feat(element): Featuretoggle for presence propagation

.gitlab-ci.yml

@@ -92,7 +92,7 @@ variables:
       - "yes"
       - "no"
   DEPLOY_UMS:
-    description: "Enable Nubus deployment."
+    description: "Enable Univention Management Stack deployment."
     value: "no"
     options:
       - "yes"
@@ -317,7 +317,7 @@ ums-deploy:
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no")
       when: "on_success"
   variables:
-    COMPONENT: "nubus"
+    COMPONENT: "univention-management-stack"
 
 ox-deploy:
   stage: "component-deploy-stage-1"

.gitlab/lint/lint-kyverno.yml

@@ -17,12 +17,12 @@ lint-kyverno:
           - "intercom-service"
           - "jitsi"
           - "nextcloud"
-          - "nubus"
           - "open-xchange"
           - "openproject"
           - "openproject-bootstrap"
           - "provisioning"
           - "services"
+          - "univention-management-stack"
           - "xwiki"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${APP}"

.reuse/dep5

@@ -3,8 +3,8 @@ Upstream-Name: openDesk - der Souveräne Arbeitsplatz
 Upstream-Contact: <opendesk@zendis.de>
 Source: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk
 
-Files: helmfile/files/theme/*
+Files: helmfile/environments/default/theme/*
-Copyright: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 License: Apache-2.0
 
 Files: helmfile/files/gpg-pubkeys/*

CHANGELOG.md

@@ -1,31 +1,3 @@
-# [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24)
-
-
-### Bug Fixes
-
-* **collabora:** Update to 24.04.5.1.1. ([8a2d951](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8a2d951c3b59c3f8ddb508ad8f95798774b7c4b0))
-* **collabora:** Update to 24.04.5.1.2. ([74d444e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/74d444e2d6065082be3ca90373a4d3b1836ea7a8))
-* **docs:** Update workflow.md. ([fd3df7d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fd3df7df6740d8e54b433c039d294843582e8947))
-* **docu:** Update documentation on integration uses cases ([#95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/95)). ([382af1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/382af1dfb966b5d10da4790212d6422a4a8c5618))
-* **helmfile:** Add S3 bucket for migrations. ([972020f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/972020f946d8238e65b1c1e2942682c797306e1a))
-* **helmfile:** Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details. ([26a7641](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/26a7641a5ab764196af6bbe26d97907de86f541e))
-* **jitsi:** Raise memory limit for jicofo and jvb as required by upstream product. ([fe923bb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fe923bb9cd58873957adb018c1410d33bb4d8f3a))
-* **keycloak:** Support for custom OIDC Clients and ClientScopes. ([46412d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/46412d1a9e4547dea8d0da3e322400ea148edf19))
-* **nextcloud:** Support templating of default quota and `*_retention_obligation` settings ([#93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/93)). ([23ef1d5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/23ef1d557bc0fdf6faac59f7a287f1ef1b302404))
-* **nextcloud:** Update to 28.0.7 including latest apps for 28. ([671f57a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/671f57a809eb4bb791698cda39f7711ac4833334))
-* **nextcloud:** Update to 28.0.7 including the apps, fix admin panel warnings ([#94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/94)). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details. ([63f8394](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63f8394e044670a89a642e933600b68ff740a102))
-* **openproject:** Bump to 14.3.0 and update Helm chart to 7.0.0. ([6b609ed](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6b609edc4a60601ca45372b4fc691f0ac7c9ed93))
-* **openproject:** Support for adding token to enable OpenProject Premium. ([dfaf4be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dfaf4be640209f5908815cceaf29db591212ddaa))
-* **xwiki:** Add email address mapping to LDAP sync; Fix hostname `null` value in notification links. ([1067e72](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1067e725b3dabce4ddfeb60b4cbe9e5b4d0db0e5))
-* **xwiki:** Remove .rtf and .odt export options as they are currently non functional. ([b806d51](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b806d51311c6d406ea3c93842601ddf5dbd13bb3))
-* **xwiki:** Update to 16.4. ([db7f5d6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/db7f5d60bdae437cebe58ab10f928a4a348e1ee3))
-* **xwiki:** Update to 16.4.1. ([e54aaab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e54aaab072f31713b5172e4bab9ba7e9ca9c5c26))
-
-
-### Features
-
-* **authentication:** Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage. ([b4570a9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4570a9a873efa6c896fe543ab0ba3b94fd086c0))
-
 ## [0.8.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.0...v0.8.1) (2024-07-01)
 
 

README.md

@@ -29,16 +29,16 @@ openDesk is a Kubernetes based, open-source and cloud-native digital workplace s
 openDesk currently features the following functional main components:
 
 | Function             | Functional Component        | Component<br/>Version                                                                 | Upstream Documentation                                                                                                                       |
-| -------------------- | --------------------------- |---------------------------------------------------------------------------------------| -------------------------------------------------------------------------------------------------------------------------------------------- |
+| -------------------- | --------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.67](https://github.com/element-hq/element-desktop/releases/tag/v1.11.67)        | [For the most recent release](https://element.io/user-guide)                                                                                 |
 | Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                      | [For the most recent release](https://docs.cryptpad.org/en/)                                                                                 |
 | File management      | Nextcloud                   | [28.0.5](https://nextcloud.com/de/changelog/#28-0-5)                                  | [Nextcloud 28](https://docs.nextcloud.com/)                                                                                                  |
-| Groupware            | OX App Suite                | [8.26](https://documentation.open-xchange.com/appsuite/releases/8.26/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
+| Groupware            | OX App Suite                | [8.23](https://documentation.open-xchange.com/appsuite/releases/8.23/)                | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
 | Knowledge management | XWiki                       | [16.4.1](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.1/)        | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                            |
 | Portal & IAM         | Nubus                       | Product Preview[^1]                                                                   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html)                                                    |
-| Project management   | OpenProject                 | [14.4.0](https://www.openproject.org/docs/release-notes/14-4-0/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
+| Project management   | OpenProject                 | [14.2.0](https://www.openproject.org/docs/release-notes/14-2-0/)                      | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
-| Videoconferencing    | Jitsi                       | [2.0.9646](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9646) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
+| Videoconferencing    | Jitsi                       | [2.0.9457](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9457) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
-| Weboffice            | Collabora                   | [24.04.6.1.1](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
+| Weboffice            | Collabora                   | [24.04.5.2.1](https://www.collaboraoffice.com/code-24-04-release-notes/)              | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
 
 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.

docs/components.md

@@ -33,7 +33,6 @@ they need to be replaced in production deployments.
 | ClamAV (Simple)             | Antivirus engine               | Eval       |
 | Collabora                   | Weboffice                      | Functional |
 | CryptPad                    | Weboffice                      | Functional |
-| dkimpy-milter               | DKIM milter for Postfix        | Eval       |
 | Element                     | Secure communications platform | Functional |
 | Intercom Service            | Cross service data exchange    | Functional |
 | Jitsi                       | Videoconferencing              | Functional |

docs/debugging.md

@@ -52,7 +52,7 @@ Below you will find some wrap-up notes when it comes to debugging openDesk by ad
 
 You can add a container by editing and updating an existing deployment, which is quite comfortable with tools like [Lens](https://k8slens.dev/).
 
-- Select the container you want to make use of as debugging container, in the example below it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
+- Select the container you want to make use of as debugging container, in the example below it's `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
 - Ensure the `shareProcessNamespace` option is enabled for the Pod.
 - Reference the selected container within the `containers` array of the deployment.
 - In case you want to access another containers filesystem, ensure the user/group settings of both containers match.
@@ -121,7 +121,7 @@ Now you can add the ephemeral container with:
 ```
 kubectl -n ${NAMESPACE} debug -it --attach=false -c ${EPH_CONTAINER_NAME} --image={DEBUG_IMAGE} ${POD_NAME}
 ```
-and open its interactive terminal with
+and open it's interactive terminal with
 ```
 kubectl -n ${NAMESPACE} attach -it -c ${EPH_CONTAINER_NAME} ${POD_NAME}
 ```

docs/enhanced-configuration/idp-federation.md

@@ -44,9 +44,9 @@ We will provide additional documents regarding user provisioning in the future,
   - UDM REST API:
     - Build a provisioning solution by yourself using the [UDM REST API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html).
     - The API gives you full control over the contents of the IAM in order to create, update or delete users and groups.
-  - Nubus Directory Importer:
+  - Directory Connector:
     - It is based on a Python one-way directory synchronization for users and groups.
-    - Please find more details in the [upstream product's documentation](https://docs.software-univention.de/nubus-kubernetes-operation/latest/en/howto-connect-external-iam.html).
+    - We will provide more details on this approach soon one the tool is made publicly available.
 - Ad-hoc provisioning (AHP)
   - This feature is currently not available in the openDesk Keycloak, but there are plans by the Supplier Univention to make it available.
   - Ad-hoc provisioning creates an user account on the fly during a users first login.
@@ -146,8 +146,8 @@ The following configuration is taking place in the Keycloak realm `opendesk`.
   - *Client ID*: Use the client ID you took form your organization's IdP config (`opendesk-federation-client` in this example)
   - *Client Secret*: Use the secret you took form your organization's IdP config
   - When completed with *Add* you get to the detailed IdP configured that also needs some updates (you may need to open the *Advanced* section to access some settings)
-    - *Back-channel logout*: `On`
+	- *Back-channel logout*: `On`
-    - *Disable user info*: `On`
+	- *Disable user info*: `On`
     - *First login flow override*: `auto-federate-flow`
 
 - In case you want to forcefully redirect all users to your organizations IdP (disabling login with local openDesk accounts):

docs/enhanced-configuration/separate-mail-matrix-domain.md

@@ -9,10 +9,6 @@ SPDX-License-Identifier: Apache-2.0
 * [Example configuration](#example-configuration)
   * [Mail domain](#mail-domain)
   * [Matrix domain](#matrix-domain)
-    * [DNS](#dns)
-    * [Webserver](#webserver)
-      * [Content Security Policy](#content-security-policy)
-      * [.well-known](#well-known)
 
 # Use case
 
@@ -63,9 +59,7 @@ or via environment variable
 export MATRIX_DOMAIN=my_organization.tld
 ```
 
-### DNS
+This setup requires also a different DNS setup:
-
-The following changes apply to the standard DNS:
 
 | Record name                      | Type | Value                                  | Comment                                                                            |
 | -------------------------------- | ---- | -------------------------------------- | ---------------------------------------------------------------------------------- |
@@ -73,14 +67,6 @@ The following changes apply to the standard DNS:
 
 *Note:* `matrix.opendesk.domain.tld` in the "Value" column can also be the IP address where synapse TLS port is listening to.
 
-### Webserver
-
-#### Content Security Policy
-
-The webserver of `my_organization.tld` should add `*.opendesk.domain.tld` to its CSP header.
-
-#### .well-known
-
 If you want to use other Matrix clients,
 e.g., Element Messenger for [iOS](https://apps.apple.com/de/app/element-messenger/id1083446067)
 or [Android](https://play.google.com/store/apps/details?id=im.vector.app),
@@ -96,4 +82,4 @@ you need to create a JSON file with the following contents that is served from
 ```
 
 This ensures clients know where to find the Matrix protocol endpoint when users specify `my_organization.tld`
-as their homeserver.
+as their homeserver.

docs/getting-started.md

@@ -3,7 +3,7 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 -->
 
-<h1>Getting started</h1>
+<h1>Getting stated</h1>
 
 This documentation should enable you to create your own evaluation instance of openDesk on your Kubernetes cluster.
 
@@ -52,7 +52,7 @@ files.
 > All configuration options and their default values can be found in files at `helmfile/environments/default/`
 
 For the following guide, we will use `dev` as environment, where variables can be set in
-`helmfile/environments/dev/values.yaml.gotmpl`.
+`helmfile/environments/dev/values.yaml`.
 
 ## DNS
 
@@ -60,16 +60,16 @@ The deployment is designed to deploy each application/service under a dedicated
 For your convenience, we recommend to create a `*.domain.tld` A-Record to your cluster ingress controller,
 otherwise you need to create an A-Record for each subdomain.
 
-| Record name                   | Type | Value                                              | Additional information                                           |
+| Record name             | Type | Value                                              | Additional information                                                             |
-|-------------------------------|------|----------------------------------------------------|------------------------------------------------------------------|
+| ----------------------- | ---- | -------------------------------------------------- | ---------------------------------------------------------------------------------- |
-| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                  |
+| *.domain.tld            | A    | IPv4 address of your Ingress Controller            |                                                                                    |
-| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                  |
+| *.domain.tld            | AAAA | IPv6 address of your Ingress Controller            |                                                                                    |
-| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld         | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld         | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix                   |
-| domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                  |
+| domain.tld              | MX   | `10 mail.domain.tld`                               |                                                                                    |
-| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                       |
+| domain.tld              | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                                         |
-| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                         |
+| _dmarc.domain.tld       | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                                           |
-| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional DKIM settings                                           |
+| _matrix._tcp.domain.tld | SRV  | `1 10 PORT matrix.domain.tld`                      | `PORT` is your NodePort/LoadBalancer port of `opendesk-synapse-federation` service |
 
 ## Domain
 
@@ -100,29 +100,29 @@ export DOMAIN=domain.tld
 
 All available apps and their default value can be found in `helmfile/environments/default/workplace.yaml`.
 
-| Component            | Name                        | Default | Description                    |
+| Component                   | Name                                | Default | Description                    |
-| -------------------- | --------------------------- | ------- | ------------------------------ |
+| --------------------------- | ----------------------------------- | ------- | ------------------------------ |
-| Certificates         | `certificates.enabled`      | `true`  | TLS certificates               |
+| Certificates                | `certificates.enabled`              | `true`  | TLS certificates               |
-| ClamAV (Distributed) | `clamavDistributed.enabled` | `false` | Antivirus engine               |
+| ClamAV (Distributed)        | `clamavDistributed.enabled`         | `false` | Antivirus engine               |
-| ClamAV (Simple)      | `clamavSimple.enabled`      | `true`  | Antivirus engine               |
+| ClamAV (Simple)             | `clamavSimple.enabled`              | `true`  | Antivirus engine               |
-| Collabora            | `collabora.enabled`         | `true`  | Weboffice                      |
+| Collabora                   | `collabora.enabled`                 | `true`  | Weboffice                      |
-| CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
+| CryptPad                    | `cryptpad.enabled`                  | `true`  | Weboffice                      |
-| Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
+| Dovecot                     | `dovecot.enabled`                   | `true`  | Mail backend                   |
-| Element              | `element.enabled`           | `true`  | Secure communications platform |
+| Element                     | `element.enabled`                   | `true`  | Secure communications platform |
-| Intercom Service     | `intercom.enabled`          | `true`  | Cross service data exchange    |
+| Intercom Service            | `intercom.enabled`                  | `true`  | Cross service data exchange    |
-| Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
+| Jitsi                       | `jitsi.enabled`                     | `true`  | Videoconferencing              |
-| MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
+| MariaDB                     | `mariadb.enabled`                   | `true`  | Database                       |
-| Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
+| Memcached                   | `memcached.enabled`                 | `true`  | Cache Database                 |
-| MinIO                | `minio.enabled`             | `true`  | Object Storage                 |
+| MinIO                       | `minio.enabled`                     | `true`  | Object Storage                 |
-| Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
+| Nextcloud                   | `nextcloud.enabled`                 | `true`  | File share                     |
-| Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
+| OpenProject                 | `openproject.enabled`               | `true`  | Project management             |
-| OpenProject          | `openproject.enabled`       | `true`  | Project management             |
+| OX Appsuite                 | `oxAppsuite.enabled`                | `true`  | Groupware                      |
-| OX Appsuite          | `oxAppsuite.enabled`        | `true`  | Groupware                      |
+| Provisioning                | `oxConnector.enabled`               | `true`  | Backend provisioning           |
-| Provisioning         | `oxConnector.enabled`       | `true`  | Backend provisioning           |
+| Postfix                     | `postfix.enabled`                   | `true`  | MTA                            |
-| Postfix              | `postfix.enabled`           | `true`  | MTA                            |
+| PostgreSQL                  | `postgresql.enabled`                | `true`  | Database                       |
-| PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
+| Redis                       | `redis.enabled`                     | `true`  | Cache Database                 |
-| Redis                | `redis.enabled`             | `true`  | Cache Database                 |
+| Univention Management Stack | `univentionManagementStack.enabled` | `true`  | Identity Management & Portal   |
-| XWiki                | `xwiki.enabled`             | `true`  | Knowledge management           |
+| XWiki                       | `xwiki.enabled`                     | `true`  | Knowledge management           |
 
 Exemplary, Jitsi can be disabled like:
 
@@ -195,31 +195,21 @@ If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to pr
 ```yaml
 cluster:
   networking:
-    cidr:
+    cidr: "127.0.0.0/8"
-      - "127.0.0.0/8"
-```
-
-If your load balancer / reverse proxy IPs are not already covered by the above `cidr` you need to
-explicitly configure the related IPs or IP ranges:
-
-```yaml
-cluster:
-  networking:
-    incomingCIDR:
-      - "172.16.0.0/12"
 ```
 
 ### Ingress
 
-By default, the `ingressClassName` is empty to choose your default ingress controller. You may want to customize it by
+By default, the `ingressClassName` is empty to choose your default ingress controller, you may want to customize it by
-setting the following attribute to the name of the currently only supported ingress controller `ingress-nginx` (see
+setting:
-[requirements.md](./requirements.md)) for reference) within your deployment if that is not the clusters default ingress.
 
 ```yaml
 ingress:
-  ingressClassName: "name-of-my-nginx-ingress"
+  ingressClassName: "cilium"
 ```
 
+**Note:** Please check the [requirements.md](./requirements.md) for the supported Ingress controllers.
+
 ### Container runtime
 
 Some apps require specific configuration for the container runtime. You can set your container runtime like `cri-o`,
@@ -263,8 +253,6 @@ To use the openDesk functionality with its web based user interface you need to
 
 | Component          | Description             |  Port | Type |
 | ------------------ | ----------------------- | ----: | ---: |
-| openDesk           | Kubernetes Ingress      |    80 |  TCP |
-| openDesk           | Kubernetes Ingress      |   443 |  TCP |
 | Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
 
 #### Mail clients
@@ -290,20 +278,6 @@ smtp:
   password: "secret"
 ```
 
-Enabling DKIM signing of emails helps to reduce spam and increases trust.
-openDesk ships dkimpy-milter as Postfix milter for signing mails.
-
-```yaml
-dkimpy:
-  enable: true
-  dkim:
-    key:
-      value: |
-        HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E=
-    selector: "default"
-    useED25519: true # when false, RSA is used
-```
-
 ### TURN configuration
 
 Some components (Jitsi, Element) use for direct communication a TURN server. You can configure your own TURN server with
@@ -403,7 +377,8 @@ When all apps are successfully deployed and pod status' went to `Running` or `Su
 https://portal.domain.tld
 ```
 
-If you change the subdomain of `nubus`, you need to replace `portal` by your specified subdomain.
+If you change the subdomain of `univentionManagementStack`, you need to replace `portal`
+by your specified subdomain.
 
