feat(nubus): Update chart to version 0.62.4

Signed-off-by: Milton Moura <miltonmoura@gmail.com>

.gitignore

@@ -6,7 +6,11 @@
 
 # Ignore changes to sample environments
 helmfile/environments/dev/*.yaml.gotmpl
+helmfile/environments/test/*.yaml.gotmpl
 helmfile/environments/prod/*.yaml.gotmpl
+!helmfile/environments/dev/sample.yaml.gotmpl
+!helmfile/environments/test/sample.yaml.gotmpl
+!helmfile/environments/prod/sample.yaml.gotmpl
 
 # Ignore in CI generated files
 .kyverno/opendesk.yaml

.gitlab-ci.yml

@@ -4,7 +4,7 @@
 ---
 include:
   - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "v2.3.3"
+    ref: "v2.3.4"
     file:
       - "ci/common/automr.yml"
       - "ci/common/lint.yml"
@@ -97,12 +97,6 @@ variables:
     options:
       - "yes"
       - "no"
-  DEPLOY_PROVISIONING:
-    description: "Enable Provisioning Components."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
   DEPLOY_COLLABORA:
     description: "Enable Collabora deployment."
     value: "no"
@@ -127,12 +121,6 @@ variables:
     options:
       - "yes"
       - "no"
-  DEPLOY_ICS:
-    description: "Enable ICS deployment."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
   DEPLOY_XWIKI:
     description: "Enable XWiki deployment."
     value: "no"
@@ -159,7 +147,7 @@ variables:
       - "no"
   RUN_TESTS:
     description: "Triggers execution of E2E-tests."
-    value: "yes"
+    value: "no"
     options:
       - "yes"
       - "no"
@@ -171,14 +159,26 @@ variables:
       - "no"
   TESTS_BRANCH:
     description: "Branch of E2E-tests on which the test pipeline is triggered"
-    value: "main"
+    value: "develop"
+  TESTS_PROJECT_URL:
+    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
+    value: "gitlab.opencode.de/api/v4/projects/1506"
+  TESTS_TESTSET:
+    description: "Selects testset for E2E-tests"
+    value: "Smoke"
+    options:
+      - "Regression"
+      - "Smoke"
+  TESTS_GRACE_PERIOD:
+    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail. GRACE_PERIOD is the period in seconds that should be waited before running the tests."
+    value: "0"
 
 .deploy-common:
   cache: {}
   dependencies: []
   extends: ".environments"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.0.1\
-          @sha256:d38f41b88374e055332860018f2936db8807b763caf6089735db0484cbb2842a"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.1.0\
+          @sha256:74f349066ac5d20e3afaa6abd28781b4c8dc086f67e3d3c1b8345e4a9c3371b1"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
     # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD
@@ -236,14 +236,6 @@ env-start:
   script:
     - "echo \"Deploying to Environment ${NAMESPACE} in ${CLUSTER} Cluster\""
     - "kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -"
-    - >
-      kubectl create secret
-      --namespace "${NAMESPACE}"
-      docker-registry external-registry
-      --docker-server "${EXTERNAL_REGISTRY}"
-      --docker-username "${EXTERNAL_REGISTRY_USERNAME}"
-      --docker-password "${EXTERNAL_REGISTRY_PASSWORD}"
-      --dry-run=client -o yaml | kubectl apply -f -
   stage: "env"
 
 policies-deploy:
@@ -295,19 +287,7 @@ services-deploy:
   variables:
     COMPONENT: "services"
 
-provisioning-deploy:
-  stage: "component-deploy-stage-2"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no" || $DEPLOY_PROVISIONING != "no")
-      when: "on_success"
-  variables:
-    COMPONENT: "provisioning"
-
-ums-deploy:
+nubus-deploy:
   stage: "component-deploy-stage-1"
   extends: ".deploy-common"
   rules:
@@ -332,18 +312,6 @@ ox-deploy:
   variables:
     COMPONENT: "open-xchange"
 
-ics-deploy:
-  stage: "component-deploy-stage-1"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ICS != "no")
-      when: "on_success"
-  variables:
-    COMPONENT: "intercom-service"
-
 xwiki-deploy:
   stage: "component-deploy-stage-1"
   extends: ".deploy-common"
@@ -461,15 +429,11 @@ env-stop:
 
 .ums-default-password: &ums-default-password
   - |
-    UMS_PASSWORDS=$( \
-      kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}' \
-      | yq '.properties.password' > passwords.txt \
-    )
     DEFAULT_USER_PASSWORD=$( \
-      awk 'NR==1{print $1}' passwords.txt \
+       kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.user_password}' | base64 -d \
     )
     DEFAULT_ADMIN_PASSWORD=$(
-      awk 'NR==3{print $1}' passwords.txt \
+       kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.admin_password}' | base64 -d \
     )
 
 run-tests:
@@ -481,6 +445,11 @@ run-tests:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
       when: "on_success"
+  parallel:
+    matrix:
+      - LANGUAGE:
+          - "de"
+          - "en"
   script:
     - *ums-default-password
     - |
@@ -490,27 +459,29 @@ run-tests:
         \"ref\": \"${TESTS_BRANCH}\", \
         \"token\": \"${CI_JOB_TOKEN}\", \
         \"variables\": { \
-          \"url\": \"https://portal.${DOMAIN}\", \
+          \"operator\": \"${OPERATOR}\", \
+          \"cluster\": \"${CLUSTER}\", \
+          \"namespace\": \"${NAMESPACE}\", \
+          \"url\": \"https://portal.${DOMAIN}/\", \
+          \"language\": \"${LANGUAGE}\", \
           \"user_name\": \"${DEFAULT_USER_NAME}\", \
           \"user_password\": \"${DEFAULT_USER_PASSWORD}\", \
           \"admin_name\": \"${DEFAULT_ADMIN_NAME}\", \
           \"admin_password\": \"${DEFAULT_ADMIN_PASSWORD}\", \
-          \"DEPLOY_ALL_COMPONENTS\": \"${DEPLOY_ALL_COMPONENTS}\", \
-          \"DEPLOY_COLLABORA\": \"${DEPLOY_COLLABORA}\", \
-          \"DEPLOY_ELEMENT\": \"${DEPLOY_ELEMENT}\", \
-          \"DEPLOY_ICS\": \"${DEPLOY_ICS}\", \
-          \"DEPLOY_JITSI\": \"${DEPLOY_JITSI}\", \
-          \"DEPLOY_KEYCLOAK\": \"${DEPLOY_UMS}\", \
-          \"DEPLOY_NEXTCLOUD\": \"${DEPLOY_NEXTCLOUD}\", \
-          \"DEPLOY_OPENPROJECT\": \"${DEPLOY_OPENPROJECT}\", \
-          \"DEPLOY_OX\": \"${DEPLOY_OX}\", \
-          \"DEPLOY_SERVICES\": \"${DEPLOY_SERVICES}\", \
-          \"DEPLOY_UCS\": \"${DEPLOY_UMS}\", \
-          \"DEPLOY_XWIKI\": \"${DEPLOY_XWIKI}\", \
-          \"DEPLOY_PROVISIONING\": \"${DEPLOY_PROVISIONING}\" \
+          \"screenshot_test\": \"yes\", \
+          \"screenshot_before_step\": \"yes\", \
+          \"screenshot_after_step\": \"yes\", \
+          \"screenshot_redirect_step\": \"yes\", \
+          \"testset\": \"${TESTS_TESTSET}\", \
+          \"testprofile\": \"Namespace\", \
+          \"gitlab_functional_yaml\": \"https://gitlab.opencode.de/api/v4/projects/1317/repository/files/helmfile%2Fenvironments%2Fdefault%2Ffunctional.yaml?ref=develop\", \
+          \"gitlab_env_namespace_template\": \"https://gitlab.opencode.de/api/v4/projects/1564/repository/files/environments%2F{operator}%2F{cluster}%2F{namespace}.yaml.gotmpl?ref=main\", \
+          \"gitlab_default_env_namespace\": \"values\", \
+          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\" \
         } \
       }" \
       "https://${TESTS_PROJECT_URL}/trigger/pipeline"
+  retry: 1
 
 avscan-prepare:
   stage: ".pre"
@@ -687,5 +658,4 @@ renovate:
   script:
     - "renovate ${RENOVATE_EXTRA_FLAGS}"
   stage: "renovate"
-
 ...

.gitlab/common/common.yml

@@ -2,10 +2,10 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.4.4\
-    @sha256:4120fe717071876f4c9ff128f26019d089fda158a4fb1912911e09af2fd3875f"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.5\
-    @sha256:60870adb64b0503d4a6efd16cef4e074b91a4ca52b48811cfcea057bcccd07e4"
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.5.0\
+    @sha256:630e102edc70c9e730a46180e79ff278fd8b5039eb336110e0df89fe415225ef"
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.6\
+    @sha256:0a8997876a0c3f5a3c73eb6bd75c5cde63757bc31b983bfd92cfcb17389d536f"
 
 .common:
   cache: {}

.gitlab/lint/lint-kyverno.yml

@@ -14,18 +14,19 @@ lint-kyverno:
           - "collabora"
           - "cryptpad"
           - "element"
-          - "intercom-service"
           - "jitsi"
           - "nextcloud"
           - "nubus"
           - "open-xchange"
           - "openproject"
           - "openproject-bootstrap"
-          - "provisioning"
           - "services"
           - "xwiki"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${APP}"
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-env
+      -d ${CI_PROJECT_DIR}/helmfile/environments
     - "helmfile template -e test --include-needs > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
     - >
       node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests

.reuse/dep5

@@ -1,16 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: openDesk - der Souveräne Arbeitsplatz
-Upstream-Contact: <opendesk@zendis.de>
-Source: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk
-
-Files: helmfile/files/theme/*
-Copyright: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-License: Apache-2.0
-
-Files: helmfile/files/gpg-pubkeys/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: CC0-1.0
-
-Files: cspell.json
-Copyright: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-License: Apache-2.0

README.md

@@ -36,9 +36,9 @@ openDesk currently features the following functional main components:
 | Groupware            | OX App Suite                | [8.26](https://documentation.open-xchange.com/appsuite/releases/8.26/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
 | Knowledge management | XWiki                       | [16.4.1](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.1/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                            |
 | Portal & IAM         | Nubus                       | Product Preview[^1]                                                                   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html)                                                    |
-| Project management   | OpenProject                 | [14.4.0](https://www.openproject.org/docs/release-notes/14-4-0/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
+| Project management   | OpenProject                 | [14.5.1](https://www.openproject.org/docs/release-notes/14-5-1/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
 | Videoconferencing    | Jitsi                       | [2.0.9646](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9646) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
-| Weboffice            | Collabora                   | [24.04.6.1.1](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
+| Weboffice            | Collabora                   | [24.04.7.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
 
 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.

REUSE.toml

@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+
+version = 1
+
+[[annotations]]
+path = "helmfile/files/theme/*"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "cspell.json"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/gpg-pubkeys/*"
+SPDX-FileCopyrightText = "2023 Bundesministerium des Innern und für Heimat, PG ZenDiS \"Projektgruppe für Aufbau ZenDiS\""
+SPDX-License-Identifier = "CC0-1.0"

cspell.json

@@ -73,7 +73,8 @@
         "Addressbooks",
         "filestore",
         "trashbin",
-        "bootstrap"
+        "bootstrap",
+        "configurability"
     ],
     "ignoreWords": [],
     "import": []

dev/charts-local.py

@@ -25,7 +25,7 @@ script_path = os.path.dirname(os.path.realpath(__file__))
 log_path = script_path+'/../logs'
 charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml'
 base_repo_path = script_path+'/..'
-base_helmfile = base_repo_path+'/helmfile_generic.yaml'
+base_helmfile = base_repo_path+'/helmfile_generic.yaml.gotmpl'
 helmfile_backup_extension = '.bak'
 
 Path(log_path).mkdir(parents=True, exist_ok=True)

docs/ci.md

@@ -33,10 +33,11 @@ You might want to set credential variables in the GitLab project at `Settings` >
 # Tests
 
 The GitLab CI pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another GitLab project.
-The `DEPLOY_`-variables are used to determine which components should be tested.
 In order for the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this GitLab project's CI variables
 that can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
 `<domain of gitlab>/api/v4/projects/<id>`.
-
+To select the current testset, use the variable `TESTS_TESTSET`. Default: `Smoke`.
 If the branch of the test pipeline is not `main` this can be set with the `.gitlab-ci.yml` variable
 `TESTS_BRANCH` while creating a new pipeline.
+
+The variable `testprofile` within the job is set to `Namespace`, which tells the e2e tests to use environment specific settings that will be read from the cluster and namespace specific file in the opendesk-env repository.

docs/components.md

@@ -33,21 +33,20 @@ they need to be replaced in production deployments.
 | ClamAV (Simple)             | Antivirus engine               | Eval       |
 | Collabora                   | Weboffice                      | Functional |
 | CryptPad                    | Weboffice                      | Functional |
+| dkimpy-milter               | DKIM milter for Postfix        | Eval       |
 | Element                     | Secure communications platform | Functional |
-| Intercom Service            | Cross service data exchange    | Functional |
 | Jitsi                       | Videoconferencing              | Functional |
 | MariaDB                     | Database                       | Eval       |
 | Memcached                   | Cache Database                 | Eval       |
 | MinIO                       | Object Storage                 | Eval       |
 | Nextcloud                   | File share                     | Functional |
+| Nubus (UMS)                 | Identity Management & Portal   | Functional |
 | OpenProject                 | Project management             | Functional |
 | OX Appsuite                 | Groupware                      | Functional |
 | OX Dovecot                  | Mail backend (IMAP)            | Functional |
-| Provisioning (OX Connector) | Groupware provisioning         | Functional |
 | Postfix                     | MTA                            | Eval       |
 | PostgreSQL                  | Database                       | Eval       |
 | Redis                       | Cache Database                 | Eval       |
-| Univention Management Stack | Identity Management & Portal   | Functional |
 | XWiki                       | Knowledge Management           | Functional |
 
 # Component integration
@@ -74,9 +73,9 @@ Most details can be found in the upstream documentation that is linked in the re
 
 ## Intercom Service / Silent Login
 
-The Intercom Service's role is to enable cross-application integration based on the user's browser interaction as handling
-authentication when the frontend of an application has to call the API from another application is often a
-challenge.
+The Intercom Service is deployed in context of Nubus/UMS. Its role is to enable cross-application integration
+based on the user's browser interaction as handling authentication when the frontend of an application has to call
+the API from another application is often a challenge.
 
 To establish a session with the Intercom Service an application can use the silent login feature within an iframe.
 

docs/development.md

@@ -138,6 +138,9 @@ configured to pull artifacts that do not originate from Open CoDE into projects
 
 The mirror script takes the information on what artifacts to mirror from the annotation inside the two yaml files:
 - `# upstreamRegistry` *required*: To identify the source registry
+- `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public the access credentials have to be specified as ENV variables containing the value of this key in their name, so you want to specific that key all uppercase:
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORT`
 - `# upstreamRepository` *required*: To identify the source repository
 - `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set it activates the mirror for the component. Only tags are being mirrored that match the given regular expression. **Note:** You have to use single quotes for this attribute's value in case you use backslash leading regex notation like `\d`.
 - `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing groups

docs/getting-started.md

@@ -60,16 +60,16 @@ The deployment is designed to deploy each application/service under a dedicated
 For your convenience, we recommend to create a `*.domain.tld` A-Record to your cluster ingress controller,
 otherwise you need to create an A-Record for each subdomain.
 
-| Record name             | Type | Value                                              | Additional information                                                             |
-| ----------------------- | ---- | -------------------------------------------------- | ---------------------------------------------------------------------------------- |
-| *.domain.tld            | A    | IPv4 address of your Ingress Controller            |                                                                                    |
-| *.domain.tld            | AAAA | IPv6 address of your Ingress Controller            |                                                                                    |
-| mail.domain.tld         | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| mail.domain.tld         | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| domain.tld              | MX   | `10 mail.domain.tld`                               |                                                                                    |
-| domain.tld              | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                                         |
-| _dmarc.domain.tld       | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                                           |
-| _matrix._tcp.domain.tld | SRV  | `1 10 PORT matrix.domain.tld`                      | `PORT` is your NodePort/LoadBalancer port of `opendesk-synapse-federation` service |
+| Record name                   | Type | Value                                              | Additional information                                           |
+|-------------------------------|------|----------------------------------------------------|------------------------------------------------------------------|
+| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                  |
+| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                  |
+| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                  |
+| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                       |
+| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                         |
+| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional DKIM settings                                           |
 
 ## Domain
 
@@ -109,7 +109,6 @@ All available apps and their default value can be found in `helmfile/environment
 | CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
 | Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
 | Element              | `element.enabled`           | `true`  | Secure communications platform |
-| Intercom Service     | `intercom.enabled`          | `true`  | Cross service data exchange    |
 | Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
 | MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
 | Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
@@ -118,7 +117,6 @@ All available apps and their default value can be found in `helmfile/environment
 | Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
 | OpenProject          | `openproject.enabled`       | `true`  | Project management             |
 | OX Appsuite          | `oxAppsuite.enabled`        | `true`  | Groupware                      |
-| Provisioning         | `oxConnector.enabled`       | `true`  | Backend provisioning           |
 | Postfix              | `postfix.enabled`           | `true`  | MTA                            |
 | PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
 | Redis                | `redis.enabled`             | `true`  | Cache Database                 |
@@ -157,6 +155,15 @@ alternatively you can use an environment variable:
 export PRIVATE_IMAGE_REGISTRY_URL=my_private_registry.domain.tld
 ```
 
+or control repository override fine-granular per registry:
+
+```yaml
+repositories:
+  image:
+    dockerHub: "my_private_registry.domain.tld/docker.io/"
+    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
+```
+
 If authentication is required, you can reference imagePullSecrets as following:
 
 ```yaml
@@ -263,6 +270,8 @@ To use the openDesk functionality with its web based user interface you need to
 
 | Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
+| openDesk           | Kubernetes Ingress      |    80 |  TCP |
+| openDesk           | Kubernetes Ingress      |   443 |  TCP |
 | Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
 
