory: "Platform"
--- a/helmfile/environments/default/cluster.yaml
+++ b/helmfile/environments/default/cluster.yaml
@@ -18,14 +18,11 @@ cluster:
    # Kubernetes cluster network CIDRs.
    cidr:
      - "10.0.0.0/8"
-    # IP addresses or IP ranges of the reverse proxy / load balancer to restrict the requesting source
-    # for defined services.
-    incomingCIDR: []
    # Ingress-gateway IP - only relevant for "NodePort" cluster services.
    # When ingress and egress gateway use different ips, which results that pods can't self-discover their incoming ip,
    # you need to provide the public (load-balanced) ingress gateways ip address.
    ingressGatewayIP: ""
-    # LoadBalancer status field - only relevant for "LoadBalancer" cluster services.
+    # LoadBalancer status fiel - only relevant for "LoadBalancer" cluster services.
    # The IP/DNS of your load-balancer will be fetched for some components from 'status' map of services.
    # Most providers use '.status.loadBalancer.ingress[0].ip' to store public ip. You can modify the chosen field here.
    loadBalancerStatusField: "ip"
--- a/helmfile/environments/default/functional.yaml
+++ b/helmfile/environments/default/functional.yaml
@@ -30,11 +30,6 @@ functional:
        # Disable to not support Matrix federation with your installation.
        enabled: true

-  email:
-    systemGenerated:
-      # By disabling all mails are sent from @<domain> instead of @<component>.<domain>.
-      useComponentInSenderdomain: true
-
  filestore:
    quota:
      # Set the default quota for all users in GB
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -20,7 +20,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "24.04.6.1.1@sha256:6237af013065838be27faae69b26feec63de6de8412499285f5379d74fef7387"
+    tag: "24.04.5.2.1@sha256:583f3764661fdce99c5a97019b732db1bed9f9b333d70640ac99a6953c493666"
  cryptpad:
    # providerCategory: "Supplier"
    # providerResponsible: "XWiki"
@@ -83,7 +83,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jibri"
-    tag: "stable-9646@sha256:30173d35449d78f8958eaf4de77e76c534806db0e49bdbb930f8c81e003e5a3b"
+    tag: "stable-9457-2@sha256:eb079f650649c6336dc93eb30cdc086c0b784f5c3fe80ea3441a1f00ebf073f3"
  jicofo:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -93,7 +93,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jicofo"
-    tag: "stable-9646@sha256:c2c72b6e4b6655d8758145f5c4d4201265626b7c3c1a03f41c7dda060ca7165d"
+    tag: "stable-9457-2@sha256:7d3213eea740721755da81ecfd9b500c71c610d04939b26de4434619a66e15e1"
  jitsi:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -103,7 +103,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/web"
-    tag: "stable-9646@sha256:04157797558743fa9c478b76d7332a45c6fbfbe4e34d6550f8716dd8526a1c6c"
+    tag: "stable-9457-2@sha256:263e2e52934900547f1496eed965e2d3e01e9b8a251844bacbac49deba97f6b2"
  jitsiKeycloakAdapter:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -113,7 +113,7 @@ images:
    # upstreamMirrorStartFrom: ["2023", "12", "14"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jitsi-keycloak-adapter"
-    tag: "v20240808@sha256:73db5ae9bb617d076b6a877500dbeece38fd15f8ae933ffadbd72d9aa82ad8da"
+    tag: "v20240314@sha256:8abe8209a59c2d646fa3e7136f6a6ea15f3f692106bba92c0e777f8d383edc12"
  jitsiPatchJVB:
    # providerCategory: "Community"
    # providerResponsible: "Nordeck"
@@ -131,7 +131,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jvb"
-    tag: "stable-9646@sha256:22dfb237cdda8142dcf2b141c28d40ec8a675dd379dda5e851dac49e43e677b7"
+    tag: "stable-9457-2@sha256:2f10f28463e65a13a260d379c4cce62531d66a94bb8dcf2dbe88cdb4cd01b16c"
  mariadb:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -195,11 +195,9 @@ images:
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry-1.docker.io"
    # upstreamRepository: "bitnami/memcached"
-    # registry: "registry-1.docker.io"
-    # repository: "bitnami/memcached"
-    registry: "docker.io"
+    registry: "registry-1.docker.io"
    repository: "bitnami/memcached"
-    tag: "1.6.29-debian-12-r4"
+    tag: "1.6.21-debian-11-r107@sha256:247ec29efd6030960047a623aef025021154662edf6b6d6e88c97936f164d99d"
  migrations:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -207,7 +205,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
-    tag: "1.2.1@sha256:241561c51dee3ccd4d54cf732020634291f124025946e6be983f850bbf4eb1d3"
+    tag: "1.1.7@sha256:08b2ca4d3e946a388576f41ab80b3e91e588580580bf53edfed695586818e2f7"
  milter:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -221,11 +219,9 @@ images:
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry-1.docker.io"
    # upstreamRepository: "bitnami/minio"
-    # registry: "registry-1.docker.io"
-    # repository: "bitnami/minio"
-    registry: "docker.io"
+    registry: "registry-1.docker.io"
    repository: "bitnami/minio"
-    tag: "2024.8.17-debian-12-r0"
+    tag: "2023@sha256:bced4f2f9fc48b755ebb3e1b35e76195a978d4331bf2d0c6699dab412d3c0be7"
  nextcloudApache2:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -258,6 +254,239 @@ images:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-php"