 **Credentials:**
 

docs/migrations.md

@@ -3,20 +3,12 @@ SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlic
 SPDX-License-Identifier: Apache-2.0
 -->
 
-<h1>Upgrade migrations</h1>
+<h1>Migrations</h1>
 
 * [Disclaimer](#disclaimer)
-* [Releases upgrades](#releases-upgrades)
+* [From v0.8.1](#from-v081)
-  * [From v0.9.0](#from-v090)
+  * [Updated customizable template attributes](#updated-customizable-template-attributes)
-    * [Automated migrations](#automated-migrations)
+  * [`migrations` S3 bucket](#migrations-s3-bucket)
-      * [Updated IAM component Nubus](#updated-iam-component-nubus)
-        * [Manual cleanup](#manual-cleanup)
-  * [From v0.8.1](#from-v081)
-    * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
-    * [Updated customizable template attributes](#updated-customizable-template-attributes)
-    * [`migrations` S3 bucket](#migrations-s3-bucket)
-* [Related components and artefacts](#related-components-and-artefacts)
-  * [Development](#development)
 
 # Disclaimer
 
@@ -24,44 +16,9 @@ We do not offer support for upgrades before we reach openDesk 1.0.
 
 Though we try to ease the pain when it comes to 0.x upgrades. That is what this document is for.
 
-Limitations:
+# From v0.8.1
-- We assume that the PV reclaim policy is set to `delete`, so expect that PVs get deleted as soon as the related PVC was deleted and will cover an explicit delete for PVs.
 
-# Releases upgrades
+## Updated customizable template attributes
-
-## From v0.9.0
-
-### Automated migrations
-
-#### Updated IAM component Nubus
-
-openDesk is integrating the latest [Nubus](https://www.univention.de/produkte/nubus/) development from Univention. The now redundant and scalable LDAP requires migration activities. These have been automated to avoid manual interaction. The `run_2` of the openDesk
-upgrade migrations executes the following steps:
-
-- Stage PRE:
-  - Delete service `ums-keycloak`, as it will be recreated headless.
-  - Scale down `statefulset/ums-ldap-server` and `statefulset/ums-ldap-notifier` in preparation or the next step:
-  - Create two new PVCs `shared-data-ums-ldap-server-primary-0` and `shared-data-ums-ldap-server-primary-1` for the new LDAP primary pods as copy from the existing `shared-data-ums-ldap-server-0`. The LDAP secondaries will sync from the primary nodes.
-- Stage POST:
-  - Restart Keycloak.
-
-##### Manual cleanup
-
-Currently we do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the no longer used PVCs after successful upgrade:
-```
-NAMESPACE=<your_namespace>
-kubectl -n ${NAMESPACE} delete pvc shared-data-ums-ldap-server-0
-kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
-```
-
-## From v0.8.1
-
-### Updated `cluster.networking.cidr`
-
-- Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1), please update your setup accordingly if you explicitly set this value.
-- Reference:[cluster.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/cluster.yaml)
-
-### Updated customizable template attributes
 
 - Action: Please ensure you update you custom deployment values according with the updated default value structure.
 - References:
@@ -70,28 +27,7 @@ kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
   - `monitoring.` prefix for `prometheus.*` and `graphana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
   - `smtp.` prefix for `localpartNoReply`, see [smtp.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/smtp.yaml).
 
-### `migrations` S3 bucket
+## `migrations` S3 bucket
 
 - Action: For self managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
 - Reference: `objectstores.migrations` in [objectstores.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/objectstores.yaml)
-
-# Related components and artefacts
-
-openDesk comes with two upgrade steps as part of the deployment, they can be found in the folder [/helmfile/apps](../helmfile/apps/) as all other components:
-
-- `migrations-pre`: Is the very first app that gets deployed.
-- `migrations-post`: Is the last app that gets deployed.
-
-Both migrations have to be deployed exclusively at their first/last position and not in parallel with other components.
-
-The status of the upgrade migrations is tracked in the ConfigMap `migrations-status`, more details can be found in the [README.md of the related container image](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/README.md).
-
-## Development
-
-When a new upgrade migration is required, ensure to address the following list:
-
-- Update the generated release version file [`global.generated.yaml`](../helmfile/environments/default/global.generated.yaml) at least on the patch level to test the upgrade in your feature branch as well as trigger it in the `develop` branch after the feature branch was merged. The set value gets overwritten during the release process with the release's actual version number.
-- You have to implement the migration logic as a runner script in the [`opendesk-migrations`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations) image. Please find more instructions in the linked repository.
-- You most likely have to update the [`opendesk-migrations` Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations) within the `rules` section of the [`role.yaml`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/templates/role.yaml) to provide the permissions required for the execution of your migration's logic.
-- You have to set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
-- Update the [`charts.yaml`](../helmfile/environments/default/charts.yaml) and [`images.yaml`](../helmfile/environments/default/images.yaml) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.

docs/requirements.md

@@ -33,13 +33,11 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)
 
 The following minimal requirements are thought for initial evaluation deployment:
 
-| Spec | Value                                                 |
+| Spec | Value                                                |
-| ---- | ----------------------------------------------------- |
+|------|------------------------------------------------------|
-| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
+| CPU  | 8 Cores of x64 or x86 CPU (ARM is not supported yet) |
-| RAM  | 32 GB, more recommended                               |
+| RAM  | 16 GB, recommended 32 GB                             |
-| Disk | HDD or SSD, >10 GB                                    |
+| Disk | HDD or SSD, >10 GB                                   |
-
-Check [`scaling.md`](./scaling.md) for more details on resource requirements and scalability.
 
 # Kubernetes
 

docs/scaling.md

@@ -7,17 +7,55 @@ SPDX-License-Identifier: Apache-2.0
 
 This document should cover the abilities to scale apps.
 
-# Horizontal scalability
+<!-- TOC -->
+* [Replicas](#replicas)
+<!-- TOC -->
 
-We are working on generating this document automatically based on the file
+# Replicas
-[`replicas.yaml`](../helmfile/environments/default/replicas.yaml) that contains necessary annotations.
-In the meantime this file can be used to check the components scaling support / capabilities.
 
-# Upstream information
+The Replicas can be increased of almost any component, but is only effective for high-availability or load-balancing for
+apps with a check-mark in `Scaling (effective)` column.
 
-While scaling services horizontally is the ideal solution, information about vertical scaling is helpful
+Verified positive effects are marked with a check-mark in `Scaling (verified)` column, apps which are not yet tested are
-when it comes to defining the applications resources, see [`resources.yaml`](../helmfile/environments/default/resources.yaml) for references.
+marked with a gear.
 
-Please find below links to the application's upstream resources about scaling:
 
-- [OpenProject system requirements](https://www.openproject.org/docs/installation-and-operations/system-requirements/)
+| Component                   | Name                                     | Scaling (effective) | Scaling (verified) |
+|-----------------------------|------------------------------------------|:-------------------:|:------------------:|
+| ClamAV                      | `replicas.clamav`                        | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.clamd`                         | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.freshclam`                     |         :x:         |        :x:         |
+|                             | `replicas.icap`                          | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.milter`                        | :white_check_mark:  | :white_check_mark: |
+| Collabora                   | `replicas.collabora`                     | :white_check_mark:  |       :gear:       |
+| CryptPad                    | `replicas.cryptpad`                      | :white_check_mark:  |       :gear:       |
+| Dovecot                     | `replicas.dovecot`                       |         :x:         |       :gear:       |
+| Element                     | `replicas.element`                       | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.matrixNeoBoardWidget`          | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixNeoChoiceWidget`         | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixNeoDateFixBot`           | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixNeoDateFixWidget`        | :white_check_mark:  |       :gear:       |
+|                             | `replicas.matrixUserVerificationService` | :white_check_mark:  |       :gear:       |
+|                             | `replicas.synapse`                       |         :x:         |       :gear:       |
+|                             | `replicas.synapseWeb`                    | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.wellKnown`                     | :white_check_mark:  | :white_check_mark: |
+| Intercom Service            | `replicas.intercomService`               | :white_check_mark:  | :white_check_mark: |
+| Jitsi                       | `replicas.jibri`                         | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jicofo`                        | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jitsi `                        | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jitsiKeycloakAdapter`          | :white_check_mark:  |       :gear:       |
+|                             | `replicas.jvb `                          |         :x:         |        :x:         |
+| Keycloak                    | `replicas.keycloak`                      | :white_check_mark:  |       :gear:       |
+| Memcached                   | `replicas.memcached`                     |       :gear:        |       :gear:       |
+| Minio                       | `replicas.minioDistributed`              | :white_check_mark:  | :white_check_mark: |
+| Nextcloud                   | `replicas.nextcloudApache2`              | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.nextcloudExporter`             | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.nextcloudPHP`                  | :white_check_mark:  | :white_check_mark: |
+| OpenProject                 | `replicas.openproject`                   | :white_check_mark:  | :white_check_mark: |
+| Postfix                     | `replicas.postfix`                       |         :x:         |       :gear:       |
+| Redis                       | `replicas.redis`                         |       :gear:        |       :gear:       |
+| Univention Management Stack |                                          |       :gear:        |       :gear:       |
+|                             | `replicas.umsPortalFrontend`             | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.umsPortalServer`               | :white_check_mark:  | :white_check_mark: |
+|                             | `replicas.umsUdmRestApi`                 | :white_check_mark:  | :white_check_mark: |
+| XWiki                       | `replicas.xwiki`                         |         :x:         |       :gear:       |

docs/workflow.md

@@ -22,8 +22,8 @@ SPDX-License-Identifier: Apache-2.0
       * [Branch workflows](#branch-workflows)
         * [`main`](#main)
         * [`develop`](#develop)
-        * [`docs`](#docs)
+        * [`docu`](#docu)
-        * [`fix`](#fix)
+        * [`mntn`](#mntn)
         * [`feat`](#feat)
       * [Branch names](#branch-names)
       * [Commit messages / Conventional Commits](#commit-messages--conventional-commits)
@@ -169,8 +169,8 @@ The basic facts for the flow are:
   - Developers can create sub-branches from their feature branch(es) as needed.
 - When a *feature* branch gets pushed a Merge Request in `Draft` state is automatically created.
 - We know three types of *feature* branches:
-  - `docs`: Doing just documentation changes
+  - `docu`: Doing just documentation changes
-  - `fix`: Maintenance of the openDesk software components and minor configurational changes
+  - `mntn`: Maintenance of the openDesk software components and minor configurational changes
   - `feat`: All changes that do not fall into the two categories above, especially
     - supplier deliverables and
     - configurational changes that have a significant impact on openDesk users or require migrations[^1]
@@ -185,21 +185,21 @@ gitGraph
     checkout "develop"
     commit id: "QA 'nightly develop'"
     commit id: "  "
-    branch "docs"
+    branch "docu"
-    checkout "docs"
+    checkout "docu"
     commit id: "Documentation commits" type: HIGHLIGHT
     checkout "develop"
-    merge "docs"
+    merge "docu"
     checkout "main"
     merge "develop" tag: "No release"
     checkout "develop"
     commit id: "   "
-    branch "fix"
+    branch "mntn"
-    checkout "fix"
+    checkout "mntn"
     commit id: "Maintenance commits" type: HIGHLIGHT
-    commit id: "QG 'fix'" type: REVERSE
+    commit id: "QG 'mntn'" type: REVERSE
     checkout "develop"
-    merge "fix"
+    merge "mntn"
     commit id: "QA 'release merge'" type: REVERSE
     checkout "main"
     merge "develop" tag: "Patch or minor release"
@@ -231,7 +231,7 @@ The Standard Quality Gate addresses quality assurance steps that should be execu
 1. Linting
    - Blocking
      - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
-     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in [development.md](./development.md).
+     - openDesk specific: Especially `images.yaml` and `charts.yaml`, find more details in the [development](./development.md) docu
    - Non Blocking
      - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
      - Formal: Yaml
@@ -277,8 +277,8 @@ This section will explain the workflow for each branch (type) based on the Gitfl
 
 - `QA 'nightly main'`: Execute the SQG based on the most recent release. The upgrade test environment should be a long-standing environment that only gets built from scratch with the previous technical release when something breaks the environment.
 - Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release) which itself is based on the [Semantic Versioning (SemVer) notation](https://semver.org) to automatically create technical releases on the merge points.
-  - "No release": When a merge from `develop` includes only changes from `docs` branches the merge into `main` will only consist of `docs` or `chore` commits. No new release will be generated by that merge.
+  - "No release": When a merge from `develop` includes only changes from `docu` branches the merge into `main` will only consist of `docs` or `chore` commits. No new release will be generated by that merge.
-  - "Patch or minor release": When changes from `fix` branches get merged these might contain `fix` or `feat` commits causing a new technical release to be built with an updated version on Patch or Minor level.
+  - "Patch or minor release": When changes from `mntn` branches get merged these might contain `fix` or `feat` commits causing a new technical release to be built with an updated version on Patch or Minor level.
   - "Minor or major release": When changes from `feat` branches get merged these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on Minor or Major level.
 - "Manual Functional Release Activities": Technical releases are loosely coupled to functional releases. The additional activities for a functional release select an existing technical release as a basis to generate the artifacts required for a functional release, for example:
   - Conduct additional manual explorative and regression tests.
@@ -289,19 +289,19 @@ This section will explain the workflow for each branch (type) based on the Gitfl
 - `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based in this case on the head revision of the `develop` branch.
 - `QA 'release merge'`: The Merge Request for this merge has to be created manually by members of the platform development team. It should document:
   - That the SQG was successfully executed upon the to-be merged state - it could be done explicitly or based on a `QA 'nightly develop'`
-  - In case of `fix` changes that usually how no test automation: Changes have been verified by a member of the platform development team.
+  - In case of `mntn` changes that usually how no test automation: Changes have been verified by a member of the platform development team.
   - That the changes have been reviewed by at least two members of the platform development team giving their approval on the Merge Request.
-- Merge points (from `docs`, `fix`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.
+- Merge points (from `docu`, `mntn`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.
 
-##### `docs`
+##### `docu`
 
-Branches of type `docs` only contain the commits themselves and have to adhere to the workflow basic fact that:
+Branches of type `docu` only contain the commits themselves and have to adhere to the workflow basic fact that:
 > All merges into `develop` or `main` require two approvals from the platform development team.
 
-##### `fix`
+##### `mntn`
 
-Besides the actual changes being committed in an `fix` branch there is only the:
+Besides the actual changes being committed in an `mntn` branch there is only the:
-- `QG 'fix'`: In addition to validating the actual change the owner of the branch has to ensure the successful execution of the SQG.
+- `QG 'mntn'`: In addition to validating the actual change the owner of the branch has to ensure the successful execution of the SQG.
 
 ##### `feat`
 
@@ -318,29 +318,47 @@ This branch type requires the most activities on top of the actual development:
 
 #### Branch names
 
-Branches created from the `develop` branch have to adhere to the following notation: `<type>/<responsible_developer>/<details>`:
+Branches created from the `develop` branch have to adhere to the following notation: `<party[-developer]>/<type>/<component>/<details>`:
 
-- `<type>`: From the list of branch types explained above:
+- `<party[-developer]>`: An identifier for the developing party optionally plus the name of the developer or team working on that branch. The following two-letter shorthand notations should be used for the owner:
-  - `docs`
+  - Suppliers
-  - `fix`
+    - `co`: Collabora
+    - `cp`: CryptPad
+    - `el`: Element
+    - `nc`: Nextcloud
+    - `nd`: Nordeck
+    - `op`: OpenProject
+    - `ox`: Open-Xchange
+    - `uv`: Univention
+    - `xw`: XWiki
+  - Other
+    - `pd`: (openDesk) Platform Development
+    - `xx`: Other, not one of the parties mentioned before
+
+- `<type>`: Based on the branch types described in this document valid values for type are
+  - `docu`
+  - `mntn`
   - `feat`
-- `<responsible_developer>`: Something that makes you identifiable as owner of the branch, e.g. the first letter of your first name followed by your family name.
+
-- `<details>`: A very short note about what is going to happen in the branch and ideally what component is affected from the following list of components:
+- `<component>`: Valid components are
   - `helmfile`
   - `ci`
+  - `cross-functional`
   - `docs`
   - `collabora`
   - `cryptpad`
   - `element`
   - `jitsi`
   - `nextcloud`
-  - `nubus`
   - `open-xchange`
   - `openproject`
   - `services`
+  - `univention-management-stack`
   - `xwiki`
 
-Example: `feat/tmueller/bump_nextcloud_to_29.0.0`.
+- `<details>`: A very short note about what is going to happen in the branch
+
+Example: `pd-tom/fix/open-xchange/bump_to_8.76`.
 
 **Note**: The above naming convention is not enforced yet, but please ensure you make use of it.
 
@@ -349,7 +367,7 @@ Example: `feat/tmueller/bump_nextcloud_to_29.0.0`.
 Commit messages must adhere to the [Conventional Commit standard](https://www.conventionalcommits.org/en/v1.0.0/#summary). Commits that do not adhere to the standard get rejected by either [Gitlab push rules](https://docs.gitlab.com/ee/user/project/repository/push_rules.html) or the CI.
 
 ```text
-<type>(<scope>): [path/to/issue#1] <short summary>.
+<type>(<scope>): [path/to/issue#1] <short summary>
   │       │              │                │
   │       │              |                └─> Summary in present tense, sentence case, with no period at the end
   │       │              |
@@ -360,7 +378,7 @@ Commit messages must adhere to the [Conventional Commit standard](https://www.co
   └─> Commit Type: chore, ci, docs, feat, fix
 ```
 
-Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`
+Example: `fix(univention-management-stack): Update standard session timeout of openDesk realm in Keycloak`
 
 **Beware**: The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.
 

helmfile/apps/element/values-element.yaml.gotmpl

@@ -5,15 +5,15 @@
 configuration:
   endToEndEncryption: true
   additionalConfiguration:
-    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
 