 #### Mail clients
@@ -288,6 +297,20 @@ smtp:
   password: "secret"
 ```
 
+Enabling DKIM signing of emails helps to reduce spam and increases trust.
+openDesk ships dkimpy-milter as Postfix milter for signing mails.
+
+```yaml
+dkimpy:
+  enable: true
+  dkim:
+    key:
+      value: |
+        HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E=
+    selector: "default"
+    useED25519: true # when false, RSA is used
+```
+
 ### TURN configuration
 
 Some components (Jitsi, Element) use for direct communication a TURN server. You can configure your own TURN server with

docs/migrations.md

@@ -8,7 +8,13 @@ SPDX-License-Identifier: Apache-2.0
 * [Disclaimer](#disclaimer)
 * [Releases upgrades](#releases-upgrades)
   * [From v0.9.0](#from-v090)
+    * [Changed openDesk defaults](#changed-opendesk-defaults)
+      * [MatrixID localpart update](#matrixid-localpart-update)
+      * [File-share configurability](#file-share-configurability)
+      * [Updated default subdomains in `global.hosts`](#updated-default-subdomains-in-globalhosts)
+      * [Updated `global.imagePullSecrets`](#updated-globalimagepullsecrets)
     * [Automated migrations](#automated-migrations)
+      * [Local Postfix as Relay](#local-postfix-as-relay)
       * [Updated IAM component Nubus](#updated-iam-component-nubus)
         * [Manual cleanup](#manual-cleanup)
   * [From v0.8.1](#from-v081)
@@ -24,25 +30,162 @@ We do not offer support for upgrades before we reach openDesk 1.0.
 
 Though we try to ease the pain when it comes to 0.x upgrades. That is what this document is for.
 
-Limitations:
-- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was deleted and will cover an explicit delete for PVs.
+**Limitations:**
+- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was
+  deleted and will cover an explicit delete for PVs.
 
 # Releases upgrades
 
 ## From v0.9.0
 
+### Changed openDesk defaults
+
+#### MatrixID localpart update
+
+Until 0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's MatrixID. Due to restrictions of the
+Matrix protocol, an update of a MatrixID is not possible, therefore, it was technically convenient to use the UUID
+as it is immutable (see https://de.wikipedia.org/wiki/Universally_Unique_Identifier for more details on UUIDs.)
+
+From the user experience perspective, that was a bad approach, so from now on, by default, the username which
+is also used for logging into openDesk is used to define the localpart of the MatrixID.
+
+For existing installations: The changed setting only affects users that login to Element the first time. Existing
+user accounts will not be harmed. If you want existing users to get new MatrixIDs based on the new setting, you
+need to update their external ID in Synapse and deactivate the old user afterward. The user will get a new
+Matrix account from scratch, losing the existing contacts, chats and rooms.
+
+The following Admin API calls are helpful:
+- GET /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain> get the user's existing external_id (auth_provider: "oidc")
+- PUT /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain> update user's external_id with JSON payload:
+  `{ "external_ids": [ { "auth_provider": "oidc", "external_id": "<old_id>+deprecated" } ] }`
+- POST /_synapse/admin/v1/deactivate/@<entryuuid>:<matrixdomain> deactivate old user with JSON payload:
+  `{ "erase": true }`
+
+For more details, check the Admin API documentation:
+https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html
+
+You can enforce the old standard with the following setting:
+```
+functional:
+  chat:
+    matrix:
+      profile:
+        useImmutableIdentifierForLocalpart: true
+```
+
+#### File-share configurability
+
+Now we provide some configurability regarding the sharing capabilities of the Nextcloud component.
+
+The new default is different from the standard until now.
+To keep the current state after the upgrade from 0.9.0, you have to provide the following settings:
+
+```
+functional:
+  filestore:
+    sharing:
+      external:
+        enabled: true
+```
+
+Please also check the other new options available at `functional.filestore.sharing`.
+
+#### Updated default subdomains in `global.hosts`
+
+We have streamlined the subdomain names used by openDesk to be more user-friendly and to avoid the use of specific
+product names.
+
+This results in following change of default subdomain naming:
+
+- **collabora**: `collabora` → `office`
+- **cryptpad**: `cryptpad` → `pad`
+- **minioApi**: `minio` → `objectstore`
+- **minioConsole**: `minio-console` → `objectstore-ui`
+- **nextcloud**: `fs` → `files`
+- **openproject**: `project` → `projects`
+
+During upgrade, any existing environment needs to keep the old subdomains,
+cause url/link changes are not every supported and not tested at all.
+
+If you have not already defined the entire `global.hosts` dictionary in your custom environments values, please set it
+to the defaults that were used before the upgrade:
+
+```yaml
+global:
+  hosts:
+    collabora: "collabora"
+    cryptpad: "cryptpad"
+    element: "chat"
+    intercomService: "ics"
+    jitsi: "meet"
+    keycloak: "id"
+    matrixNeoBoardWidget: "matrix-neoboard-widget"
+    matrixNeoChoiceWidget: "matrix-neochoice-widget"
+    matrixNeoDateFixBot: "matrix-neodatefix-bot"
+    matrixNeoDateFixWidget: "matrix-neodatefix-widget"
+    minioApi: "minio"
+    minioConsole: "minio-console"
+    nextcloud: "fs"
+    openproject: "project"
+    openxchange: "webmail"
+    synapse: "matrix"
+    synapseFederation: "matrix-federation"
+    univentionManagementStack: "portal"
+    whiteboard: "whiteboard"
+    xwiki: "wiki"
+```
+
+In case you would like to use the updated hostnames you at least have to apply some manual changes. But do this at
+your own risk. Be also aware that some of your user's bookmarks and links will stop working.
+
+- Update the affected portal tiles:
+  - All tiles in the "Files" category.
+  - The "Projects" tile in the "Management" category.
+- There are two options to change the link for the portal tiles:
+  - Use an admin account to access the portal's edit mode (on the bottom of the sidebar portal's menu).
+  - Utilize the UDM REST API to update the portal tile objects.
+- Update the hostnames for the OpenProject-Nextcloud integration using a functional admin user for both components:
+  - In OpenProject: *Administration* > *Files* > *External file storages* > Select `Nextcloud at [your_domain]`
+    Edit *Details* - *General Information* - *Storage provider* and update the *hostname* to `files.<your_domain>`.
+  - In Nextcloud: *Administration* > *OpenProject* > *OpenProject server* update the *OpenProject host* to
+    to `projects.<your_domain>`.
+
+#### Updated `global.imagePullSecrets`
+
+Without using a custom registry, you can pull all the openDesk images without authentication.
+Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them.
+
+You can keep the current settings by setting the `external-registry` in your custom environment values:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "external-registry"
+```
+
 ### Automated migrations
 
+#### Local Postfix as Relay
+
+All components relay outgoing mails to the local Postfix. In order for the configuration to be picked up by all components the following restarts are triggered in the migrations `POST` stage:
+
+- Deployments:
+  - `opendesk-nextcloud-php`
+  - `ums-umc-server`
+- Stateful Sets:
+  - `ums-selfservice-listener`
+  - `opendesk-synapse`
+
 #### Updated IAM component Nubus
 
 openDesk is integrating the latest [Nubus](https://www.univention.de/produkte/nubus/) development from Univention. The now redundant and scalable LDAP requires migration activities. These have been automated to avoid manual interaction. The `run_2` of the openDesk
 upgrade migrations executes the following steps:
 
-- Stage PRE:
+- Stage `PRE`:
   - Delete service `ums-keycloak`, as it will be recreated headless.
   - Scale down `statefulset/ums-ldap-server` and `statefulset/ums-ldap-notifier` in preparation or the next step:
   - Create two new PVCs `shared-data-ums-ldap-server-primary-0` and `shared-data-ums-ldap-server-primary-1` for the new LDAP primary pods as copy from the existing `shared-data-ums-ldap-server-0`. The LDAP secondaries will sync from the primary nodes.
-- Stage POST:
+- Stage `POST`:
   - Restart Keycloak.
 
 ##### Manual cleanup

docs/requirements.md

@@ -24,7 +24,7 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)
 - Domain and DNS Service
 - Ingress controller (Ingress NGINX)
 - [Helm](https://helm.sh/) >= v3.9.0
-- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v0.157.0**
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc.5**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
 - Volume provisioner supporting RWO (read-write-once)
 - Certificate handling with [cert-manager](https://cert-manager.io/)

docs/security-context.md

@@ -158,7 +158,6 @@ This list gives you an overview of templated security settings and if they compl
 | **element**/opendesk-synapse | :white_check_mark: | no | no | yes | yes | 10991 | 10991 | yes | yes |
 | **element**/opendesk-synapse-web | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-well-known | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
-| **intercom-service**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **jitsi**/jitsi | :white_check_mark: | no | no | yes | yes | 1993 | 1993 | yes | yes |
 | **jitsi**/jitsi/jitsi/jibri | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no ["SYS_ADMIN"] |
 | **jitsi**/jitsi/jitsi/jicofo | :x: | no | no | no | no | 0 | 0 | yes | no |
@@ -183,7 +182,7 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **provisioning**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **open-xchange**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
 | **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
 | **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
@@ -196,6 +195,7 @@ This list gives you an overview of templated security settings and if they compl
 | **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
 | **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **univention-management-stack**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |

docs/workflow.md

@@ -355,7 +355,7 @@ Commit messages must adhere to the [Conventional Commit standard](https://www.co
   │       │              |
   │       │              └─> Issue reference (optional)
   │       │
-  │       └─> Commit Scope: helmfile, docs, collabora, intercom-service, ...
+  │       └─> Commit Scope: helmfile, docs, collabora, nextcloud, open-xhcange etc.
   │
   └─> Commit Type: chore, ci, docs, feat, fix
 ```

helmfile.yaml.gotmpl

@@ -15,7 +15,7 @@ environments:
 ---
 # yamllint disable
 helmfiles:
-  - path: "./helmfile_generic.yaml"
+  - path: "./helmfile_generic.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 # {{/*

helmfile/apps/collabora/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/\
-      {{ .Values.charts.collabora.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
 
 releases:
   - name: "collabora-online"
@@ -19,6 +18,7 @@ releases:
     version: "{{ .Values.charts.collabora.version }}"
     values:
       - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.collaboraOnline | default "additionalValues: false" }}
     installed: {{ .Values.collabora.enabled }}
 
 commonLabels:

helmfile/apps/collabora/helmfile.yaml.gotmpl

@@ -6,7 +6,7 @@ bases:
   - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/collabora/values.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,7 +8,7 @@ autoscaling:
   enabled: false
 
 collabora:
-  extra_params: "--o:ssl.enable=false --o:ssl.termination=true --o:fetch_update_check=0"
+  extra_params: "--o:ssl.enable=false --o:ssl.termination=true --o:fetch_update_check=0 --o:remote_font_config.url=https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/index.php/apps/richdocuments/settings/fonts.json"
   username: "collabora-internal-admin"
   password: {{ .Values.secrets.collabora.adminPassword | quote }}
   aliasgroups:
@@ -24,7 +25,7 @@ grafana:
       {{ .Values.monitoring.grafana.dashboards.annotations | toYaml | nindent 6 }}
 
 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
   tag: {{ .Values.images.collabora.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
@@ -83,6 +84,8 @@ ingress:
       hosts:
         - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
 
+podAnnotations: {}
+
 podSecurityContext:
   fsGroup: 100
 

helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/\
-      {{ .Values.charts.cryptpad.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
 
 releases:
   - name: "cryptpad"
@@ -19,6 +18,7 @@ releases:
     version: "{{ .Values.charts.cryptpad.version }}"
     values:
       - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.cryptpad | default "additionalValues: false" }}
     installed: {{ .Values.cryptpad.enabled }}
 
 commonLabels:

helmfile/apps/cryptpad/helmfile.yaml.gotmpl

@@ -6,7 +6,7 @@ bases:
   - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/cryptpad/values.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/README.md or
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/values.yaml
@@ -23,7 +26,7 @@ enableEmbedding: true
 fullnameOverride: "cryptpad"
 
 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
   tag: {{ .Values.images.cryptpad.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
@@ -50,6 +53,8 @@ ingress:
 persistence:
   enabled: false
 
+podAnnotations: {}
+
 podSecurityContext:
   fsGroup: 4001
 

helmfile/apps/element/helmfile-child.yaml

@@ -1,184 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-repositories:
-  # openDesk Element
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
-  - name: "element-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.element.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/\
-      {{ .Values.charts.element.repository }}"
-  - name: "element-well-known-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.elementWellKnown.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/\
-      {{ .Values.charts.elementWellKnown.repository }}"
-  - name: "synapse-web-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.synapseWeb.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/\
-      {{ .Values.charts.synapseWeb.repository }}"
-  - name: "synapse-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.synapse.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/\
-      {{ .Values.charts.synapse.repository }}"
-  - name: "synapse-create-account-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.synapseCreateAccount.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/\
-      {{ .Values.charts.synapseCreateAccount.repository }}"
-
-  # openDesk Matrix Widgets
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
-  - name: "matrix-user-verification-service-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixUserVerificationService.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/\
-      {{ .Values.charts.matrixUserVerificationService.repository }}"
-  - name: "matrix-neoboard-widget-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
-      {{ .Values.charts.matrixNeoboardWidget.repository }}"
-  - name: "matrix-neochoice-widget-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/\
-      {{ .Values.charts.matrixNeoboardWidget.repository }}"
-  - name: "matrix-neodatefix-widget-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/\
-      {{ .Values.charts.matrixNeodatefixWidget.repository }}"
-  - name: "matrix-neodatefix-bot-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/\
-      {{ .Values.charts.matrixNeodatefixBot.repository }}"
-
-
-releases:
-  - name: "opendesk-element"
-    chart: "element-repo/{{ .Values.charts.element.name }}"
-    version: "{{ .Values.charts.element.version }}"
-    values:
-      - "values-element.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-well-known"
-    chart: "element-well-known-repo/{{ .Values.charts.elementWellKnown.name }}"
-    version: "{{ .Values.charts.elementWellKnown.version }}"
-    values:
-      - "values-well-known.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-synapse-web"
-    chart: "synapse-web-repo/{{ .Values.charts.synapseWeb.name }}"
-    version: "{{ .Values.charts.synapseWeb.version }}"
-    values:
-      - "values-synapse-web.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-synapse"
-    chart: "synapse-repo/{{ .Values.charts.synapse.name }}"
-    version: "{{ .Values.charts.synapse.version }}"
-    values:
-      - "values-synapse.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-matrix-user-verification-service-bootstrap"
-    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
-    version: "{{ .Values.charts.synapseCreateAccount.version }}"
-    values:
-      - "values-matrix-user-verification-service-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "opendesk-matrix-user-verification-service"
-    chart: "matrix-user-verification-service-repo/{{ .Values.charts.matrixUserVerificationService.name }}"
-    version: "{{ .Values.charts.matrixUserVerificationService.version }}"
-    values:
-      - "values-matrix-user-verification-service.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neoboard-widget"
-    chart: "matrix-neoboard-widget-repo/{{ .Values.charts.matrixNeoboardWidget.name }}"
-    version: "{{ .Values.charts.matrixNeoboardWidget.version }}"
-    values:
-      - "values-matrix-neoboard-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neochoice-widget"
-    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiseWidget.name }}"
-    version: "{{ .Values.charts.matrixNeochoiseWidget.version }}"
-    values:
-      - "values-matrix-neochoice-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neodatefix-widget"
-    chart: "matrix-neodatefix-widget-repo/{{ .Values.charts.matrixNeodatefixWidget.name }}"
-    version: "{{ .Values.charts.matrixNeodatefixWidget.version }}"
-    values:
-      - "values-matrix-neodatefix-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neodatefix-bot-bootstrap"
-    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
-    version: "{{ .Values.charts.synapseCreateAccount.version }}"
-    values:
-      - "values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-  - name: "matrix-neodatefix-bot"
-    chart: "matrix-neodatefix-bot-repo/{{ .Values.charts.matrixNeodatefixBot.name }}"
-    version: "{{ .Values.charts.matrixNeodatefixBot.version }}"
-    values:
-      - "values-matrix-neodatefix-bot.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
-    timeout: 900
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "element"
-...

helmfile/apps/element/helmfile-child.yaml.gotmpl

@@ -0,0 +1,76 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # openDesk Element
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
+  - name: "element-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.element.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
+  - name: "element-well-known-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.elementWellKnown.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
+  - name: "synapse-web-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseWeb.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
+  - name: "synapse-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapse.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+
+releases:
+  - name: "opendesk-element"
+    chart: "element-repo/{{ .Values.charts.element.name }}"
+    version: "{{ .Values.charts.element.version }}"
+    values:
+      - "values-element.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskElement | default "additionalValues: false" }}
+    installed: {{ .Values.element.enabled }}
+    timeout: 900
+
+  - name: "opendesk-well-known"
+    chart: "element-well-known-repo/{{ .Values.charts.elementWellKnown.name }}"
+    version: "{{ .Values.charts.elementWellKnown.version }}"
+    values:
+      - "values-well-known.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskWellKnown | default "additionalValues: false" }}
+    installed: {{ .Values.element.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-web"
+    chart: "synapse-web-repo/{{ .Values.charts.synapseWeb.name }}"
+    version: "{{ .Values.charts.synapseWeb.version }}"
+    values:
+      - "values-synapse-web.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskSynapseWeb | default "additionalValues: false" }}
+    installed: {{ .Values.element.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse"
+    chart: "synapse-repo/{{ .Values.charts.synapse.name }}"
+    version: "{{ .Values.charts.synapse.version }}"
+    values:
+      - "values-synapse.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskSynapse | default "additionalValues: false" }}
+    installed: {{ .Values.element.enabled }}
+    timeout: 900
+
+commonLabels:
+  deploy-stage: "component-1"
+  component: "element"
+...

helmfile/apps/element/helmfile.yaml.gotmpl

@@ -6,7 +6,7 @@ bases:
   - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/element/values-element.yaml.gotmpl

@@ -1,11 +1,13 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   endToEndEncryption: true
   additionalConfiguration:
-    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=opendesk-matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
 
     "net.nordeck.element_web.module.opendesk":
       config:
@@ -18,84 +20,6 @@ configuration:
           --cpd-color-bg-action-primary-rest: {{ .Values.theme.colors.primary | quote }}
           --cpd-color-text-action-accent: {{ .Values.theme.colors.primary | quote }}
 
-    "net.nordeck.element_web.module.widget_lifecycle":
-      widget_permissions:
-        "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/jitsi.html":
-          identity_approved: true
-        "https://{{ .Values.global.hosts.matrixNeoBoardWidget }}.{{ .Values.global.domain }}/*":
-          preload_approved: true
-          capabilities_approved:
-            - org.matrix.msc2762.send.event:net.nordeck.whiteboard.document.create
-            - org.matrix.msc2762.receive.event:net.nordeck.whiteboard.document.create
-            - org.matrix.msc2762.send.event:net.nordeck.whiteboard.document.chunk
-            - org.matrix.msc2762.receive.event:net.nordeck.whiteboard.document.chunk
-            - org.matrix.msc2762.send.event:net.nordeck.whiteboard.document.snapshot
-            - org.matrix.msc2762.receive.event:net.nordeck.whiteboard.document.snapshot
-            - org.matrix.msc2762.send.state_event:m.room.power_levels#
-            - org.matrix.msc2762.receive.state_event:m.room.power_levels#
-            - org.matrix.msc2762.receive.state_event:m.room.member
-            - org.matrix.msc2762.receive.state_event:m.room.name
-            - org.matrix.msc2762.send.state_event:net.nordeck.whiteboard
-            - org.matrix.msc2762.receive.state_event:net.nordeck.whiteboard
-            - org.matrix.msc2762.send.state_event:net.nordeck.whiteboard.sessions#*
-            - org.matrix.msc2762.receive.state_event:net.nordeck.whiteboard.sessions
-            - org.matrix.msc3819.send.to_device:net.nordeck.whiteboard.connection_signaling
-            - org.matrix.msc3819.receive.to_device:net.nordeck.whiteboard.connection_signaling
-            - town.robin.msc3846.turn_servers
-        "https://{{ .Values.global.hosts.matrixNeoChoiceWidget }}.{{ .Values.global.domain }}/*":
-          preload_approved: true
-          capabilities_approved:
-            - org.matrix.msc2762.send.event:net.nordeck.poll.vote
-            - org.matrix.msc2762.receive.event:net.nordeck.poll.vote
-            - org.matrix.msc2762.send.state_event:net.nordeck.poll
-            - org.matrix.msc2762.receive.state_event:net.nordeck.poll
-            - org.matrix.msc2762.send.state_event:net.nordeck.poll.settings
-            - org.matrix.msc2762.receive.state_event:net.nordeck.poll.settings
-            - org.matrix.msc2762.receive.state_event:m.room.power_levels
-            - org.matrix.msc2762.receive.state_event:m.room.name
-            - org.matrix.msc2762.receive.state_event:m.room.member
-            - org.matrix.msc2762.send.state_event:net.nordeck.poll.group
-            - org.matrix.msc2762.receive.state_event:net.nordeck.poll.group
-            - org.matrix.msc2762.send.event:net.nordeck.poll.start
-            - org.matrix.msc2762.receive.event:net.nordeck.poll.start
-        "https://{{ .Values.global.hosts.matrixNeoDateFixWidget }}.{{ .Values.global.domain }}/*":
-          preload_approved: true
-          identity_approved: true
-          capabilities_approved:
-            - org.matrix.msc2931.navigate
-            - org.matrix.msc2762.timeline:*
-            - org.matrix.msc2762.receive.state_event:m.room.power_levels
-            - org.matrix.msc2762.receive.event:m.reaction
-            - org.matrix.msc2762.receive.state_event:m.room.create
-            - org.matrix.msc2762.receive.state_event:m.room.tombstone
-            - org.matrix.msc2762.receive.state_event:m.room.member
-            - org.matrix.msc2762.send.state_event:m.room.member
-            - org.matrix.msc2762.receive.state_event:m.room.name
-            - org.matrix.msc2762.receive.state_event:m.room.topic
-            - org.matrix.msc2762.receive.state_event:m.space.parent
-            - org.matrix.msc2762.receive.state_event:m.space.child
-            - org.matrix.msc2762.receive.state_event:net.nordeck.meetings.metadata
-            - org.matrix.msc2762.receive.state_event:im.vector.modular.widgets
-            - org.matrix.msc2762.send.event:net.nordeck.meetings.meeting.create
-            - org.matrix.msc2762.receive.event:net.nordeck.meetings.meeting.create
-            - org.matrix.msc2762.send.event:net.nordeck.meetings.breakoutsessions.create
-            - org.matrix.msc2762.receive.event:net.nordeck.meetings.breakoutsessions.create
-            - org.matrix.msc2762.send.event:net.nordeck.meetings.meeting.close
-            - org.matrix.msc2762.receive.event:net.nordeck.meetings.meeting.close
-            - org.matrix.msc2762.send.event:net.nordeck.meetings.meeting.widgets.handle
-            - org.matrix.msc2762.receive.event:net.nordeck.meetings.meeting.widgets.handle
-            - org.matrix.msc2762.send.event:net.nordeck.meetings.meeting.participants.handle
-            - org.matrix.msc2762.receive.event:net.nordeck.meetings.meeting.participants.handle
-            - org.matrix.msc2762.send.event:net.nordeck.meetings.meeting.update
-            - org.matrix.msc2762.receive.event:net.nordeck.meetings.meeting.update
-            - org.matrix.msc2762.send.event:net.nordeck.meetings.meeting.change.message_permissions
-            - org.matrix.msc2762.receive.event:net.nordeck.meetings.meeting.change.message_permissions
-            - org.matrix.msc2762.send.event:net.nordeck.meetings.sub_meetings.send_message
-            - org.matrix.msc2762.receive.event:net.nordeck.meetings.sub_meetings.send_message
-            - org.matrix.msc3973.user_directory_search
-
-  welcomeUserId: "@meetings-bot:{{ .Values.global.domain }}"
-
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -121,7 +45,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.element.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.element.registry | quote }}
   repository: {{ .Values.images.element.repository | quote }}
   tag: {{ .Values.images.element.tag | quote }}
 