    tag: "1.10.3@sha256:e659ab95d0d3a33d4937354449c12fa46fe2669a866bbf432a9d729bed6d54f7"
+  opendeskKeycloakBootstrap:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
+    tag: "1.2.0@sha256:3b364c60bedb9ae001c39cbf84e4b4b326b9559078f21bfc993cf0e601196e6f"
+  openproject:
+    # providerCategory: "Supplier"
+    # providerResponsible: "OpenProject"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "openproject/open_desk"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["13", "1", "1"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
+    tag: "14.3.0@sha256:922621b394c1a60e1c427b866284ac636b35717f03bde89302131ad369fbf9ad"
+  openprojectBootstrap:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-openproject-bootstrap"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/opendesk-openproject-bootstrap"
+    tag: "1.1.3@sha256:401afe66c418fd130088edbed5cc3b4464dc667eb609f194ea68fd30dcbd1e90"
+  openprojectInitDb:
+    # providerCategory: "Community"
+    # providerResponsible: "OpenProject"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "library/postgres"
+    registry: "registry-1.docker.io"
+    repository: "library/postgres"
+    tag: "16.3-alpine3.20@sha256:de3d7b6e4b5b3fe899e997579d6dfe95a99539d154abe03f0b6839133ed05065"
+  openxchangeBootstrap:
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "alpine/k8s"
+    registry: "registry-1.docker.io"
+    repository: "alpine/k8s"
+    tag: "1.26.8@sha256:acde24d2a8ebaafda76f464591a5ddc7d0acd08bb38b12560961c1b1c4fc85ec"
+  openxchangeCoreGuidedtours:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/core-guidedtours"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["8", "6", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-guidedtours"
+    tag: "8.6.3@sha256:6fb8169cba4beb4bd9039f4ce7ab9b29fc02c4991b283824db949fe2b7be34e2"
+  openxchangeCoreMW:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/middleware-public-sector"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["8", "20", "51"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/middleware-public-sector"
+    tag: "8.23.47@sha256:b721bf41d7f06b328e9235a0561436cb678bc2a1a67202f0fa6e1f55956cc0cc"
+  openxchangeCoreUI:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/core-ui"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["8", "20", "1"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui"
+    tag: "8.23.2@sha256:0cc07053cbb9d7062a17ef807c6a6942a912748243a6f0c63a892d5cb2953351"
+  openxchangeCoreUIMiddleware:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/core-ui-middleware"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["2", "0", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui-middleware"
+    tag: "2.0.3@sha256:56fe8afe841105f0725674e36afc6f10f22751e3c21a301a6322834383f2d786"
+  openxchangeCoreUserGuide:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/core-user-guide"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["8", "20", "799279"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-user-guide"
+    tag: "8.23.941932@sha256:231b13cb795241513d2f54ee4bc628843ae737b5ecceab758aba3658f03de1bd"
+  openxchangeDocumentConverter:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/documentconverter"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["8", "20", "50"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/documentconverter"
+    tag: "8.23.43@sha256:aa9bbce833ae018573997fb07dcaf32bb7c5c4c6a7d6331f3d3156fd5b8d53b3"
+  openxchangeGotenberg:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/gotenberg"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["7", "9", "2"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/gotenberg"
+    tag: "8.2.0@sha256:ec5afe8eea496d3bef6c42291fde9c203c20e8a68189a2314ef876e9c0e67680"
+  openxchangeGuardUI:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/guard-ui"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["4", "2", "2"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/guard-ui"
+    tag: "8.23.0@sha256:0510458017fa028582515ce18c0b12f91ac9e23f0e94e99ac34fd49b07146c01"
+  openxchangeImageConverter:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/imageconverter"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["8", "20", "50"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/imageconverter"
+    tag: "8.23.43@sha256:ecc77a569f60e1b14f0d77ec93d891200b89d11eb9d7c26f59fa7696343e20e3"
+  openxchangeNextcloudIntegrationUI:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/nextcloud-integration-ui"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["1", "2", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/nextcloud-integration-ui"
+    tag: "1.2.0@sha256:3d0ef11196f7544a01539e6790e4402ad69e2a501312eb7c7bb128c6563d0a8d"
+  openxchangePublicSectorUI:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Open-Xchange"
+    # upstreamRegistry: "https://registry.open-xchange.com"
+    # upstreamRepository: "appsuite-public-sector/public-sector-ui"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["2", "2", "1"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/public-sector-ui"
+    tag: "2.3.0@sha256:a557816ee55500ecc3b46b60f0440ea66c7f0d90e888ce3b0df8a9acdd72acbe"