     "net.nordeck.element_web.module.opendesk":
       config:
         banner:
           ics_navigation_json_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/navigation.json"
           ics_silent_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/silent"
-          portal_logo_svg_url: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
+          portal_logo_svg_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
-          portal_url: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/"
+          portal_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/"
         custom_css_variables:
           --cpd-color-bg-action-primary-rest: {{ .Values.theme.colors.primary | quote }}
           --cpd-color-text-action-accent: {{ .Values.theme.colors.primary | quote }}

helmfile/apps/element/values-synapse.yaml.gotmpl

@@ -40,27 +40,18 @@ configuration:
               regex: "@.*"
         url: null
         sender_localpart: intercom-service
-      - as_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+    use_presence: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
-        hs_token: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
+    presence: 
-        id: ox-appsuite
-        namespaces:
-          users:
-            - exclusive: false
-              regex: "@.*"
-        url: null
-        sender_localpart: ox-appsuite
-
-    presence:
       enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
+    
+    
 
     smtp:
-      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}"
-      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      host: {{ .Values.smtp.host | quote }}
-      port: 25
+      port: {{ .Values.smtp.port }}
-      tls: false
+      username: {{ .Values.smtp.username | quote }}
-      starttls: false
+      password: {{ .Values.smtp.password | quote }}
-      username: ""
-      password: ""
 
     oidc:
       clientId: "opendesk-matrix"

helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl

@@ -35,9 +35,6 @@ configuration:
         value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
     host: {{ .Values.cache.nextcloud.host | quote }}
     port: {{ .Values.cache.nextcloud.port | quote }}
-  collabora:
-    # internalWopiUrl: ""
-    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
   database:
     host: {{ .Values.databases.nextcloud.host | quote }}
     port: {{ .Values.databases.nextcloud.port | quote }}
@@ -48,7 +45,7 @@ configuration:
         value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
   ldap:
     host: {{ .Values.ldap.host | quote }}
-    password: {{ .Values.secrets.nubus.ldapSearch.nextcloud | quote }}
+    password: {{ .Values.secrets.univentionManagementStack.ldapSearch.nextcloud | quote }}
     adminGroupName: "managed-by-attribute-FileshareAdmin"
   objectstore:
     auth:
@@ -75,17 +72,14 @@ configuration:
       value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
   smtp:
     auth:
-      enabled: false
       username:
-        value: ""
+        value: {{ .Values.smtp.username | quote }}
       password:
-        value: ""
+        value: {{ .Values.smtp.password | quote }}
-    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    host: {{ .Values.smtp.host | quote }}
-    port: 25
+    port: {{ .Values.smtp.port | quote }}
     fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
-    mailDomain: "{{ .Values.global.domain }}"
+    mailDomain: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
-    security: ""
-    skipVerifyPeer: true
   quota:
     default: "{{ .Values.functional.filestore.quota.default }} GB"
     retentionObligation:

helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl

@@ -66,7 +66,6 @@ php:
           value: "nextcloud_user"
         password:
           value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
-    trustedProxies: {{ join " " .Values.cluster.networking.cidr | quote }}
   containerSecurityContext:
     allowPrivilegeEscalation: false
     capabilities:
@@ -108,7 +107,6 @@ apache2:
   configuration:
     php:
       host: "opendesk-nextcloud-php.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}"
-    trustedProxies: {{ join " " .Values.cluster.networking.cidr | quote }}
   containerSecurityContext:
     allowPrivilegeEscalation: false
     capabilities:
@@ -145,5 +143,4 @@ apache2:
   replicaCount: {{ .Values.replicas.nextcloudApache2 }}
   resources:
     {{ .Values.resources.nextcloudApache2 | toYaml | nindent 4 }}
-
 ...

helmfile/apps/nubus/values-nubus.yaml.gotmpl

@@ -1,333 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-global:
-  nubusDeployment: true
-  ldap:
-    baseDn: {{ .Values.ldap.baseDn | quote }}
-    domainName: {{ .Values.global.domain | quote }}
-  domain: {{ .Values.global.domain | quote }}
-  ingressClass: {{ .Values.ingress.ingressClassName | default "nginx" | quote }}
-  certManagerIssuer: "letsencrypt-prod-dns"
-  nubusMasterPassword: {{ env "MASTER_PASSWORD" | default "sovereign-workplace" | quote }}
-  keycloak:
-    realm: {{ .Values.platform.realm | quote }}
-  objectStorage:
-    bucket: {{ .Values.objectstores.nubus.bucket | quote }}
-    connection:
-      host: "minio"
-      port: "9000"
-      protocol: "http"
-  credentialOverride:
-    ldapServer:
-      adminPassword: {{ .Values.secrets.nubus.ldapSecret | quote}}
-    defaultUsers:
-      defaultAdminPassword: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote}}
-      defaultUserPassword: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote}}
-
-  # -- Extensions to load. Add entries to load additional extensions into Nubus.
-  extensions:
-    - name: "ox"
-      image:
-        registry: {{ .Values.images.nubusOxExtension.registry }}
-        repository: {{ .Values.images.nubusOxExtension.repository }}
-        tag: {{ .Values.images.nubusOxExtension.tag }}
-        imagePullPolicy: "IfNotPresent"
-    - name: "opendesk"
-      image:
-        registry: "registry.opencode.de"
-        repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-        imagePullPolicy: "IfNotPresent"
-        tag: "1.1.0"
-
-  # -- Allows to configure the system extensions to load. This is intended for
-  # internal usage, prefer to use `global.extensions` for user configured
-  # extensions.
-  systemExtensions:
-    - name: "portal"
-      image:
-        registry: {{ .Values.images.nubusPortalExtension.registry }}
-        repository: {{ .Values.images.nubusPortalExtension.repository }}
-        tag: {{ .Values.images.nubusPortalExtension.tag }}
-        imagePullPolicy: "IfNotPresent"
-
-# Nubus bundled services
-postgresql:
-  enabled: false
-  provisioning:
-    enabled: false
-
-minio:
-  enabled: false
-
-# Nubus services which use customer supplied services
-keycloak:
-  keycloak:
-    auth:
-      username: "kcadmin"
-      credentialSecret:
-        name: "ums-opendesk-keycloak-credentials"
-        key: "admin_password"
-  postgresql:
-    connection:
-      host: {{ .Values.databases.keycloak.host | quote }}
-      port: {{ .Values.databases.keycloak.port | quote }}
-    auth:
-      username: {{ .Values.databases.keycloak.username | quote }}
-      database: {{ .Values.databases.keycloak.name | quote }}
-      credentialSecret:
-        name: "ums-keycloak-postgresql-opendesk-credentials"
-        key: "keycloakDatabasePassword"
-  config:
-    exposeAdminConsole: {{ .Values.debug.enabled }}
-
-nubusGuardian:
-  provisioning:
-    enabled: false
-    config:
-      keycloak:
-        credentialSecret:
-          name: "ums-opendesk-keycloak-credentials"
-          key: "admin_password"
-      managementApi:
-        credentialSecret:
-          name: "ums-opendesk-guardian-client-secret"
-          key: "managementApiClientSecret"
-
-  postgresql:
-    connection:
-      host: {{ .Values.databases.umsGuardianManagementApi.host | quote }}
-      port: {{ .Values.databases.umsGuardianManagementApi.port | quote }}
-    auth:
-      username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
-      database: {{ .Values.databases.umsGuardianManagementApi.name | quote }}
-      credentialSecret:
-        name: "ums-guardian-postgresql-opendesk-credentials"
-        key: "guardianDatabasePassword"
-
-nubusNotificationsApi:
-  postgresql:
-    connection:
-      host: {{ .Values.databases.umsNotificationsApi.host | quote }}
-      port: {{ .Values.databases.umsNotificationsApi.port | quote }}
-    auth:
-      username: {{ .Values.databases.umsNotificationsApi.username | quote }}
-      database: {{ .Values.databases.umsNotificationsApi.name | quote }}
-      existingSecret: "ums-notifications-api-postgresql-opendesk-credentials"
-
-
-nubusKeycloakExtensions:
-  keycloak:
-    auth:
-      username: "kcadmin"
-      credentialSecret:
-        name: "ums-opendesk-keycloak-credentials"
-        key: "admin_password"
-  proxy:
-    ingress:
-      paths:
-        {{- if .Values.debug.enabled }}
-        - pathType: "Prefix"
-          path: "/admin/"
-        {{- end }}
-        - pathType: "Prefix"
-          path: "/realms/"
-        - pathType: "Prefix"
-          path: "/js/"
-        - pathType: "Prefix"
-          path: "/resources/"
-        - pathType: "Prefix"
-          path: "/fingerprintjs"
-
-
-  postgresql:
-    connection:
-      host: {{ .Values.databases.keycloakExtension.host | quote }}
-      port: {{ .Values.databases.keycloakExtension.port | quote }}
-    auth:
-      database: {{ .Values.databases.keycloakExtension.name | quote }}
-      username: {{ .Values.databases.keycloakExtension.username | quote }}
-      credentialSecret:
-        name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
-        key: "umcKeycloakExtensionsDatabasePassword"
-  smtp:
-    connection:
-      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
-      port: 25
-      ssl: false
-      starttls: false
-    auth:
-      enabled: false
-      username: ""
-      credentialSecret:
-        name: "ums-keycloak-extensions-smtp-opendesk-credentials"
-        key: "umcKeycloakExtensionsSmtpPassword"
-  handler:
-    appConfig:
-      logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
-      newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
-      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
-
-nubusPortalListener:
-  portalListener:
-    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
-    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
-    objectStorageCredentialSecret:
-      name: "ums-portal-listener-minio-opendesk-credentials"
-      accessKeyKey: "access-key-id"
-      secretKeyKey: "secret-key-id"
-
-nubusPortalServer:
-  portalServer:
-    objectStorageEndpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
-    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
-    objectStorageCredentialSecret:
-      name: "ums-portal-server-minio-opendesk-credentials"
-      accessKeyKey: "access-key-id"
-      secretKeyKey: "secret-key-id"
-    centralNavigation:
-      enabled: true
-      authenticatorSecretName: "ums-opendesk-portal-server-central-navigation"
-
-# NOTE: disabled until the next update.
-nubusProvisioning:
-  enabled: false
-nubusUdmListener:
-  enabled: false
-nubusSelfServiceListener:
-  enabled: true
-  selfserviceListener:
-    umcAdminUser: "default.admin"
-
-# Nubus services
-nubusStackDataUms:
-  stackDataContext:
-    umcPostgresqlHostname: {{ .Values.databases.umsSelfservice.host | quote }}
-    umcPostgresqlUsername: {{ .Values.databases.umsSelfservice.username | quote }}
-    umcMemcachedHostname: {{ .Values.cache.umsSelfservice.host | quote }}
-    umcMemcachedUsername: ""
-    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
-    umcHtmlTitle: "openDesk Portal"
-    installUmcPolicies: true
-  nubusUmcServer:
-    memcached:
-      auth:
-        username: ""
-
-# TODO: Remove values when upstreaming fixes
-nubusStackDataSwp:
-  stackDataSwp:
-    {{- if .Values.functional.admin.portal.deploymentInformation.enabled }}
-    systemInformation:
-      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
-      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
-    {{- end }}
-  stackDataContext:
-    ldapSearchUsers:
-      {{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
-      - username: {{ printf "ldapsearch_%s" $username | quote }}
-        password: {{ $password | quote }}
-        lastname: "LDAP-Search-User"
-      {{- end }}
-    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
-    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
-    smtpPort: 25
-    smtpUser: ""
-    smtpStartTls: false
-    ldapBase: {{ .Values.ldap.baseDn }}
-    # FIXME: Should be templated correctly in the future
-    portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }}
-    portalRealtimeVideoconferenceLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.jitsi .Values.global.domain }}
-    portalManagementProjectLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openproject .Values.global.domain }}
-    portalManagementKnowledgeLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.xwiki .Values.global.domain }}
-    portalGroupwareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
-    portalFileshareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.nextcloud .Values.global.domain }}
-    portalTitleDE: "openDesk Portal"
-    portalTitleEN: "openDesk Portal"
-    oxDefaultContext: "1"
-
-nubusUmcServer:
-  postgresql:
-    bundled: false
-    connection:
-      host: {{ .Values.databases.umsSelfservice.host | quote }}
-      port: {{ .Values.databases.umsSelfservice.port | quote }}
-    auth:
-      username: {{ .Values.databases.umsSelfservice.username | quote }}
-      database: {{ .Values.databases.umsSelfservice.name | quote }}
-      credentialSecret:
-        name: "ums-umc-server-postgresql-opendesk-credentials"
-        key: "umcServerDatabasePassword"
-  memcached:
-    bundled: false
-    server: {{ .Values.cache.umsSelfservice.host | quote }}
-    auth:
-      credentialSecret:
-        name: "ums-umc-server-memcached-opendesk-credentials"
-        key: "umcServerMemcachedPassword"
-  smtp:
-    credentialSecret:
-      name: "ums-umc-server-smtp-credentials-custom"
-
-nubusUmcGateway:
-  umcGateway:
-    umcHtmlTitle: "openDesk Portal"
-
-nubusKeycloakBootstrap:
-  keycloak:
-    auth:
-      username: "kcadmin"
-      credentialSecret:
-        name: "ums-opendesk-keycloak-credentials"
-        key: "admin_password"
-  bootstrap:
-    ldapMappers:
-      - ldapAndUserModelAttributeName: "opendeskProjectmanagementAdmin"
-      - ldapAndUserModelAttributeName: "oxContextIDNum"
-    twoFactorAuthentication:
-      enabled: true
-      group: "2fa-users"
-
-# Credential secrets for accessing customer supplied services
-extraSecrets:
-  - name: "ums-opendesk-portal-server-central-navigation"
-    stringData:
-      authenticator.secret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-  - name: "ums-opendesk-guardian-client-secret"
-    stringData:
-      managementApiClientSecret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
-  - name: "ums-opendesk-keycloak-credentials"
-    stringData:
-      admin_password: {{ .Values.secrets.keycloak.adminPassword | quote }}
-  - name: "ums-keycloak-postgresql-opendesk-credentials"
-    stringData:
-      keycloakDatabasePassword: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
-  - name: "ums-guardian-postgresql-opendesk-credentials"
-    stringData:
-      guardianDatabasePassword: {{ .Values.databases.umsGuardianManagementApi.password | default .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
-  - name: "ums-notifications-api-postgresql-opendesk-credentials"
-    stringData:
-      password: {{ .Values.databases.umsNotificationsApi.password | default .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
-  - name: "ums-umc-server-postgresql-opendesk-credentials"
-    stringData:
-      umcServerDatabasePassword: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
-  - name: "ums-umc-server-memcached-opendesk-credentials"
-    stringData:
-      umcServerMemcachedPassword: ""
-  - name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
-    stringData:
-      umcKeycloakExtensionsDatabasePassword: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
-  - name: "ums-keycloak-extensions-smtp-opendesk-credentials"
-    stringData:
-      umcKeycloakExtensionsSmtpPassword: ""
-  - name: "ums-portal-server-minio-opendesk-credentials"
-    stringData:
-      access-key-id: {{ .Values.objectstores.nubus.username | quote }}
-      secret-key-id: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
-  - name: "ums-portal-listener-minio-opendesk-credentials"
-    stringData:
-      access-key-id: {{ .Values.objectstores.nubus.username | quote }}
-      secret-key-id: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
-  - name: "ums-umc-server-smtp-credentials-custom"
-    stringData:
-      password: ""

helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl

@@ -1,229 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-keycloak:
-  enabled: true
-  podAnnotations:
-    intents.otterize.com/service-name: "ums-keycloak"
-  replicaCount: {{ .Values.replicas.keycloak }}
-  resources:
-    {{ .Values.resources.umsKeycloak | toYaml | nindent 4 }}
-
-guardian:
-  authorizationApi:
-    podAnnotations:
-      intents.otterize.com/service-name: "ums-guardian-authorization-api"
-    resources:
-      {{ .Values.resources.umsGuardianAuthorizationApi | toYaml | nindent 6 }}
-  managementApi:
-    podAnnotations:
-      intents.otterize.com/service-name: "ums-guardian-management-api"
-    resources:
-      {{ .Values.resources.umsGuardianManagementApi | toYaml | nindent 6 }}
-  managementUi:
-    podAnnotations:
-      intents.otterize.com/service-name: "ums-guardian-management-ui"
-    resources:
-      {{ .Values.resources.umsGuardianManagementUi | toYaml | nindent 6 }}#
-  openPolicyAgent:
-    podAnnotations:
-      intents.otterize.com/service-name: "ums-ums-open-policy-agent"
-    resources:
-      {{ .Values.resources.umsOpenPolicyAgent | toYaml | nindent 6 }}
-  provisioning:
-    # Using openDesk keycloak provisioning
-    enabled: false
-
-nubusNotificationsApi:
-  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-notifications-api"
-  serviceAccount:
-    annotations:
-      intended.usage: "compliance"
-  replicaCount: {{ .Values.replicas.umsNotificationsApi }}
-  resources:
-    {{ .Values.resources.umsNotificationsApi | toYaml | nindent 4 }}
-
-nubusUmcServer:
-  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-umc-server"
-  replicaCount: {{ .Values.replicas.umsUmcServer }}
-  resources:
-    {{ .Values.resources.umsUmcServer | toYaml | nindent 4 }}
-  selfService:
-    passwordresetEmailBody: |
-        Sehr geehrte Benutzerin, sehr geehrter Benutzer,
-
-        Ihr Benutzername für {domainname} lautet: {username}
-
-        Sie erhalten diese Nachricht, da Sie Ihr Passwort zurücksetzen möchten oder weil Ihr Benutzer neu im System angelegt wurde.
-
-        Klicken Sie bitte auf den folgenden Link, um Ihr Passwort zu setzen:
-        https://{fqdn}/univention/portal/#/selfservice/newpassword/?token={token}&username={username}
-
-        Der genannte Link ist nur 48 Stunden gültig, danach fordern Sie ihn bitte erneut an unter:
-        https://{fqdn}/univention/portal/#/selfservice/passwordforgotten
-
-        Mit freundlichen Grüßen
-        Ihr {domainname} Passwort-Service
-
-nubusKeycloakExtensions:
-  handler:
-    replicaCount: {{ .Values.replicas.umsKeycloakExtensionsHandler }}
-    podAnnotations:
-      intents.otterize.com/service-name: "ums-keycloak-extensions-handler"
-    resources:
-      {{ .Values.resources.umsKeycloakExtensionHandler | toYaml | nindent 6 }}
-  proxy:
-    replicaCount: {{ .Values.replicas.umsKeycloakExtensionsProxy }}
-    podAnnotations:
-      intents.otterize.com/service-name: "ums-keycloak-extensions-proxy"
-    resources:
-      {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 6 }}
-
-nubusPortalListener:
-  podAnnotations:
-    intents.otterize.com/service-name: "ums-portal-listener"
-  replicaCount: {{ .Values.replicas.umsPortalListener }}
-  resources:
-    {{ .Values.resources.umsPortalListener | toYaml | nindent 4 }}
-  persistence:
-    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-    size: {{ .Values.persistence.size.nubus.portalListener | quote }}
-
-nubusPortalServer:
-  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-portal-server"
-  serviceAccount:
-    annotations:
-      intended.usage: "compliance"
-  replicaCount: {{ .Values.replicas.umsPortalServer }}
-  resources:
-    {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
-
-nubusLdapNotifier:
-  podAnnotations:
-    intents.otterize.com/service-name: "ums-ldap-notifier"
-  replicaCount: {{ .Values.replicas.umsLdapNotifier }}
-  resources:
-    {{ .Values.resources.umsLdapNotifier | toYaml | nindent 4 }}
-
-nubusLdapServer:
-  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-ldap-server"
-  serviceAccount:
-    annotations:
-      intended.usage: "compliance"
-  initResources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
-  resources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
-  persistence:
-    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-    size: {{ .Values.persistence.size.nubus.ldapServerData | quote }}
-
-nubusPortalFrontend:
-  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-portal-frontend"
-  serviceAccount:
-    annotations:
-      intended.usage: "compliance"
-  replicaCount: {{ .Values.replicas.umsPortalFrontend }}
-  resources:
-    {{ .Values.resources.umsPortalFrontend | toYaml | nindent 4 }}
-  portalFrontend:
-    branding:
-      css: {{ .Values.theme.imagery.portalCss | toJson }}
-      favicon: {{ .Values.theme.imagery.faviconIcoB64 | toJson }}
-      logo: {{ .Values.theme.imagery.logoHeaderSvgB64 | toJson }}
-      backgroundImage: {{ .Values.theme.imagery.logoPortalBackgroundSvgB64 | toJson }}
-
-nubusStackDataUms:
-  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-stack-data-ums"
-  resources:
-    {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}
-
-nubusStackDataSwp:
-  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-stack-data-swp"
-  resources:
-    {{ .Values.resources.umsStackDataSwp | toYaml | nindent 4 }}
-
-nubusSelfServiceListener:
-  podAnnotations:
-    intents.otterize.com/service-name: "ums-selfservice-listener"
-  resources:
-    {{ .Values.resources.umsSelfserviceListener | toYaml | nindent 4 }}
-  replicaCount: {{ .Values.replicas.umsSelfserviceListener }}
-
-nubusUdmRestApi:
-  additionalAnnotations:
-    intents.otterize.com/service-name: "ums-udm-rest-api"
-  serviceAccount:
-    annotations:
-      intended.usage: "compliance"
-  resources:
-    {{ .Values.resources.umsUdmRestApi | toYaml | nindent 4 }}
-  initResources:
-    {{ .Values.resources.umsUdmRestApiInit | toYaml | nindent 4 }}
-  replicaCount: {{ .Values.replicas.umsUdmRestApi }}
-
-nubusUmcGateway:
-  replicaCount: {{ .Values.replicas.umsUmcGateway }}
-  resources:
-    {{ .Values.resources.umsUmcGateway | toYaml | nindent 4 }}
-  extraVolumes:
-    - name: "entrypoint-swp-patches"
-      configMap:
-        name: "ums-stack-data-swp-umc-gateway-entrypoint"
-        defaultMode: 0555
-  extraVolumeMounts:
-    - name: "entrypoint-swp-patches"
-      mountPath: "/entrypoint.d/90-swp.sh"
-      subPath: "90-swp.sh"
-
-nubusKeycloakBootstrap:
-  podAnnotations:
-    intents.otterize.com/service-name: "ums-keycloak-bootstrap"
-  serviceAccount:
-    annotations:
-      intended.usage: "compliance"
-  resources:
-    {{ .Values.resources.umsKeycloakBootstrap | toYaml | nindent 4 }}
-
-nubusProvisioning:
-  serviceAccount:
-    annotations:
-      intended.usage: "compliance"
-  nats:
-    resources:
-      {{ .Values.resources.nubusProvisioning.nats | toYaml | nindent 6 }}
-    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-nats"
-    serviceAccount:
-      annotations:
-        intended.usage: "compliance"
-  api:
-    resources:
-      {{ .Values.resources.nubusProvisioning.api | toYaml | nindent 6 }}
-    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-api"
-  dispatcher:
-    resources:
-      {{ .Values.resources.nubusProvisioning.dispatcher | toYaml | nindent 6 }}
-    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-dispatcher"
-  prefill:
-    resources:
-      {{ .Values.resources.nubusProvisioning.prefill | toYaml | nindent 6 }}
-    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-prefill"
-  registerConsumers:
-    resources:
-      {{ .Values.resources.nubusProvisioning.registerConsumers | toYaml | nindent 6 }}
-    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-register-consumers"
-  udmTransformer:
-    resources:
-      {{ .Values.resources.nubusProvisioning.udmTransformer | toYaml | nindent 6 }}
-    additionalAnnotations:
-      intents.otterize.com/service-name: "ums-provisioning-udm-transformer"

helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl

@@ -1,241 +0,0 @@
-# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-keycloak:
-  image:
-    registry: {{ .Values.images.nubusKeycloak.registry }}
-    repository: {{ .Values.images.nubusKeycloak.repository }}
-    tag: {{ .Values.images.nubusKeycloak.tag }}
-
-nubusKeycloakBootstrap:
-  image:
-    registry: {{ .Values.images.nubusKeycloakBootstrap.registry }}
-    repository: {{ .Values.images.nubusKeycloakBootstrap.repository }}
-    tag: {{ .Values.images.nubusKeycloakBootstrap.tag }}
-
-nubusKeycloakExtensions:
-    handler:
-      image:
-        registry: {{ .Values.images.nubusKeycloakExtensionHandler.registry }}
-        repository: {{ .Values.images.nubusKeycloakExtensionHandler.repository }}
-        tag: {{ .Values.images.nubusKeycloakExtensionHandler.tag }}
-
-    proxy:
-      image:
-        registry: {{ .Values.images.nubusKeycloakExtensionProxy.registry }}
-        repository: {{ .Values.images.nubusKeycloakExtensionProxy.repository }}
-        tag: {{ .Values.images.nubusKeycloakExtensionProxy.tag }}
-
-nubusLdapNotifier:
-  image:
-    registry: {{ .Values.images.nubusLdapNotifier.registry }}
-    repository: {{ .Values.images.nubusLdapNotifier.repository }}
-    tag: {{ .Values.images.nubusLdapNotifier.tag }}
-
-nubusLdapServer:
-  ldapServer:
-    image:
-      registry: {{ .Values.images.nubusLdapServer.registry }}
-      repository: {{ .Values.images.nubusLdapServer.repository }}
-      tag: {{ .Values.images.nubusLdapServer.tag }}
-  dhInitcontainer:
-    image:
-      registry: {{ .Values.images.nubusLdapServerDhInitContainer.registry }}
-      repository: {{ .Values.images.nubusLdapServerDhInitContainer.repository }}
-      tag: {{ .Values.images.nubusLdapServerDhInitContainer.tag }}
-  waitForDependency:
-    image:
-      registry: {{ .Values.images.nubusWaitForDependency.registry }}
-      repository: {{ .Values.images.nubusWaitForDependency.repository }}
-      tag: {{ .Values.images.nubusWaitForDependency.tag }}
-
-
-nubusPortalConsumer:
-  portalConsumer:
-    image:
-      registry: {{ .Values.images.nubusPortalConsumer.registry }}
-      repository: {{ .Values.images.nubusPortalConsumer.repository }}
-      tag: {{ .Values.images.nubusPortalConsumer.tag }}
-
-
-nubusNotificationsApi:
-  image:
-    registry: {{ .Values.images.nubusNotificationsApi.registry }}
-    repository: {{ .Values.images.nubusNotificationsApi.repository }}
-    tag: {{ .Values.images.nubusNotificationsApi.tag }}
-
-nubusPortalFrontend:
-  image:
-    registry: {{ .Values.images.nubusPortalFrontend.registry }}
-    repository: {{ .Values.images.nubusPortalFrontend.repository }}
-    tag: {{ .Values.images.nubusPortalFrontend.tag }}
-
-nubusPortalListener:
-  image:
-    registry: {{ .Values.images.nubusPortalListener.registry }}
-    repository: {{ .Values.images.nubusPortalListener.repository }}
-    tag: {{ .Values.images.nubusPortalListener.tag }}
-  waitForDependency:
-    image:
-      registry: {{ .Values.images.nubusWaitForDependency.registry }}
-      repository: {{ .Values.images.nubusWaitForDependency.repository }}
-      tag: {{ .Values.images.nubusWaitForDependency.tag }}
-
-nubusPortalServer:
-  image:
-    registry: {{ .Values.images.nubusPortalServer.registry }}
-    repository: {{ .Values.images.nubusPortalServer.repository }}
-    tag: {{ .Values.images.nubusPortalServer.tag }}
-
-nubusProvisioning:
-  api:
-    image:
-      registry: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.registry }}
-      repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
-      tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
-  dispatcher:
-    image:
-      registry: {{ .Values.images.nubusProvisioningDispatcher.registry }}
-      repository: {{ .Values.images.nubusProvisioningDispatcher.repository }}
-      tag: {{ .Values.images.nubusProvisioningDispatcher.tag }}
-  udmTransformer:
-    image:
-      registry: {{ .Values.images.nubusProvisioningUdmTransformer.registry }}
-      repository: {{ .Values.images.nubusProvisioningUdmTransformer.repository }}
-      tag: {{ .Values.images.nubusProvisioningUdmTransformer.tag }}
-  prefill:
-    image:
-      registry: {{ .Values.images.nubusProvisioningPrefill.registry }}
-      repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
-      tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
-  registerConsumers:
-    image:
-      registry: {{ .Values.images.nubusWaitForDependency.registry }}
-      repository: {{ .Values.images.nubusWaitForDependency.repository }}
-      tag: {{ .Values.images.nubusWaitForDependency.tag }}
-  nats:
-    nats:
-        image:
-            registry: {{ .Values.images.nubusNats.registry }}
-            repository: {{ .Values.images.nubusNats.repository }}
-            tag: {{ .Values.images.nubusNats.tag }}
-    reloader:
-        image:
-            registry: {{ .Values.images.nubusNatsReloader.registry }}
-            repository: {{ .Values.images.nubusNatsReloader.repository }}
-            tag: {{ .Values.images.nubusNatsReloader.tag }}
-    natsBox:
-        image:
-            registry: {{ .Values.images.nubusNatsBox.registry }}
-            repository: {{ .Values.images.nubusNatsBox.repository }}
-            tag: {{ .Values.images.nubusNatsBox.tag }}
-
-nubusProvisioningEventsAndConsumerApi:
-  image:
-    registry: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.registry }}
-    repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
-    tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
-
-nubusProvisioningPrefill:
-  image:
-    registry: {{ .Values.images.nubusProvisioningPrefill.registry }}
-    repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
-    tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
-
-nubusUdmListener:
-  image:
-    registry: {{ .Values.images.nubusProvisioningUdmListener.registry }}
-    repository: {{ .Values.images.nubusProvisioningUdmListener.repository }}
-    tag: {{ .Values.images.nubusProvisioningUdmListener.tag }}
-
-nubusSelfServiceListener:
-  selfserviceListener:
-    image:
-      registry: {{ .Values.images.nubusSelfserviceListener.registry }}
-      repository: {{ .Values.images.nubusSelfserviceListener.repository }}
-      tag: {{ .Values.images.nubusSelfserviceListener.tag }}
-  selfserviceInvitation:
-    image:
-      registry: {{ .Values.images.nubusSelfserviceInvitation.registry }}
-      repository: {{ .Values.images.nubusSelfserviceInvitation.repository }}
-      tag: {{ .Values.images.nubusSelfserviceInvitation.tag }}
-  waitForDependency:
-    image:
-      registry: {{ .Values.images.nubusWaitForDependency.registry }}
-      repository: {{ .Values.images.nubusWaitForDependency.repository }}
-      tag: {{ .Values.images.nubusWaitForDependency.tag }}
-
-nubusUdmRestApi:
-  # oxPlugin:
-  #   image:
-  #     registry: \{\{ .Values.images.nubusUdmRestApiOxPlugin.registry }}
-  #     repository: \{\{ .Values.images.nubusUdmRestApiOxPlugin.repository }}
-  #     tag: \{\{ .Values.images.nubusUdmRestApiOxPlugin.tag }}
-  # portalPlugin:
-  #   image:
-  #     registry: \{\{ .Values.images.nubusUdmRestApiPortalPlugin.registry }}
-  #     repository: \{\{ .Values.images.nubusUdmRestApiPortalPlugin.repository }}
-  #     tag: \{\{ .Values.images.nubusUdmRestApiPortalPlugin.tag }}
-  udmRestApi:
-    image:
-      registry: {{ .Values.images.nubusUdmRestApi.registry }}
-      repository: {{ .Values.images.nubusUdmRestApi.repository }}
-      tag: {{ .Values.images.nubusUdmRestApi.tag }}
-
-nubusUmcGateway:
-  image:
-    registry: {{ .Values.images.nubusUmcGateway.registry }}
-    repository: {{ .Values.images.nubusUmcGateway.repository }}
-    tag: {{ .Values.images.nubusUmcGateway.tag }}
-
-nubusUmcServer:
-  image:
-    registry: {{ .Values.images.nubusUmcServer.registry }}
-    repository: {{ .Values.images.nubusUmcServer.repository }}
-    tag: {{ .Values.images.nubusUmcServer.tag }}
-
-nubusWaitForDependency:
-  image:
-    registry: {{ .Values.images.nubusWaitForDependency.registry }}
-    repository: {{ .Values.images.nubusWaitForDependency.repository }}
-    tag: {{ .Values.images.nubusWaitForDependency.tag }}
-
-
-nubusGuardian:
-  provisioning:
-    image:
-      registry: {{ .Values.images.nubusGuardianProvisioning.registry }}
-      repository: {{ .Values.images.nubusGuardianProvisioning.repository }}
-      tag: {{ .Values.images.nubusGuardianProvisioning.tag }}
-  authorizationApi:
-    image:
-      registry: {{ .Values.images.nubusGuardianAuthorizationApi.registry }}
-      repository: {{ .Values.images.nubusGuardianAuthorizationApi.repository }}
-      tag: {{ .Values.images.nubusGuardianAuthorizationApi.tag }}
-  managementApi:
-    image:
-      registry: {{ .Values.images.nubusGuardianManagementApi.registry }}
-      repository: {{ .Values.images.nubusGuardianManagementApi.repository }}
-      tag: {{ .Values.images.nubusGuardianManagementApi.tag }}
-  managementUi:
-    image:
-      registry: {{ .Values.images.nubusGuardianManagementUi.registry }}
-      repository: {{ .Values.images.nubusGuardianManagementUi.repository }}
-      tag: {{ .Values.images.nubusGuardianManagementUi.tag }}
-  openPolicyAgent:
-    image:
-      registry: {{ .Values.images.nubusOpenPolicyAgent.registry }}
-      repository: {{ .Values.images.nubusOpenPolicyAgent.repository }}
-      tag: {{ .Values.images.nubusOpenPolicyAgent.tag }}
-
-nubusStackDataUms:
-  image:
-    registry: {{ .Values.images.nubusDataLoader.registry }}
-    repository: {{ .Values.images.nubusDataLoader.repository }}
-    tag: {{ .Values.images.nubusDataLoader.tag }}
-
-nubusStackDataSwp:
-  image:
-    registry: {{ .Values.images.nubusDataLoader.registry }}
-    repository: {{ .Values.images.nubusDataLoader.repository }}
-    tag: {{ .Values.images.nubusDataLoader.tag }}

helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl

@@ -23,7 +23,7 @@ dovecot:
     port: 389
     base: "dc=swp-ldap,dc=internal"
     dn: "uid=ldapsearch_dovecot,cn=users,dc=swp-ldap,dc=internal"
-    password: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
+    password: {{ .Values.secrets.univentionManagementStack.ldapSearch.dovecot | quote }}
   oidc:
     enabled: true
     clientID: "opendesk-dovecot"
@@ -31,12 +31,12 @@ dovecot:
     introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
     introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
     usernameAttribute: "opendesk_username"
-  loginTrustedNetworks: {{ join " " .Values.cluster.networking.cidr | quote }}
+  loginTrustedNetworks: {{ .Values.cluster.networking.cidr | quote }}
 
   submission:
     enabled: true
     ssl: "no"
-    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
+    host: "postfix:25"
 
 certificate:
   secretName: {{ .Values.ingress.tls.secretName | quote }}

helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl

@@ -23,7 +23,7 @@ appsuite:
             type: "adminDN"
             adminDN:
               dn: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
-              password: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}
+              password: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
 
     uiSettings:
       # Enterprise contact picker

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -185,7 +185,7 @@ appsuite:
       com.openexchange.oidc.opLogoutEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
       com.openexchange.oidc.opTokenEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
       com.openexchange.oidc.rpRedirectURIAuth: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/appsuite/api/oidc/auth"
-      com.openexchange.oidc.rpRedirectURILogout: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+      com.openexchange.oidc.rpRedirectURILogout: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
       com.openexchange.oidc.rpRedirectURIPostSSOLogout: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/appsuite/api/oidc/logout"
       com.openexchange.oidc.ssoLogout: "true"
       com.openexchange.oidc.startDefaultBackend: "true"
@@ -241,11 +241,6 @@ appsuite:
       com.openexchange.file.storage.nextcloud.oauth.url: "http://opendesk-nextcloud-apache2/"
       com.openexchange.file.storage.nextcloud.oauth.webdav.username.strategy: "user"
       com.openexchange.nextcloud.filepicker.includeAccessToken: "false"
-      # Element integration
-      com.openexchange.conference.element.enabled: "true"
-      com.openexchange.conference.element.meetingHostUrl: http://matrix-neodatefix-bot
-      com.openexchange.conference.element.matrixLoginUrl: http://opendesk-synapse-web:8008/_matrix/client/v3/login
-      com.openexchange.conference.element.matrixUuidClaimName: opendesk_useruuid
       # GDPR
       com.openexchange.gdpr.dataexport.enabled: "false"
       com.openexchange.gdpr.dataexport.active: "false"
@@ -264,7 +259,6 @@ appsuite:
       com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
       com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
       com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
-      com.openexchange.conference.element.authToken: {{ .Values.secrets.oxAppsuite.synapseAsToken | quote }}
     propertiesFiles:
       /opt/open-xchange/etc/AdminDaemon.properties:
         MASTER_ACCOUNT_OVERRIDE: "true"
@@ -275,7 +269,7 @@ appsuite:
       /opt/open-xchange/etc/ldapauth.properties:
         java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/dc=swp-ldap,dc=internal"
         bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
-        bindDNPassword: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}
+        bindDNPassword: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
         bindOnly: "false"
       /opt/open-xchange/etc/antivirus.properties:
         com.openexchange.antivirus.enabled: "true"
@@ -317,7 +311,7 @@ appsuite:
       # io.ox/mail//contactCollectOnMailAccess: "true"
       # Dynamic theme
       io.ox/dynamic-theme//mainColor: {{ .Values.theme.colors.primary | quote }}
-      io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
+      io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
       io.ox/dynamic-theme//topbarBackground: {{ .Values.theme.colors.white | quote }}
       io.ox/dynamic-theme//topbarColor: {{ .Values.theme.colors.black | quote }}
       io.ox/dynamic-theme//listSelected: {{ .Values.theme.colors.primary15 | quote }}
@@ -332,13 +326,12 @@ appsuite:
       oxguardpass: |
         {{ .Values.secrets.oxAppsuite.oxguardMC }}
         {{ .Values.secrets.oxAppsuite.oxguardRC }}
-    redis: &redisConfiguration
+    redis:
       enabled: true
       mode: "standalone"
       hosts:
-        - "redis-master:6379"
+        - "redis-master"
       auth:
-        enabled: true
         password: {{ .Values.secrets.redis.password | quote }}
     image:
       registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreMW.registry | quote }}
@@ -403,7 +396,15 @@ appsuite:
       tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     overrides: {}
-    redis: *redisConfiguration
+    redis:
+      mode: "standalone"
+      hosts:
+        - "redis-master:6379"
+      auth:
+        enabled: true
+        password: {{ .Values.secrets.redis.password | quote }}
+        # Workaround for a bug in 8.23
+        ca: ""
     resources:
       {{ .Values.resources.openxchangeCoreUIMiddleware | toYaml | nindent 6 }}
     updater:
@@ -440,7 +441,6 @@ appsuite:
       registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeDocumentConverter.registry | quote }}
       repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
       tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
-    redis: *redisConfiguration
     resources:
       {{- .Values.resources.openxchangeCoreDocumentConverter | toYaml | nindent 6 }}
     securityContext:
@@ -519,7 +519,6 @@ appsuite:
           endpoint: "."
           accessKey: "."
           secretKey: "."
-    redis: *redisConfiguration
     resources:
       {{- .Values.resources.openxchangeCoreImageConverter | toYaml | nindent 6 }}
     securityContext:
@@ -546,8 +545,7 @@ appsuite:
       - name: {{ . | quote }}
     {{- end }}
     image:
-      registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeGuardUI.registry | quote }}
+      repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGuardUI.registry }}/{{ .Values.images.openxchangeGuardUI.repository }}"
-      repository: {{ .Values.images.openxchangeGuardUI.repository | quote }}
       tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
       pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     resources:

helmfile/apps/openproject/values.yaml.gotmpl

@@ -37,7 +37,7 @@ environment:
   # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
   OPENPROJECT_SEED_LDAP_OPENDESK_HOST: {{ .Values.ldap.host | quote }}
   OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
-  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.nubus.ldapSearch.openproject | quote }}
+  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.univentionManagementStack.ldapSearch.openproject | quote }}
   OPENPROJECT_SEED_LDAP_OPENDESK_SECURITY: "plain_ldap"
   OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,dc=swp-ldap,dc=internal"
   OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "dc=swp-ldap,dc=internal"
@@ -57,18 +57,18 @@ environment:
   OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_USER: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
   OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
   OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
   OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
-  OPENPROJECT_SMTP__USER__NAME: ""
+  OPENPROJECT_SMTP__USER__NAME: {{ .Values.smtp.username | quote }}
-  OPENPROJECT_SMTP__PASSWORD: ""
+  OPENPROJECT_SMTP__PASSWORD: {{ .Values.smtp.password | quote }}
-  OPENPROJECT_SMTP__PORT: 25
+  OPENPROJECT_SMTP__PORT: {{ .Values.smtp.port | quote }}
   OPENPROJECT_SMTP__SSL: "false" # (default=false)
-  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  OPENPROJECT_SMTP__ADDRESS: {{ .Values.smtp.host | quote }}
-  OPENPROJECT_SMTP__AUTHENTICATION: "none"
+  OPENPROJECT_SMTP__AUTHENTICATION: "plain"
-  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "false"
+  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
-  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "none"
+  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
-  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
-  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.nubus .Values.global.domain | quote }}
+  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
   OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
   OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
   {{- if .Values.enterprise.openproject.token }}

helmfile/apps/provisioning/values-oxconnector.yaml.gotmpl

@@ -19,9 +19,9 @@ oxConnector:
   caCert: "ucctempldapstring"
   debugLevel: {{ if .Values.debug.enabled }}"4"{{ else }}"1"{{ end }}
   domainName: {{ .Values.global.domain | quote }}
-  ldapHost: "{{ .Values.ldap.host }}-primary"
+  ldapHost: {{ .Values.ldap.host | quote }}
   logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
-  ldapPassword: {{ .Values.secrets.nubus.ldapSecret | quote }}
+  ldapPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
   ldapBaseDn: "dc=swp-ldap,dc=internal"
   ldapHostDn: "cn=admin,dc=swp-ldap,dc=internal"
   tlsMode: "off"

helmfile/apps/services/helmfile-child.yaml

@@ -57,17 +57,6 @@ repositories:
     url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/\
       {{ .Values.charts.mariadb.repository }}"
 
