chore(release): 0.1.0 [skip ci]

# [0.1.0](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.0.6...v0.1.0) (2023-08-14) ### Bug Fixes * **docs:** Typo ([ee684a7](ee684a7891)) ### Features * **element:** Add element component ([5f0ca92](5f0ca92a05))
fix(docs): Typo
2025-12-06 15:31:38 +01:00 · 2023-08-14 08:36:35 +00:00 · 2023-08-14 08:34:08 +00:00 · 2023-08-14 08:48:42 +02:00 · 2023-08-14 06:44:08 +00:00 · 2023-08-14 06:42:59 +00:00
25 changed files with 391 additions and 99 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -78,6 +78,12 @@ variables:
    options:
      - "yes"
      - "no"
+  DEPLOY_ELEMENT:
+    description: "Enable Element deployment."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
  DEPLOY_KEYCLOAK:
    description: "Enable Keycloak deployment."
    value: "no"
@@ -127,8 +133,7 @@ variables:
      - "yes"
      - "no"
  TESTS_PROJECT_URL:
-    description: "URL of the E2E-test gitlab project API with project ID."
-    value: "gitlab.souvap-univention.de/api/v4/projects/6"
+    description: "URL of the E2E-test Gitlab project API with project ID."
  # please use the following set of variables with normalized names:
  DOMAIN: "${NAMESPACE}.${CLUSTER}.${BASE_DOMAIN}"
  ISTIO_DOMAIN: "${NAMESPACE}.istio.${CLUSTER}.${BASE_DOMAIN}"
@@ -192,7 +197,7 @@ env-cleanup:
 env-start:
  environment:
    name: "${NAMESPACE}"
-    url: "https://portal.${NAMESPACE}.${SWP_DOMAIN}"
+    url: "https://portal.${DOMAIN}"
    on_stop: "env-stop"
  extends: ".deploy-common"
  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
@@ -359,6 +364,18 @@ jitsi-deploy:
  variables:
    COMPONENT: "jitsi"

+element-deploy:
+  stage: "component-deploy-stage-1"
+  extends: ".deploy-common"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $NAMESPACE =~ /.+/ &&
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ELEMENT != "no")
+      when: "always"
+  variables:
+    COMPONENT: "element"
+
 env-stop:
  extends: ".deploy-common"
  environment:
@@ -445,15 +462,18 @@ run-tests:
  image: "registry.souvap-univention.de/souvap/tooling/images/semantic-release-patched:latest"
  except:
    - "tags"
+    - "triggers"
    - "web"

 common-yaml-linter:
  except:
    - "tags"
+    - "triggers"
    - "web"

 reuse-linter:
  allow_failure: false
  except:
    - "tags"
+    - "triggers"
    - "web"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,29 @@
+# [0.1.0](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.0.6...v0.1.0) (2023-08-14)
+
+
+### Bug Fixes
+
+* **docs:** Typo ([ee684a7](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/commit/ee684a78910ce721ea834e9ec2f4222ed37572c6))
+
+
+### Features
+
+* **element:** Add element component ([5f0ca92](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/commit/5f0ca92a058e51a27aa56e35ebcf2048bad88671))
+
+## [0.0.6](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.0.5...v0.0.6) (2023-08-14)
+
+
+### Bug Fixes
+
+* **open-xchange:** Functional mailboxes auth settings update in AppSuite and Dovecot ([53948ea](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/commit/53948eae7648cc9785d2b8a813fc7e40b36aa3aa))
+
+## [0.0.5](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.0.4...v0.0.5) (2023-08-11)
+
+
+### Bug Fixes
+
+* **keycloak:** Improve digest image pinning ([b8a8932](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/commit/b8a8932221ae4d6632c7d1f4a85f46fea01a92e7))
+
 ## [0.0.4](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.0.3...v0.0.4) (2023-08-11)


--- a/README.md
+++ b/README.md
@@ -8,10 +8,7 @@ SPDX-License-Identifier: Apache-2.0

 # Disclaimer August 2023

-The current state of the Sovereign Workplace misses the component
-_Element Starter Edition_ because it is not generally available yet.
-
-Also does the Sovereign Workplace contain components that are going to be
+The current state of the Sovereign Workplace contains components that are going to be
 replaced. Like for example the UCS dev container monolith will be substituted by
 multiple Univention Management Stack containers.