@@ -133,6 +57,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101

helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl

@@ -1,52 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  enabled: true
-  privileged: false
-  readOnlyRootFilesystem: true
-  runAsGroup: 101
-  runAsNonRoot: true
-  runAsUser: 101
-  seccompProfile:
-    type: "RuntimeDefault"
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.matrixNeoBoardWidget | toYaml | nindent 4 }}
-
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-image:
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoBoardWidget.registry | quote }}
-  repository: {{ .Values.images.matrixNeoBoardWidget.repository | quote }}
-  tag: {{ .Values.images.matrixNeoBoardWidget.tag | quote }}
-
-ingress:
-  enabled: {{ .Values.ingress.enabled }}
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
-  tls:
-    enabled: {{ .Values.ingress.tls.enabled }}
-    secretName: {{ .Values.ingress.tls.secretName | quote }}
-
-podSecurityContext:
-  enabled: true
-  fsGroup: 101
-
-replicaCount: {{ .Values.replicas.matrixNeoBoardWidget }}
-
-resources:
-  {{ .Values.resources.matrixNeoBoardWidget | toYaml | nindent 2 }}
-
-theme:
-  {{ .Values.theme | toYaml | nindent 2 }}
-
-...

helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl

@@ -1,52 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  enabled: true
-  privileged: false
-  readOnlyRootFilesystem: true
-  runAsGroup: 101
-  runAsNonRoot: true
-  runAsUser: 101
-  seccompProfile:
-    type: "RuntimeDefault"
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.matrixNeoChoiceWidget | toYaml | nindent 4 }}
-
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-image:
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoChoiceWidget.registry | quote }}
-  repository: {{ .Values.images.matrixNeoChoiceWidget.repository | quote }}
-  tag: {{ .Values.images.matrixNeoChoiceWidget.tag | quote }}
-
-ingress:
-  enabled: {{ .Values.ingress.enabled }}
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
-  tls:
-    enabled: {{ .Values.ingress.tls.enabled }}
-    secretName: {{ .Values.ingress.tls.secretName | quote }}
-
-podSecurityContext:
-  enabled: true
-  fsGroup: 101
-
-replicaCount: {{ .Values.replicas.matrixNeoChoiceWidget }}
-
-theme:
-  {{ .Values.theme | toYaml | nindent 2 }}
-
-resources:
-  {{ .Values.resources.matrixNeoChoiceWidget | toYaml | nindent 2 }}
-
-...

helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl

@@ -1,41 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-cleanup:
-  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
-
-configuration:
-  username: "meetings-bot"
-  pod: "opendesk-synapse-0"
-  secretName: "matrix-neodatefix-bot-account"
-  password: {{ .Values.secrets.matrixNeoDateFixBot.password | quote }}
-
-global:
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
-  url: {{ .Values.images.synapseCreateUser.repository | quote }}
-  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-
-fullnameOverride: "matrix-neodatefix-bot-bootstrap"
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  privileged: false
-  readOnlyRootFilesystem: true
-  runAsGroup: 101
-  runAsNonRoot: true
-  runAsUser: 101
-  seccompProfile:
-    type: "RuntimeDefault"
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}
-
-...

helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl

@@ -1,80 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-configuration:
-  bot:
-    username: "meetings-bot"
-    displayname: "Terminplaner Bot"
-  openxchangeBaseUrl: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
-  strings:
-    breakoutSessionWidgetName: "Breakoutsessions"
-    calendarRoomName: "Terminplaner"
-    calendarWidgetName: "Terminplaner"
-    cockpitWidgetName: "Meeting Steuerung"
-    jitsiWidgetName: "Videokonferenz"
-    matrixNeoBoardWidgetName: "Whiteboard"
-    matrixNeoChoiceWidgetName: "Abstimmungen"
-
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  enabled: true
-  privileged: false
-  readOnlyRootFilesystem: true
-  runAsGroup: 101
-  runAsNonRoot: true
-  runAsUser: 101
-  seccompProfile:
-    type: "RuntimeDefault"
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.matrixNeoDateFixBot | toYaml | nindent 4 }}
-
-extraEnvVars:
-  - name: "ACCESS_TOKEN"
-    valueFrom:
-      secretKeyRef:
-        name: "matrix-neodatefix-bot-account"
-        key: "access_token"
-
-image:
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixBot.registry | quote }}
-  repository: {{ .Values.images.matrixNeoDateFixBot.repository | quote }}
-  tag: {{ .Values.images.matrixNeoDateFixBot.tag | quote }}
-
-ingress:
-  enabled: {{ .Values.ingress.enabled }}
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
-  tls:
-    enabled: {{ .Values.ingress.tls.enabled }}
-    secretName: {{ .Values.ingress.tls.secretName | quote }}
-
-livenessProbe:
-  enabled: true
-
-persistence:
-  size: {{ .Values.persistence.size.matrixNeoDateFixBot | quote }}
-  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-
-podSecurityContext:
-  enabled: true
-  fsGroup: 101
-
-readinessProbe:
-  enabled: true
-
-replicaCount: {{ .Values.replicas.matrixNeoDateFixBot }}
-
-resources:
-  {{ .Values.resources.matrixNeoDateFixBot | toYaml | nindent 2 }}
-
-...

helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl

@@ -1,57 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-configuration:
-  bot:
-    username: "meetings-bot"
-    homeserver: {{ .Values.global.matrixDomain | default .Values.global.domain }}
-
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  enabled: true
-  privileged: false
-  readOnlyRootFilesystem: true
-  runAsGroup: 101
-  runAsNonRoot: true
-  runAsUser: 101
-  seccompProfile:
-    type: "RuntimeDefault"
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.matrixNeoDateFixWidget | toYaml | nindent 4 }}
-
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-image:
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixWidget.registry | quote }}
-  repository: {{ .Values.images.matrixNeoDateFixWidget.repository | quote }}
-  tag: {{ .Values.images.matrixNeoDateFixWidget.tag | quote }}
-
-ingress:
-  enabled: {{ .Values.ingress.enabled }}
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
-  tls:
-    enabled: {{ .Values.ingress.tls.enabled }}
-    secretName: {{ .Values.ingress.tls.secretName | quote }}
-
-podSecurityContext:
-  enabled: true
-  fsGroup: 101
-
-replicaCount: {{ .Values.replicas.matrixNeoDateFixWidget }}
-
-resources:
-  {{ .Values.resources.matrixNeoDateFixWidget | toYaml | nindent 2 }}
-
-theme:
-  {{ .Values.theme | toYaml | nindent 2 }}
-
-...

helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl

@@ -1,40 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-cleanup:
-  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
-
-configuration:
-  username: "uvs"
-  pod: "opendesk-synapse-0"
-  secretName: "opendesk-matrix-user-verification-service-account"
-  password: {{ .Values.secrets.matrixUserVerificationService.password | quote }}
-
-global:
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
-  url: {{ .Values.images.synapseCreateUser.repository | quote }}
-  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-
-fullnameOverride: "opendesk-matrix-user-verification-service-bootstrap"
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  privileged: false
-  readOnlyRootFilesystem: true
-  runAsGroup: 101
-  runAsNonRoot: true
-  runAsUser: 101
-  seccompProfile:
-    type: "RuntimeDefault"
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}
-...

helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl

@@ -1,51 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  enabled: true
-  privileged: false
-  readOnlyRootFilesystem: false
-  runAsGroup: 0
-  runAsNonRoot: false
-  runAsUser: 0
-  seccompProfile:
-    type: "RuntimeDefault"
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.matrixUserVerificationService | toYaml | nindent 4 }}
-
-extraEnvVars:
-  - name: "UVS_ACCESS_TOKEN"
-    valueFrom:
-      secretKeyRef:
-        name: "opendesk-matrix-user-verification-service-account"
-        key: "access_token"
-  - name: "UVS_DISABLE_IP_BLACKLIST"
-    value: "true"
-
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-image:
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixUserVerificationService.registry | quote }}
-  repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
-  tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}
-
-podSecurityContext:
-  enabled: true
-  fsGroup: 101
-
-replicaCount: {{ .Values.replicas.matrixUserVerificationService }}
-
-resources:
-  {{ .Values.resources.matrixUserVerificationService | toYaml | nindent 2 }}
-
-...

helmfile/apps/element/values-synapse-web.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 clusterDomain: {{ .Values.cluster.networking.domain }}
 
@@ -29,7 +32,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseWeb.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseWeb.registry | quote }}
   repository: {{ .Values.images.synapseWeb.repository | quote }}
   tag: {{ .Values.images.synapseWeb.tag | quote }}
 
@@ -48,6 +51,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101

helmfile/apps/element/values-synapse.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   additionalConfiguration:
@@ -9,10 +12,9 @@ configuration:
     room_prejoin_state:
       additional_event_types:
         - "m.space.parent"
-        - "net.nordeck.meetings.metadata"
         - "m.room.power_levels"
-    # When a user logs into Element a parallel request is done through Intercom Service to allow Synapse API
-    # interaction, to avoid (temporary) blocking of the user for followup logins we want to raise the limits.
+    # To allow intercom service logins for the users and also allow proper testautomation we want to raise the
+    # ratelimit in a reasonable manner.
     # https://matrix-org.github.io/synapse/v1.59/usage/configuration/config_documentation.html#ratelimiting
     rc_login:
       account:
@@ -30,40 +32,27 @@ configuration:
 
   homeserver:
     serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
-    appServiceConfigs:
-      - as_token: {{ .Values.secrets.intercom.synapseAsToken | quote }}
-        hs_token: {{ .Values.secrets.intercom.synapseAsToken | quote }}
-        id: intercom-service
-        namespaces:
-          users:
-            - exclusive: false
-              regex: "@.*"
-        url: null
-        sender_localpart: intercom-service
-      - as_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
-        hs_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
-        id: ox-appsuite
-        namespaces:
-          users:
-            - exclusive: false
-              regex: "@.*"
-        url: null
-        sender_localpart: ox-appsuite
 
-    presence: 
+    presence:
       enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
-    
+
+    profile:
+      allowUsersToUpdateDisplayname: {{ .Values.functional.chat.matrix.profile.allowUsersToUpdateDisplayname }}
+
     smtp:
-      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.element }}.{{ end }}{{ .Values.global.domain }}"
-      host: {{ .Values.smtp.host | quote }}
-      port: {{ .Values.smtp.port }}
-      username: {{ .Values.smtp.username | quote }}
-      password: {{ .Values.smtp.password | quote }}
+      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      port: 25
+      tls: false
+      starttls: false
+      username: ""
+      password: ""
 
     oidc:
       clientId: "opendesk-matrix"
       clientSecret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
       issuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+      matrixIdLocalpart: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
       scopes:
         - "openid"
         - "opendesk-matrix-scope"
@@ -81,14 +70,6 @@ configuration:
           transport: {{ .Values.turn.transport | quote }}
         {{- end }}
 
-    guestModule:
-      enabled: true
-      image:
-        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-        registry: {{ .Values.global.imageRegistry | default .Values.images.synapseGuestModule.registry | quote }}
-        repository: {{ .Values.images.synapseGuestModule.repository | quote }}
-        tag: {{ .Values.images.synapseGuestModule.tag | quote }}
-
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -124,7 +105,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapse.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapse.registry | quote }}
   repository: {{ .Values.images.synapse.repository | quote }}
   tag: {{ .Values.images.synapse.tag | quote }}
 
@@ -132,6 +113,8 @@ persistence:
   size: {{ .Values.persistence.size.synapse | quote }}
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 10991

helmfile/apps/element/values-well-known.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   e2ee:
@@ -30,7 +33,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.wellKnown.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.wellKnown.registry | quote }}
   repository: {{ .Values.images.wellKnown.repository | quote }}
   tag: {{ .Values.images.wellKnown.tag | quote }}
 
@@ -42,6 +45,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101

helmfile/apps/intercom-service/helmfile-child.yaml

@@ -1,27 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
----
-repositories:
-  # Intercom Service
-  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
-  - name: "intercom-service-repo"
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.intercomService.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/\
-      {{ .Values.charts.intercomService.repository }}"
-
-releases:
-  - name: "intercom-service"
-    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
-    version: "{{ .Values.charts.intercomService.version }}"
-    values:
-      - "values.yaml.gotmpl"
-    installed: {{ .Values.intercom.enabled }}
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "intercom-service"
-...

helmfile/apps/jitsi/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/\
-      {{ .Values.charts.jitsi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
 
 releases:
   - name: "jitsi"
@@ -19,6 +18,7 @@ releases:
     version: "{{ .Values.charts.jitsi.version }}"
     values:
       - "values-jitsi.yaml.gotmpl"
+      - {{ .Values.customization.release.jitsi | default "additionalValues: false" }}
     installed: {{ .Values.jitsi.enabled }}
     timeout: 900
 

helmfile/apps/jitsi/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/jitsi/helmfile.yaml.gotmpl

@@ -6,7 +6,7 @@ bases:
   - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/jitsi/values-jitsi.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -9,6 +10,7 @@ global:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations: {}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -31,7 +33,7 @@ cleanup:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiKeycloakAdapter.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsiKeycloakAdapter.registry | quote }}
   repository: {{ .Values.images.jitsiKeycloakAdapter.repository | quote }}
   tag: {{ .Values.images.jitsiKeycloakAdapter.tag | quote }}
 
@@ -48,8 +50,9 @@ jitsi:
   web:
     replicaCount: {{ .Values.replicas.jitsi }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
       tag: {{ .Values.images.jitsi.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     ingress:
       enabled: {{ .Values.ingress.enabled }}
       ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -61,6 +64,8 @@ jitsi:
         - secretName: {{ .Values.ingress.tls.secretName | quote }}
           hosts:
             - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
+    extraConfigJs:
+      doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
     extraEnvs:
       TURN_ENABLE: "1"
     resources:
@@ -79,8 +84,9 @@ jitsi:
         {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
   prosody:
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
       tag: {{ .Values.images.prosody.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     imagePullSecrets:
     {{- range .Values.global.imagePullSecrets }}
       - name: {{ . | quote }}
@@ -128,8 +134,9 @@ jitsi:
   jicofo:
     replicaCount: {{ .Values.replicas.jicofo }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
       tag: {{ .Values.images.jicofo.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     xmpp:
       password: {{ .Values.secrets.jitsi.jicofoAuthPassword | quote }}
       componentSecret: {{ .Values.secrets.jitsi.jicofoComponentPassword | quote }}
@@ -150,8 +157,9 @@ jitsi:
   jvb:
     replicaCount: {{ .Values.replicas.jvb }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
       tag: {{ .Values.images.jvb.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     xmpp:
       password: {{ .Values.secrets.jitsi.jvbAuthPassword | quote }}
     resources:
@@ -173,8 +181,9 @@ jitsi:
   jibri:
     replicaCount: {{ .Values.replicas.jibri }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
       tag: {{ .Values.images.jibri.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     recorder:
       password: {{ .Values.secrets.jitsi.jibriRecorderPassword | quote }}
     xmpp:
@@ -211,9 +220,12 @@ patchJVB:
       {{ .Values.seLinuxOptions.jitsiPatchJVB | toYaml | nindent 6 }}
   image:
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiPatchJVB.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.jitsiPatchJVB.registry | quote }}
     repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
     tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
+
+podAnnotations: {}
+
 replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}
 
 resources:

helmfile/apps/migrations-post/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/\
-      {{ .Values.charts.migrations.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
 
 releases:
   - name: "opendesk-migrations-post"
@@ -22,6 +21,7 @@ releases:
     values:
       - "values.yaml.gotmpl"
       - "../../shared/migrations.yaml.gotmpl"
+      - {{ .Values.customization.release.migrationsPost | default "additionalValues: false" }}
     installed: {{ .Values.migrations.enabled }}
     timeout: 900
 

helmfile/apps/migrations-post/helmfile.yaml.gotmpl

@@ -5,7 +5,7 @@ bases:
   - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/migrations-post/values.yaml.gotmpl

@@ -3,6 +3,8 @@
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+podAnnotations: {}
+
 migrations:
   stage: "POST"
 ...

helmfile/apps/migrations-pre/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/\
-      {{ .Values.charts.migrations.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
 
 releases:
   - name: "opendesk-migrations-pre"
@@ -22,6 +21,7 @@ releases:
     values:
       - "values.yaml.gotmpl"
       - "../../shared/migrations.yaml.gotmpl"
+      - {{ .Values.customization.release.migrationsPre | default "additionalValues: false" }}
     installed: {{ .Values.migrations.enabled }}
     timeout: 900
 

helmfile/apps/migrations-pre/helmfile.yaml.gotmpl

@@ -5,7 +5,7 @@ bases:
   - "../../bases/environments.yaml"
 ---
 helmfiles:
-  - path: "./helmfile-child.yaml"
+  - path: "./helmfile-child.yaml.gotmpl"
     values:
       - {{ toYaml .Values | nindent 8 }}
 ...

helmfile/apps/migrations-pre/values.yaml.gotmpl

@@ -3,6 +3,8 @@
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+podAnnotations: {}
+
 migrations:
   stage: "PRE"
 ...

helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl

@@ -10,16 +10,14 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/\
-      {{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
   - name: "nextcloud-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.nextcloud.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/\
-      {{ .Values.charts.nextcloud.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
 
 releases:
   - name: "opendesk-nextcloud-management"
@@ -27,6 +25,7 @@ releases:
     version: "{{ .Values.charts.nextcloudManagement.version }}"
     values:
       - "values-nextcloud-mgmt.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskNextcloudManagement | default "additionalValues: false" }}
     waitForJobs: true
     wait: true
     installed: {{ .Values.nextcloud.enabled }}
@@ -36,6 +35,7 @@ releases:
     version: "{{ .Values.charts.nextcloud.version }}"
     values:
       - "values-nextcloud.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskNextcloud | default "additionalValues: false" }}
     needs:
       - "opendesk-nextcloud-management"
     installed: {{ .Values.nextcloud.enabled }}

helmfile/apps/nextcloud/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/nextcloud/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl

@@ -73,16 +73,31 @@ configuration:
       value: "opendesk_username"
     password:
       value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  sharing:
+    allowLinks: {{ .Values.functional.filestore.sharing.external.enabled }}
+    allowMailNotification: {{ .Values.functional.filestore.sharing.external.enabled }}
+    allowPublicUpload: {{ .Values.functional.filestore.sharing.external.enabled }}
+    enforceLinksPassword: {{ .Values.functional.filestore.sharing.external.enforcePasswords }}
+    enforcePasswordProtection: {{ .Values.functional.filestore.sharing.external.enforcePasswords }}
+    defaultInternalExpireEnabled: {{ .Values.functional.filestore.sharing.internal.expiry.activeByDefault }}
+    defaultInternalExpireEnforced: {{ .Values.functional.filestore.sharing.internal.expiry.enforced }}
+    defaultInternalExpireDays: {{ .Values.functional.filestore.sharing.internal.expiry.defaultDays | quote }}
+    defaultExternalExpireEnabled: {{ .Values.functional.filestore.sharing.external.expiry.activeByDefault }}
+    defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
+    defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
   smtp:
     auth:
+      enabled: false
       username:
-        value: {{ .Values.smtp.username | quote }}
+        value: ""
       password:
-        value: {{ .Values.smtp.password | quote }}
-    host: {{ .Values.smtp.host | quote }}
-    port: {{ .Values.smtp.port | quote }}
+        value: ""
+    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    port: 25
     fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
-    mailDomain: "{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.nextcloud }}.{{ end }}{{ .Values.global.domain }}"
+    mailDomain: "{{ .Values.global.domain }}"
+    security: ""
+    skipVerifyPeer: true
   quota:
     default: "{{ .Values.functional.filestore.quota.default }} GB"
     retentionObligation:
@@ -112,7 +127,7 @@ debug:
   loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudManagement.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloudManagement.registry | quote }}
   repository: {{ .Values.images.nextcloudManagement.repository | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.nextcloudManagement.tag | quote }}

helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl

@@ -28,10 +28,11 @@ exporter:
     seLinuxOptions:
       {{ .Values.seLinuxOptions.nextcloudExporter | toYaml | nindent 6 }}
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudExporter.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloudExporter.registry | quote }}
     repository: "{{ .Values.images.nextcloudExporter.repository }}"
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudExporter.tag | quote }}
+  podAnnotations: {}
   prometheus:
     serviceMonitor:
       enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
@@ -87,10 +88,11 @@ php:
   debug:
     loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudPHP.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloudPHP.registry | quote }}
     repository: "{{ .Values.images.nextcloudPHP.repository }}"
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudPHP.tag | quote }}
+  podAnnotations: {}
   prometheus:
     serviceMonitor:
       enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
@@ -138,10 +140,11 @@ apache2:
     tls:
       secretName: {{ .Values.ingress.tls.secretName | quote }}
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudApache2.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloudApache2.registry | quote }}
     repository: {{ .Values.images.nextcloudApache2.repository | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudApache2.tag | quote }}
+  podAnnotations: {}
   replicaCount: {{ .Values.replicas.nextcloudApache2 }}
   resources:
     {{ .Values.resources.nextcloudApache2 | toYaml | nindent 4 }}

helmfile/apps/nubus/helmfile-child.yaml.gotmpl

@@ -10,17 +10,24 @@ repositories:
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
     url:
-      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/\
-      {{ .Values.charts.nubus.repository }}"
-  # OpenDesk Keycloak Bootstrap Chart
+      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
+  # Intercom Service
+  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
+  - name: "intercom-service-repo"
+    keyring: "../../files/gpg-pubkeys/univention-de.gpg"
+    verify: {{ .Values.charts.intercomService.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+  # openDesk Keycloak Bootstrap Chart
   - name: "opendesk-keycloak-bootstrap-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/\
-      {{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
 
 releases:
   # Univention Management Stack Umbrella Chart
@@ -31,14 +38,25 @@ releases:
       - "values-nubus.yaml.gotmpl"
       - "values-opendesk-customization.yaml.gotmpl"
       - "values-opendesk-images.yaml.gotmpl"
+      - {{ .Values.customization.release.ums | default "additionalValues: false" }}
     installed: {{ .Values.nubus.enabled }}
     timeout: 900
-  # OpenDesk Keycloak Bootstrap Chart
+  # Intercom-Service
+  - name: "intercom-service"
+    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
+    version: "{{ .Values.charts.intercomService.version }}"
+    values:
+      - "values-intercom-service.yaml.gotmpl"
+      - {{ .Values.customization.release.intercomService | default "additionalValues: false" }}
+    installed: {{ .Values.nubus.enabled }}
+
+  # openDesk Keycloak Bootstrap Chart
   - name: "opendesk-keycloak-bootstrap"
     chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.opendeskKeycloakBootstrap.name }}"
     version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
     values:
       - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskKeycloakBootstrap | default "additionalValues: false" }}
     needs:
       - "ums"
     installed: {{ .Values.nubus.enabled }}

helmfile/apps/nubus/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/nubus/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/nubus/values-intercom-service.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -52,10 +55,12 @@ ics:
     url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
     audience: "opendesk-oxappsuite"
   nextcloud:
+    origin: {{ .Values.global.hosts.nextcloud | quote }}
+    subdomain: {{ .Values.global.hosts.nextcloud | quote }}
     audience: "opendesk-nextcloud"
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.intercom.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.intercom.registry | quote }}
   repository: {{ .Values.images.intercom.repository | quote }}
   tag: {{ .Values.images.intercom.tag | quote }}
 
@@ -67,11 +72,47 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 1000
   fsGroupChangePolicy: "Always"
 
+provisioning:
+  enabled: true
+  config:
+    nubusBaseUrl: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
+    keycloak:
+      url: "http://ums-keycloak:8080/realms/{{ .Values.platform.realm }}/"
+      username: "kcadmin"
+      realm: {{ .Values.platform.realm | quote }}
+      connection:
+        host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
+        baseUrl: "http://ums-keycloak:8080"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+    ics_client:
+      clientSecret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
+      credentialSecret:
+        key: "ics_secret"
+  image:
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository | quote }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag | quote }}
+  provisioningImage:
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakBootstrap.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloakBootstrap.repository | quote }}
+    tag: {{ .Values.images.nubusKeycloakBootstrap.tag | quote }}
+  securityContext:
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.intercom | toYaml | nindent 6 }}
+
 replicaCount: {{ .Values.replicas.intercomService }}
 
 resources:

helmfile/apps/nubus/values-nubus.yaml.gotmpl

@@ -1,5 +1,7 @@
-# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 global:
   nubusDeployment: true
@@ -7,8 +9,11 @@ global:
     baseDn: {{ .Values.ldap.baseDn | quote }}
     domainName: {{ .Values.global.domain | quote }}
   domain: {{ .Values.global.domain | quote }}
+  subDomains:
+    portal: {{ .Values.global.hosts.nubus | quote }}
+    keycloak: {{ .Values.global.hosts.keycloak | quote }}
   ingressClass: {{ .Values.ingress.ingressClassName | default "nginx" | quote }}
-  certManagerIssuer: "letsencrypt-prod-dns"
+  certManagerIssuer: {{ .Values.certificate.issuerRef.name | quote }}
   nubusMasterPassword: {{ env "MASTER_PASSWORD" | default "sovereign-workplace" | quote }}
   keycloak:
     realm: {{ .Values.platform.realm | quote }}
@@ -24,21 +29,45 @@ global:
     defaultUsers:
       defaultAdminPassword: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote}}
       defaultUserPassword: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote}}
+      defaultAdministratorPassword: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote}}
+    portalConsumer:
+      minio:
+        accessKey: {{ .Values.objectstores.nubus.username | quote }}
+        secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+      provisioningApi:
+        password: {{ .Values.secrets.nubus.portalConsumer.provisioningApiPassword | quote}}
+    provisioning:
+      api:
+        adminPassword: {{ .Values.secrets.nubus.provisioning.api.adminPassword | quote}}
+        natsPassword: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
+        prefillPassword: {{ .Values.secrets.nubus.provisioning.api.prefillPassword | quote}}
+        udmTransformerPassword: {{ .Values.secrets.nubus.provisioning.api.udmTransformerPassword | quote}}
+      dispatcher:
+        natsPassword: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
+      nats:
+        adminPassword: {{ .Values.secrets.nats.natsAdminPassword | quote}}
+      prefill:
+        natsPassword: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
+      udmTransformer:
+        natsPassword: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
+    selfserviceConsumer:
+      provisioningApi:
+        password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}
 
   # -- Extensions to load. Add entries to load additional extensions into Nubus.
   extensions:
     - name: "ox"
       image:
-        registry: {{ .Values.images.nubusOxExtension.registry }}
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOxExtension.registry | quote }}
         repository: {{ .Values.images.nubusOxExtension.repository }}
         tag: {{ .Values.images.nubusOxExtension.tag }}
-        imagePullPolicy: "IfNotPresent"
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
     - name: "opendesk"
       image:
-        registry: "registry.opencode.de"
-        repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-        imagePullPolicy: "IfNotPresent"
-        tag: "1.1.0"
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpendeskExtension.registry | quote }}
+        repository: {{ .Values.images.nubusOpendeskExtension.repository }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        tag: {{ .Values.images.nubusOpendeskExtension.tag }}
 
   # -- Allows to configure the system extensions to load. This is intended for
   # internal usage, prefer to use `global.extensions` for user configured
@@ -46,10 +75,72 @@ global:
   systemExtensions:
     - name: "portal"
       image:
-        registry: {{ .Values.images.nubusPortalExtension.registry }}
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalExtension.registry | quote }}
         repository: {{ .Values.images.nubusPortalExtension.repository }}
         tag: {{ .Values.images.nubusPortalExtension.tag }}
-        imagePullPolicy: "IfNotPresent"
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+  configUcr:
+    directory:
+      manager:
+        web:
+          modules:
+            users:
+              user:
+                add:
+                  default: cn=openDesk User,cn=templates,cn=univention,{{ .Values.ldap.baseDn }}
+                properties:
+                  description:
+                    syntax: TextArea
+                  firstname:
+                    required: "true"
+                  mailPrimaryAddress:
+                    required: "true"
+                  username:
+                    syntax: uid
+                search:
+                  autosearch: "False"
+                wizard:
+                  property:
+                    invite:
+                      default: "True"
+                    overridePWLength:
+                      default: "False"
+                      visible: "False"
+                    pwdChangeNextLogin:
+                      default: "True"
+                      visible: "False"
+            wizard:
+              disabled: "No"
+
+    ucs:
+      web:
+        theme: light
+
+    umc:
+      cookie-banner:
+        show: "false"
+      login:
+        password-complexity-message:
+          de: "Das Passwort muss den folgenden Anforderungen entsprechen:<br><ul><li>Mindestlänge: 8 Zeichen</li></ul>Anmerkung: Wird befinden uns nicht in einer Produktivumgebung."
+          en: "Password must comply with the following rules:<br><ul><li>Minimum length: 8 characters</li></ul>Note: We are in a non production (dev/test/demo) system."
+      module:
+        udm:
+          oxmail:
+            oxcontext:
+              disabled: "True"
+          portals:
+            all:
+              disabled: "True"
+      self-service:
+        passwordreset:
+          token_validity_period: 172800
+
+ingress:
+  certManager:
+    enabled: false
+  tls:
+    enabled: {{ .Values.ingress.tls.enabled }}
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
 
 # Nubus bundled services
 postgresql:
@@ -83,9 +174,15 @@ keycloak:
 
 nubusGuardian:
   provisioning:
-    enabled: true
+    enabled: false
     config:
+      nubusBaseUrl: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain }}
       keycloak:
+        realm: {{ .Values.platform.realm | quote }}
+        username: "kcadmin"
+        connection:
+          host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
+          baseUrl: "http://ums-keycloak:8080"
         credentialSecret:
           name: "ums-opendesk-keycloak-credentials"
           key: "admin_password"
@@ -93,7 +190,12 @@ nubusGuardian:
         credentialSecret:
           name: "ums-opendesk-guardian-client-secret"
           key: "managementApiClientSecret"
-
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
   postgresql:
     connection:
       host: {{ .Values.databases.umsGuardianManagementApi.host | quote }}
@@ -114,7 +216,80 @@ nubusNotificationsApi:
       username: {{ .Values.databases.umsNotificationsApi.username | quote }}
       database: {{ .Values.databases.umsNotificationsApi.name | quote }}
       existingSecret: "ums-notifications-api-postgresql-opendesk-credentials"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+nubusPortalFrontend:
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName }}
+
+    # TODO: Remove the block "items" once the "redirects" section has been
+    # corrected.
+    #
+    # This does override the path configuration of the ingress
+    # "ums-portal-frontend-redirects" to avoid that "/univention/*" is
+    # redirected to "/univention/portal/".
+    items:
+      - name: rewrites
+        # -- Define the Fully Qualified Domain Name (FQDN) where application should be reachable.
+        host: ""
+
+        # -- Define the Ingress paths.
+        paths:
+          - path: /univention/(portal|selfservice)/
+            pathType: ImplementationSpecific
+          - path: /univention/(portal|selfservice)/index.html
+            pathType: ImplementationSpecific
+          - path: /univention/(portal|selfservice)/(css|fonts|i18n|media|js|oidc|custom)(/.*)
+            pathType: ImplementationSpecific
+          - path: /univention/(portal)/(icons)(/.*)$
+            pathType: ImplementationSpecific
+
+        # -- The Ingress controller class name.
+        ingressClassName: ""
+
+        # -- Define custom ingress annotations.
+        # annotations:
+        #   nginx.ingress.kubernetes.io/rewrite-target: /
+        annotations:
+          nginx.ingress.kubernetes.io/rewrite-target: "/$2$3"
+          nginx.ingress.kubernetes.io/use-regex: "true"
+
+        # -- Secure an Ingress by specifying a Secret that contains a TLS private key and certificate.
+        #
+        # Ref.: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
+        tls:
+          # enabled: true
+          # Set to override the global secretName
+          secretName: ""
+      - name: redirects
+        host: ""
+        paths:
+          - pathType: Exact
+            path: /$
+          - pathType: Exact
+            path: /univention$
+          - pathType: Exact
+            path: /univention/$
+          - pathType: Exact
+            path: /univention/portal$
+          - pathType: Exact
+            path: /univention/selfservice$
+        ingressClassName: ""
+        annotations:
+          nginx.ingress.kubernetes.io/permanent-redirect: "/univention/portal/"
+        tls:
+          # enabled: true
+          # Set to override the global secretName
+          secretName: ""
 
 nubusKeycloakExtensions:
   keycloak:
@@ -138,6 +313,11 @@ nubusKeycloakExtensions:
           path: "/resources/"
         - pathType: "Prefix"
           path: "/fingerprintjs"
+      certManager:
+        enabled: false
+      tls:
+        enabled: {{ .Values.ingress.tls.enabled }}
+        secretName: {{ .Values.ingress.tls.secretName | quote }}
 
 
   postgresql:
@@ -152,10 +332,13 @@ nubusKeycloakExtensions:
         key: "umcKeycloakExtensionsDatabasePassword"
   smtp:
     connection:
-      host: {{ .Values.smtp.host | quote }}
-      port: {{ .Values.smtp.port | quote }}
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      port: 25
+      ssl: false
+      starttls: false
     auth:
-      username: {{ .Values.smtp.username | quote }}
+      enabled: false
+      username: ""
       credentialSecret:
         name: "ums-keycloak-extensions-smtp-opendesk-credentials"
         key: "umcKeycloakExtensionsSmtpPassword"
@@ -163,16 +346,20 @@ nubusKeycloakExtensions:
     appConfig:
       logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
       newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
-      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.keycloak }}.{{ end }}{{ .Values.global.domain }}"
+      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
 
 nubusPortalListener:
-  portalListener:
+  enabled: false
+
+nubusPortalConsumer:
+  enabled: true
+  portalConsumer:
+    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
     objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
     objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
-    objectStorageCredentialSecret:
-      name: "ums-portal-listener-minio-opendesk-credentials"
-      accessKeyKey: "access-key-id"
-      secretKeyKey: "secret-key-id"
+  provisioningApi:
+    auth:
+      username: "portal-consumer"
 
 nubusPortalServer:
   portalServer:
@@ -185,19 +372,38 @@ nubusPortalServer:
     centralNavigation:
       enabled: true
       authenticatorSecretName: "ums-opendesk-portal-server-central-navigation"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusUdmRestApi:
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
 
-# NOTE: disabled until the next update.
 nubusProvisioning:
-  enabled: false
-nubusUdmListener:
-  enabled: false
-nubusSelfServiceListener:
   enabled: true
-  selfserviceListener:
-    umcAdminUser: "default.admin"
+
+nubusUdmListener:
+  enabled: true
+
+nubusSelfServiceListener:
+  enabled: false
+
+nubusSelfServiceConsumer:
+  enabled: true
 