-  # openDesk dkimpy-milter
-  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter
-  - name: "dkimpy-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.dkimpy.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/\
-      {{ .Values.charts.dkimpy.repository }}"
-
   # openDesk Postfix
   # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
   - name: "postfix-repo"
@@ -189,14 +178,6 @@ releases:
     installed: {{ .Values.postfix.enabled }}
     timeout: 900
 
-  - name: "opendesk-dkimpy-milter"
-    chart: "dkimpy-repo/{{ .Values.charts.dkimpy.name }}"
-    version: "{{ .Values.charts.dkimpy.version }}"
-    values:
-      - "values-dkimpy.yaml.gotmpl"
-    installed: {{ .Values.dkimpy.enabled }}
-    timeout: 900
-
   - name: "clamav"
     chart: "clamav-repo/{{ .Values.charts.clamav.name }}"
     version: "{{ .Values.charts.clamav.version }}"

helmfile/apps/services/values-dkimpy.yaml.gotmpl

@@ -1,44 +0,0 @@
-# SPDX-FileCopyrightText: Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-# SPDX-License-Identifier: Apache-2.0
----
-containerSecurityContext:
-  allowPrivilegeEscalation: true
-  capabilities: {}
-  enabled: true
-  seccompProfile:
-    type: "RuntimeDefault"
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-  runAsUser: 1000
-  runAsGroup: 1000
-  privileged: false
-  seLinuxOptions:
-    {{ .Values.seLinuxOptions.dkimpy | toYaml | nindent 4 }}
-
-global:
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.dkimpy.registry | quote }}
-  repository: {{ .Values.images.dkimpy.repository | quote }}
-  tag: {{ .Values.images.dkimpy.tag | quote }}
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-
-podSecurityContext:
-  enabled: true
-  fsGroup: 1000
-
-configuration:
-  domain: "{{ .Values.global.domain }}{{ if .Values.global.mailDomain }}, {{ .Values.global.mailDomain }}{{ end }}"
-  key:
-    {{ .Values.smtp.dkim.key | toYaml | nindent 4 }}
-  mode: "s"
-  selector: {{ .Values.smtp.dkim.selector }}
-  useED25519: {{ .Values.smtp.dkim.useED25519 }}
-
-replicaCount: {{ .Values.replicas.dkimpy }}
-
-resources:
-  {{ .Values.resources.dkimpy | toYaml | nindent 2 }}
-...

helmfile/apps/services/values-mariadb.yaml.gotmpl

@@ -3,7 +3,6 @@
 ---
 cleanup:
   deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -36,32 +35,19 @@ job:
   retries: 10
   wait: 30
   users:
-    - username: {{ .Values.databases.nextcloud.username | quote }}
-      password: {{ .Values.secrets.mariadb.nextcloudUser | quote}}
-      connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
-    # users for the moment.
-    - username: "openxchange_user"
-    # - username: {{ .Values.databases.xwiki.username | quote }}
-      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
-      connectionLimit: {{ .Values.databases.oxAppsuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
     - username: "xwiki_user"
-    # - username: {{ .Values.databases.oxAppsuite.username | quote }}
       password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
-      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: "openxchange_user"
+      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
+    - username: "nextcloud_user"
+      password: {{ .Values.secrets.mariadb.nextcloudUser | quote}}
   databases:
-    - name: {{ .Values.databases.nextcloud.name | quote }}
-      user: {{ .Values.databases.nextcloud.username | quote }}
-    # OX and XWiki are using the db's `root` users (see `database.yaml`). So we are statically referencing their dedicated
-    # users for the moment.
-    - name: "openxchange"
-      user: "openxchange_user"
-    # - name: {{ .Values.databases.oxAppsuite.name | quote }}
-    #   user: {{ .Values.databases.oxAppsuite.username | quote }}
     - name: "xwiki"
       user: "xwiki_user"
-    # - name: {{ .Values.databases.xwiki.name | quote }}
+    - name: "nextcloud"
-    #   user: {{ .Values.databases.xwiki.username | quote }}
+      user: "nextcloud_user"
+    - name: "openxchange"
+      user: "openxchange_user"
 
 mariadb:
   rootPassword: {{ .Values.secrets.mariadb.rootPassword | quote }}

helmfile/apps/services/values-minio.yaml.gotmpl

@@ -85,8 +85,7 @@ persistence:
 provisioning:
   enabled: true
   cleanupAfterFinished:
-    enabled: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
+    enabled: true
-    seconds: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
   extraCommands:
     - "mc anonymous set download provisioning/ums/portal-assets"
   buckets:
@@ -99,7 +98,7 @@ provisioning:
     - name: {{ .Values.objectstores.openproject.bucket | quote }}
       versioning: true
       withLock: false
-    - name: {{ .Values.objectstores.nubus.bucket | quote }}
+    - name: {{ .Values.objectstores.univentionManagementStack.bucket | quote }}
       versioning: false
       withLock: false
   policies:
@@ -170,7 +169,7 @@ provisioning:
       policies:
         - "openproject-bucket-policy"
       setPolicies: true
-    - username: {{ .Values.objectstores.nubus.username | quote }}
+    - username: {{ .Values.objectstores.univentionManagementStack.username | quote }}
       password: {{ .Values.secrets.minio.umsUser | quote }}
       disabled: false
       policies:

helmfile/apps/services/values-otterize.yaml.gotmpl

@@ -41,7 +41,7 @@ apps:
   redis:
     enabled: {{ .Values.redis.enabled }}
   univentionManagementStack:
-    enabled: {{ .Values.nubus.enabled }}
+    enabled: {{ .Values.univentionManagementStack.enabled }}
   xwiki:
     enabled: {{ .Values.xwiki.enabled }}
 

helmfile/apps/services/values-postfix.yaml.gotmpl

@@ -49,12 +49,9 @@ postfix:
     - fileName: "sasl_passwd.map"
       content:
         - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
-  {{- if .Values.dkimpy.enabled }}
-  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
-  {{- end }}
   rspamdHost: ""
   relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
-  relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
+  relayNets: {{ .Values.cluster.networking.cidr | quote}}
   smtpSASLAuthEnable: "yes"
   smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
   smtpUseTLS: "yes"

helmfile/apps/services/values-postgresql.yaml.gotmpl

@@ -1,10 +1,6 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
-cleanup:
-  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
-
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -21,6 +17,8 @@ containerSecurityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.postgresql | toYaml | nindent 4 }}
 
+job:
+
 podSecurityContext:
   enabled: true
   fsGroup: 1001
@@ -45,43 +43,36 @@ image:
 
 job:
   users:
-    - username: {{ .Values.databases.keycloak.username | quote }}
+    - username: "keycloak_user"
       password: {{ .Values.secrets.postgresql.keycloakUser | quote }}
-      connectionLimit: {{ .Values.databases.keycloak.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: "openproject_user"
-    - username: {{ .Values.databases.openproject.username | quote }}
       password: {{ .Values.secrets.postgresql.openprojectUser | quote }}
-      connectionLimit: {{ .Values.databases.openproject.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: "keycloak_extensions_user"
-    - username: {{ .Values.databases.keycloakExtension.username | quote }}
       password: {{ .Values.secrets.postgresql.keycloakExtensionUser | quote }}
-      connectionLimit: {{ .Values.databases.keycloakExtension.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: "matrix_user"
-    - username: {{ .Values.databases.synapse.username | quote }}
       password: {{ .Values.secrets.postgresql.matrixUser | quote }}
-      connectionLimit: {{ .Values.databases.synapse.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: "notificationsapi_user"
-    - username: {{ .Values.databases.umsNotificationsApi.username | quote }}
       password: {{ .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
-      connectionLimit: {{ .Values.databases.umsNotificationsApi.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: "guardianmanagementapi_user"
-    - username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
       password: {{ .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
-      connectionLimit: {{ .Values.databases.umsGuardianManagementApi.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
+    - username: "selfservice_user"
-    - username: {{ .Values.databases.umsSelfservice.username | quote }}
       password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
-      connectionLimit: {{ .Values.databases.umsSelfservice.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
   databases:
-    - name: {{ .Values.databases.keycloak.name | quote }}
+    - name: "keycloak"
-      user: {{ .Values.databases.keycloak.username | quote }}
+      user: "keycloak_user"
-    - name: {{ .Values.databases.keycloakExtension.name | quote }}
+    - name: "keycloak_extensions"
-      user: {{ .Values.databases.keycloakExtension.username | quote }}
+      user: "keycloak_extensions_user"
-    - name: {{ .Values.databases.openproject.name | quote }}
+    - name: "openproject"
-      user: {{ .Values.databases.openproject.username | quote }}
+      user: "openproject_user"
-    - name: {{ .Values.databases.synapse.name | quote }}
+    - name: "matrix"
-      user: {{ .Values.databases.synapse.username | quote }}
+      user: "matrix_user"
       additionalParams: "ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0"
-    - name: {{ .Values.databases.umsGuardianManagementApi.name | quote }}
+    - name: "guardianmanagementapi"
-      user: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
+      user: "guardianmanagementapi_user"
-    - name: {{ .Values.databases.umsNotificationsApi.name | quote }}
+    - name: "notificationsapi"
-      user: {{ .Values.databases.umsNotificationsApi.username | quote }}
+      user: "notificationsapi_user"
-    - name: {{ .Values.databases.umsSelfservice.name | quote }}
+    - name: "selfservice"
-      user: {{ .Values.databases.umsSelfservice.username | quote }}
+      user: "selfservice_user"
 
 persistence:
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

helmfile/apps/univention-management-stack/helmfile-child.yaml

@@ -3,15 +3,15 @@
 ---
 repositories:
   # Univention Management Stack Umbrella Chart
-  - name: "nubus"
+  - name: "ums"
     keyring: "../../files/gpg-pubkeys/univention-de.gpg"
-    verify: {{ .Values.charts.nubus.verify }}
+    verify: {{ .Values.charts.ums.verify }}
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
     url:
-      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/\
+      "{{ .Values.global.helmRegistry | default .Values.charts.ums.registry }}/\
-      {{ .Values.charts.nubus.repository }}"
+      {{ .Values.charts.ums.repository }}"
   # OpenDesk Keycloak Bootstrap Chart
   - name: "opendesk-keycloak-bootstrap-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
@@ -25,13 +25,11 @@ repositories:
 releases:
   # Univention Management Stack Umbrella Chart
   - name: "ums"
-    chart: "nubus/{{ .Values.charts.nubus.name }}"
+    chart: "ums/{{ .Values.charts.ums.name }}"
-    version: "{{ .Values.charts.nubus.version }}"
+    version: "{{ .Values.charts.ums.version }}"
     values:
-      - "values-nubus.yaml.gotmpl"
+      - "values-umbrella.yaml.gotmpl"
-      - "values-opendesk-customization.yaml.gotmpl"
+    installed: {{ .Values.univentionManagementStack.enabled }}
-      - "values-opendesk-images.yaml.gotmpl"
-    installed: {{ .Values.nubus.enabled }}
     timeout: 900
   # OpenDesk Keycloak Bootstrap Chart
   - name: "opendesk-keycloak-bootstrap"
@@ -41,10 +39,10 @@ releases:
       - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
     needs:
       - "ums"
-    installed: {{ .Values.nubus.enabled }}
+    installed: {{ .Values.univentionManagementStack.enabled }}
     timeout: 900
 
 commonLabels:
   deploy-stage: "component-1"
-  component: "nubus"
+  component: "univention-management-stack"
 ...

helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl

@@ -26,10 +26,6 @@ config:
       {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
     clients:
       {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
-  managed:
-    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
-    # 'guardian-management-api', 'guardian-scripts', 'guardian-ui' clients have been added explicitly for the moment (see further down this file)
-    clients: [ 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
   keycloak:
     adminUser: "kcadmin"
     adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
@@ -43,7 +39,8 @@ config:
     # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
     # to LDAP group membership to ensure a user cannot access an application without the required
     # group membership.
-    # ToDo: Ensure all applications verify the token's signature to ensure it is not tampered.
+    # ToDo:
+    # - Jitsi does currently not care if it gets scopes/claims as long as the user is authenticated.
     clientScopes:
       - name: "read_contacts"
         protocol: "openid-connect"
@@ -464,7 +461,7 @@ config:
         redirectUris:
           - "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*"
           - "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         standardFlowEnabled: true
         directAccessGrantsEnabled: true
         serviceAccountsEnabled: true
@@ -475,7 +472,7 @@ config:
         attributes:
           backchannel.logout.session.required: true
           backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
           - "opendesk-matrix-scope"
       # The following is a temporary OIDC client for matrix, as the OIDC logout still uses "matrix" as client ID.
@@ -491,7 +488,7 @@ config:
         publicClient: false
         authorizationServicesEnabled: false
         attributes:
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         defaultClientScopes: []
         optionalClientScopes: []
       - name: "opendesk-nextcloud"
@@ -501,7 +498,7 @@ config:
         secret: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
         redirectUris:
           - "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         consentRequired: false
         frontchannelLogout: false
         publicClient: false
@@ -509,7 +506,7 @@ config:
         attributes:
           backchannel.logout.session.required: true
           backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/index.php/apps/user_oidc/backchannel-logout/opendesk"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
           - "opendesk-nextcloud-scope"
           - "read_contacts"
@@ -521,7 +518,7 @@ config:
         secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
         redirectUris:
           - "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         consentRequired: false
         frontchannelLogout: false
         publicClient: false
@@ -530,7 +527,7 @@ config:
         attributes:
           backchannel.logout.session.required: true
           backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
           - "opendesk-openproject-scope"
       - name: "opendesk-oxappsuite"
@@ -540,7 +537,7 @@ config:
         secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
         redirectUris:
           - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         consentRequired: false
         frontchannelLogout: false
         publicClient: false
@@ -548,7 +545,7 @@ config:
         attributes:
           backchannel.logout.session.required: true
           backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
           - "opendesk-oxappsuite-scope"
           - "read_contacts"
@@ -560,7 +557,7 @@ config:
         secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
         redirectUris:
           - "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         consentRequired: false
         frontchannelLogout: false
         publicClient: false
@@ -568,19 +565,19 @@ config:
         attributes:
           backchannel.logout.session.required: false
           backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/oidc/authenticator/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
           - "opendesk-xwiki-scope"
       - name: "guardian-management-api"
         clientId: "guardian-management-api"
-        rootUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
         protocol: "openid-connect"
         publicClient: false
         clientAuthenticatorType: "client-secret"
         secret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
         redirectUris:
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/guardian/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
         fullScopeAllowed: true
         standardFlowEnabled: true
         implicitFlowEnabled: false
@@ -685,19 +682,19 @@ config:
       - name: "guardian-scripts"
         clientId: "guardian-scripts"
         description: ""
-        rootUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        adminUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        adminUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
         surrogateAuthRequired: false
         enabled: true
         alwaysDisplayInConsole: false
         clientAuthenticatorType: "client-secret"
         redirectUris:
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/guardian/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/guardian/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
         webOrigins:
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
         bearerOnly: false
         consentRequired: false
         standardFlowEnabled: true
@@ -786,11 +783,11 @@ config:
           - "microprofile-jwt"
       - name: "guardian-ui"
         clientId: "guardian-ui"
-        rootUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        rootUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+        baseUrl: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
         clientAuthenticatorType: "client-secret"
         redirectUris:
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/guardian/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
         standardFlowEnabled: true
         publicClient: true
         implicitFlowEnabled: false

helmfile/apps/xwiki/values.yaml.gotmpl

@@ -55,7 +55,7 @@ customConfigs:
     xwiki.authentication.ldap.port: 389
     ## Authentication to the LDAP server
     xwiki.authentication.ldap.bind_DN: "uid=ldapsearch_xwiki,cn=users,dc=swp-ldap,dc=internal"
-    xwiki.authentication.ldap.bind_pass: {{ .Values.secrets.nubus.ldapSearch.xwiki | quote }}
+    xwiki.authentication.ldap.bind_pass: {{ .Values.secrets.univentionManagementStack.ldapSearch.xwiki | quote }}
     ## Base DN used for searching for users
     xwiki.authentication.ldap.base_DN: "dc=swp-ldap,dc=internal"
     ## Allow short update cycles of the LDAP group cache
@@ -83,8 +83,8 @@ customConfigs:
     # yamllint disable-line rule:line-length
     oidc.userinfoclaims: "xwiki_user_accessibility,xwiki_user_company,xwiki_user_displayHiddenDocuments,xwiki_user_editor,xwiki_user_usertype"
     url.trustedDomains: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-    workplaceServices.navigationEndpoint: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/navigation.json"
+    workplaceServices.navigationEndpoint: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json"
-    workplaceServices.base: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+    workplaceServices.base: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
     workplaceServices.portalSecret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
     openoffice.serverType: "0"
     notifications.emails.live.graceTime: "5"
@@ -129,18 +129,20 @@ postgresql:
   enabled: false
 