@@ -184,12 +181,13 @@ production deployments. These components are grouped together in the
 subdirectory `/helmfile/apps/services`.

 | Component                   | Name                                | Default | Description                    | Type       |
-|-----------------------------|-------------------------------------|---------|------------------------------|------------|
+|-----------------------------|-------------------------------------|---------|--------------------------------|------------|
 | Certificates                | `certificates.enabled`              | `true`  | TLS certificates               | Eval       |
 | ClamAV (Distributed)        | `clamavDistributed.enabled`         | `false` | Antivirus engine               | Eval       |
 | ClamAV (Simple)             | `clamavSimple.enabled`              | `true`  | Antivirus engine               | Eval       |
 | Collabora                   | `collabora.enabled`                 | `true`  | Weboffice                      | Functional |
 | Dovecot                     | `dovecot.enabled`                   | `true`  | Mail backend                   | Functional |
+| Element                     | `element.enabled`                   | `true`  | Secure communications platform | Functional |
 | Intercom Service            | `intercom.enabled`                  | `true`  | Cross service data exchange    | Functional |
 | Jitsi                       | `jitsi.enabled`                     | `true`  | Videoconferencing              | Functional |
 | Keycloak                    | `keycloak.enabled`                  | `true`  | Identity Provider              | Functional |
@@ -221,6 +219,12 @@ the application to your own database instances.