 # Nubus services
 nubusStackDataUms:
+  additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
+    argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
   stackDataContext:
     umcPostgresqlHostname: {{ .Values.databases.umsSelfservice.host | quote }}
     umcPostgresqlUsername: {{ .Values.databases.umsSelfservice.username | quote }}
@@ -205,27 +411,12 @@ nubusStackDataUms:
     umcMemcachedUsername: ""
     externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
     umcHtmlTitle: "openDesk Portal"
-    installUmcPolicies: true
-  nubusUmcServer:
-    memcached:
-      auth:
-        username: ""
-
-# TODO: Remove values when upstreaming fixes
-nubusStackDataSwp:
-  stackDataContext:
-    ldapSearchUsers:
-      {{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
-      - username: {{ printf "ldapsearch_%s" $username | quote }}
-        password: {{ $password | quote }}
-        lastname: "LDAP-Search-User"
-      {{- end }}
-    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
-    smtpHost: {{ .Values.smtp.host | quote }}
-    smtpPort: {{ .Values.smtp.port | quote }}
-    smtpUser: {{ .Values.smtp.username | quote }}
+    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    smtpPort: 25
+    smtpUser: ""
+    smtpStartTls: false
     ldapBase: {{ .Values.ldap.baseDn }}
-    # FIXME: Should be templated correctly in the future
+  templateContext:
     portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }}
     portalRealtimeVideoconferenceLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.jitsi .Values.global.domain }}
     portalManagementProjectLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openproject .Values.global.domain }}
@@ -235,6 +426,48 @@ nubusStackDataSwp:
     portalTitleDE: "openDesk Portal"
     portalTitleEN: "openDesk Portal"
     oxDefaultContext: "1"
+    ldapSearchUsers:
+      {{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
+      - username: {{ printf "ldapsearch_%s" $username | quote }}
+        password: {{ $password | quote }}
+        lastname: "LDAP-Search-User"
+      {{- end }}
+    ldapSystemUsers: []
+    portaltileGroupUserStandard:
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupUserAdmin:
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Support,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupUserAll:
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupGroupware:
+      - 'cn=managed-by-attribute-Groupware,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupFileshare:
+      - 'cn=managed-by-attribute-Fileshare,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementProject:
+      - 'cn=managed-by-attribute-Projectmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementKnowledge:
+      - 'cn=managed-by-attribute-Knowledgemanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementLearn:
+      - 'cn=managed-by-attribute-Learnmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupLiveCollaboration:
+      - 'cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}'
+    systemInformation:
+      enabled: true
+      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
+      {{- if .Values.functional.admin.portal.deploymentInformation.enabled }}
+      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
+      {{- else }}
+      deployDate: "not available"
+      {{- end }}
+  # In openDesk the external memcache does not expect a username to be set. Overwriting
+  # the default username of `selfservice` is part of the customizing:
+  nubusUmcServer:
+    memcached:
+      auth:
+        username: ""
 
 nubusUmcServer:
   postgresql:
@@ -258,12 +491,35 @@ nubusUmcServer:
   smtp:
     credentialSecret:
       name: "ums-umc-server-smtp-credentials-custom"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
 
 nubusUmcGateway:
   umcGateway:
     umcHtmlTitle: "openDesk Portal"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+    # TODO: Remove the block "paths" once it has been corrected upstream.
+    paths:
+        - path: /()(univention/)(languages.json|meta.json|theme.css)
+          pathType: ImplementationSpecific
+        - path: /()(univention/)((js|management|themes)/.*)
+          pathType: ImplementationSpecific
+        - path: /()(univention/login/)(dialog.js|main.js|LoginDialog.js|i18n/.*?/main.json)
+          pathType: ImplementationSpecific
 
 nubusKeycloakBootstrap:
+  additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
   keycloak:
     auth:
       username: "kcadmin"
@@ -277,6 +533,11 @@ nubusKeycloakBootstrap:
     twoFactorAuthentication:
       enabled: true
       group: "2fa-users"
+  ldap:
+    auth:
+      bindDn: {{ printf "uid=ldapsearch_keycloak,cn=users,%s" .Values.ldap.baseDn }}
+      credentialSecret:
+        name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
 
 # Credential secrets for accessing customer supplied services
 extraSecrets:
@@ -309,15 +570,14 @@ extraSecrets:
       umcKeycloakExtensionsDatabasePassword: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
   - name: "ums-keycloak-extensions-smtp-opendesk-credentials"
     stringData:
-      umcKeycloakExtensionsSmtpPassword: {{ .Values.smtp.password | quote }}
-  - name: "ums-portal-server-minio-opendesk-credentials"
+      umcKeycloakExtensionsSmtpPassword: ""
+  - name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
     stringData:
-      access-key-id: {{ .Values.objectstores.nubus.username | quote }}
-      secret-key-id: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
-  - name: "ums-portal-listener-minio-opendesk-credentials"
+      password: {{ .Values.secrets.nubus.ldapSearch.keycloak | quote }}
+  - name: "ums-portal-server-minio-opendesk-credentials"
     stringData:
       access-key-id: {{ .Values.objectstores.nubus.username | quote }}
       secret-key-id: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
   - name: "ums-umc-server-smtp-credentials-custom"
     stringData:
-      password: {{ .Values.smtp.password | quote }}
+      password: ""

helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl

@@ -1,35 +1,130 @@
-# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 keycloak:
   enabled: true
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: false
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsKeycloak | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   podAnnotations:
     intents.otterize.com/service-name: "ums-keycloak"
   replicaCount: {{ .Values.replicas.keycloak }}
   resources:
     {{ .Values.resources.umsKeycloak | toYaml | nindent 4 }}
 
-guardian:
+nubusGuardian:
   authorizationApi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
     podAnnotations:
       intents.otterize.com/service-name: "ums-guardian-authorization-api"
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    replicaCount: {{ .Values.replicas.umsGuardianAuthorizationApi }}
     resources:
       {{ .Values.resources.umsGuardianAuthorizationApi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianAuthorizationApi | toYaml | nindent 8 }}
   managementApi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
     podAnnotations:
       intents.otterize.com/service-name: "ums-guardian-management-api"
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    replicaCount: {{ .Values.replicas.umsGuardianManagementApi }}
     resources:
       {{ .Values.resources.umsGuardianManagementApi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianManagementApi | toYaml | nindent 8 }}
   managementUi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
     podAnnotations:
       intents.otterize.com/service-name: "ums-guardian-management-ui"
+    replicaCount: {{ .Values.replicas.umsGuardianManagementUi }}
     resources:
-      {{ .Values.resources.umsGuardianManagementUi | toYaml | nindent 6 }}#
+      {{ .Values.resources.umsGuardianManagementUi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianManagementUi | toYaml | nindent 8 }}
   openPolicyAgent:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
     podAnnotations:
       intents.otterize.com/service-name: "ums-ums-open-policy-agent"
+    replicaCount: {{ .Values.replicas.umsGuardianOpenPolicyAgent }}
     resources:
       {{ .Values.resources.umsOpenPolicyAgent | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsGuardianOpenPolicyAgent | toYaml | nindent 8 }}
   provisioning:
     # Using openDesk keycloak provisioning
     enabled: false
@@ -37,9 +132,24 @@ guardian:
 nubusNotificationsApi:
   additionalAnnotations:
     intents.otterize.com/service-name: "ums-notifications-api"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsNotificationsApi | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   serviceAccount:
-    annotations:
-      intended.usage: "compliance"
+    create: true
   replicaCount: {{ .Values.replicas.umsNotificationsApi }}
   resources:
     {{ .Values.resources.umsNotificationsApi | toYaml | nindent 4 }}
@@ -47,7 +157,40 @@ nubusNotificationsApi:
 nubusUmcServer:
   additionalAnnotations:
     intents.otterize.com/service-name: "ums-umc-server"
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  containerSecurityContextInit:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  proxy:
+    replicaCount: {{ .Values.replicas.umsUmcServerProxy }}
   replicaCount: {{ .Values.replicas.umsUmcServer }}
+
   resources:
     {{ .Values.resources.umsUmcServer | toYaml | nindent 4 }}
   selfService:
@@ -69,39 +212,118 @@ nubusUmcServer:
 
 nubusKeycloakExtensions:
   handler:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
     replicaCount: {{ .Values.replicas.umsKeycloakExtensionsHandler }}
     podAnnotations:
       intents.otterize.com/service-name: "ums-keycloak-extensions-handler"
     resources:
       {{ .Values.resources.umsKeycloakExtensionHandler | toYaml | nindent 6 }}
+    securityContext:
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler | toYaml | nindent 8 }}
   proxy:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
     replicaCount: {{ .Values.replicas.umsKeycloakExtensionsProxy }}
     podAnnotations:
       intents.otterize.com/service-name: "ums-keycloak-extensions-proxy"
     resources:
       {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 6 }}
+    securityContext:
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler | toYaml | nindent 8 }}
 
-nubusPortalListener:
+nubusPortalConsumer:
+  portalConsumer:
+    image:
+      pullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . | quote }}
+        {{- end }}
   podAnnotations:
-    intents.otterize.com/service-name: "ums-portal-listener"
-  replicaCount: {{ .Values.replicas.umsPortalListener }}
+    intents.otterize.com/service-name: "ums-portal-consumer"
+  replicaCount: {{ .Values.replicas.umsPortalConsumer }}
   resources:
-    {{ .Values.resources.umsPortalListener | toYaml | nindent 4 }}
+    {{ .Values.resources.umsPortalConsumer | toYaml | nindent 4 }}
+  resourcesWaitForDependency:
+    {{ .Values.resources.umsPortalConsumerDependencies | toYaml | nindent 4 }}
   persistence:
     storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-    size: {{ .Values.persistence.size.nubus.portalListener | quote }}
+    size: {{ .Values.persistence.size.nubus.portalConsumer | quote }}
+  securityContext:
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalConsumer | toYaml | nindent 6 }}
+
+nubusUdmListener:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 102
+    runAsGroup: 65534
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUdmListener | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUdmListener }}
+  resources:
+    {{ .Values.resources.umsUdmListener | toYaml | nindent 4 }}
 
 nubusPortalServer:
   additionalAnnotations:
     intents.otterize.com/service-name: "ums-portal-server"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalServer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   serviceAccount:
-    annotations:
-      intended.usage: "compliance"
+    create: true
   replicaCount: {{ .Values.replicas.umsPortalServer }}
   resources:
     {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
 
 nubusLdapNotifier:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 101
+    runAsGroup: 102
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsLdapNotifier | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   podAnnotations:
     intents.otterize.com/service-name: "ums-ldap-notifier"
   replicaCount: {{ .Values.replicas.umsLdapNotifier }}
@@ -109,23 +331,95 @@ nubusLdapNotifier:
     {{ .Values.resources.umsLdapNotifier | toYaml | nindent 4 }}
 
 nubusLdapServer:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  highAvailabilityMode: false
+  replicaCountPrimary: 1
+  replicaCountSecondary: 0 # {{ .Values.replicas.umsLdapServerSecondary }}
+  replicaCountProxy: 0 # {{ .Values.replicas.umsLdapServerProxy }}
   additionalAnnotations:
     intents.otterize.com/service-name: "ums-ldap-server"
   serviceAccount:
-    annotations:
-      intended.usage: "compliance"
+    create: true
   initResources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
   resources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
   persistence:
     storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
     size: {{ .Values.persistence.size.nubus.ldapServerData | quote }}
-
+  extraVolumes:
+    - name: "migration-scripts"
+      secret:
+        secretName: "ums-ldap-server-migration"
+        defaultMode: 0555
+  extraVolumeMounts:
+    - name: "migration-scripts"
+      mountPath: "/entrypoint.d/30-purge.sh"
+      subPath: "30-purge.sh"
+    - name: "migration-scripts"
+      mountPath: "/entrypoint.d/95-slapadd-24-ldiff.sh"
+      subPath: "95-slapadd-24-ldif.sh"
+  extraSecrets:
+    - name: "ums-ldap-server-migration"
+      stringData:
+        30-purge.sh: |
+          #!/usr/bin/env bash
+          me=$(basename "$0")
+          echo "- Running ${me}"
+          if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
+            echo "- Cleaning up /var/lib/univention-ldap."
+            cd /var/lib/univention-ldap
+            rm -rf internal
+            rm -rf ldap
+            ls -l
+          else
+            echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
+          fi
+        95-slapadd-24-ldif.sh: |
+          #!/usr/bin/env bash
+          me=$(basename "$0")
+          echo "- Running ${me}"
+          ls -l /var/lib/univention-ldap
+          if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
+            echo "- slapadd-ing /var/lib/univention-ldap/ldap-24-export.ldif"
+            ls -l /var/lib/univention-ldap/
+            rm -rf /var/lib/univention-ldap/ldap
+            rm -rf /var/lib/univention-ldap/internal
+            echo "- deleted /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
+            ls -l /var/lib/univention-ldap/
+            mkdir /var/lib/univention-ldap/ldap
+            mkdir /var/lib/univention-ldap/internal
+            echo "- created /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
+            ls -l /var/lib/univention-ldap/
+            /usr/sbin/slapadd -v -l /var/lib/univention-ldap/ldap-24-export.ldif
+            echo "- slapadd executed"
+            ls -l /var/lib/univention-ldap/
+            mv /var/lib/univention-ldap/ldap-24-export.ldif /var/lib/univention-ldap/ldap-24-export.ldif-imported
+            echo "- import file renamed"
+            ls -l /var/lib/univention-ldap/
+          else
+            echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
+          fi
 nubusPortalFrontend:
   additionalAnnotations:
     intents.otterize.com/service-name: "ums-portal-frontend"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalFrontend | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   serviceAccount:
-    annotations:
-      intended.usage: "compliance"
+    create: true
   replicaCount: {{ .Values.replicas.umsPortalFrontend }}
   resources:
     {{ .Values.resources.umsPortalFrontend | toYaml | nindent 4 }}
@@ -137,27 +431,69 @@ nubusPortalFrontend:
       backgroundImage: {{ .Values.theme.imagery.logoPortalBackgroundSvgB64 | toJson }}
 
 nubusStackDataUms:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsStackDataUms | toYaml | nindent 6 }}
+  pullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   additionalAnnotations:
     intents.otterize.com/service-name: "ums-stack-data-ums"
   resources:
     {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}
 
-nubusStackDataSwp:
-  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-stack-data-swp"
-  resources:
-    {{ .Values.resources.umsStackDataSwp | toYaml | nindent 4 }}
-
-nubusSelfServiceListener:
+nubusSelfServiceConsumer:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsSelfserviceConsumer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   podAnnotations:
     intents.otterize.com/service-name: "ums-selfservice-listener"
   resources:
-    {{ .Values.resources.umsSelfserviceListener | toYaml | nindent 4 }}
-  replicaCount: {{ .Values.replicas.umsSelfserviceListener }}
+    {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsSelfserviceConsumer }}
 
 nubusUdmRestApi:
   additionalAnnotations:
     intents.otterize.com/service-name: "ums-udm-rest-api"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUdmRestApi | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   serviceAccount:
     annotations:
       intended.usage: "compliance"
@@ -168,20 +504,43 @@ nubusUdmRestApi:
   replicaCount: {{ .Values.replicas.umsUdmRestApi }}
 
 nubusUmcGateway:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcGateway | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   replicaCount: {{ .Values.replicas.umsUmcGateway }}
   resources:
     {{ .Values.resources.umsUmcGateway | toYaml | nindent 4 }}
-  extraVolumes:
-    - name: "entrypoint-swp-patches"
-      configMap:
-        name: "ums-stack-data-swp-umc-gateway-entrypoint"
-        defaultMode: 0555
-  extraVolumeMounts:
-    - name: "entrypoint-swp-patches"
-      mountPath: "/entrypoint.d/90-swp.sh"
-      subPath: "90-swp.sh"
 
 nubusKeycloakBootstrap:
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    readOnlyRootFilesystem: false
+    runAsGroup: 1000
+    runAsNonRoot: true
+    runAsUser: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsKeycloakBootstrap | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
   podAnnotations:
     intents.otterize.com/service-name: "ums-keycloak-bootstrap"
   serviceAccount:
@@ -191,39 +550,81 @@ nubusKeycloakBootstrap:
     {{ .Values.resources.umsKeycloakBootstrap | toYaml | nindent 4 }}
 
 nubusProvisioning:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsProvisioning | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount:
+    dispatcher: {{ .Values.replicas.umsProvisioningDispatcher }}
+    udmTransformer: {{ .Values.replicas.umsProvisioningUdmTransformer }}
+    prefill: {{ .Values.replicas.umsProvisioningPrefill }}
+    api: {{ .Values.replicas.umsProvisioningApi }}
+
   serviceAccount:
-    annotations:
-      intended.usage: "compliance"
+    create: true
   nats:
+    config:
+      cluster:
+        replicas: {{ .Values.replicas.umsProvisioningNats }}
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - "ALL"
+      enabled: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      seccompProfile:
+        type: "RuntimeDefault"
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsProvisioningNats | toYaml | nindent 8 }}
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    persistence:
+      size: {{ .Values.persistence.size.nubus.provisioningNats }}
     resources:
-      {{ .Values.resources.nubusProvisioning.nats | toYaml | nindent 6 }}
+      {{ .Values.resources.umsProvisioningNats | toYaml | nindent 6 }}
     additionalAnnotations:
       intents.otterize.com/service-name: "ums-provisioning-nats"
     serviceAccount:
-      annotations:
-        intended.usage: "compliance"
+      create: true
   api:
     resources:
-      {{ .Values.resources.nubusProvisioning.api | toYaml | nindent 6 }}
+      {{ .Values.resources.umsProvisioningApi | toYaml | nindent 6 }}
     additionalAnnotations:
       intents.otterize.com/service-name: "ums-provisioning-api"
   dispatcher:
     resources:
-      {{ .Values.resources.nubusProvisioning.dispatcher | toYaml | nindent 6 }}
+      {{ .Values.resources.umsProvisioningDispatcher | toYaml | nindent 6 }}
     additionalAnnotations:
       intents.otterize.com/service-name: "ums-provisioning-dispatcher"
   prefill:
     resources:
-      {{ .Values.resources.nubusProvisioning.prefill | toYaml | nindent 6 }}
+      {{ .Values.resources.umsProvisioningPrefill | toYaml | nindent 6 }}
     additionalAnnotations:
       intents.otterize.com/service-name: "ums-provisioning-prefill"
   registerConsumers:
-    resources:
-      {{ .Values.resources.nubusProvisioning.registerConsumers | toYaml | nindent 6 }}
     additionalAnnotations:
       intents.otterize.com/service-name: "ums-provisioning-register-consumers"
   udmTransformer:
     resources:
-      {{ .Values.resources.nubusProvisioning.udmTransformer | toYaml | nindent 6 }}
+      {{ .Values.resources.umsProvisioningUdmTransformer | toYaml | nindent 6 }}
     additionalAnnotations:
       intents.otterize.com/service-name: "ums-provisioning-udm-transformer"
+  resources:
+    registerConsumers:
+      {{ .Values.resources.umsProvisioningRegisterConsumers | toYaml | nindent 6 }}

helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl

@@ -1,241 +1,260 @@
-# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
+global:
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
 keycloak:
   image:
-    registry: {{ .Values.images.nubusKeycloak.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloak.registry | quote }}
     repository: {{ .Values.images.nubusKeycloak.repository }}
     tag: {{ .Values.images.nubusKeycloak.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusKeycloakBootstrap:
   image:
-    registry: {{ .Values.images.nubusKeycloakBootstrap.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakBootstrap.registry | quote }}
     repository: {{ .Values.images.nubusKeycloakBootstrap.repository }}
     tag: {{ .Values.images.nubusKeycloakBootstrap.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusKeycloakExtensions:
     handler:
       image:
-        registry: {{ .Values.images.nubusKeycloakExtensionHandler.registry }}
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionHandler.registry | quote }}
         repository: {{ .Values.images.nubusKeycloakExtensionHandler.repository }}
         tag: {{ .Values.images.nubusKeycloakExtensionHandler.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
     proxy:
       image:
-        registry: {{ .Values.images.nubusKeycloakExtensionProxy.registry }}
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionProxy.registry | quote }}
         repository: {{ .Values.images.nubusKeycloakExtensionProxy.repository }}
         tag: {{ .Values.images.nubusKeycloakExtensionProxy.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusLdapNotifier:
   image:
-    registry: {{ .Values.images.nubusLdapNotifier.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapNotifier.registry | quote }}
     repository: {{ .Values.images.nubusLdapNotifier.repository }}
     tag: {{ .Values.images.nubusLdapNotifier.tag }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusLdapServer:
   ldapServer:
     image:
-      registry: {{ .Values.images.nubusLdapServer.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServer.registry | quote }}
       repository: {{ .Values.images.nubusLdapServer.repository }}
       tag: {{ .Values.images.nubusLdapServer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   dhInitcontainer:
     image:
-      registry: {{ .Values.images.nubusLdapServerDhInitContainer.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServerDhInitContainer.registry | quote }}
       repository: {{ .Values.images.nubusLdapServerDhInitContainer.repository }}
       tag: {{ .Values.images.nubusLdapServerDhInitContainer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   waitForDependency:
     image:
-      registry: {{ .Values.images.nubusWaitForDependency.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
       repository: {{ .Values.images.nubusWaitForDependency.repository }}
       tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
+nubusNotificationsApi:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusNotificationsApi.registry | quote }}
+    repository: {{ .Values.images.nubusNotificationsApi.repository }}
+    tag: {{ .Values.images.nubusNotificationsApi.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalFrontend:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalFrontend.registry | quote }}
+    repository: {{ .Values.images.nubusPortalFrontend.repository }}
+    tag: {{ .Values.images.nubusPortalFrontend.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusPortalConsumer:
   portalConsumer:
     image:
-      registry: {{ .Values.images.nubusPortalConsumer.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalConsumer.registry | quote }}
       repository: {{ .Values.images.nubusPortalConsumer.repository }}
       tag: {{ .Values.images.nubusPortalConsumer.tag }}
-
-
-nubusNotificationsApi:
-  image:
-    registry: {{ .Values.images.nubusNotificationsApi.registry }}
-    repository: {{ .Values.images.nubusNotificationsApi.repository }}
-    tag: {{ .Values.images.nubusNotificationsApi.tag }}
-
-nubusPortalFrontend:
-  image:
-    registry: {{ .Values.images.nubusPortalFrontend.registry }}
-    repository: {{ .Values.images.nubusPortalFrontend.repository }}
-    tag: {{ .Values.images.nubusPortalFrontend.tag }}
-
-nubusPortalListener:
-  image:
-    registry: {{ .Values.images.nubusPortalListener.registry }}
-    repository: {{ .Values.images.nubusPortalListener.repository }}
-    tag: {{ .Values.images.nubusPortalListener.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   waitForDependency:
     image:
-      registry: {{ .Values.images.nubusWaitForDependency.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
       repository: {{ .Values.images.nubusWaitForDependency.repository }}
       tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusPortalServer:
   image:
-    registry: {{ .Values.images.nubusPortalServer.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalServer.registry | quote }}
     repository: {{ .Values.images.nubusPortalServer.repository }}
     tag: {{ .Values.images.nubusPortalServer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusProvisioning:
   api:
     image:
-      registry: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningEventsAndConsumerApi.registry | quote }}
       repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
       tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   dispatcher:
     image:
-      registry: {{ .Values.images.nubusProvisioningDispatcher.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningDispatcher.registry | quote }}
       repository: {{ .Values.images.nubusProvisioningDispatcher.repository }}
       tag: {{ .Values.images.nubusProvisioningDispatcher.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   udmTransformer:
     image:
-      registry: {{ .Values.images.nubusProvisioningUdmTransformer.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningUdmTransformer.registry | quote }}
       repository: {{ .Values.images.nubusProvisioningUdmTransformer.repository }}
       tag: {{ .Values.images.nubusProvisioningUdmTransformer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   prefill:
     image:
-      registry: {{ .Values.images.nubusProvisioningPrefill.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningPrefill.registry | quote }}
       repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
       tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   registerConsumers:
     image:
-      registry: {{ .Values.images.nubusWaitForDependency.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
       repository: {{ .Values.images.nubusWaitForDependency.repository }}
       tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   nats:
     nats:
-        image:
-            registry: {{ .Values.images.nubusNats.registry }}
-            repository: {{ .Values.images.nubusNats.repository }}
-            tag: {{ .Values.images.nubusNats.tag }}
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNats.registry | quote }}
+        repository: {{ .Values.images.nubusNats.repository }}
+        tag: {{ .Values.images.nubusNats.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     reloader:
-        image:
-            registry: {{ .Values.images.nubusNatsReloader.registry }}
-            repository: {{ .Values.images.nubusNatsReloader.repository }}
-            tag: {{ .Values.images.nubusNatsReloader.tag }}
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsReloader.registry | quote }}
+        repository: {{ .Values.images.nubusNatsReloader.repository }}
+        tag: {{ .Values.images.nubusNatsReloader.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     natsBox:
-        image:
-            registry: {{ .Values.images.nubusNatsBox.registry }}
-            repository: {{ .Values.images.nubusNatsBox.repository }}
-            tag: {{ .Values.images.nubusNatsBox.tag }}
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsBox.registry | quote }}
+        repository: {{ .Values.images.nubusNatsBox.repository }}
+        tag: {{ .Values.images.nubusNatsBox.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusProvisioningEventsAndConsumerApi:
   image:
-    registry: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningEventsAndConsumerApi.registry | quote }}
     repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
     tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusProvisioningPrefill:
   image:
-    registry: {{ .Values.images.nubusProvisioningPrefill.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningPrefill.registry | quote }}
     repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
     tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusUdmListener:
   image:
-    registry: {{ .Values.images.nubusProvisioningUdmListener.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningUdmListener.registry | quote }}
     repository: {{ .Values.images.nubusProvisioningUdmListener.repository }}
     tag: {{ .Values.images.nubusProvisioningUdmListener.tag }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
-nubusSelfServiceListener:
-  selfserviceListener:
-    image:
-      registry: {{ .Values.images.nubusSelfserviceListener.registry }}
-      repository: {{ .Values.images.nubusSelfserviceListener.repository }}
-      tag: {{ .Values.images.nubusSelfserviceListener.tag }}
-  selfserviceInvitation:
-    image:
-      registry: {{ .Values.images.nubusSelfserviceInvitation.registry }}
-      repository: {{ .Values.images.nubusSelfserviceInvitation.repository }}
-      tag: {{ .Values.images.nubusSelfserviceInvitation.tag }}
+nubusSelfServiceConsumer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusSelfServiceConsumer.registry | quote }}
+    repository: {{ .Values.images.nubusSelfServiceConsumer.repository }}
+    tag: {{ .Values.images.nubusSelfServiceConsumer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   waitForDependency:
     image:
-      registry: {{ .Values.images.nubusWaitForDependency.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
       repository: {{ .Values.images.nubusWaitForDependency.repository }}
       tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusUdmRestApi:
-  # oxPlugin:
-  #   image:
-  #     registry: \{\{ .Values.images.nubusUdmRestApiOxPlugin.registry }}
-  #     repository: \{\{ .Values.images.nubusUdmRestApiOxPlugin.repository }}
-  #     tag: \{\{ .Values.images.nubusUdmRestApiOxPlugin.tag }}
-  # portalPlugin:
-  #   image:
-  #     registry: \{\{ .Values.images.nubusUdmRestApiPortalPlugin.registry }}
-  #     repository: \{\{ .Values.images.nubusUdmRestApiPortalPlugin.repository }}
-  #     tag: \{\{ .Values.images.nubusUdmRestApiPortalPlugin.tag }}
   udmRestApi:
     image:
-      registry: {{ .Values.images.nubusUdmRestApi.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUdmRestApi.registry | quote }}
       repository: {{ .Values.images.nubusUdmRestApi.repository }}
       tag: {{ .Values.images.nubusUdmRestApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusUmcGateway:
   image:
-    registry: {{ .Values.images.nubusUmcGateway.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUmcGateway.registry | quote }}
     repository: {{ .Values.images.nubusUmcGateway.repository }}
     tag: {{ .Values.images.nubusUmcGateway.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusUmcServer:
   image:
-    registry: {{ .Values.images.nubusUmcServer.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUmcServer.registry | quote }}
     repository: {{ .Values.images.nubusUmcServer.repository }}
     tag: {{ .Values.images.nubusUmcServer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  proxy:
+    image:
+      registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusUmcServerProxy.registry | quote }}
+      repository: {{ .Values.images.nubusUmcServerProxy.repository }}
+      tag: {{ .Values.images.nubusUmcServerProxy.tag }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusWaitForDependency:
   image:
-    registry: {{ .Values.images.nubusWaitForDependency.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
     repository: {{ .Values.images.nubusWaitForDependency.repository }}
     tag: {{ .Values.images.nubusWaitForDependency.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 
 nubusGuardian:
   provisioning:
     image:
-      registry: {{ .Values.images.nubusGuardianProvisioning.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianProvisioning.registry | quote }}
       repository: {{ .Values.images.nubusGuardianProvisioning.repository }}
       tag: {{ .Values.images.nubusGuardianProvisioning.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   authorizationApi:
     image:
-      registry: {{ .Values.images.nubusGuardianAuthorizationApi.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianAuthorizationApi.registry | quote }}
       repository: {{ .Values.images.nubusGuardianAuthorizationApi.repository }}
       tag: {{ .Values.images.nubusGuardianAuthorizationApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   managementApi:
     image:
-      registry: {{ .Values.images.nubusGuardianManagementApi.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianManagementApi.registry | quote }}
       repository: {{ .Values.images.nubusGuardianManagementApi.repository }}
       tag: {{ .Values.images.nubusGuardianManagementApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   managementUi:
     image:
-      registry: {{ .Values.images.nubusGuardianManagementUi.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianManagementUi.registry | quote }}
       repository: {{ .Values.images.nubusGuardianManagementUi.repository }}
       tag: {{ .Values.images.nubusGuardianManagementUi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   openPolicyAgent:
     image:
-      registry: {{ .Values.images.nubusOpenPolicyAgent.registry }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpenPolicyAgent.registry | quote }}
       repository: {{ .Values.images.nubusOpenPolicyAgent.repository }}
       tag: {{ .Values.images.nubusOpenPolicyAgent.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 nubusStackDataUms:
   image:
-    registry: {{ .Values.images.nubusDataLoader.registry }}
-    repository: {{ .Values.images.nubusDataLoader.repository }}
-    tag: {{ .Values.images.nubusDataLoader.tag }}
-
-nubusStackDataSwp:
-  image:
-    registry: {{ .Values.images.nubusDataLoader.registry }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusDataLoader.registry | quote }}
     repository: {{ .Values.images.nubusDataLoader.repository }}
     tag: {{ .Values.images.nubusDataLoader.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl

@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
@@ -11,7 +11,7 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.opendeskKeycloakBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.opendeskKeycloakBootstrap.registry | quote }}
   repository: {{ .Values.images.opendeskKeycloakBootstrap.repository | quote }}
   tag: {{ .Values.images.opendeskKeycloakBootstrap.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -28,7 +28,8 @@ config:
       {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
   managed:
     clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
-    clients: [ 'UMC', 'guardian-management-api', 'guardian-scripts', 'guardian-ui', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
+    # 'guardian-management-api', 'guardian-scripts', 'guardian-ui' clients have been added explicitly for the moment (see further down this file)
+    clients: [ 'opendesk-intercom', 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
   keycloak:
     adminUser: "kcadmin"
     adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
@@ -388,60 +389,6 @@ config:
           backchannel.logout.session.required: false
         defaultClientScopes:
           - "opendesk-dovecot-scope"
-      - name: "opendesk-intercom"
-        clientId: "opendesk-intercom"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/callback"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.revoke.offline.tokens: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
-        protocolMappers:
-          - name: "intercom-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "opendesk-intercom"
-              id.token.claim: false
-              access.token.claim: true
-          # temporary additional claim while entryuuid is a hardcoded attribute in IntercomService and we cannot set
-          # it to `opendesk_useruuid` standard claim. For reference:
-          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/app.js#L89
-          - name: "entryuuid_temp"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "entryUUID"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "entryuuid"
-              jsonType.label: "String"
-          # temporary additional claim while phoenixusername is a hardcoded attribute in IntercomService and we cannot
-          # set it to `opendesk_username` standard claim. For reference:
-          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/routes/navigation.js#L27
-          - name: "phoenixusername_temp"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "phoenixusername"
-              jsonType.label: "String"
-        defaultClientScopes:
-          - "offline_access"
       - name: "opendesk-jitsi"
         clientId: "opendesk-jitsi"
         protocol: "openid-connect"

helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/\
-      {{ .Values.charts.dovecot.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
 
   # Open-Xchange
   - name: "open-xchange-repo"
@@ -20,8 +19,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/\
-      {{ .Values.charts.openXchangeAppSuite.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
 
   # openDesk Open-Xchange Bootstrap
   # Source:
@@ -32,8 +30,14 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
-      {{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/{{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
+
+  # OX Connector
+  - name: "ox-connector-repo"
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
 
 releases:
   - name: "dovecot"
@@ -41,6 +45,7 @@ releases:
     version: "{{ .Values.charts.dovecot.version }}"
     values:
       - "values-dovecot.yaml.gotmpl"
+      - {{ .Values.customization.release.dovecot | default "additionalValues: false" }}
     installed: {{ .Values.dovecot.enabled }}
     timeout: 900
 
@@ -50,6 +55,7 @@ releases:
     values:
       - "values-openxchange.yaml.gotmpl"
       - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
+      - {{ .Values.customization.release.openXchange | default "additionalValues: false" }}
     installed: {{ .Values.oxAppsuite.enabled }}
     timeout: 900
 
@@ -58,9 +64,20 @@ releases:
     version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
     values:
       - "values-openxchange-bootstrap.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskOpenXchangeBootstrap | default "additionalValues: false" }}
     installed: {{ .Values.oxAppsuite.enabled }}
     timeout: 900
 
+  - name: "ox-connector"
+    chart: "ox-connector-repo/{{ .Values.charts.oxConnector.name }}"
+    version: "{{ .Values.charts.oxConnector.version }}"
+    values:
+      - "values-oxconnector.yaml.gotmpl"
+      - {{ .Values.customization.release.oxConnector | default "additionalValues: false" }}
+    installed: {{ .Values.oxAppsuite.enabled }}
+    needs:
+      - "open-xchange"
+
 commonLabels:
   deploy-stage: "component-1"
   component: "open-xchange"

helmfile/apps/open-xchange/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/open-xchange/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl

@@ -1,18 +1,17 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.dovecot.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.dovecot.registry | quote }}
   repository: {{ .Values.images.dovecot.repository | quote }}
   tag: {{ .Values.images.dovecot.tag | quote }}
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . | quote }}
-{{- end }}
+  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
 
 dovecot:
   mailDomain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
@@ -36,7 +35,7 @@ dovecot:
   submission:
     enabled: true
     ssl: "no"
-    host: "postfix:25"
+    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
 
 certificate:
   secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -67,6 +66,9 @@ containerSecurityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.dovecot | toYaml | nindent 4 }}
 
+
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 1000

helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,14 +8,22 @@ cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
   deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 
+containerSecurityContext:
+  seccompProfile:
+    type: "RuntimeDefault"
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.openxchangeBootstrap | toYaml | nindent 4 }}
+
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.openxchangeBootstrap.registry | quote }}
   url: {{ .Values.images.openxchangeBootstrap.repository | quote }}
   tag: {{ .Values.images.openxchangeBootstrap.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . | quote }}
-{{- end }}
+  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
+
+podAnnotations:
+  argocd.argoproj.io/hook: "Sync"
+  argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
 ...

helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 appsuite:
   core-mw:

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -19,13 +20,15 @@ global:
 
 nextcloud-integration-ui:
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeNextcloudIntegrationUI.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeNextcloudIntegrationUI.registry | quote }}
     repository: {{ .Values.images.openxchangeNextcloudIntegrationUI.repository | quote }}
     tag: {{ .Values.images.openxchangeNextcloudIntegrationUI.tag | quote }}
   imagePullSecrets:
   {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
   {{- end }}
+  podAnnotations: {}
+  replicaCount: {{ .Values.replicas.openxchangeNextcloudIntegrationUI }}
   resources:
     {{ .Values.resources.openxchangeNextcloudIntegrationUI | toYaml | nindent 4 }}
   securityContext:
@@ -46,14 +49,17 @@ nextcloud-integration-ui:
 
 public-sector-ui:
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangePublicSectorUI.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangePublicSectorUI.registry | quote }}
     repository: {{ .Values.images.openxchangePublicSectorUI.repository | quote }}
     tag: {{ .Values.images.openxchangePublicSectorUI.tag | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   imagePullSecrets:
   {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
   {{- end }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  replicaCount: {{ .Values.replicas.openxchangePublicSectorUI }}
+  podAnnotations: {}
   resources:
     {{ .Values.resources.openxchangePublicSectorUI | toYaml | nindent 4 }}
   securityContext:
@@ -116,6 +122,7 @@ appsuite:
     jolokiaLogin: "jolokia"
     jolokiaPassword: {{ .Values.secrets.oxAppsuite.jolokiaPassword | quote }}
     hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
+    podAnnotations: {}
     serviceAccount:
       create: true
     features:
@@ -131,9 +138,11 @@ appsuite:
         - name: {{ . | quote }}
       {{- end }}
       image:
-        repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGotenberg.registry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
+        repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeGotenberg.registry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
         tag: {{ .Values.images.openxchangeGotenberg.tag | quote }}
         pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+      replicaCount: {{ .Values.replicas.openxchangeGotenberg }}
+      podAnnotations: {}
       resources:
         {{ .Values.resources.openxchangeGotenberg | toYaml | nindent 8 }}
       securityContext:
@@ -222,7 +231,7 @@ appsuite:
       # Old capability can be used to toggle all integrations with a single switch
       com.openexchange.capability.public-sector: "true"
       # New capabilities in 2.0
-      com.openexchange.capability.public-sector-element: "true"
+      com.openexchange.capability.public-sector-element: "false"
       com.openexchange.capability.public-sector-navigation: "true"
       com.openexchange.capability.client-onboarding: "true"
       com.openexchange.capability.dynamic-theme: "true"
@@ -341,7 +350,7 @@ appsuite:
         enabled: true
         password: {{ .Values.secrets.redis.password | quote }}
     image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreMW.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreMW.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -356,6 +365,7 @@ appsuite:
     {{- range .Values.global.imagePullSecrets }}
       - name: {{ . | quote }}
     {{- end }}
+    replicas: {{ .Values.replicas.openxchangeCoreMW }}
     resources:
       {{ .Values.resources.openxchangeCoreMW | toYaml | nindent 6 }}
 
@@ -366,10 +376,12 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUI.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreUI.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreUI.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreUI.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    replicaCount: {{ .Values.replicas.openxchangeCoreUI }}
+    podAnnotations: {}
     resources:
       {{ .Values.resources.openxchangeCoreUI | toYaml | nindent 6 }}
     securityContext:
@@ -398,12 +410,14 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUIMiddleware.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreUIMiddleware.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreUIMiddleware.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     overrides: {}
+    podAnnotations: {}
     redis: *redisConfiguration
+    replicaCount: {{ .Values.replicas.openxchangeCoreUIMiddleware }}
     resources:
       {{ .Values.resources.openxchangeCoreUIMiddleware | toYaml | nindent 6 }}
     updater:
@@ -437,10 +451,12 @@ appsuite:
         remoteCache:
           enabled: false
     image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeDocumentConverter.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeDocumentConverter.registry | quote }}
       repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
       tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
+    podAnnotations: {}
     redis: *redisConfiguration
+    replicaCount: {{ .Values.replicas.openxchangeCoreDocumentConverter }}
     resources:
       {{- .Values.resources.openxchangeCoreDocumentConverter | toYaml | nindent 6 }}
     securityContext:
@@ -482,10 +498,12 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreGuidedtours.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreGuidedtours.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreGuidedtours.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreGuidedtours.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    podAnnotations: {}
+    replicaCount: {{ .Values.replicas.openxchangeCoreGuidedtours }}
     resources:
       {{- .Values.resources.openxchangeCoreGuidedtours | toYaml | nindent 6 }}
     securityContext:
@@ -510,7 +528,7 @@ appsuite:
     basicAuthLogin: "oxlogin"
     basicAuthPassword: {{ .Values.secrets.oxAppsuite.basicAuthPassword | quote }}
     image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeImageConverter.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeImageConverter.registry | quote }}
       repository: {{ .Values.images.openxchangeImageConverter.repository | quote }}
       tag: {{ .Values.images.openxchangeImageConverter.tag | quote }}
     objectCache:
@@ -519,7 +537,9 @@ appsuite:
           endpoint: "."
           accessKey: "."
           secretKey: "."
+    podAnnotations: {}
     redis: *redisConfiguration
+    replicaCount: {{ .Values.replicas.openxchangeCoreImageConverter }}
     resources:
       {{- .Values.resources.openxchangeCoreImageConverter | toYaml | nindent 6 }}
     securityContext:
@@ -546,10 +566,12 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeGuardUI.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeGuardUI.registry | quote }}
       repository: {{ .Values.images.openxchangeGuardUI.repository | quote }}
       tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    podAnnotations: {}
+    replicaCount: {{ .Values.replicas.openxchangeGuardUI }}
     resources:
       {{- .Values.resources.openxchangeGuardUI | toYaml | nindent 6 }}
     securityContext:
@@ -572,7 +594,7 @@ appsuite:
   core-user-guide:
     enabled: true
     image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUserGuide.registry | quote }}
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openxchangeCoreUserGuide.registry | quote }}
       repository: {{ .Values.images.openxchangeCoreUserGuide.repository | quote }}
       tag: {{ .Values.images.openxchangeCoreUserGuide.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -580,6 +602,8 @@ appsuite:
     {{- range .Values.global.imagePullSecrets }}
       - name: {{ . | quote }}
     {{- end }}
+    podAnnotations: {}
+    replicaCount: {{ .Values.replicas.openxchangeCoreUserGuide }}
     resources:
       {{- .Values.resources.openxchangeCoreUserGuide | toYaml | nindent 6 }}
     securityContext:

helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl

@@ -1,12 +1,25 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.oxConnector.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.oxConnector.registry | quote }}
   repository: {{ .Values.images.oxConnector.repository | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.oxConnector.tag | quote }}
 