 properties:
-  "attachment:xwiki:FlamingoThemes.Iceberg@logo.svg": "data:image/svg+xml;base64,{{ .Values.theme.imagery.logoHeaderSvgB64 }}"
+  "attachment:xwiki:FlamingoThemes.Iceberg@logo.svg": "data:image/svg+xml;base64,{{ .Values.theme.imagery.logoHeaderSvg | b64enc }}"
-  "attachment:xwiki:XWiki.DefaultSkin@icons.xwiki.favicon.svg": "data:image/svg+xml;base64,{{ .Values.theme.imagery.faviconSvgB64 }}"
+  "attachment:xwiki:XWiki.DefaultSkin@icons.xwiki.favicon.svg": "data:image/svg+xml;base64,{{ .Values.theme.imagery.faviconSvg | b64enc }}"
   "attachment:xwiki:XWiki.DefaultSkin@icons.xwiki.favicon16.png": "data:image/png;base64,{{ .Values.theme.imagery.favicon16PngB64 }}"
   "attachment:xwiki:XWiki.DefaultSkin@icons.xwiki.favicon144.png": "data:image/png;base64,{{ .Values.theme.imagery.favicon144PngB64 }}"
   "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.secure": 1
   "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.server": "{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
   "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.port": 443
   ## SMTP settings
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ .Values.smtp.host | quote }}
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.port": 25
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.port": {{ .Values.smtp.port | quote }}
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.properties": "mail.smtp.starttls.enable=false"
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.username": {{ .Values.smtp.username | quote }}
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.password": {{ .Values.smtp.password | quote }}
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.properties": "mail.smtp.starttls.enable=true"
   ## Link LDAP users and users authenticated through OIDC
   "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.addOIDCObject": 1
   "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.OIDCIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"

helmfile/environments/default/charts.yaml

@@ -60,18 +60,6 @@ charts:
     name: "cryptpad"
     version: "0.0.19"
     verify: true
-  dkimpy:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter/opendesk-dkimpy-milter"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["1", "0", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter"
-    name: "opendesk-dkimpy-milter"
-    version: "1.0.0"
-    verify: true
   dovecot:
     # providerCategory: "Platform"
     # providerResponsible: "Open-Xchange"
@@ -90,7 +78,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-element"
-    version: "3.3.2"
+    version: "3.3.0"
     verify: true
   elementWellKnown:
     # providerCategory: "Platform"
@@ -100,7 +88,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-well-known"
-    version: "3.3.2"
+    version: "3.3.0"
     verify: true
   home:
     # providerCategory: "Platform"
@@ -132,7 +120,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-jitsi"
     name: "opendesk-jitsi"
-    version: "1.9.2"
+    version: "1.7.9"
     verify: true
   mariadb:
     # providerCategory: "Platform"
@@ -142,7 +130,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-mariadb"
     name: "mariadb"
-    version: "2.3.1"
+    version: "2.2.1"
     verify: true
   matrixNeoboardWidget:
     # providerCategory: "Platform"
@@ -192,7 +180,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-matrix-user-verification-service"
-    version: "3.3.2"
+    version: "3.3.0"
     verify: true
   memcached:
     # providerCategory: "Community"
@@ -212,7 +200,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
     name: "opendesk-migrations"
-    version: "1.2.2"
+    version: "1.0.1"
     verify: true
   minio:
     # providerCategory: "Community"
@@ -232,7 +220,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud"
-    version: "3.0.0"
+    version: "2.1.0"
     verify: true
   nextcloudManagement:
     # providerCategory: "Platform"
@@ -242,7 +230,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
     name: "opendesk-nextcloud-management"
-    version: "3.0.0"
+    version: "2.1.0"
     verify: true
   nginx:
     # providerCategory: "Community"
@@ -254,20 +242,6 @@ charts:
     name: "nginx"
     version: "15.9.3"
     verify: true
-  nubus:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/charts/nubus"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "19", "3"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus-dev/charts"
-    name: "nubus"
-    version: "0.40.0-pre-jtorres-create-readonly-user"
-    verify: true
   opendeskKeycloakBootstrap:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -276,7 +250,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
     name: "opendesk-keycloak-bootstrap"
-    version: "2.1.1"
+    version: "2.1.0"
     verify: true
   openproject:
     # providerCategory: "Supplier"
@@ -288,7 +262,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
     name: "openproject"
-    version: "7.0.0"
+    version: "5.3.0"
     verify: true
   openprojectBootstrap:
     # providerCategory: "Platform"
@@ -310,7 +284,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
     name: "appsuite-public-sector"
-    version: "2.8.78"
+    version: "2.5.3"
     verify: false
   openXchangeAppSuiteBootstrap:
     # providerCategory: "Platform"
@@ -330,7 +304,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-otterize"
     name: "opendesk-otterize"
-    version: "2.1.0"
+    version: "2.0.1"
     verify: true
   oxConnector:
     # providerCategory: "Supplier"
@@ -352,7 +326,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-postfix"
     name: "postfix"
-    version: "2.3.0"
+    version: "2.0.5"
     verify: true
   postgresql:
     # providerCategory: "Platform"
@@ -362,7 +336,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-postgresql"
     name: "postgresql"
-    version: "2.1.1"
+    version: "2.0.5"
     verify: true
   redis:
     # providerCategory: "Community"
@@ -382,7 +356,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse"
-    version: "3.3.2"
+    version: "3.3.0"
     verify: true
   synapseCreateAccount:
     # providerCategory: "Platform"
@@ -392,7 +366,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse-create-account"
-    version: "3.3.2"
+    version: "3.3.0"
     verify: true
   synapseWeb:
     # providerCategory: "Platform"
@@ -402,7 +376,31 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
     name: "opendesk-synapse-web"
-    version: "3.3.2"
+    version: "3.3.0"
+    verify: true
+  ums:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/charts/ums"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "12", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
+    name: "ums"
+    version: "0.16.0"
+    verify: true
+  umsKeycloakBootstrap:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/charts/keycloak-bootstrap"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "1", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
+    name: "keycloak-bootstrap"
+    version: "0.1.0"
     verify: true
   xwiki:
     # providerCategory: "Supplier"

helmfile/environments/default/cluster.yaml

@@ -15,17 +15,13 @@ cluster:
   networking:
     # Kubernetes internal cluster domain.
     domain: "cluster.local"
-    # Kubernetes cluster network CIDRs.
+    # Kubernetes cluster network CIDR.
-    cidr:
+    cidr: "10.0.0.0/8"
-      - "10.0.0.0/8"
-    # IP addresses or IP ranges of the reverse proxy / load balancer to restrict the requesting source
-    # for defined services.
-    incomingCIDR: []
     # Ingress-gateway IP - only relevant for "NodePort" cluster services.
     # When ingress and egress gateway use different ips, which results that pods can't self-discover their incoming ip,
     # you need to provide the public (load-balanced) ingress gateways ip address.
     ingressGatewayIP: ""
-    # LoadBalancer status field - only relevant for "LoadBalancer" cluster services.
+    # LoadBalancer status fiel - only relevant for "LoadBalancer" cluster services.
     # The IP/DNS of your load-balancer will be fetched for some components from 'status' map of services.
     # Most providers use '.status.loadBalancer.ingress[0].ip' to store public ip. You can modify the chosen field here.
     loadBalancerStatusField: "ip"

helmfile/environments/default/database.yaml

@@ -2,76 +2,62 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 databases:
-  defaults:
-    userConnectionLimit: 100
   keycloak:
     name: "keycloak"
     host: "postgresql"
     port: 5432
     username: "keycloak_user"
     password: ""
-    connectionLimit: ~
   keycloakExtension:
     name: "keycloak_extensions"
     host: "postgresql"
     port: 5432
     username: "keycloak_extensions_user"
     password: ""
-    connectionLimit: ~
   nextcloud:
     name: "nextcloud"
     host: "mariadb"
     port: 3306
     username: "nextcloud_user"
     password: ""
-    connectionLimit: ~
   openproject:
     name: "openproject"
     host: "postgresql"
     port: 5432
     username: "openproject_user"
     password: ""
-    connectionLimit: ~
   oxAppsuite:
-    name: "configdb"
     host: "mariadb"
-    port: 3306
+    name: "configdb"
     username: "root"
     password: ""
-    connectionLimit: ~
   synapse:
-    name: "matrix"
     host: "postgresql"
-    port: 5432
+    name: "matrix"
     username: "matrix_user"
     password: ""
-    connectionLimit: ~
+    port: 5432
   umsGuardianManagementApi:
     name: "guardianmanagementapi"
     host: "postgresql"
     port: 5432
     username: "guardianmanagementapi_user"
     password: ""
-    connectionLimit: ~
   umsNotificationsApi:
     name: "notificationsapi"
     host: "postgresql"
     port: 5432
     username: "notificationsapi_user"
     password: ""
-    connectionLimit: ~
   umsSelfservice:
     name: "selfservice"
     host: "postgresql"
     port: 5432
     username: "selfservice_user"
     password: ""
-    connectionLimit: 10
   xwiki:
     name: "xwiki"
     host: "mariadb"
-    port: 3306
     username: "root"
     password: ""
-    connectionLimit: ~
 ...

helmfile/environments/default/functional.yaml

@@ -13,7 +13,7 @@ functional:
       # Define a list of groups to enable 2FA for.
       # Note: Removing a group from the list will not disable 2FA for the removed group.
       groups:
-        - "Domain Admins"
+      - "Domain Admins"
     oidc:
       # Define additional/custom OIDC clients to be created in the 'opendesk' realm of Keycloak.
       clients: ~
@@ -45,11 +45,11 @@ functional:
         # Ref.: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#versions-retention-obligation
         versions: "auto"
         # yamllint enable rule:line-length
-
+        
   dataProtection:
     matrixPresence:
       # Enable to allow information about the user presence status to be shared.
       # Ref.: https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#presence
       enabled: false
-
+  
 ...

helmfile/environments/default/global.generated.yaml

@@ -3,5 +3,5 @@
 ---
 global:
   systemInformation:
-    releaseVersion: "v0.9.1"
+    releaseVersion: "v0.8.1"
 ...

helmfile/environments/default/global.gotmpl

@@ -40,11 +40,11 @@ global:
     minioApi: "minio"
     minioConsole: "minio-console"
     nextcloud: "fs"
-    nubus: "portal"
     openproject: "project"
     openxchange: "webmail"
     synapse: "matrix"
     synapseFederation: "matrix-federation"
+    univentionManagementStack: "portal"
     whiteboard: "whiteboard"
     xwiki: "wiki"
 