+  oxConnector:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/ox-connector-standalone"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "4", "2"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ox-connector-standalone"
+    tag: "0.4.2@sha256:308489c0c0e0436bbbedbd757f78875d44468992c46c8d371c584dc778b30770"
+  postfix:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/images/postfix"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/postfix"
+    tag: "1.0.0@sha256:61e4661a7323101dfb51c85c5a48c345c75436f3f533176f049d2660d711a8a5"
+  postgresql:
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "library/postgres"
+    registry: "registry-1.docker.io"
+    repository: "library/postgres"
+    tag: "15.4-alpine3.18@sha256:f36c528a2dc8747ea40b4cb8578da69fa75c5063fd6a71dcea3e3b2a6404ff7b"
+  prosody:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Nordeck"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "jitsi/prosody"
+    # upstreamMirrorTagFilterRegEx: '^stable-(\d+)-?\d?$'
+    # upstreamMirrorStartFrom: ["8922"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/prosody"
+    tag: "stable-9457-2@sha256:5364b0c9c6de654b7b31b5821e9cd7a39660a19010348e7ac56b85be2944daa0"
+  redis:
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "bitnami/redis"
+    # WE ARE STUCK WITH <7.4 because of https://redis.com/blog/redis-adopts-dual-source-available-licensing/
+    registry: "registry-1.docker.io"
+    repository: "bitnami/redis"
+    tag: "7.2.3-debian-11-r2@sha256:9ac3bbf7740969d32689e360ddcfa5f672538c47f6f6cf296173c3078de0edf2"
+  synapse:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "matrixdotorg/synapse"
+    # upstreamMirrorTagFilterRegEx: '^v(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["1", "91", "2"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse"
+    tag: "v1.108.0@sha256:0754a5c372f4cfb5f69f58ad4b70d05bc2e380354f1b0c9101611e9157082712"
+  synapseCreateUser:
+    # providerCategory: "Community"
+    # providerResponsible: "Nordeck"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "alpine/k8s"
+    registry: "registry-1.docker.io"
+    repository: "alpine/k8s"
+    tag: "1.30.0@sha256:d7a11b7032550e992667fd7725b039dcd639270fbceec368d7e66e3d9e41ee15"
+  synapseGuestModule:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Nordeck"
+    # upstreamRegistry: "https://ghcr.io"
+    # upstreamRepository: "nordeck/synapse-guest-module"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["1", "0", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/synapse-guest-module"
+    tag: "1.0.0@sha256:6b3b17183a7d163148cc1bc5342604682ec67d898394fc743db2f339e61c722e"
+  synapseWeb:
+    # providerCategory: "Community"
+    # providerResponsible: "Element"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "rapidfort/haproxy-official"
+    registry: "registry-1.docker.io"
+    repository: "rapidfort/haproxy-official"
+    tag: "2.6.15-bullseye@sha256:47b6ca4074347788cb414fbf3db35d0c51e9e47af33be46457f95c750540887c"
  nubusDataLoader:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -265,11 +494,9 @@ images:
    # upstreamRepository: "nubus/images/data-loader"
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
    # upstreamMirrorStartFrom: ["0", "41", "5"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/data-loader"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/data-loader"
-    tag: "0.60.1@sha256:fc658d98f3611bbc793eecdab4f4668d4648f45047d60c92bde9ee642568f701"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/data-loader"
+    tag: "0.58.1@sha256:9dcc4c8d99d3fa968aa3ddc67812c70816509c29111a503798d7a7c522cde850"
  nubusGuardianAuthorizationApi:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -307,11 +534,9 @@ images:
    # upstreamRepository: "nubus/images/guardian-init"
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
    # upstreamMirrorStartFrom: ["0", "3", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-init"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/guardian-init"
-    tag: "0.10.0@sha256:480943182f20b04b3d37b340e701545e002710c6668925de3758587174c5ee56"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-init"
+    tag: "0.9.1@sha256:6006fb1c2779b906e7725df524f2587b2a610cc442793bf8f16b2b4b8c0494fb"
  nubusKeycloak:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -329,11 +554,9 @@ images:
    # upstreamRepository: "nubus/images/keycloak-bootstrap"
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
    # upstreamMirrorStartFrom: ["0", "1", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-bootstrap"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/keycloak-bootstrap"
-    tag: "0.1.2"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-bootstrap"
+    tag: "0.1.0@sha256:351097e9e7b469f2fc149fe612ec6ad515d5e6b081d7e2785bd926a1d77209d2"
  nubusKeycloakExtensionHandler:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -343,7 +566,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "0", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-handler"
-    tag: "0.9.4@sha256:247182a965cc56fe2a891d42a7cfe84205804a9e58dd8f0a8191726a68cb9db1"