+  waitForDependency:
+    registry: {{ .Values.global.imageRegistry | default .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+    pullSecrets:
+    {{- range .Values.global.imagePullSecrets }}
+    - name: {{ . | quote }}
+    {{- end }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag | quote }}
+
 imagePullSecrets:
 {{- range .Values.global.imagePullSecrets }}
   - name: {{ . | quote }}
@@ -16,16 +29,8 @@ ingress:
   enabled: false
 
 oxConnector:
-  caCert: "ucctempldapstring"
-  debugLevel: {{ if .Values.debug.enabled }}"4"{{ else }}"1"{{ end }}
   domainName: {{ .Values.global.domain | quote }}
-  ldapHost: "{{ .Values.ldap.host }}-primary"
-  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
-  ldapPassword: {{ .Values.secrets.nubus.ldapSecret | quote }}
-  ldapBaseDn: "dc=swp-ldap,dc=internal"
-  ldapHostDn: "cn=admin,dc=swp-ldap,dc=internal"
-  tlsMode: "off"
-  notifierServer: {{ .Values.ldap.notifierHost | quote }}
+  logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
   oxDefaultContext: "1"
   oxImapServer: "imap://127.0.0.1:143"
   oxLocalTimezone: "Europe/Berlin"
@@ -35,12 +40,21 @@ oxConnector:
   oxSmtpServer: "smtp://127.0.0.1:587"
   oxSoapServer: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
 
+provisioningApi:
+  connection:
+    baseUrl: "http://ums-provisioning-api"
+  auth:
+    username: "ox-connector"
+    password: {{ .Values.secrets.oxConnector.provisioningApiPassword | quote }}
+
 resources:
   {{ .Values.resources.oxConnector | toYaml | nindent 2 }}
 
 persistence:
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 
+podAnnotations: {}
+
 ## Container deployment probes
 probes:
   liveness:

helmfile/apps/openproject-bootstrap/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/\
-      {{ .Values.charts.openprojectBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
 
 releases:
   - name: "opendesk-openproject-bootstrap"
@@ -21,6 +20,7 @@ releases:
     waitForJobs: true
     values:
       - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskOpenprojectBootstrap | default "additionalValues: false" }}
     installed: {{ .Values.openproject.enabled }}
     timeout: 900
 

helmfile/apps/openproject-bootstrap/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/openproject-bootstrap/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/openproject-bootstrap/values.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -15,6 +16,8 @@ cleanup:
   keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 
 config:
+  debug:
+    enabled: {{ .Values.debug.enabled }}
   openproject:
     fileshareName: "Nextcloud at {{ .Values.global.domain }}"
     admin:
@@ -42,7 +45,7 @@ containerSecurityContext:
     {{ .Values.seLinuxOptions.openprojectBootstrap | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openprojectBootstrap.registry | quote }}
   repository: {{ .Values.images.openprojectBootstrap.repository | quote }}
   tag: {{ .Values.images.openprojectBootstrap.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy |quote }}
@@ -50,6 +53,8 @@ image:
 job:
   enabled: true
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 1000

helmfile/apps/openproject/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/\
-      {{ .Values.charts.openproject.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
 
 releases:
   - name: "openproject"
@@ -21,8 +20,9 @@ releases:
     waitForJobs: true
     values:
       - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.openproject | default "additionalValues: false" }}
     installed: {{ .Values.openproject.enabled }}
-    timeout: 900
+    timeout: 1500
 
 commonLabels:
   deploy-stage: "component-1"

helmfile/apps/openproject/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/openproject/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/openproject/values.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,6 +8,10 @@ global:
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
+appInit:
+  resources:
+    {{ .Values.resources.openprojectAppInit | toYaml | nindent 4 }}
+
 containerSecurityContext:
   enabled: true
   privileged: false
@@ -23,6 +28,15 @@ containerSecurityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.openproject | toYaml | nindent 4 }}
 
+dbInit:
+  image:
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.openprojectDbInit.registry | quote }}
+    repository: {{ .Values.images.openprojectDbInit.repository | quote }}
+    tag: {{ .Values.images.openprojectDbInit.tag | quote }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  resources:
+    {{ .Values.resources.openprojectDbInit | toYaml | nindent 4 }}
+
 environment:
 # For more details and more options see
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
@@ -31,7 +45,6 @@ environment:
   OPENPROJECT_USER__DEFAULT__TIMEZONE: "Europe/Berlin"
   OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
   OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"
-  OPENPROJECT_PER__PAGE__OPTIONS: "20, 50, 100, 200"
   OPENPROJECT_EMAIL__DELIVERY__METHOD: "smtp"
   OPENPROJECT_DEFAULT__COMMENT__SORT__ORDER: "desc"
   # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
@@ -59,15 +72,15 @@ environment:
   OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
   OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
   OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
-  OPENPROJECT_SMTP__USER__NAME: {{ .Values.smtp.username | quote }}
-  OPENPROJECT_SMTP__PASSWORD: {{ .Values.smtp.password | quote }}
-  OPENPROJECT_SMTP__PORT: {{ .Values.smtp.port | quote }}
+  OPENPROJECT_SMTP__USER__NAME: ""
+  OPENPROJECT_SMTP__PASSWORD: ""
+  OPENPROJECT_SMTP__PORT: 25
   OPENPROJECT_SMTP__SSL: "false" # (default=false)
-  OPENPROJECT_SMTP__ADDRESS: {{ .Values.smtp.host | quote }}
-  OPENPROJECT_SMTP__AUTHENTICATION: "plain"
-  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
-  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
-  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.openproject }}.{{ end }}{{ .Values.global.domain }}"
+  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  OPENPROJECT_SMTP__AUTHENTICATION: "none"
+  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "false"
+  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "none"
+  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
   OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.nubus .Values.global.domain | quote }}
   OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
   OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
@@ -76,18 +89,11 @@ environment:
   {{- end }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.openproject.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.openproject.registry | quote }}
   repository: {{ .Values.images.openproject.repository | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   tag: {{ .Values.images.openproject.tag | quote }}
 
-initdb:
-  image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectInitDb.registry | quote }}
-    repository: {{ .Values.images.openprojectInitDb.repository | quote }}
-    tag: {{ .Values.images.openprojectInitDb.tag | quote }}
-    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-
 memcached:
   bundled: false
   connection:
@@ -97,6 +103,8 @@ memcached:
 persistence:
   enabled: false
 
+podAnnotations: {}
+
 postgresql:
   bundled: false
   auth:
@@ -180,5 +188,12 @@ s3:
 seederJob:
   annotations:
     intents.otterize.com/service-name: "openproject-seeder"
+  resources:
+    {{ .Values.resources.openprojectSeederJob | toYaml | nindent 4 }}
+
+workers:
+  default:
+    resources:
+      {{ .Values.resources.openprojectWorkers | toYaml | nindent 6 }}
 
 ...

helmfile/apps/provisioning/helmfile-child.yaml

@@ -1,24 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
----
-repositories:
-  # OX Connector
-  - name: "ox-connector-repo"
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/\
-      {{ .Values.charts.oxConnector.repository }}"
-
-releases:
-  - name: "ox-connector"
-    chart: "ox-connector-repo/{{ .Values.charts.oxConnector.name }}"
-    version: "{{ .Values.charts.oxConnector.version }}"
-    values:
-      - "values-oxconnector.yaml.gotmpl"
-    installed: {{ .Values.oxConnector.enabled }}
-
-commonLabels:
-  deploy-stage: "component-2"
-  component: "provisioning"
-...

helmfile/apps/provisioning/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/services/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/\
-      {{ .Values.charts.otterize.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
 
   # openDesk Home
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
@@ -21,8 +20,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/\
-      {{ .Values.charts.home.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
 
   # openDesk Certificates
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
@@ -32,8 +30,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/\
-      {{ .Values.charts.certificates.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
 
   # openDesk PostgreSQL
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postgresql
@@ -43,8 +40,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/\
-      {{ .Values.charts.postgresql.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
 
   # openDesk MariaDB
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
@@ -54,8 +50,17 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/\
-      {{ .Values.charts.mariadb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
+
+  # openDesk dkimpy-milter
+  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter
+  - name: "dkimpy-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.dkimpy.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"
 
   # openDesk Postfix
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
@@ -65,8 +70,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/\
-      {{ .Values.charts.postfix.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
 
   # openDesk ClamAV
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
@@ -76,16 +80,14 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/\
-      {{ .Values.charts.clamav.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
   - name: "clamav-simple-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.clamavSimple.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/\
-      {{ .Values.charts.clamavSimple.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
 
   # VMWare Bitnami
   # Source: https://github.com/bitnami/charts/
@@ -95,24 +97,21 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/\
-      {{ .Values.charts.memcached.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
   - name: "redis-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.redis.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/\
-      {{ .Values.charts.redis.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
   - name: "minio-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.minio.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/\
-      {{ .Values.charts.minio.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
 
 releases:
   - name: "opendesk-otterize"
@@ -120,6 +119,7 @@ releases:
     version: "{{ .Values.charts.otterize.version }}"
     values:
       - "values-otterize.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskOtterize | default "additionalValues: false" }}
     installed: {{ .Values.security.otterizeIntents.enabled }}
     timeout: 900
 
@@ -128,6 +128,7 @@ releases:
     version: "{{ .Values.charts.home.version }}"
     values:
       - "values-home.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskHome | default "additionalValues: false" }}
     installed: {{ .Values.home.enabled }}
 
   - name: "opendesk-certificates"
@@ -135,6 +136,7 @@ releases:
     version: "{{ .Values.charts.certificates.version }}"
     values:
       - "values-certificates.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskCertificates | default "additionalValues: false" }}
     installed: {{ .Values.certificates.enabled }}
     timeout: 900
 
@@ -143,6 +145,7 @@ releases:
     version: "{{ .Values.charts.redis.version }}"
     values:
       - "values-redis.yaml.gotmpl"
+      - {{ .Values.customization.release.redis | default "additionalValues: false" }}
     installed: {{ .Values.redis.enabled }}
     timeout: 900
 
@@ -151,6 +154,7 @@ releases:
     version: "{{ .Values.charts.memcached.version }}"
     values:
       - "values-memcached.yaml.gotmpl"
+      - {{ .Values.customization.release.memcached | default "additionalValues: false" }}
     installed: {{ .Values.memcached.enabled }}
     timeout: 900
 
@@ -159,6 +163,7 @@ releases:
     version: "{{ .Values.charts.postgresql.version }}"
     values:
       - "values-postgresql.yaml.gotmpl"
+      - {{ .Values.customization.release.postgresql | default "additionalValues: false" }}
     installed: {{ .Values.postgresql.enabled }}
     timeout: 900
 
@@ -167,6 +172,7 @@ releases:
     version: "{{ .Values.charts.mariadb.version }}"
     values:
       - "values-mariadb.yaml.gotmpl"
+      - {{ .Values.customization.release.mariadb | default "additionalValues: false" }}
     installed: {{ .Values.mariadb.enabled }}
     timeout: 900
 
@@ -175,14 +181,25 @@ releases:
     version: "{{ .Values.charts.postfix.version }}"
     values:
       - "values-postfix.yaml.gotmpl"
+      - {{ .Values.customization.release.postfix | default "additionalValues: false" }}
     installed: {{ .Values.postfix.enabled }}
     timeout: 900
 
+  - name: "opendesk-dkimpy-milter"
+    chart: "dkimpy-repo/{{ .Values.charts.dkimpy.name }}"
+    version: "{{ .Values.charts.dkimpy.version }}"
+    values:
+      - "values-dkimpy.yaml.gotmpl"
+      - {{ .Values.customization.release.opendeskDkimpyMilter | default "additionalValues: false" }}
+    installed: {{ .Values.dkimpy.enabled }}
+    timeout: 900
+
   - name: "clamav"
     chart: "clamav-repo/{{ .Values.charts.clamav.name }}"
     version: "{{ .Values.charts.clamav.version }}"
     values:
       - "values-clamav-distributed.yaml.gotmpl"
+      - {{ .Values.customization.release.clamav | default "additionalValues: false" }}
     installed: {{ .Values.clamavDistributed.enabled }}
     timeout: 900
 
@@ -191,6 +208,7 @@ releases:
     version: "{{ .Values.charts.clamavSimple.version }}"
     values:
       - "values-clamav-simple.yaml.gotmpl"
+      - {{ .Values.customization.release.clamavSimple | default "additionalValues: false" }}
     installed: {{ .Values.clamavSimple.enabled }}
     timeout: 900
 
@@ -199,6 +217,7 @@ releases:
     version: "{{ .Values.charts.minio.version }}"
     values:
       - "values-minio.yaml.gotmpl"
+      - {{ .Values.customization.release.minio | default "additionalValues: false" }}
     installed: {{ .Values.minio.enabled }}
     timeout: 900
 

helmfile/apps/services/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/services/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/services/values-certificates.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -6,7 +7,48 @@ SPDX-License-Identifier: Apache-2.0
 global:
   domain: {{ .Values.global.domain | quote }}
   hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
+    {{- if .Values.collabora.enabled }}
+    collabora: {{ .Values.global.hosts.collabora }}
+    {{- end }}
+    {{- if .Values.cryptpad.enabled }}
+    cryptpad: {{ .Values.global.hosts.cryptpad }}
+    {{- end }}
+    {{- if .Values.element.enabled }}
+    element: {{ .Values.global.hosts.element }}
+    matrixNeoBoardWidget: {{ .Values.global.hosts.matrixNeoBoardWidget }}
+    matrixNeoChoiceWidget: {{ .Values.global.hosts.matrixNeoChoiceWidget }}
+    matrixNeoDateFixBot: {{ .Values.global.hosts.matrixNeoDateFixBot }}
+    matrixNeoDateFixWidget: {{ .Values.global.hosts.matrixNeoDateFixWidget }}
+    synapse: {{ .Values.global.hosts.synapse }}
+    synapseFederation: {{ .Values.global.hosts.synapseFederation }}
+    whiteboard: {{ .Values.global.hosts.whiteboard }}
+    {{- end }}
+    {{- if .Values.nubus.enabled }}
+    intercomService: {{ .Values.global.hosts.intercomService }}
+    {{- end }}
+    {{- if .Values.jitsi.enabled }}
+    jitsi: {{ .Values.global.hosts.jitsi }}
+    {{- end }}
+    {{- if .Values.minio.enabled }}
+    minioApi: {{ .Values.global.hosts.minioApi }}
+    minioConsole: {{ .Values.global.hosts.minioConsole }}
+    {{- end }}
+    {{- if .Values.nextcloud.enabled }}
+    nextcloud: {{ .Values.global.hosts.nextcloud }}
+    {{- end }}
+    {{- if .Values.openproject.enabled }}
+    openproject: {{ .Values.global.hosts.openproject }}
+    {{- end }}
+    {{- if .Values.oxAppsuite.enabled }}
+    openxchange: {{ .Values.global.hosts.openxchange }}
+    {{- end }}
+    {{- if .Values.nubus.enabled }}
+    keycloak: {{ .Values.global.hosts.keycloak }}
+    nubus: {{ .Values.global.hosts.nubus }}
+    {{- end }}
+    {{- if .Values.xwiki.enabled }}
+    xwiki: {{ .Values.global.hosts.xwiki }}
+    {{- end }}
 
 issuerRef:
   name: {{ .Values.certificate.issuerRef.name | quote }}

helmfile/apps/services/values-clamav-distributed.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 clamd:
   containerSecurityContext:
@@ -18,10 +21,11 @@ clamd:
     seLinuxOptions:
       {{ .Values.seLinuxOptions.clamd | toYaml | nindent 6 }}
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.clamd.registry | quote }}
     repository: {{ .Values.images.clamd.repository | quote }}
     tag: {{ .Values.images.clamd.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
   podSecurityContext:
     enabled: true
     fsGroup: 101
@@ -62,10 +66,11 @@ freshclam:
     seLinuxOptions:
       {{ .Values.seLinuxOptions.freshclam | toYaml | nindent 6 }}
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.freshclam.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.freshclam.registry | quote }}
     repository: {{ .Values.images.freshclam.repository | quote }}
     tag: {{ .Values.images.freshclam.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
   podSecurityContext:
     enabled: true
     fsGroup: 101
@@ -73,7 +78,15 @@ freshclam:
   replicaCount: {{ .Values.replicas.freshclam }}
   resources:
     {{ .Values.resources.freshclam | toYaml | nindent 4 }}
-
+  settings:
+    database:
+      auth:
+        {{ .Values.repositories.clamav.auth | toYaml | nindent 8 }}
+      mirror:
+        scheme: {{ .Values.repositories.clamav.mirror.scheme | quote }}
+        url: {{ .Values.repositories.clamav.mirror.url | quote }}
+      customURLs:
+        {{ .Values.repositories.clamav.customURLs | toYaml | nindent 8 }}
 global:
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
@@ -95,10 +108,11 @@ icap:
     seLinuxOptions:
       {{ .Values.seLinuxOptions.icap | toYaml | nindent 6 }}
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.icap.registry | quote }}
     repository: {{ .Values.images.icap.repository | quote }}
     tag: {{ .Values.images.icap.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
   podSecurityContext:
     enabled: true
     fsGroup: 101
@@ -124,10 +138,11 @@ milter:
     seLinuxOptions:
       {{ .Values.seLinuxOptions.milter | toYaml | nindent 6 }}
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.milter.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.milter.registry | quote }}
     repository: {{ .Values.images.milter.repository | quote }}
     tag: {{ .Values.images.milter.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  podAnnotations: {}
   podSecurityContext:
     enabled: true
     fsGroup: 101

helmfile/apps/services/values-clamav-simple.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -23,12 +26,12 @@ global:
 
 image:
   clamav:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.clamd.registry | quote }}
     repository: {{ .Values.images.clamd.repository | quote }}
     tag: {{ .Values.images.clamd.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   icap:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.icap.registry | quote }}
     repository: {{ .Values.images.icap.repository | quote }}
     tag: {{ .Values.images.icap.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -37,6 +40,8 @@ persistence:
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
   size: {{ .Values.persistence.size.clamav | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -47,4 +52,14 @@ replicaCount: {{ .Values.replicas.clamav }}
 resources:
   {{ .Values.resources.clamd | toYaml | nindent 4 }}
 
+settings:
+  freshclam:
+    database:
+      auth:
+        {{ .Values.repositories.clamav.auth | toYaml | nindent 8 }}
+      mirror:
+        scheme: {{ .Values.repositories.clamav.mirror.scheme | quote }}
+        url: {{ .Values.repositories.clamav.mirror.url | quote }}
+      customURLs:
+        {{ .Values.repositories.clamav.customURLs | toYaml | nindent 8 }}
 ...