 | Component   | Name               | Type       | Parameter | Key                                    | Default                    |
 |-------------|--------------------|------------|-----------|----------------------------------------|----------------------------|
+| Element     | Synapse            | PostgreSQL |           |                                        |                            |
+|             |                    |            | Name      | `databases.synapse.name`               | `matrix`                   |
+|             |                    |            | Host      | `databases.synapse.host`               | `postgresql`               |
+|             |                    |            | Port      | `databases.synapse.port`               | `5432`                     |
+|             |                    |            | Username  | `databases.synapse.username`           | `matrix_user`              |
+|             |                    |            | Password  | `databases.synapse.password`           |                            |
 | Keycloak    | Keycloak           | PostgreSQL |           |                                        |                            |
 |             |                    |            | Name      | `databases.keycloak.name`              | `keycloak`                 |
 |             |                    |            | Host      | `databases.keycloak.host`              | `postgresql`               |
@@ -269,10 +273,14 @@ actual scalability of the components (see column `Scales at least to 2`).
 |             | `replicas.milter`      | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
 | Collabora   | `replicas.collabora`   | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
 | Dovecot     | `replicas.dovecot`     | `1`     | :white_check_mark: | :x:                | not tested           |
+| Element     | `replicas.element`     | `2`     | :white_check_mark: | :white_check_mark: | :white_check_mark:   |
+|             | `replicas.synapse`     | `1`     | :white_check_mark: | :x:                | not tested           |
+|             | `replicas.synapseWeb`  | `2`     | :white_check_mark: | :white_check_mark: | :white_check_mark:   |
+|             | `replicas.wellKnown`   | `2`     | :white_check_mark: | :white_check_mark: | :white_check_mark:   |
 | Jitsi       | `replicas.jibri`       | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
 |             | `replicas.jicofo`      | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
 |             | `replicas.jitsi `      | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-|             | `replicas.jvb `        | `1`     | :white_check_mark: | :x:                | tested               |
+|             | `replicas.jvb `        | `1`     | :white_check_mark: | :x:                | :x:                  |
 | Keycloak    | `replicas.keycloak`    | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
 | Nextcloud   | `replicas.nextcloud`   | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
 | OpenProject | `replicas.openproject` | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
--- a/helmfile.yaml
+++ b/helmfile.yaml
@@ -15,6 +15,7 @@ helmfiles:
  - path: "helmfile/apps/nextcloud/helmfile.yaml"
  - path: "helmfile/apps/collabora/helmfile.yaml"
  - path: "helmfile/apps/jitsi/helmfile.yaml"
+  - path: "helmfile/apps/element/helmfile.yaml"
  - path: "helmfile/apps/openproject/helmfile.yaml"
  - path: "helmfile/apps/xwiki/helmfile.yaml"
  - path: "helmfile/apps/provisioning/helmfile.yaml"
--- a/helmfile/apps/element/helmfile.yaml
+++ b/helmfile/apps/element/helmfile.yaml
@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  - name: "sovereign-workplace-element"
+    url: "https://gitlab.souvap-univention.de/api/v4/projects/148/packages/helm/stable"
+
+releases:
+  - name: "sovereign-workplace-element"
+    chart: "sovereign-workplace-element/sovereign-workplace-element"
+    version: "1.1.2"
+    values:
+      - "values-element.gotmpl"
+    condition: "element.enabled"
+
+  - name: "sovereign-workplace-well-known"
+    chart: "sovereign-workplace-element/sovereign-workplace-well-known"
+    version: "1.1.2"
+    values:
+      - "values-well-known.gotmpl"
+    condition: "element.enabled"
+
+  - name: "sovereign-workplace-synapse-web"
+    chart: "sovereign-workplace-element/sovereign-workplace-synapse-web"
+    version: "1.1.2"
+    values:
+      - "values-synapse-web.gotmpl"
+    condition: "element.enabled"
+
+  - name: "sovereign-workplace-synapse"
+    chart: "sovereign-workplace-element/sovereign-workplace-synapse"
+    version: "1.1.2"
+    values:
+      - "values-synapse.gotmpl"
+    condition: "element.enabled"
+
+commonLabels:
+  deploy-stage: "component-1"
+  component: "element"
+
+bases:
+  - "../../bases/environments.yaml"
+...
--- a/helmfile/apps/element/values-element.gotmpl
+++ b/helmfile/apps/element/values-element.gotmpl
@@ -0,0 +1,31 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: "{{ .Values.global.domain }}"
+  registry: "{{ .Values.global.imageRegistry }}"
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: "{{ .Values.global.imageRegistry }}"
+  repository: "{{ .Values.images.element.repository }}"
+  tag: "{{ .Values.images.element.tag }}"
+
+ingress:
+  host: "{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}"
+  enabled: "{{ .Values.ingress.enabled }}"
+  ingressClassName: "{{ .Values.ingress.ingressClassName }}"
+  tls:
+    enabled: "{{ .Values.ingress.tls.enabled }}"
+    secretName: "{{ .Values.ingress.tls.secretName }}"
+
+replicaCount: {{ .Values.replicas.element }}
+
+resources:
+  {{ .Values.resources.element | toYaml | nindent 2 }}
+...
--- a/helmfile/apps/element/values-synapse-web.gotmpl
+++ b/helmfile/apps/element/values-synapse-web.gotmpl
@@ -0,0 +1,31 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: "{{ .Values.global.domain }}"
+  registry: "{{ .Values.global.imageRegistry }}"
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: "{{ .Values.global.imageRegistry }}"
+  repository: "{{ .Values.images.synapseWeb.repository }}"
+  tag: "{{ .Values.images.synapseWeb.tag }}"
+
+ingress:
+  host: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
+  enabled: "{{ .Values.ingress.enabled }}"
+  ingressClassName: "{{ .Values.ingress.ingressClassName }}"
+  tls:
+    enabled: "{{ .Values.ingress.tls.enabled }}"
+    secretName: "{{ .Values.ingress.tls.secretName }}"
+
+replicaCount: {{ .Values.replicas.synapseWeb }}
+
+resources:
+  {{ .Values.resources.synapseWeb | toYaml | nindent 2 }}
+...
--- a/helmfile/apps/element/values-synapse.gotmpl
+++ b/helmfile/apps/element/values-synapse.gotmpl
@@ -0,0 +1,52 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: "{{ .Values.global.domain }}"
+  registry: "{{ .Values.global.imageRegistry }}"
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: "{{ .Values.global.imageRegistry }}"
+  repository: "{{ .Values.images.synapse.repository }}"
+  tag: "{{ .Values.images.synapse.tag }}"
+
+configuration:
+  database:
+    host: "{{ .Values.databases.synapse.host }}"
+    name: "{{ .Values.databases.synapse.name }}"
+    user: "{{ .Values.databases.synapse.username }}"
+    password: "{{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser }}"
+
+  homeserver:
+    oidc:
+      clientSecret: {{ .Values.secrets.keycloak.clientSecret.matrix }}
+      issuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap"
+
+    turn:
+      sharedSecret: {{ .Values.turn.credentials }}
+      servers:
+        {{- if .Values.turn.tls.host }}
+        - server: {{ .Values.turn.tls.host }}
+          port: {{ .Values.turn.tls.port }}
+          transport: {{ .Values.turn.transport }}
+        {{- else if .Values.turn.server.host }}
+        - server: {{ .Values.turn.server.host }}
+          port: {{ .Values.turn.server.port }}
+          transport: {{ .Values.turn.transport }}
+        {{- end }}
+
+persistence:
+  size: "{{ .Values.persistence.size.synapse }}"
+  storageClass: "{{ .Values.persistence.storageClassNames.RWO }}"
+
+replicaCount: {{ .Values.replicas.synapse }}
+
+resources:
+  {{ .Values.resources.synapse | toYaml | nindent 2 }}
+...
--- a/helmfile/apps/element/values-well-known.gotmpl
+++ b/helmfile/apps/element/values-well-known.gotmpl
@@ -0,0 +1,31 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: "{{ .Values.global.domain }}"
+  registry: "{{ .Values.global.imageRegistry }}"
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: "{{ .Values.global.imageRegistry }}"
+  repository: "{{ .Values.images.wellKnown.repository }}"
+  tag: "{{ .Values.images.wellKnown.tag }}"
+
+ingress:
+  host: "{{ .Values.global.domain }}"
+  enabled: "{{ .Values.ingress.enabled }}"
+  ingressClassName: "{{ .Values.ingress.ingressClassName }}"
+  tls:
+    enabled: "{{ .Values.ingress.tls.enabled }}"
+    secretName: "{{ .Values.ingress.tls.secretName }}"
+
+replicaCount: {{ .Values.replicas.wellKnown }}
+
+resources:
+  {{ .Values.resources.wellKnown | toYaml | nindent 2 }}
+...
--- a/helmfile/apps/jitsi/helmfile.yaml
+++ b/helmfile/apps/jitsi/helmfile.yaml
@@ -8,7 +8,7 @@ repositories:
 releases:
  - name: "jitsi"
    chart: "jitsi/sovereign-workplace-jitsi"
-    version: "1.1.0"
+    version: "1.1.3"
    values:
      - "values-jitsi.gotmpl"
    condition: "jitsi.enabled"
--- a/helmfile/apps/jitsi/values-jitsi.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.gotmpl
@@ -17,10 +17,10 @@ image:
  tag: "{{ .Values.images.jitsiKeycloakAdapter.tag }}"