+    tag: "0.9.1@sha256:4c8087cf871c1383a016c331a9687812d71ee6b6e1a899d241a1b887a1ec3702"
  nubusKeycloakExtensionProxy:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -353,7 +576,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "0", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-proxy"
-    tag: "0.9.4@sha256:a572fe076a2ef5966433fec478c92cffade816e71f2b4661bd8dbcb9e60c8c2f"
+    tag: "0.9.1@sha256:01e5e160799f30e85cccecd3dc4c50d4c296f5fa48c15c5e1d52d94ea63eb5f7"
  nubusLdapNotifier:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -372,8 +595,8 @@ images:
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
    # upstreamMirrorStartFrom: ["0", "8", "2"]
    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/images/temp-nubus-ldap-2.5-upgrade"
-    tag: "1.1.20@sha256:90f46b8817fa05e6e3ac3b2f053911198675805fb82db8240bfa41239d7e7c61"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server"
+    tag: "0.17.1@sha256:5b7b629b9655c7bb2857013f3399cefe5bdd3963d568bbf77d6d488c005e3b3b"
  nubusLdapServerDhInitContainer:
    # providerCategory: 'Community'
    # providerResponsible: 'Univention'
@@ -426,16 +649,6 @@ images:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-authorization-api-opa"
    tag: "2.0.0@sha256:56a92a08da5addb951a2b2df09974889295ddde8526e93ad40dd973de1052ad4"
-  nubusOxExtension:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/ox-extension"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "10", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ox-extension"
-    tag: "0.10.0@sha256:f6f32ce0486594eca9c8682b10f60e9d174a526d5acd2ba4d0abcb8f522539b9"
  nubusPortalConsumer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -446,16 +659,6 @@ images:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-consumer"
    tag: "0.27.0@sha256:e86bf827d1e93b61473a0730492f48f8dbf0d056b79dd9ecde7af1612696b144"
-  nubusPortalExtension:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/portal-extension"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "28", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-extension"
-    tag: "0.28.0@sha256:1ec467bebc402265e1c24b3d441c211faad1a025ded41afe8dd4687b7ad5a9a4"
  nubusPortalFrontend:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -545,7 +748,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "3", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-invitation"
-    tag: "0.6.4@sha256:3fcc56c2e039a5a503183ec272fea334083079ceb83c8af7283f9be9b4334d71"
+    tag: "0.6.2@sha256:28b111488e13deb565475c69bc6493b4bafbc96f50109cc77e23f8055b9f4e34"
  nubusSelfserviceListener:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -555,7 +758,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "3", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-listener"
-    tag: "0.6.4@sha256:9605072b60d832ba165d8b7f9b1b7195693e7d5744479af321e4cf242f9ea500"
+    tag: "0.6.5@sha256:a9724fd41cb89a9bdf231ea8699126d2d3503dc894fe9510a1e080ab8408838d"
  nubusStackGateway:
    # providerCategory: "Community"
    # providerResponsible: "Univention"
@@ -581,11 +784,9 @@ images:
    # upstreamRepository: "nubus/images/umc-gateway"
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
    # upstreamMirrorStartFrom: ["0", "7", "3"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-gateway"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/umc-gateway"
-    tag: "0.26.0@sha256:c8d025851ca45c50f61fa1da97681a583e07ab57945a0b9fecb56cefc1e11331"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-gateway"
+    tag: "0.22.2@sha256:fe4d2c148946da6f5e92201f398ebd0d5a72795c50648993bd220ea1e228658d"
  nubusUmcServer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -613,7 +814,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
-    tag: "1.2.1@sha256:f5ce0be27580c6347c5e700c4fa271a811d45d8a0e4b40ffe8a4d0e3d47e670f"
+    tag: "1.2.0@sha256:3b364c60bedb9ae001c39cbf84e4b4b326b9559078f21bfc993cf0e601196e6f"
  openproject:
    # providerCategory: "Supplier"
    # providerResponsible: "OpenProject"
@@ -623,7 +824,7 @@ images:
    # upstreamMirrorStartFrom: ["13", "1", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "14.4.0@sha256:0c1ee5467b5c7888f38eae88a712c2eec6c96995b85f09e0c27705c09f450a70"
+    tag: "14.2.0@sha256:b4ea55b925de4fc8760ccf30268f0a2d472c4204bd4fc512720e8757489335d6"
  openprojectBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -631,7 +832,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-openproject-bootstrap"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-openproject-bootstrap"
-    tag: "1.1.4@sha256:2fd97a316114428849aaeef87fb8755274e675830088a93afcafac91bb048d1d"
+    tag: "1.1.3@sha256:401afe66c418fd130088edbed5cc3b4464dc667eb609f194ea68fd30dcbd1e90"
  openprojectInitDb:
    # providerCategory: "Community"
    # providerResponsible: "OpenProject"
@@ -657,7 +858,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "6", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-guidedtours"
-    tag: "8.6.5@sha256:cbdea676267011d5c9ef7764fcd23ef432219b61c4f3949ef11ddfc4920873dd"
+    tag: "8.6.3@sha256:6fb8169cba4beb4bd9039f4ce7ab9b29fc02c4991b283824db949fe2b7be34e2"