helmfile/environments/default/images.yaml

@@ -20,7 +20,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "24.04.6.1.1@sha256:6237af013065838be27faae69b26feec63de6de8412499285f5379d74fef7387"
+    tag: "24.04.5.2.1@sha256:583f3764661fdce99c5a97019b732db1bed9f9b333d70640ac99a6953c493666"
   cryptpad:
     # providerCategory: "Supplier"
     # providerResponsible: "XWiki"
@@ -30,14 +30,6 @@ images:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/cryptpad"
     tag: "opendesk-20231222@sha256:f4d20d5c38c87b11ed1a1b46ef6a3633d32c6758ebdff8556458f040318fa5e2"
-  dkimpy:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/images/dkimpy-milter"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/images/dkimpy-milter"
-    tag: "1.1.0@sha256:f140c7fc3fd9636addc612edd6e10f6aefa69e34ff637c95ce9036a32e44555f"
   dovecot:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -91,7 +83,7 @@ images:
     # upstreamMirrorStartFrom: ["8922"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jibri"
-    tag: "stable-9646@sha256:30173d35449d78f8958eaf4de77e76c534806db0e49bdbb930f8c81e003e5a3b"
+    tag: "stable-9457-2@sha256:eb079f650649c6336dc93eb30cdc086c0b784f5c3fe80ea3441a1f00ebf073f3"
   jicofo:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -101,7 +93,7 @@ images:
     # upstreamMirrorStartFrom: ["8922"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jicofo"
-    tag: "stable-9646@sha256:c2c72b6e4b6655d8758145f5c4d4201265626b7c3c1a03f41c7dda060ca7165d"
+    tag: "stable-9457-2@sha256:7d3213eea740721755da81ecfd9b500c71c610d04939b26de4434619a66e15e1"
   jitsi:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -111,7 +103,7 @@ images:
     # upstreamMirrorStartFrom: ["8922"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/web"
-    tag: "stable-9646@sha256:04157797558743fa9c478b76d7332a45c6fbfbe4e34d6550f8716dd8526a1c6c"
+    tag: "stable-9457-2@sha256:263e2e52934900547f1496eed965e2d3e01e9b8a251844bacbac49deba97f6b2"
   jitsiKeycloakAdapter:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -121,7 +113,7 @@ images:
     # upstreamMirrorStartFrom: ["2023", "12", "14"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jitsi-keycloak-adapter"
-    tag: "v20240808@sha256:73db5ae9bb617d076b6a877500dbeece38fd15f8ae933ffadbd72d9aa82ad8da"
+    tag: "v20240314@sha256:8abe8209a59c2d646fa3e7136f6a6ea15f3f692106bba92c0e777f8d383edc12"
   jitsiPatchJVB:
     # providerCategory: "Community"
     # providerResponsible: "Nordeck"
@@ -139,7 +131,7 @@ images:
     # upstreamMirrorStartFrom: ["8922"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jvb"
-    tag: "stable-9646@sha256:22dfb237cdda8142dcf2b141c28d40ec8a675dd379dda5e851dac49e43e677b7"
+    tag: "stable-9457-2@sha256:2f10f28463e65a13a260d379c4cce62531d66a94bb8dcf2dbe88cdb4cd01b16c"
   mariadb:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -203,11 +195,9 @@ images:
     # providerResponsible: "openDesk"
     # upstreamRegistry: "https://registry-1.docker.io"
     # upstreamRepository: "bitnami/memcached"
-    # registry: "registry-1.docker.io"
+    registry: "registry-1.docker.io"
-    # repository: "bitnami/memcached"
-    registry: "docker.io"
     repository: "bitnami/memcached"
-    tag: "1.6.29-debian-12-r4"
+    tag: "1.6.21-debian-11-r107@sha256:247ec29efd6030960047a623aef025021154662edf6b6d6e88c97936f164d99d"
   migrations:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -215,7 +205,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
-    tag: "1.2.1@sha256:241561c51dee3ccd4d54cf732020634291f124025946e6be983f850bbf4eb1d3"
+    tag: "1.0.2@sha256:fbe21b4e2a276d2c5d052c1bb52158debfcc146188e654661001d4ff45b1b453"
   milter:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -229,11 +219,9 @@ images:
     # providerResponsible: "openDesk"
     # upstreamRegistry: "https://registry-1.docker.io"
     # upstreamRepository: "bitnami/minio"
-    # registry: "registry-1.docker.io"
+    registry: "registry-1.docker.io"
-    # repository: "bitnami/minio"
-    registry: "docker.io"
     repository: "bitnami/minio"
-    tag: "2024.8.3-debian-12-r1"
+    tag: "2023@sha256:bced4f2f9fc48b755ebb3e1b35e76195a978d4331bf2d0c6699dab412d3c0be7"
   nextcloudApache2:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -241,7 +229,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-apache2"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-apache2"
-    tag: "1.1.24@sha256:c9222da8be7af12c9076b41d1a14e019725afc075e1aaa2b727be21c1bf45f10"
+    tag: "1.1.22@sha256:8bfa92fcfdcb2fee1b3560a623ffb319fcfcc7e5fbcc20d631df747427e88f84"
   nextcloudExporter:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -257,7 +245,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-management"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-management"
-    tag: "1.4.4@sha256:b70c159d6a1827748ca1f8fe0b9fd5b011eaed8719172105e1e9c8b8d776cf97"
+    tag: "1.4.2@sha256:a4c12a624c76b44c8305a768ced33e2b9af9497ff9cfa639045df846d89fbda4"
   nextcloudPHP:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -265,383 +253,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-php"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-php"
-    tag: "1.10.3@sha256:e659ab95d0d3a33d4937354449c12fa46fe2669a866bbf432a9d729bed6d54f7"
+    tag: "1.10.1@sha256:8eb5ac95eaea69e0928e48aa5a121cbf10f359be4679040da8464810e9d799ff"
-  nubusDataLoader:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/data-loader"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "41", "5"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/data-loader"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus-dev/images/data-loader"
-    tag: "0.63.0-pre-jtorres-create-readonly-user-nubus@sha256:82947d98b5c04b9ffa0093429dc33b0f94c602f08b6e595eb1ca28bb4dd160b7"
-  nubusGuardianAuthorizationApi:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://docker.software-univention.de"
-    # upstreamRepository: "guardian-authorization-api-authorization-api"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["1", "0", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-authorization-api-authorization-api"
-    tag: "2.0.0@sha256:5f194f9385aea5a279e25a57352f7b88a6cc4fa90b3bf04c2c97b9ff2bad70a5"
-  nubusGuardianManagementApi:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://docker.software-univention.de"
-    # upstreamRepository: "guardian-management-api-management-api"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["1", "0", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-management-api-management-api"
-    tag: "2.0.0@sha256:61a1ab84efebe2a87d358e8624f8b39073a6071683e7cd77b740a97d464753a2"
-  nubusGuardianManagementUi:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://docker.software-univention.de"
-    # upstreamRepository: "guardian-management-ui-management-ui"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["1", "0", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-management-ui-management-ui"
-    tag: "2.0.0@sha256:57e2503a4772f0ff656e792a98fadef4d41c248218e6c368f76ce82a892478cf"
-  nubusGuardianProvisioning:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/guardian-init"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "3", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-init"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/guardian-init"
-    tag: "0.11.0@sha256:c691aecaf2074a9f1cc6ec5277a70792642bd677f0ff58a6278041b2d99c9d51"
-  nubusKeycloak:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://docker.software-univention.de"
-    # upstreamRepository: "keycloak-keycloak"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+).+$'
-    # upstreamMirrorStartFrom: ["22", "0", "3"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-keycloak"
-    tag: "24.0.3-ucs1@sha256:cc66a1730abdd5abe88ac5cf045b6558f289bf1ae8d077ee884a42d785742f8b"
-  nubusKeycloakBootstrap:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/keycloak-bootstrap"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "1", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-bootstrap"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/keycloak-bootstrap"
-    tag: "0.1.2"
-  nubusKeycloakExtensionHandler:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/keycloak-handler"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "0", "3"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-handler"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/keycloak-handler"
-    tag: "0.10.0@sha256:7aa5bac4821c9226fd74c6a2883f7c24d214b4610d516574866cf933ee1be080"
-  nubusKeycloakExtensionProxy:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/keycloak-proxy"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "0", "3"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-proxy"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/keycloak-proxy"
-    tag: "0.10.0@sha256:a5f6ae65732f7fb9d7ceae11f1c412b109d230e197075d8a8e1d989c87a0309d"
-  nubusLdapNotifier:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/ldap-notifier"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "8", "2"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-notifier"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/ldap-notifier"
-    tag: "0.20.0@sha256:d891fe11075740ff0fe1694b2c5fb72c43ac6d823904af8593e0ab359b9175e0"
-  nubusLdapServer:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/ldap-server"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "8", "2"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/images/temp-nubus-ldap-2.5-upgrade"
-    tag: "1.1.20@sha256:90f46b8817fa05e6e3ac3b2f053911198675805fb82db8240bfa41239d7e7c61"
-  nubusLdapServerDhInitContainer:
-    # providerCategory: 'Community'
-    # providerResponsible: 'Univention'
-    # upstreamRegistry: 'registry-1.docker.io'
-    # upstreamRepository: 'natsio/nats-box'
-    registry: "registry-1.docker.io"
-    repository: "natsio/nats-box"
-    tag: "0.14.2@sha256:c9b8ebaabb2ca4c227feb4f6b856dc72d4775ac3d71f80d2c65aa82303079011"
-  nubusNats:
-    # providerCategory: 'Community'
-    # providerResponsible: 'Univention'
-    # upstreamRegistry: 'registry-1.docker.io'
-    # upstreamRepository: 'library/nats'
-    registry: "registry-1.docker.io"
-    repository: "library/nats"
-    tag: "2.10.10@sha256:fa26beda8a3187ccefa47afcfe9ea6d0e2f40a57c8f64d70bd63c792d7973938"
-  nubusNatsBox:
-    # providerCategory: 'Community'
-    # providerResponsible: 'Univention'
-    # upstreamRegistry: 'registry-1.docker.io'
-    # upstreamRepository: 'natsio/nats-box'
-    registry: "registry-1.docker.io"
-    repository: "natsio/nats-box"
-    tag: "0.14.2@sha256:c9b8ebaabb2ca4c227feb4f6b856dc72d4775ac3d71f80d2c65aa82303079011"
-  nubusNatsReloader:
-    # providerCategory: 'Community'
-    # providerResponsible: 'Univention'
-    # upstreamRegistry: 'registry-1.docker.io'
-    # upstreamRepository: 'natsio/nats-server-config-reloader'
-    registry: "registry-1.docker.io"
-    repository: "natsio/nats-server-config-reloader"
-    tag: "0.14.1@sha256:77dd4c60001ffbf442c6b25592e73b4fca06ea9406c677607192788d80453783"
-  nubusNotificationsApi:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/notifications-api"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "9", "4"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/notifications-api"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/notifications-api"
-    tag: "0.33.0@sha256:0ddb81d4789b2f43b55ded46ff88db4b99a68e7b1006e35877f582aac875c9ad"
-  nubusOpenPolicyAgent:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://docker.software-univention.de"
-    # upstreamRepository: "guardian-authorization-api-opa"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["1", "0", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-authorization-api-opa"
-    tag: "2.0.0@sha256:56a92a08da5addb951a2b2df09974889295ddde8526e93ad40dd973de1052ad4"
-  nubusOxExtension:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/ox-extension"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "10", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/ox-extension"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/ox-extension"
-    tag: "0.11.0"
-  nubusPortalConsumer:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/portal-consumer"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "27", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-consumer"
-    tag: "0.27.0@sha256:e86bf827d1e93b61473a0730492f48f8dbf0d056b79dd9ecde7af1612696b144"
-  nubusPortalExtension:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/portal-extension"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "28", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-extension"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/portal-extension"
-    tag: "0.28.0"
-  nubusPortalFrontend:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/portal-frontend"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "9", "4"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-frontend"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/portal-frontend"
-    tag: "0.33.0@sha256:9cce16009cc478ece11704521347fc4938a3ac5ee4570ac439dd50b08452a3ff"
-  nubusPortalListener:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/portal-listener"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "9", "4"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-listener"
-    tag: "0.24.2@sha256:98306b30c99e190ece6633921d9d54297634b0e4ca58ceaf0794c7050f0b8470"
-  nubusPortalServer:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/portal-server"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "9", "4"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-server"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus-dev/images/portal-server"
-    tag: "0.33.1@sha256:82e9002786a9d1ec524c0f386838ac4ee1fa9a581b66d2e353ea57cc01e26a95"
-  nubusProvisioningDispatcher:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/provisioning-dispatcher"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "14", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-dispatcher"
-    tag: "0.28.3@sha256:79c81b0143e78c7cabb1efd63d47530eac686fba11db57c173abd8ebdd396778"
-  nubusProvisioningEventsAndConsumerApi:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/provisioning-events-and-consumer-api"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "14", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-events-and-consumer-api"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/provisioning-events-and-consumer-api"
-    tag: "0.36.0@sha256:69dd2946e7b05384304eeeca50dea645d20f7658d225e7c532381c3bdf2027ce"
-  nubusProvisioningPrefill:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/provisioning-prefill"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "14", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-prefill"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/provisioning-prefill"
-    tag: "0.36.0@sha256:147406648848c068aacc2cb467633d51c65cddbcaa622c352e5fe5349bf92ce6"
-  nubusProvisioningUdmListener:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/provisioning-udm-listener"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "14", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-listener"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/provisioning-udm-listener"
-    tag: "0.36.0@sha256:8a960db9ff94b3c8a63be1588e47ccc1f62f3071abdce7ee2ef89afbe2674eed"
-  nubusProvisioningUdmTransformer:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/provisioning-udm-transformer"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "14", "0"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-transformer"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/provisioning-udm-transformer"
-    tag: "0.36.0@sha256:8080b55e705391aa2ac9b11db11dc1f984b5626271b2f175bfe26967b857b06d"
-  nubusSelfserviceInvitation:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/selfservice-invitation"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "3", "2"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-invitation"
-    tag: "0.6.4@sha256:3fcc56c2e039a5a503183ec272fea334083079ceb83c8af7283f9be9b4334d71"
-  nubusSelfserviceListener:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/selfservice-listener"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "3", "2"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-listener"
-    tag: "0.6.4@sha256:9605072b60d832ba165d8b7f9b1b7195693e7d5744479af321e4cf242f9ea500"
-  nubusStackGateway:
-    # providerCategory: "Community"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://registry-1.docker.io"
-    # upstreamRepository: "bitnami/nginx"
-    registry: "registry-1.docker.io"
-    repository: "bitnami/nginx"
-    tag: "1.25.4@sha256:dd352b597f4c38ae24abec411710f4249fb5c793293c7ed04737db6b41d32d24"
-  nubusUdmRestApi:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/udm-rest-api"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "9", "3"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/udm-rest-api"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/udm-rest-api"
-    tag: "0.21.0@sha256:f3d189dd0ca619778c907569ddedbdf8772fba26f26cf9e6b8cde2a62618da63"
-  nubusUmcGateway:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/umc-gateway"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "7", "3"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-gateway"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/umc-gateway"
-    tag: "0.27.0@sha256:f0d5831061d9e8c9a47e724d00eeb8902b08f2380d4ca298812e9c1870ff4697"
-  nubusUmcServer:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/umc-server"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "7", "3"]
-    # registry: "registry.opencode.de"
-    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-server"
-    registry: "artifacts.software-univention.de"
-    repository: "nubus/images/umc-server"
-    tag: "0.27.0@sha256:fa552aa595f75d54b216af4390bd5ea3d5385e6a9a5f558804da3aae9f700acf"
-  nubusWaitForDependency:
-    # providerCategory: "Supplier"
-    # providerResponsible: "Univention"
-    # upstreamRegistry: "https://artifacts.software-univention.de"
-    # upstreamRepository: "nubus/images/wait-for-dependency"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
-    # upstreamMirrorStartFrom: ["0", "9", "4"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/wait-for-dependency"
-    tag: "0.25.0@sha256:71a4d66fd67db6f92212b1936862b2b0d5a678d412213d74452a9195c2fe67f7"
   opendeskKeycloakBootstrap:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -649,7 +261,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-keycloak-bootstrap"
-    tag: "1.2.1@sha256:f5ce0be27580c6347c5e700c4fa271a811d45d8a0e4b40ffe8a4d0e3d47e670f"
+    tag: "1.2.0@sha256:3b364c60bedb9ae001c39cbf84e4b4b326b9559078f21bfc993cf0e601196e6f"
   openproject:
     # providerCategory: "Supplier"
     # providerResponsible: "OpenProject"
@@ -659,7 +271,7 @@ images:
     # upstreamMirrorStartFrom: ["13", "1", "1"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "14.4.0@sha256:0c1ee5467b5c7888f38eae88a712c2eec6c96995b85f09e0c27705c09f450a70"
+    tag: "14.2.0@sha256:b4ea55b925de4fc8760ccf30268f0a2d472c4204bd4fc512720e8757489335d6"
   openprojectBootstrap:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -667,7 +279,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-openproject-bootstrap"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/opendesk-openproject-bootstrap"
-    tag: "1.1.4@sha256:2fd97a316114428849aaeef87fb8755274e675830088a93afcafac91bb048d1d"
+    tag: "1.1.3@sha256:401afe66c418fd130088edbed5cc3b4464dc667eb609f194ea68fd30dcbd1e90"
   openprojectInitDb:
     # providerCategory: "Community"
     # providerResponsible: "OpenProject"
@@ -693,7 +305,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "6", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-guidedtours"
-    tag: "8.6.5@sha256:cbdea676267011d5c9ef7764fcd23ef432219b61c4f3949ef11ddfc4920873dd"
+    tag: "8.6.3@sha256:6fb8169cba4beb4bd9039f4ce7ab9b29fc02c4991b283824db949fe2b7be34e2"
   openxchangeCoreMW:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -703,7 +315,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "51"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/middleware-public-sector"
-    tag: "8.26.38@sha256:ff2dcf50a9d9a801357255f7244173fe9835715fd1852a28e3a8ebb7c0634293"
+    tag: "8.23.47@sha256:b721bf41d7f06b328e9235a0561436cb678bc2a1a67202f0fa6e1f55956cc0cc"
   openxchangeCoreUI:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -713,7 +325,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "1"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui"
-    tag: "8.27.4@sha256:d5b99bfc12baaeb5cbfc332c260ecca5308b6b662fe8acc8cd07479c99a1d148"
+    tag: "8.23.2@sha256:0cc07053cbb9d7062a17ef807c6a6942a912748243a6f0c63a892d5cb2953351"
   openxchangeCoreUIMiddleware:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -723,7 +335,7 @@ images:
     # upstreamMirrorStartFrom: ["2", "0", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui-middleware"
-    tag: "2.0.4@sha256:e1d647cca13e7c433a9d643aa1a350197511274b239ead100aa1682ffe2fa116"
+    tag: "2.0.3@sha256:56fe8afe841105f0725674e36afc6f10f22751e3c21a301a6322834383f2d786"
   openxchangeCoreUserGuide:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -733,7 +345,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "799279"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-user-guide"
-    tag: "8.27.1071402@sha256:764108a8dcb28467dadad1cfd98074a8e174209652de2f009d74fea51bb50d65"
+    tag: "8.23.941932@sha256:231b13cb795241513d2f54ee4bc628843ae737b5ecceab758aba3658f03de1bd"
   openxchangeDocumentConverter:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -743,7 +355,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "50"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/documentconverter"
-    tag: "8.27.54@sha256:79080b4b766901977532a18ef38af70234a99cf0bf53900c4df3902f24702eb7"
+    tag: "8.23.43@sha256:aa9bbce833ae018573997fb07dcaf32bb7c5c4c6a7d6331f3d3156fd5b8d53b3"
   openxchangeGotenberg:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -763,7 +375,7 @@ images:
     # upstreamMirrorStartFrom: ["4", "2", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/guard-ui"
-    tag: "8.27.0@sha256:89b81de90a6e7078371d8ea02ab4e1056c512ba515db113daf55b160533f7a73"
+    tag: "8.23.0@sha256:0510458017fa028582515ce18c0b12f91ac9e23f0e94e99ac34fd49b07146c01"
   openxchangeImageConverter:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -773,7 +385,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "50"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/imageconverter"
-    tag: "8.27.55@sha256:f999c8205d83730a064aec13eb98762e1c7354f31f42e0add0136cf15be32dd0"
+    tag: "8.23.43@sha256:ecc77a569f60e1b14f0d77ec93d891200b89d11eb9d7c26f59fa7696343e20e3"
   openxchangeNextcloudIntegrationUI:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -811,7 +423,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/platform-development/images/postfix"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/platform-development/images/postfix"
-    tag: "2.0.0@sha256:5b2432dc09318db172a593bca860887ee9d713b9987db64f8b265f3e08a1d374"
+    tag: "1.0.0@sha256:61e4661a7323101dfb51c85c5a48c345c75436f3f533176f049d2660d711a8a5"
   postgresql:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -875,6 +487,298 @@ images:
     registry: "registry-1.docker.io"
     repository: "rapidfort/haproxy-official"
     tag: "2.6.15-bullseye@sha256:47b6ca4074347788cb414fbf3db35d0c51e9e47af33be46457f95c750540887c"
+  umsDataLoader:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/data-loader"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "41", "5"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/data-loader"
+    tag: "0.45.2@sha256:6e2e054903f361eea5cd54ae6dd3da94380d4a6a11f2628983e2acdbc66d605e"
+  umsGuardianAuthorizationApi:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://docker.software-univention.de"
+    # upstreamRepository: "guardian-authorization-api-authorization-api"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["1", "0", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-authorization-api-authorization-api"
+    tag: "2.0.0@sha256:5f194f9385aea5a279e25a57352f7b88a6cc4fa90b3bf04c2c97b9ff2bad70a5"
+  umsGuardianManagementApi:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://docker.software-univention.de"
+    # upstreamRepository: "guardian-management-api-management-api"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["1", "0", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-management-api-management-api"
+    tag: "2.0.0@sha256:61a1ab84efebe2a87d358e8624f8b39073a6071683e7cd77b740a97d464753a2"
+  umsGuardianManagementUi:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://docker.software-univention.de"
+    # upstreamRepository: "guardian-management-ui-management-ui"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["1", "0", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-management-ui-management-ui"
+    tag: "2.0.0@sha256:57e2503a4772f0ff656e792a98fadef4d41c248218e6c368f76ce82a892478cf"
+  umsGuardianProvisioning:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/guardian-init"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "3", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-init"
+    tag: "0.4.0@sha256:390e20ad73a91ae2ecc33d91d1f21872a46e6af4d4d09095d1ce18a6d4a3635e"
+  umsKeycloak:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://docker.software-univention.de"
+    # upstreamRepository: "keycloak-keycloak"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+).+$'
+    # upstreamMirrorStartFrom: ["22", "0", "3"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-keycloak"
+    tag: "24.0.3-ucs1@sha256:cc66a1730abdd5abe88ac5cf045b6558f289bf1ae8d077ee884a42d785742f8b"
+  umsKeycloakBootstrap:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/keycloak-bootstrap"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "1", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-bootstrap"
+    tag: "0.1.0@sha256:351097e9e7b469f2fc149fe612ec6ad515d5e6b081d7e2785bd926a1d77209d2"
+  umsKeycloakExtensionHandler:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/keycloak-handler"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "0", "3"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-handler"
+    tag: "0.4.0@sha256:7c2728d6fce0fa6e6cc2a3c196294fcb4fcce0dd246b95ad96bd96325776a004"
+  umsKeycloakExtensionProxy:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/keycloak-proxy"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "0", "3"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-proxy"
+    tag: "0.4.0@sha256:d7369d8b9cb177fc19b08452266bf7440b683fd0a15c01baeb5c131db20081bf"
+  umsLdapNotifier:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/ldap-notifier"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "8", "2"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-notifier"
+    tag: "0.10.3@sha256:beb4577e7fdf1e18d3769e62296f210c0651460346dc2325e6cc29f4c671fa71"
+  umsLdapServer:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/ldap-server"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "8", "2"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/ldap-server"
+    tag: "0.10.3@sha256:7742eca27bf1134cf92e6e3571bc2784e2f21a76664fdcab6ae213051db26c05"
+  umsNats:
+    # providerCategory: 'Community'
+    # providerResponsible: 'Univention'
+    # upstreamRegistry: 'registry-1.docker.io'
+    # upstreamRepository: 'library/nats'
+    registry: "registry-1.docker.io"
+    repository: "library/nats"
+    tag: "2.10.10@sha256:fa26beda8a3187ccefa47afcfe9ea6d0e2f40a57c8f64d70bd63c792d7973938"
+  umsNatsBox:
+    # providerCategory: 'Community'
+    # providerResponsible: 'Univention'
+    # upstreamRegistry: 'registry-1.docker.io'
+    # upstreamRepository: 'natsio/nats-box'
+    registry: "registry-1.docker.io"
+    repository: "natsio/nats-box"
+    tag: "0.14.2@sha256:c9b8ebaabb2ca4c227feb4f6b856dc72d4775ac3d71f80d2c65aa82303079011"
+  umsNatsReloader:
+    # providerCategory: 'Community'
+    # providerResponsible: 'Univention'
+    # upstreamRegistry: 'registry-1.docker.io'
+    # upstreamRepository: 'natsio/nats-server-config-reloader'
+    registry: "registry-1.docker.io"
+    repository: "natsio/nats-server-config-reloader"
+    tag: "0.14.1@sha256:77dd4c60001ffbf442c6b25592e73b4fca06ea9406c677607192788d80453783"
+  umsNotificationsApi:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/notifications-api"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "9", "4"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/notifications-api"
+    tag: "0.20.3@sha256:1e32854d6d4413725870fde26a904da83282b3debea82b386c5753223ecc6a59"
+  umsOpenPolicyAgent:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://docker.software-univention.de"
+    # upstreamRepository: "guardian-authorization-api-opa"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["1", "0", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/guardian-authorization-api-opa"
+    tag: "2.0.0@sha256:56a92a08da5addb951a2b2df09974889295ddde8526e93ad40dd973de1052ad4"
+  umsPortalFrontend:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/portal-frontend"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "9", "4"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-frontend"
+    tag: "0.20.3@sha256:4fe6646711efcc07eb4b6e59a57f1d5080cca5f4ec2c960d073e92ecae8be42f"
+  umsPortalListener:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/portal-listener"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "9", "4"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-listener"
+    tag: "0.20.7@sha256:8f158b88e0ceb7a5c79d2ad390f6ce851ce0c5ccb675d08d6b6c37f0b21f6177"
+  umsPortalServer:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/portal-server"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "9", "4"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/portal-server"
+    tag: "0.20.3@sha256:0ec3db74ce9b7c8706d1534b6dcb464eb016a5de94c3b5bfc49215ccb606715c"
+  umsProvisioningDispatcher:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/provisioning-dispatcher"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "14", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-dispatcher"
+    tag: "0.21.3@sha256:29c5f216ab0f8d12c1e77969de6e82046c0d47e1111838fb0a2dcd9950c0175d"
+  umsProvisioningEventsAndConsumerApi:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/provisioning-events-and-consumer-api"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "14", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-events-and-consumer-api"
+    tag: "0.21.3@sha256:4cb498a64dd40c0963ca1ca382213ad5b8a4de5eb57650946d78ac44b359f43f"
+  umsProvisioningPrefill:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/provisioning-prefill"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "14", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-prefill"
+    tag: "0.21.3@sha256:944ff8558d12c59f3490cba68680281c3fa5468fd6fd011fd002befcb9956973"
+  umsProvisioningUdmListener:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/provisioning-udm-listener"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "14", "0"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-listener"
+    tag: "0.21.3@sha256:e1cd42558e44bb72ed5c7798cef711db94df7d10d6895c993ca6412df1d25f02"
+  umsSelfserviceInvitation:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/selfservice-invitation"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "3", "2"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-invitation"
+    tag: "0.4.0@sha256:bd252758576e1733076c78756f04225ebed73d9c48de22440975ef11dd087caf"
+  umsSelfserviceListener:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/selfservice-listener"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "3", "2"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/selfservice-listener"
+    tag: "0.4.0@sha256:0bc0235fd64a19a183f112da73109b54712c2d70fe7fa77c6405beefb7167588"
+  umsStackGateway:
+    # providerCategory: "Community"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "bitnami/nginx"
+    registry: "registry-1.docker.io"
+    repository: "bitnami/nginx"
+    tag: "1.25.4@sha256:dd352b597f4c38ae24abec411710f4249fb5c793293c7ed04737db6b41d32d24"
+  umsUdmRestApi:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/udm-rest-api"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "9", "3"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/udm-rest-api"
+    tag: "0.9.3@sha256:7cf2fec05a4ff8b7085a35a215edbce1eb9456c1ae140af46257e66d5a6cd6f7"
+  umsUmcGateway:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/umc-gateway"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "7", "3"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-gateway"
+    tag: "0.11.6@sha256:5d7c1a9b74409d2d7c42e08ca87b41cda506e43cad49efbc85a4ed6b8e9c6bc8"
+  umsUmcServer:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/umc-server"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "7", "3"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/umc-server"
+    tag: "0.11.8@sha256:38a87524703a1e11fbb3cd3cc9d90d5b719e92329a0e3ea05c50451105d64ac6"
+  umsWaitForDependency:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Univention"
+    # upstreamRegistry: "https://artifacts.software-univention.de"
+    # upstreamRepository: "nubus/images/wait-for-dependency"
+    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
+    # upstreamMirrorStartFrom: ["0", "9", "4"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/univention/images-mirror/wait-for-dependency"
+    tag: "0.20.3@sha256:d1ccba5fe7448c2bda71c8a93f265a42a000e8dc79fd884e7e6ecdf29ad80efc"
   wellKnown:
     # providerCategory: "Community"
     # providerResponsible: "Element"

helmfile/environments/default/objectstores.yaml

@@ -33,7 +33,7 @@ objectstores:
     username: "openproject_user"
     pathStyle: true
     useIamProfile: false
-  nubus:
+  univentionManagementStack:
     bucket: "ums"
     endpoint: ""
     region: "eu-west-1"

helmfile/environments/default/opendesk_main.gotmpl

@@ -6,74 +6,71 @@
 ---
 certificates:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 clamavDistributed:
   enabled: false
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 clamavSimple:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 collabora:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 cryptpad:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
-dkimpy:
-  enabled: false
-  namespace: ~
 dovecot:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 element:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 home:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 intercom:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 jitsi:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 mariadb:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 memcached:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 migrations:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 minio:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 nextcloud:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
-nubus:
-  enabled: true
-  namespace: ~
 openproject:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 oxAppsuite:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 oxConnector:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 postfix:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 postgresql:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 redis:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
+univentionManagementStack:
+  enabled: true
+  namespace: {{ env "NAMESPACE" | quote }}
 xwiki:
   enabled: true
-  namespace: ~
+  namespace: {{ env "NAMESPACE" | quote }}
 ...