helmfile/apps/services/values-dkimpy.yaml.gotmpl

@@ -0,0 +1,47 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+containerSecurityContext:
+  allowPrivilegeEscalation: true
+  capabilities: {}
+  enabled: true
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  privileged: false
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.dkimpy | toYaml | nindent 4 }}
+
+global:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.dkimpy.registry | quote }}
+  repository: {{ .Values.images.dkimpy.repository | quote }}
+  tag: {{ .Values.images.dkimpy.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 1000
+
+configuration:
+  domain: "{{ .Values.global.domain }}{{ if .Values.global.mailDomain }}, {{ .Values.global.mailDomain }}{{ end }}"
+  key:
+    {{ .Values.smtp.dkim.key | toYaml | nindent 4 }}
+  mode: "s"
+  selector: {{ .Values.smtp.dkim.selector }}
+  useED25519: {{ .Values.smtp.dkim.useED25519 }}
+
+replicaCount: {{ .Values.replicas.dkimpy }}
+
+resources:
+  {{ .Values.resources.dkimpy | toYaml | nindent 2 }}
+...

helmfile/apps/services/values-mariadb.yaml.gotmpl

@@ -1,8 +1,12 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -25,7 +29,7 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.mariadb.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.mariadb.registry | quote }}
   repository: {{ .Values.images.mariadb.repository | quote }}
   tag: {{ .Values.images.mariadb.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -35,19 +39,32 @@ job:
   retries: 10
   wait: 30
   users:
-    - username: "xwiki_user"
-      password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
-    - username: "openxchange_user"
-      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
-    - username: "nextcloud_user"
+    - username: {{ .Values.databases.nextcloud.username | quote }}
       password: {{ .Values.secrets.mariadb.nextcloudUser | quote}}
+      connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
+    # users for the moment.
+    - username: "openxchange_user"
+    # - username: {{ .Values.databases.xwiki.username | quote }}
+      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
+      connectionLimit: {{ .Values.databases.oxAppsuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: "xwiki_user"
+    # - username: {{ .Values.databases.oxAppsuite.username | quote }}
+      password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
+      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
   databases:
-    - name: "xwiki"
-      user: "xwiki_user"
-    - name: "nextcloud"
-      user: "nextcloud_user"
+    - name: {{ .Values.databases.nextcloud.name | quote }}
+      user: {{ .Values.databases.nextcloud.username | quote }}
+    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
+    # users for the moment.
     - name: "openxchange"
       user: "openxchange_user"
+    # - name: {{ .Values.databases.oxAppsuite.name | quote }}
+    #   user: {{ .Values.databases.oxAppsuite.username | quote }}
+    - name: "xwiki"
+      user: "xwiki_user"
+    # - name: {{ .Values.databases.xwiki.name | quote }}
+    #   user: {{ .Values.databases.xwiki.username | quote }}
 
 mariadb:
   rootPassword: {{ .Values.secrets.mariadb.rootPassword | quote }}
@@ -56,6 +73,8 @@ persistence:
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
   size: {{ .Values.persistence.size.mariadb | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 1001

helmfile/apps/services/values-memcached.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 architecture: {{ if gt .Values.replicas.memcached 1 }}"high-availability"{{ else }}"standalone"{{ end }}
 
@@ -24,11 +27,13 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.memcached.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.memcached.registry | quote }}
   repository: {{ .Values.images.memcached.repository | quote }}
   tag: {{ .Values.images.memcached.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
+podAnnotations: {}
+
 replicaCount: {{ .Values.replicas.memcached }}
 
 resources:

helmfile/apps/services/values-minio.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 apiIngress:
   enabled: {{ .Values.ingress.enabled }}
@@ -39,7 +42,7 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.minio.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.minio.registry | quote }}
   repository: "{{ .Values.images.minio.repository }}"
   tag: "{{ .Values.images.minio.tag }}"
   pullPolicy: "{{ .Values.global.imagePullPolicy }}"
@@ -85,7 +88,8 @@ persistence:
 provisioning:
   enabled: true
   cleanupAfterFinished:
-    enabled: true
+    enabled: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+    seconds: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
   extraCommands:
     - "mc anonymous set download provisioning/ums/portal-assets"
   buckets:
@@ -178,6 +182,8 @@ provisioning:
   resources:
     {{ .Values.resources.minio | toYaml | nindent 4 }}
 
+podAnnotations: {}
+
 readinessProbe:
   enabled: true
   initialDelaySeconds: 5

helmfile/apps/services/values-otterize.yaml.gotmpl

@@ -16,8 +16,6 @@ apps:
     enabled: {{ .Values.dovecot.enabled }}
   element:
     enabled: {{ .Values.element.enabled }}
-  intercom:
-    enabled: {{ .Values.intercom.enabled }}
   jitsi:
     enabled: {{ .Values.jitsi.enabled }}
   mariadb:
@@ -32,8 +30,6 @@ apps:
     enabled: {{ .Values.openproject.enabled }}
   oxAppsuite:
     enabled: {{ .Values.oxAppsuite.enabled }}
-  oxConnector:
-    enabled: {{ .Values.oxConnector.enabled }}
   postfix:
     enabled: {{ .Values.postfix.enabled }}
   postgresql:
@@ -48,7 +44,6 @@ apps:
 ingressController:
   {{ .Values.security.ingressController | toYaml | nindent 2 }}
 
-
 extraApps:
   clusterPostfix:
     enabled: {{ .Values.security.clusterPostfix.enabled }}

helmfile/apps/services/values-postfix.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 certificate:
   secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -25,7 +28,7 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.postfix.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.postfix.registry | quote }}
   repository: {{ .Values.images.postfix.repository | quote }}
   tag: {{ .Values.images.postfix.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -49,6 +52,9 @@ postfix:
     - fileName: "sasl_passwd.map"
       content:
         - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
+  {{- if .Values.dkimpy.enabled }}
+  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
+  {{- end }}
   rspamdHost: ""
   relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
   relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
@@ -70,6 +76,8 @@ postfix:
   virtualMailboxDomains: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
   virtualTransport: "lmtps:dovecot:24"
 
+podAnnotations: {}
+
 replicaCount: {{ .Values.replicas.postfix }}
 
 resources:

helmfile/apps/services/values-postgresql.yaml.gotmpl

@@ -1,6 +1,13 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
+cleanup:
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
+
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -17,8 +24,6 @@ containerSecurityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.postgresql | toYaml | nindent 4 }}
 
-job:
-
 podSecurityContext:
   enabled: true
   fsGroup: 1001
@@ -34,7 +39,7 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.postgresql.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.postgresql.registry | quote }}
   repository: {{ .Values.images.postgresql.repository | quote }}
   tag: {{ .Values.images.postgresql.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -43,41 +48,50 @@ image:
 
 job:
   users:
-    - username: "keycloak_user"
+    - username: {{ .Values.databases.keycloak.username | quote }}
       password: {{ .Values.secrets.postgresql.keycloakUser | quote }}
-    - username: "openproject_user"
+      connectionLimit: {{ .Values.databases.keycloak.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.openproject.username | quote }}
       password: {{ .Values.secrets.postgresql.openprojectUser | quote }}
-    - username: "keycloak_extensions_user"
+      connectionLimit: {{ .Values.databases.openproject.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.keycloakExtension.username | quote }}
       password: {{ .Values.secrets.postgresql.keycloakExtensionUser | quote }}
-    - username: "matrix_user"
+      connectionLimit: {{ .Values.databases.keycloakExtension.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.synapse.username | quote }}
       password: {{ .Values.secrets.postgresql.matrixUser | quote }}
-    - username: "notificationsapi_user"
+      connectionLimit: {{ .Values.databases.synapse.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.umsNotificationsApi.username | quote }}
       password: {{ .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
-    - username: "guardianmanagementapi_user"
+      connectionLimit: {{ .Values.databases.umsNotificationsApi.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
       password: {{ .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
-    - username: "selfservice_user"
+      connectionLimit: {{ .Values.databases.umsGuardianManagementApi.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: {{ .Values.databases.umsSelfservice.username | quote }}
       password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
+      connectionLimit: {{ .Values.databases.umsSelfservice.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
   databases:
-    - name: "keycloak"
-      user: "keycloak_user"
-    - name: "keycloak_extensions"
-      user: "keycloak_extensions_user"
-    - name: "openproject"
-      user: "openproject_user"
-    - name: "matrix"
-      user: "matrix_user"
+    - name: {{ .Values.databases.keycloak.name | quote }}
+      user: {{ .Values.databases.keycloak.username | quote }}
+    - name: {{ .Values.databases.keycloakExtension.name | quote }}
+      user: {{ .Values.databases.keycloakExtension.username | quote }}
+    - name: {{ .Values.databases.openproject.name | quote }}
+      user: {{ .Values.databases.openproject.username | quote }}
+    - name: {{ .Values.databases.synapse.name | quote }}
+      user: {{ .Values.databases.synapse.username | quote }}
       additionalParams: "ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0"
-    - name: "guardianmanagementapi"
-      user: "guardianmanagementapi_user"
-    - name: "notificationsapi"
-      user: "notificationsapi_user"
-    - name: "selfservice"
-      user: "selfservice_user"
+    - name: {{ .Values.databases.umsGuardianManagementApi.name | quote }}
+      user: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
+    - name: {{ .Values.databases.umsNotificationsApi.name | quote }}
+      user: {{ .Values.databases.umsNotificationsApi.username | quote }}
+    - name: {{ .Values.databases.umsSelfservice.name | quote }}
+      user: {{ .Values.databases.umsSelfservice.username | quote }}
 
 persistence:
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
   size: {{ .Values.persistence.size.postgresql | quote }}
 
+podAnnotations: {}
+
 postgres:
   password: {{ .Values.secrets.postgresql.postgresUser | quote }}
 

helmfile/apps/services/values-redis.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 architecture: "standalone"
 
@@ -12,7 +15,7 @@ global:
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.redis.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.redis.registry | quote }}
   repository: {{ .Values.images.redis.repository | quote }}
   tag: {{ .Values.images.redis.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -35,6 +38,7 @@ master:
   count: {{ .Values.replicas.redis }}
   persistence:
     size: {{ .Values.persistence.size.redis | quote }}
+  podAnnotations: {}
   resources:
     {{ .Values.resources.redis | toYaml | nindent 4 }}
 

helmfile/apps/xwiki/helmfile-child.yaml.gotmpl

@@ -10,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/\
-      {{ .Values.charts.xwiki.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
 
 releases:
   - name: "xwiki"
@@ -20,6 +19,7 @@ releases:
     wait: true
     values:
       - "values.yaml.gotmpl"
+      - {{ .Values.customization.release.xwiki | default "additionalValues: false" }}
     installed: {{ .Values.xwiki.enabled }}
     timeout: 900
 

helmfile/apps/xwiki/helmfile.yaml

@@ -1,12 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-helmfiles:
-  - path: "./helmfile-child.yaml"
-    values:
-      - {{ toYaml .Values | nindent 8 }}
-...

helmfile/apps/xwiki/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/xwiki/values.yaml.gotmpl

@@ -1,10 +1,11 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  name: "{{ .Values.global.imageRegistry | default .Values.images.xwiki.registry }}/{{ .Values.images.xwiki.repository }}"
+  name: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.xwiki.registry }}/{{ .Values.images.xwiki.repository }}"
   tag: {{ .Values.images.xwiki.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
@@ -136,13 +137,13 @@ properties:
   "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.secure": 1
   "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.server": "{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
   "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.port": 443
+  ## This option overwrites the LDAP group mappings including all dynamically created mappings, therefore on XWiki restart an LDAP sync is triggered to load the dynamic mapping.
+  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.ldap_group_mapping": "xwiki:XWiki.XWikiAdminGroup=cn=managed-by-attribute-KnowledgemanagementAdmin,cn=groups,dc=swp-ldap,dc=internal"
   ## SMTP settings
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ if .Values.functional.email.systemGenerated.useComponentInSenderdomain }}{{ .Values.global.hosts.xwiki }}.{{ end }}{{ .Values.global.domain }}"
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ .Values.smtp.host | quote }}
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.port": {{ .Values.smtp.port | quote }}
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.username": {{ .Values.smtp.username | quote }}
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.password": {{ .Values.smtp.password | quote }}
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.properties": "mail.smtp.starttls.enable=true"
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.port": 25
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.properties": "mail.smtp.starttls.enable=false"
   ## Link LDAP users and users authenticated through OIDC
   "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.addOIDCObject": 1
   "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.OIDCIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"

helmfile/environments/default/charts.yaml

@@ -24,7 +24,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav"
     name: "opendesk-clamav"
-    version: "4.0.5"
+    version: "4.0.6"
     verify: true
   clamavSimple:
     # providerCategory: "Platform"
@@ -34,7 +34,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-clamav"
     name: "clamav-simple"
-    version: "4.0.5"
+    version: "4.0.6"
     verify: true
   collabora:
     # providerCategory: "Supplier"
@@ -46,7 +46,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/collabora/charts-mirror"
     name: "collabora-online"
-    version: "1.1.20"
+    version: "1.1.21"
     verify: true
   cryptpad:
     # providerCategory: "Supplier"
@@ -60,6 +60,18 @@ charts:
     name: "cryptpad"
     version: "0.0.19"
     verify: true
+  dkimpy:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter/opendesk-dkimpy-milter"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["1", "0", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter"
+    name: "opendesk-dkimpy-milter"
+    version: "1.0.0"
+    verify: true
   dovecot:
     # providerCategory: "Platform"
     # providerResponsible: "Open-Xchange"
@@ -78,7 +90,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-element"
-    version: "3.3.0"
+    version: "3.4.1"
     verify: true
   elementWellKnown:
     # providerCategory: "Platform"
@@ -88,7 +100,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-well-known"
-    version: "3.3.0"
+    version: "3.4.1"
     verify: true
   home:
     # providerCategory: "Platform"
@@ -110,7 +122,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "intercom-service"
-    version: "2.0.1"
+    version: "2.2.0"
     verify: true
   jitsi:
     # providerCategory: "Platform"
@@ -120,7 +132,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
     name: "opendesk-jitsi"
-    version: "1.9.2"
+    version: "1.12.1"
     verify: true
   mariadb:
     # providerCategory: "Platform"
@@ -130,57 +142,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-mariadb"
     name: "mariadb"
-    version: "2.2.1"
-    verify: true
-  matrixNeoboardWidget:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neoboard-widget"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
-    name: "matrix-neoboard-widget"
-    version: "3.5.0"
-    verify: true
-  matrixNeochoiseWidget:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neochoice-widget"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
-    name: "matrix-neochoice-widget"
-    version: "3.5.0"
-    verify: true
-  matrixNeodatefixBot:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-bot"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
-    name: "matrix-neodatefix-bot"
-    version: "3.5.0"
-    verify: true
-  matrixNeodatefixWidget:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets/matrix-neodatefix-widget"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets"
-    name: "matrix-neodatefix-widget"
-    version: "3.5.0"
-    verify: true
-  matrixUserVerificationService:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-matrix-user-verification-service"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
-    name: "opendesk-matrix-user-verification-service"
-    version: "3.3.0"
+    version: "2.3.1"
     verify: true
   memcached:
     # providerCategory: "Community"
@@ -200,7 +162,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
     name: "opendesk-migrations"
-    version: "1.2.2"
+    version: "1.3.3"
     verify: true
   minio:
     # providerCategory: "Community"
@@ -220,7 +182,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud"
-    version: "3.0.0"
+    version: "3.2.0"
     verify: true
   nextcloudManagement:
     # providerCategory: "Platform"
@@ -230,7 +192,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud-management"
-    version: "3.0.0"
+    version: "3.2.0"
     verify: true
   nginx:
     # providerCategory: "Community"
@@ -249,10 +211,12 @@ charts:
     # upstreamRepository: "nubus/charts/nubus"
     # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
     # upstreamMirrorStartFrom: ["0", "19", "3"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
+    # registry: "registry.opencode.de"
+    # repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus/charts"
     name: "nubus"
-    version: "0.33.0"
+    version: "0.62.4"
     verify: true
   opendeskKeycloakBootstrap:
     # providerCategory: "Platform"
@@ -262,7 +226,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
     name: "opendesk-keycloak-bootstrap"
-    version: "2.1.1"
+    version: "2.1.2"
     verify: true
   openproject:
     # providerCategory: "Supplier"
@@ -274,7 +238,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
     name: "openproject"
-    version: "7.0.0"
+    version: "8.0.0"
     verify: true
   openprojectBootstrap:
     # providerCategory: "Platform"
@@ -284,7 +248,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-openproject-bootstrap"
     name: "opendesk-openproject-bootstrap"
-    version: "1.3.0"
+    version: "2.0.0"
     verify: true
   openXchangeAppSuite:
     # providerCategory: "Supplier"
@@ -296,7 +260,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
     name: "appsuite-public-sector"
-    version: "2.8.78"
+    version: "2.10.9"
     verify: false
   openXchangeAppSuiteBootstrap:
     # providerCategory: "Platform"
@@ -306,7 +270,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap"
     name: "opendesk-open-xchange-bootstrap"
-    version: "1.3.4"
+    version: "2.0.0"
     verify: true
   otterize:
     # providerCategory: "Platform"
@@ -328,7 +292,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
     name: "ox-connector"
-    version: "0.4.2"
+    version: "0.14.5"
     verify: true
   postfix:
     # providerCategory: "Platform"
@@ -338,7 +302,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix"
     name: "postfix"
-    version: "2.2.0"
+    version: "2.3.0"
     verify: true
   postgresql:
     # providerCategory: "Platform"
@@ -348,7 +312,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-postgresql"
     name: "postgresql"
-    version: "2.0.5"
+    version: "2.1.1"
     verify: true
   redis:
     # providerCategory: "Community"
@@ -368,17 +332,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse"
-    version: "3.3.0"
-    verify: true
-  synapseCreateAccount:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse-create-account"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
-    name: "opendesk-synapse-create-account"
-    version: "3.3.0"
+    version: "3.4.1"
     verify: true
   synapseWeb:
     # providerCategory: "Platform"
@@ -388,7 +342,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse-web"
-    version: "3.3.0"
+    version: "3.4.1"
     verify: true
   xwiki:
     # providerCategory: "Supplier"

helmfile/environments/default/customization.yaml

@@ -0,0 +1,57 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# This variable allows customization of helmfile releases by loading custom values file.
+# Example:
+# customization:
+#   release:
+#     collaboraOnline: /path/to/additional/file.yaml
+customization:
+  release:
+    # collabora
+    collaboraOnline: ~
+    # cryptpad
+    cryptpad: ~
+    # element
+    opendeskElement: ~
+    opendeskWellKnown: ~
+    opendeskSynapseWeb: ~
+    opendeskSynapse: ~
+    # jitsi
+    jitsi: ~
+    # migrations-post
+    migrationsPost: ~
+    # migrations-pre
+    migrationsPre: ~
+    # nextcloud
+    opendeskNextcloudManagement: ~
+    opendeskNextcloud: ~
+    # nubus
+    ums: ~
+    intercomService: ~
+    opendeskKeycloakBootstrap: ~
+    # open-xchange
+    dovecot: ~
+    openXchange: ~
+    opendeskOpenXchangeBootstrap: ~
+    oxConnector: ~
+    # openproject
+    openproject: ~
+    # openproject-bootstrap
+    opendeskOpenprojectBootstrap: ~
+    # services
+    opendeskOtterize: ~
+    opendeskHome: ~
+    opendeskCertificates: ~
+    redis: ~
+    memcached: ~
+    postgresql: ~
+    mariadb: ~
+    postfix: ~
+    opendeskDkimpyMilter: ~
+    clamav: ~
+    clamavSimple: ~
+    minio: ~
+    # xwiki
+    xwiki: ~
+...