  openxchangeCoreMW:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -667,7 +868,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "51"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/middleware-public-sector"
-    tag: "8.26.38@sha256:ff2dcf50a9d9a801357255f7244173fe9835715fd1852a28e3a8ebb7c0634293"
+    tag: "8.23.47@sha256:b721bf41d7f06b328e9235a0561436cb678bc2a1a67202f0fa6e1f55956cc0cc"
  openxchangeCoreUI:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -677,7 +878,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui"
-    tag: "8.27.4@sha256:d5b99bfc12baaeb5cbfc332c260ecca5308b6b662fe8acc8cd07479c99a1d148"
+    tag: "8.23.2@sha256:0cc07053cbb9d7062a17ef807c6a6942a912748243a6f0c63a892d5cb2953351"
  openxchangeCoreUIMiddleware:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -687,7 +888,7 @@ images:
    # upstreamMirrorStartFrom: ["2", "0", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui-middleware"
-    tag: "2.0.4@sha256:e1d647cca13e7c433a9d643aa1a350197511274b239ead100aa1682ffe2fa116"
+    tag: "2.0.3@sha256:56fe8afe841105f0725674e36afc6f10f22751e3c21a301a6322834383f2d786"
  openxchangeCoreUserGuide:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -697,7 +898,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "799279"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-user-guide"
-    tag: "8.27.1071402@sha256:764108a8dcb28467dadad1cfd98074a8e174209652de2f009d74fea51bb50d65"
+    tag: "8.23.941932@sha256:231b13cb795241513d2f54ee4bc628843ae737b5ecceab758aba3658f03de1bd"
  openxchangeDocumentConverter:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -707,7 +908,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "50"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/documentconverter"
-    tag: "8.27.54@sha256:79080b4b766901977532a18ef38af70234a99cf0bf53900c4df3902f24702eb7"
+    tag: "8.23.43@sha256:aa9bbce833ae018573997fb07dcaf32bb7c5c4c6a7d6331f3d3156fd5b8d53b3"
  openxchangeGotenberg:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -727,7 +928,7 @@ images:
    # upstreamMirrorStartFrom: ["4", "2", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/guard-ui"
-    tag: "8.27.0@sha256:89b81de90a6e7078371d8ea02ab4e1056c512ba515db113daf55b160533f7a73"
+    tag: "8.23.0@sha256:0510458017fa028582515ce18c0b12f91ac9e23f0e94e99ac34fd49b07146c01"
  openxchangeImageConverter:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -737,7 +938,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "50"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/imageconverter"
-    tag: "8.27.55@sha256:f999c8205d83730a064aec13eb98762e1c7354f31f42e0add0136cf15be32dd0"
+    tag: "8.23.43@sha256:ecc77a569f60e1b14f0d77ec93d891200b89d11eb9d7c26f59fa7696343e20e3"
  openxchangeNextcloudIntegrationUI:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
--- a/helmfile/environments/default/opendesk_main.gotmpl
+++ b/helmfile/environments/default/opendesk_main.gotmpl
@@ -6,71 +6,71 @@
 ---
 certificates:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 clamavDistributed:
  enabled: false
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 clamavSimple:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 collabora:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 cryptpad:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 dovecot:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 element:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 home:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 intercom:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 jitsi:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 mariadb:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 memcached:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 migrations:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 minio:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 nextcloud:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 nubus:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 openproject:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 oxAppsuite:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 oxConnector:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 postfix:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 postgresql:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 redis:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 xwiki:
  enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 ...
--- a/helmfile/environments/default/replicas.yaml
+++ b/helmfile/environments/default/replicas.yaml
@@ -1,138 +1,62 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
-# This file contains annotations to (later) generate parts of "docs/scaling.md".
-# When adding new components in here, do not forget to add them as well to
-# `../test/values.yaml.gotmpl` to ensure their linting coverage.
+# Before increasing the replicas of components, please consult the scaling documentation at "docs/scaling.md" to ensure
+# that scaling of the respective component is possible and has the desired effect.
 replicas:
-  # -- component: Antivirus (ClamAV)
-  # -- scalable: true
-  # -- comment: clamav-simple - supports `ReadWriteOnce` PVCs.