helmfile/environments/default/persistence.yaml

@@ -16,7 +16,7 @@ persistence:
     prosody: "1Gi"
     redis: "1Gi"
     synapse: "1Gi"
-    nubus:
+    univentionManagementStack:
       ldapServerData: "1Gi"
       ldapServerShared: "1Gi"
       portalListener: "1Gi"

helmfile/environments/default/replicas.yaml

@@ -1,140 +1,62 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
-# This file contains annotations to (later) generate parts of "docs/scaling.md".
+# Before increasing the replicas of components, please consult the scaling documentation at "docs/scaling.md" to ensure
-# When adding new components in here, do not forget to add them as well to
+# that scaling of the respective component is possible and has the desired effect.
-# `../test/values.yaml.gotmpl` to ensure their linting coverage.
 replicas:
-  # -- component: Antivirus (ClamAV)
+  # clamav-simple
-  # -- scalable: true
-  # -- comment: clamav-simple - supports `ReadWriteOnce` PVCs.
   clamav: 1
-  # -- scalable: true
+  # clamav-distributed
-  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
   clamd: 1
-  # -- scalable: true
-  # -- comment: clamav-distributed - You do not want to scale this service, as it just updates the signature files centrally an should be a singleton.
-  freshclam: 1
-  # -- scalable: true
-  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
-  icap: 1
-  # -- scalable: true
-  # -- comment: clamav-distributed - requires `ReadWriteMany` PVCs.
-  milter: 1
-
-  # -- component: Weboffice (Collabora)
-  # -- scalable: true
   collabora: 1
-
-  # -- component: Pad (CryptPad)
-  # -- scalable: false
   cryptpad: 1
-
-  # -- component: Groupware (OX AppSuite, OX Dovecot etc.)
-  # -- scalable: false
-  # -- comment: Scalable in openDesk Enterprise only
   dovecot: 1
-  # -- scalable: false
-  postfix: 1
-  # -- scalable: true
-  dkimpy: 1
-
-  # -- component: Chat (Element, Synapse)
-  # -- scalable: true
   element: 1
-  # -- scalable: tbd
+  # clamav-distributed
-  matrixNeoBoardWidget: 1
+  freshclam: 1
-  # -- scalable: tbd
+  # clamav-distributed
-  matrixNeoChoiceWidget: 1
+  icap: 1
-  # -- scalable: tbd
-  matrixNeoDateFixBot: 1
-  # -- scalable: tbd
-  matrixNeoDateFixWidget: 1
-  # -- scalable: tbd
-  matrixUserVerificationService: 1
-  # -- scalable: tbd
-  synapse: 1
-  # -- scalable: true
-  synapseWeb: 1
-  # -- scalable: true
-  wellKnown: 1
-
-  # -- component: IAM (Nubus)
-  # -- scalable: true
   intercomService: 1
-  # -- scalable: true
-  keycloak: 1
-  # -- scalable: false
-  # -- comment: Will be removed soon.
-  oxConnector: 1
-  # -- scalable: false
-  # -- comment: Should not be scaled, is an async process.
-  umsKeycloakExtensionsHandler: 1
-  # -- scalable: true
-  umsKeycloakExtensionsProxy: 1
-  # -- scalable: tbd
-  umsLdapNotifier: 1
-  # -- scalable: tbd
-  umsLdapServer: 1
-  # -- scalable: tbd
-  umsNotificationsApi: 1
-  # -- scalable: true
-  umsPortalFrontend: 1
-  # -- scalable: tbd
-  umsPortalListener: 1
-  # -- scalable: true
-  umsPortalServer: 1
-  # -- scalable: tbd
-  umsSelfserviceListener: 1
-  # -- scalable: tbd
-  umsStackGateway: 1
-  # -- scalable: true
-  umsUdmRestApi: 1
-  # -- scalable: tbd
-  umsUmcGateway: 1
-  # -- scalable: tbd
-  umsUmcServer: 1
-
-  # -- component: Video conference (Jitsi)
-  # -- scalable: tbd
   jibri: 1
-  # -- scalable: tbd
   jicofo: 1
-  # -- scalable: tbd
   jitsi: 1
-  # -- scalable: tbd
   jitsiKeycloakAdapter: 1
-  # -- scalable: tbd
   jvb: 1
-
+  keycloak: 1
-  # -- component: Persistence Layer
-  # -- scalable: false
   mariadb: 1
-  # -- scalable: false
+  matrixNeoBoardWidget: 1
+  matrixNeoChoiceWidget: 1
+  matrixNeoDateFixBot: 1
+  matrixNeoDateFixWidget: 1
+  matrixUserVerificationService: 1
   memcached: 1
-  # -- scalable: true
+  # clamav-distributed
+  milter: 1
   minio: 1
-  # -- scalable: false
-  postgres: 1
-  # -- scalable: tbd
-  redis: 1
-
-  # -- component: Filestore (Nextcloud)
-  # -- scalable: true
   nextcloudApache2: 1
-  # -- scalable: true
   nextcloudExporter: 1
-  # -- scalable: true
   nextcloudPHP: 1
-
-  # -- component: Project management (OpenProject)
-  # -- scalable: true
   openprojectWeb: 1
-  # -- scalable: tdb
-  # -- comment: Async process that usually has no need for scaling
   openprojectWorker: 1
-
+  oxConnector: 1
-  # -- component: Knowledge management (XWiki)
+  postfix: 1
-  # -- scalable: false
+  postgres: 1
+  redis: 1
+  synapse: 1
+  synapseWeb: 1
+  umsKeycloakExtensionsHandler: 1
+  umsKeycloakExtensionsProxy: 1
+  umsLdapNotifier: 1
+  umsLdapServer: 1
+  umsNotificationsApi: 1
+  umsPortalFrontend: 1
+  umsPortalListener: 1
+  umsPortalServer: 1
+  umsSelfserviceListener: 1
+  umsStackGateway: 1
+  umsUdmRestApi: 1
+  umsUmcGateway: 1
+  umsUmcServer: 1
+  wellKnown: 1
   xwiki: 1
 ...

helmfile/environments/default/resources.yaml

@@ -25,13 +25,6 @@ resources:
     requests:
       cpu: 0.1
       memory: "512Mi"
-  dkimpy:
-    limits:
-      cpu: 99
-      memory: "256Mi"
-    requests:
-      cpu: 0.1
-      memory: "128Mi"
   dovecot:
     limits:
       cpu: 99
@@ -225,49 +218,6 @@ resources:
     requests:
       cpu: 0.1
       memory: "512Mi"
-  nubusProvisioning:
-    nats:
-      limits:
-        cpu: 288
-        memory: "1Gi"
-      requests:
-        cpu: 0.1
-        memory: "128Mi"
-    dispatcher:
-      limits:
-        cpu: 1
-        memory: "1Gi"
-      requests:
-        cpu: 0.1
-        memory: "64Mi"
-    registerConsumers:
-      limits:
-        cpu: 1
-        memory: "1Gi"
-      requests:
-        cpu: 0.1
-        memory: "64Mi"
-    udmTransformer:
-      limits:
-        cpu: 1
-        memory: "1Gi"
-      requests:
-        cpu: 0.1
-        memory: "64Mi"
-    prefill:
-      limits:
-        cpu: 1
-        memory: "1Gi"
-      requests:
-        cpu: 0.1
-        memory: "64Mi"
-    api:
-      limits:
-        cpu: 1
-        memory: "1Gi"
-      requests:
-        cpu: 0.1
-        memory: "100Mi"
   openproject:
     limits:
       cpu: 99

helmfile/environments/default/secrets.gotmpl

@@ -18,8 +18,7 @@ secrets:
     cookieHashSalt: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "cookie_hash_salt" | sha1sum | quote }}
     shareCryptKey: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "share_crypt_key" | sha1sum | quote }}
     sessiondEncryptionKey: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "sessiond_encryption_key" | sha1sum | quote }}
-    synapseAsToken: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "as_token" | sha1sum | quote }}
+  univentionManagementStack:
-  nubus:
     ldapSecret: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "cn=admin" "ldap" | sha1sum | quote }}
     ldapSearch:
       keycloak: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "nubus" "ldapsearch_keycloak" | sha1sum | quote }}

helmfile/environments/default/selinux.yaml

@@ -11,7 +11,6 @@ seLinuxOptions:
   clamd: ~
   collabora: ~
   cryptpad: ~
-  dkimpy: ~
   dovecot: ~
   element: ~
   freshclam: ~

helmfile/environments/default/smtp.gotmpl

@@ -9,17 +9,4 @@ smtp:
   username: ""
   password: {{ env "SMTP_PASSWORD" | quote }}
   localpartNoReply: "no-reply"
-
-  # For the following settings to have effect `dkimpy.enabled` must be `true`.
-  dkim:
-    key:
-      # DKIM private key as plaintext value.
-      value: ""
-
-      # DKIM private key from existing secret. As a higher precedence than the plain `value`.
-      secret:
-        name: ""
-        key: ""
-    selector: "rsa"
-    useED25519: false
 ...

helmfile/environments/default/theme.gotmpl

@@ -1,53 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-## The theme properties will be used to set the installations color an images.
-## This is currently not supported by most of the components, but we still
-## want to collect and provide the related information based on the attributes
-## defined in this file.
-#
-theme:
-  ## Define texts
-  #
-  texts:
-    productName: "openDesk"
-
-  ## Define colors
-  #
-  colors:
-    # Element, OX AppSuite, Xwiki
-    primary: "#5e27dd"
-    # OX AppSuite
-    primary15: "#e7dffa"
-    # OX AppSuite
-    black: "#000000"
-    # OX AppSuite, Xwiki
-    white: "#ffffff"
-    # OX AppSuite, Xwiki
-    secondaryGreyLight: "#f5f5f5"
-
-    # Not in use yet
-    primary65: "#9673e9"
-    primary35: "#c7b3f3"
-    secondaryBlue: "#52c1ff"
-    secondaryBlueHighcontrast: "#0c3ff3"
-    secondaryRed: "#ff529e"
-    secondaryYellow: "#ffc700"
-    secondaryGreen: "#00ffcd"
-    secondaryGrey: "#adb3bc"
-
-  ## Define imagery
-  #
-  imagery:
-    # Xwiki
-    faviconSvgB64: {{ readFile "./../../files/theme/favicon.svg" | b64enc | quote }}
-    faviconIcoB64: {{ readFile "./../../files/theme/favicon.ico" | b64enc | quote }}
-    favicon16PngB64: {{ readFile "./../../files/theme/favicon16.png" | b64enc | quote }}
-    favicon144PngB64: {{ readFile "./../../files/theme/favicon144.png" | b64enc | quote }}
-    logoHeaderSvgB64: {{ readFile "./../../files/theme/logoHeader.svg" | b64enc | quote }}
-
-    # Portal
-    logoPortalBackgroundSvgB64: {{ readFile "./../../files/theme/logoPortalBackground.svg" | b64enc | quote }}
-    portalCss: {{ readFile "./../../files/theme/portal.css" | b64enc }}
-
-...

helmfile/environments/test/values.yaml.gotmpl

@@ -18,16 +18,16 @@ persistence:
     mariadb: "42Gi"
     matrixNeoDateFixBot: "42Gi"
     minio: "42Gi"
-    nubus:
-      ldapServerData: "42Gi"
-      ldapServerShared: "42Gi"
-      portalListener: "42Gi"
-      selfserviceListener: "42Gi"
     postfix: "42Gi"
     postgresql: "42Gi"
     prosody: "42Gi"
     redis: "42Gi"
     synapse: "42Gi"
+    univentionManagementStack:
+      ldapServerData: "42Gi"
+      ldapServerShared: "42Gi"
+      portalListener: "42Gi"
+      selfserviceListener: "42Gi"
     xwiki: "42Gi"
 ingress:
   ingressClassName: "kyverno"
@@ -35,13 +35,17 @@ ingress:
     enabled: true
     secretName: "kyverno-tls"
 replicas:
+  # clamav-simple
   clamav: 42
+  # clamav-distributed
   clamd: 42
   collabora: 42
   cryptpad: 42
   dovecot: 42
   element: 42
+  # clamav-distributed
   freshclam: 42
+  # clamav-distributed
   icap: 42
   intercomService: 42
   jibri: 42
@@ -57,6 +61,7 @@ replicas:
   matrixNeoDateFixWidget: 42
   matrixUserVerificationService: 42
   memcached: 42
+  # clamav-distributed
   milter: 42
   minio: 42
   nextcloudApache2: 42

helmfile/files/theme/favicon.svg

@@ -1 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg id="b" width="40" height="40" viewBox="0 0 40 40" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg"><defs id="defs59" /><circle id="c" cx="20" cy="20" r="20" fill="#5e27dd" /><path d="m 34.23,19.98 c 0,2.12 -0.41,3.76 -1.2,4.92 -0.81,1.15 -1.84,1.92 -3.07,2.33 -1.25,0.41 -2.68,0.6 -4.29,0.6 H 19.9 v -9.45 h 3.58 v 6.31 h 2.19 c 1.15,0 2.06,-0.09 2.72,-0.25 0.65,-0.18 1.2,-0.6 1.62,-1.29 0.42,-0.67 0.64,-1.73 0.64,-3.18 0,-1.45 -0.21,-2.49 -0.65,-3.16 -0.42,-0.69 -0.97,-1.11 -1.62,-1.29 -0.67,-0.18 -1.57,-0.26 -2.7,-0.26 h -2.15 v -3.11 h 2.15 c 1.61,0 3.04,0.19 4.29,0.6 1.24,0.39 2.26,1.16 3.07,2.33 0.79,1.15 1.2,2.79 1.2,4.89 z" fill="#ffffff" id="path52" /><path d="m 16.38,19.31 c -0.44,-0.88 -1.09,-1.59 -1.96,-2.1 -0.86,-0.53 -1.85,-0.79 -3,-0.79 -1.15,0 -2.14,0.26 -3,0.79 -0.87,0.51 -1.52,1.22 -1.98,2.1 -0.44,0.86 -0.67,1.8 -0.67,2.82 0,1.02 0.23,1.94 0.67,2.82 0.46,0.86 1.11,1.57 1.98,2.1 0.86,0.51 1.85,0.78 3,0.78 1.15,0 2.14,-0.26 3,-0.78 0.86,-0.53 1.52,-1.24 1.96,-2.1 0.46,-0.88 0.69,-1.82 0.69,-2.82 0,-1 -0.23,-1.96 -0.69,-2.82 z m -1.02,5.14 c -0.34,0.71 -0.85,1.29 -1.52,1.73 -0.69,0.44 -1.48,0.67 -2.42,0.67 C 10.48,26.85 9.67,26.62 9,26.18 8.33,25.74 7.82,25.16 7.48,24.45 7.14,23.73 6.97,22.97 6.97,22.14 6.97,21.31 7.15,20.53 7.48,19.83 7.82,19.11 8.33,18.54 9,18.1 c 0.67,-0.44 1.48,-0.65 2.42,-0.65 0.94,0 1.73,0.21 2.42,0.65 0.67,0.44 1.18,1.01 1.52,1.73 0.34,0.71 0.51,1.48 0.51,2.31 0,0.83 -0.18,1.59 -0.51,2.31 z" fill="#ffffff" id="path54" /></svg>

helmfile/shared/migrations.yaml.gotmpl

@@ -15,13 +15,16 @@ cleanup:
   keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 
 migrations:
-  runId: 2
+  runId: 1
-  namespace: {{ .Values.migrations.namespace | default .Release.Namespace | quote }}
+  currentOdRelease: {{ .Values.global.systemInformation.releaseVersion | quote }}
+  namespace: {{ .Values.migrations.namespace | quote }}
   loglevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
   failOnUnexpectedState: true
-  environmentDetails:
+  credentials:
-    {{ .Values | toYaml | nindent 4 }}
+    keycloakAdminUsername: "kcadmin"
-  cleanup: false
+    keycloakAdminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
+  urls:
+    keycloakBase: "http://ums-keycloak.{{ .Values.univentionManagementStack.namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
 
 containerSecurityContext:
   allowPrivilegeEscalation: false

helmfile_generic.yaml

@@ -13,7 +13,7 @@ helmfiles:
       - {{ toYaml .Values | nindent 8 }}
   - path: "helmfile/apps/services/helmfile-child.yaml"
     values: *values
-  - path: "helmfile/apps/nubus/helmfile-child.yaml"
+  - path: "helmfile/apps/univention-management-stack/helmfile-child.yaml"
     values: *values
   - path: "helmfile/apps/intercom-service/helmfile-child.yaml"
     values: *values