+  # clamav-simple
  clamav: 1
-  # -- scalable: true
-  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
+  # clamav-distributed
  clamd: 1
-  # -- scalable: true
-  # -- comment: clamav-distributed - You do not want to scale this service, as it just updates the signature files centrally an should be a singleton.
-  freshclam: 1
-  # -- scalable: true
-  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
-  icap: 1
-  # -- scalable: true
-  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
-  milter: 1
-
-  # -- component: Weboffice (Collabora)
-  # -- scalable: true
  collabora: 1
-
-  # -- component: Pad (CryptPad)
-  # -- scalable: false
  cryptpad: 1
-
-  # -- component: Groupware (OX AppSuite, OX Dovecot etc.)
-  # -- scalable: false
-  # -- comment: Scalable in openDesk Enterprise only
  dovecot: 1
-  # -- scalable: false
-  postfix: 1
-
-  # -- component: Chat (Element, Synapse)
-  # -- scalable: true
  element: 1
-  # -- scalable: tbd
-  matrixNeoBoardWidget: 1
-  # -- scalable: tbd
-  matrixNeoChoiceWidget: 1
-  # -- scalable: tbd
-  matrixNeoDateFixBot: 1
-  # -- scalable: tbd
-  matrixNeoDateFixWidget: 1
-  # -- scalable: tbd
-  matrixUserVerificationService: 1
-  # -- scalable: tbd
-  synapse: 1
-  # -- scalable: true
-  synapseWeb: 1
-  # -- scalable: true
-  wellKnown: 1
-
-  # -- component: IAM (Nubus)
-  # -- scalable: true
+  # clamav-distributed
+  freshclam: 1
+  # clamav-distributed
+  icap: 1
  intercomService: 1
-  # -- scalable: true
-  keycloak: 1
-  # -- scalable: false
-  # -- comment: Will be removed soon.
-  oxConnector: 1
-  # -- scalable: false
-  # -- comment: Should not be scaled, is an async process.
-  umsKeycloakExtensionsHandler: 1
-  # -- scalable: true
-  umsKeycloakExtensionsProxy: 1
-  # -- scalable: tbd
-  umsLdapNotifier: 1
-  # -- scalable: tbd
-  umsLdapServer: 1
-  # -- scalable: tbd
-  umsNotificationsApi: 1
-  # -- scalable: true
-  umsPortalFrontend: 1
-  # -- scalable: tbd
-  umsPortalListener: 1
-  # -- scalable: true
-  umsPortalServer: 1
-  # -- scalable: tbd
-  umsSelfserviceListener: 1
-  # -- scalable: tbd
-  umsStackGateway: 1
-  # -- scalable: true
-  umsUdmRestApi: 1
-  # -- scalable: tbd
-  umsUmcGateway: 1
-  # -- scalable: tbd
-  umsUmcServer: 1
-
-  # -- component: Video conference (Jitsi)
-  # -- scalable: tbd
  jibri: 1
-  # -- scalable: tbd
  jicofo: 1
-  # -- scalable: tbd
  jitsi: 1
-  # -- scalable: tbd
  jitsiKeycloakAdapter: 1
-  # -- scalable: tbd
  jvb: 1
-
-  # -- component: Persistence Layer
-  # -- scalable: false
+  keycloak: 1
  mariadb: 1
-  # -- scalable: false
+  matrixNeoBoardWidget: 1
+  matrixNeoChoiceWidget: 1
+  matrixNeoDateFixBot: 1
+  matrixNeoDateFixWidget: 1
+  matrixUserVerificationService: 1
  memcached: 1
-  # -- scalable: true
+  # clamav-distributed
+  milter: 1
  minio: 1
-  # -- scalable: false
-  postgres: 1
-  # -- scalable: tbd
-  redis: 1
-
-  # -- component: Filestore (Nextcloud)
-  # -- scalable: true
  nextcloudApache2: 1
-  # -- scalable: true
  nextcloudExporter: 1
-  # -- scalable: true
  nextcloudPHP: 1
-
-  # -- component: Project management (OpenProject)
-  # -- scalable: true
  openprojectWeb: 1
-  # -- scalable: tdb
-  # -- comment: Async process that usually has no need for scaling
  openprojectWorker: 1
-
-  # -- component: Knowledge management (XWiki)
-  # -- scalable: false
+  oxConnector: 1
+  postfix: 1
+  postgres: 1
+  redis: 1
+  synapse: 1
+  synapseWeb: 1
+  umsKeycloakExtensionsHandler: 1
+  umsKeycloakExtensionsProxy: 1
+  umsLdapNotifier: 1
+  umsLdapServer: 1
+  umsNotificationsApi: 1
+  umsPortalFrontend: 1
+  umsPortalListener: 1
+  umsPortalServer: 1
+  umsSelfserviceListener: 1
+  umsStackGateway: 1
+  umsUdmRestApi: 1
+  umsUmcGateway: 1
+  umsUmcServer: 1
+  wellKnown: 1
  xwiki: 1
 ...
--- a/helmfile/environments/default/secrets.gotmpl
+++ b/helmfile/environments/default/secrets.gotmpl
@@ -18,7 +18,6 @@ secrets:
    cookieHashSalt: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "cookie_hash_salt" | sha1sum | quote }}
    shareCryptKey: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "share_crypt_key" | sha1sum | quote }}
    sessiondEncryptionKey: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "sessiond_encryption_key" | sha1sum | quote }}
-    synapseAsToken: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "as_token" | sha1sum | quote }}
  nubus:
    ldapSecret: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "cn=admin" "ldap" | sha1sum | quote }}
    ldapSearch:
--- a/helmfile/environments/test/values.yaml.gotmpl
+++ b/helmfile/environments/test/values.yaml.gotmpl
@@ -35,13 +35,17 @@ ingress:
    enabled: true
    secretName: "kyverno-tls"
 replicas:
+  # clamav-simple
  clamav: 42
+  # clamav-distributed
  clamd: 42
  collabora: 42
  cryptpad: 42
  dovecot: 42
  element: 42
+  # clamav-distributed
  freshclam: 42
+  # clamav-distributed
  icap: 42
  intercomService: 42
  jibri: 42
@@ -57,6 +61,7 @@ replicas:
  matrixNeoDateFixWidget: 42
  matrixUserVerificationService: 42
  memcached: 42
+  # clamav-distributed
  milter: 42
  minio: 42
  nextcloudApache2: 42
--- a/helmfile/shared/migrations.yaml.gotmpl
+++ b/helmfile/shared/migrations.yaml.gotmpl
@@ -16,12 +16,11 @@ cleanup:

 migrations:
  runId: 2
-  namespace: {{ .Values.migrations.namespace | default .Release.Namespace | quote }}
+  namespace: {{ .Values.migrations.namespace | quote }}
  loglevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
  failOnUnexpectedState: true
  environmentDetails:
    {{ .Values | toYaml | nindent 4 }}
-  cleanup: false

 containerSecurityContext:
  allowPrivilegeEscalation: false
Author	SHA1	Message	Date
Jaime Conde	2427389207	fix(nubus): Fix udm-rest-api extended_attributes	2024-08-01 22:01:27 +02:00
Jaime Conde	2767ff1923	fix(nubus): Better logging and fixes for keycloak-extensions	2024-08-01 10:12:58 +02:00
Jaime Conde	1805a6bce5	fix(provisioning): Point OX Connector to LDAP Server Primaries	2024-08-01 10:05:04 +02:00
Jaime Conde	66561d9a25	fix(nubus): Keycloak Extensions wrong sender email	2024-08-01 00:06:32 +02:00
Jaime Conde	ed144c2be2	fix(nubus): Keycloak Extensions bump python-keycloak	2024-07-31 18:12:49 +02:00
Thorsten Roßner	aae2dc3344	fix(migrations): Properly handle pre-existing configmaps when adding a value.	2024-07-31 17:50:07 +02:00
Thorsten Roßner	8b1f1c1380	fix(nubus): Theming	2024-07-31 17:50:07 +02:00
Thorsten Roßner	ba8366301b	fix(helmfile): Re-add `services` app to `helmfile_generic.yaml`.	2024-07-31 17:50:07 +02:00
Thorsten Roßner	8b7cb04765	fix(nubus): Update component name.	2024-07-31 17:50:07 +02:00
Thorsten Roßner	a33efe6160	fix(migrations): Support Nubus MR upgrade.	2024-07-31 17:50:07 +02:00
Thorsten Roßner	b361b57dae	fix(migrations): Support Nubus MR upgrade.	2024-07-31 17:50:06 +02:00
Carlos García-Mauriño	dc8ec1f5f9	feat(nubus): Update ums-stack	2024-07-31 17:43:26 +02:00
Carlos García-Mauriño	b06faf8616	fix(nubus): UMC policies Might want to replace this commit and just use the same change from `ums-stack`.	2024-07-31 17:43:26 +02:00
Carlos García-Mauriño	4db56e2833	fix(nubus): Enable selfservice listener	2024-07-31 17:43:26 +02:00
Carlos García-Mauriño	eef32033f6	feat(nubus): Update upstream charts and images	2024-07-31 17:43:26 +02:00
Carlos García-Mauriño	613302ddbf	feat(nubus): Move theme customization to this repo	2024-07-31 17:43:26 +02:00
Carlos García-Mauriño	30cb62bf05	feat(nubus): Update nubus to 0.28.0.	2024-07-31 17:43:26 +02:00
Jaime Conde	1c0a329866	fix(nubus): Keycloak admin console only when debug is set	2024-07-31 17:43:26 +02:00
Thorsten Roßner	150b222c88	fix(docs): Update migration.md with LDAP PVC update information.	2024-07-31 17:43:25 +02:00
Jaime Conde	663bb3f344	fix(nubus): Disable provisioning	2024-07-31 17:42:09 +02:00
Jaime Conde	97f55f40d0	fix(nubus): Portal title	2024-07-31 17:42:09 +02:00
Jaime Conde	795d4f14bb	fix(nubus): Disable keycloak admin console unless debug is set	2024-07-31 17:42:09 +02:00
Jaime Conde	cae20a56d9	fix(nubus): OX ldap mappers	2024-07-31 17:42:09 +02:00
Jaime Conde	22d984e71f	fix(nubus): Rebase images	2024-07-31 17:42:07 +02:00
Jaime Conde	f626b81c53	fix(nubus): Drop old files	2024-07-31 17:40:57 +02:00
Jaime Conde	c15fb90ef3	fix(nubus): Boostrap new file	2024-07-31 17:40:57 +02:00
Jaime Conde	ecfd051521	fix(nubus): Bump nubus to include fixes	2024-07-31 17:40:57 +02:00
Jaime Conde	02f708c0d9	fix(nubus): Central navigation	2024-07-31 17:40:57 +02:00
Jaime Conde	7b01ffa57f	fix(nubus): Portal title	2024-07-31 17:40:57 +02:00
Jaime Conde	19f0ed87a3	fix(nubus): Keycloak wrong credentials	2024-07-31 17:40:57 +02:00
Daniel Troeder	f084bbf840	fix(nubus): Support for customization/templating of password reset email.	2024-07-31 17:40:57 +02:00
Jaime Conde	d9a248e06b	fix(nubus): Fix tile links to use templated links	2024-07-31 17:40:57 +02:00
Jaime Conde	ef346d4b57	fix(nubus): Drop guardian provisioning	2024-07-31 17:40:57 +02:00
Jaime Conde	9dfbadfac5	fix(nubus): Missing ldapBase caused by extra quoting	2024-07-31 17:40:57 +02:00
Jaime Conde	b75273089a	fix(nubus): Missing secret mapping for keycloak-boostrap	2024-07-31 17:40:57 +02:00
Jaime Conde	1d652f2d4e	fix(nubus): Rollback secret derivation change	2024-07-31 17:40:57 +02:00
Jaime Conde	a33a7bcf00	fix(nubus): Use Keycloak credentials	2024-07-31 17:40:57 +02:00
Thorsten Roßner	1956fafd79	fix(nubus): Reorder images.yaml for opendesk Linter.	2024-07-31 17:40:55 +02:00
Jaime Conde	0680bc97cb	fix(nubus): Quote port for keycloak-extensions	2024-07-31 17:38:01 +02:00
Jaime Conde	7ef6aa07f6	fix(nubus): Bump nubus version	2024-07-31 17:38:01 +02:00
Jaime Conde	065dface91	fix(nubus): Map helmfile default account secrets to Nubus	2024-07-31 17:38:01 +02:00
Andreas Niemann	eedece7699	chore(nubus): Switch to mainline Nubus branch	2024-07-31 17:38:01 +02:00
Andreas Niemann	181a67e7be	feat(nubus): Introduce credentialOverride usage	2024-07-31 17:38:01 +02:00
Carlos García-Mauriño	80b4a62c1b	feat: Customize nubus images	2024-07-31 17:38:01 +02:00
Carlos García-Mauriño	55692d407e	feat: Update pinned images	2024-07-31 17:38:01 +02:00
Andreas Niemann	2d52fac18c	chore(nubus): Change stack-gateway ingress hostname to read .Values.global.domain	2024-07-31 17:38:01 +02:00
Jaime Conde	a76cf0abaf	fix(nubus): Stack-gateway ingress namespace repeated twice	2024-07-31 17:38:01 +02:00
Thorsten Roßner	403714afcc	fix(nubus): Some cleanup.	2024-07-31 17:38:01 +02:00
Thorsten Roßner	99712f1594	fix(nubus): Set OpenCoDE as registry for Nubus umbrella chart.	2024-07-31 17:38:01 +02:00
Andreas Niemann	283fcf9626	chore(nubus): Change stack-gateway ingress hostname to read .Values.global.domain	2024-07-31 17:38:01 +02:00
Andreas Niemann	31fdc63a63	chore(nubus): Drop unneeded univnetion-management-stack app	2024-07-31 17:38:01 +02:00
Andreas Niemann	b00a7b59c0	fix(nubus): Use otterize feature branch feat(nubus): Use nubus umbrella	2024-07-31 17:38:01 +02:00