 settings:
-  jwtAppSecret: "{{ .Values.secrets.jitsiPlain.jwtAppSecret }}"
+  jwtAppSecret: "{{ .Values.secrets.jitsi.jwtAppSecret }}"

 jitsi:
-  publicURL: "https://{{ .Values.global.hosts.jitsiPlain }}.{{ .Values.global.domain }}"
+  publicURL: "https://{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
  web:
    replicaCount: {{ .Values.replicas.jitsi }}
    image:
@@ -30,13 +30,13 @@ jitsi:
      enabled: "{{ .Values.ingress.enabled }}"
      ingressClassName: "{{ .Values.ingress.ingressClassName }}"
      hosts:
-        - host: "{{ .Values.global.hosts.jitsiPlain }}.{{ .Values.global.domain }}"
+        - host: "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
          paths:
            - "/"
      tls:
        - secretName: "{{ .Values.ingress.tls.secretName }}"
          hosts:
-            - "{{ .Values.global.hosts.jitsiPlain }}.{{ .Values.global.domain }}"
+            - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
    extraEnvs:
      TURN_ENABLE: "1"
    resources:
@@ -55,7 +55,7 @@ jitsi:
      - name: "JWT_APP_ID"
        value: "myappid"
      - name: "JWT_APP_SECRET"
-        value: "{{ .Values.secrets.jitsiPlain.jwtAppSecret }}"
+        value: "{{ .Values.secrets.jitsi.jwtAppSecret }}"
      - name: TURNS_HOST
        value: "{{ .Values.turn.tls.host }}"
      - name: TURNS_PORT
@@ -79,8 +79,8 @@ jitsi:
      repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jicofo.repository }}"
      tag: "{{ .Values.images.jicofo.tag }}"
    xmpp:
-      password: "{{ .Values.secrets.jitsiPlain.jicofoAuthPassword }}"
-      componentSecret: "{{ .Values.secrets.jitsiPlain.jicofoComponentPassword }}"
+      password: "{{ .Values.secrets.jitsi.jicofoAuthPassword }}"
+      componentSecret: "{{ .Values.secrets.jitsi.jicofoComponentPassword }}"
    resources:
      {{ .Values.resources.jicofo | toYaml | nindent 6 }}
  jvb:
@@ -89,7 +89,7 @@ jitsi:
      repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jvb.repository }}"
      tag: "{{ .Values.images.jvb.tag }}"
    xmpp:
-      password: "{{ .Values.secrets.jitsiPlain.jvbAuthPassword }}"
+      password: "{{ .Values.secrets.jitsi.jvbAuthPassword }}"
    resources:
      {{ .Values.resources.jvb | toYaml | nindent 6 }}
    service:
@@ -100,9 +100,9 @@ jitsi:
      repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jibri.repository }}"
      tag: "{{ .Values.images.jibri.tag }}"
    recorder:
-      password: "{{ .Values.secrets.jitsiPlain.jibriRecorderPassword }}"
+      password: "{{ .Values.secrets.jitsi.jibriRecorderPassword }}"
    xmpp:
-      password: "{{ .Values.secrets.jitsiPlain.jibriXmppPassword }}"
+      password: "{{ .Values.secrets.jitsi.jibriXmppPassword }}"
    resources:
      {{ .Values.resources.jibri | toYaml | nindent 6 }}
  imagePullSecrets:
--- a/helmfile/apps/keycloak/values-extensions.gotmpl
+++ b/helmfile/apps/keycloak/values-extensions.gotmpl
@@ -18,7 +18,11 @@ handler:
  image:
    registry: "{{ .Values.global.imageRegistry }}"
    repository: "{{ .Values.images.keycloakExtensionHandler.repository }}"
+{{- if .Values.images.keycloakExtensionHandler.digest }}
+    sha256: "{{ .Values.images.keycloakExtensionHandler.digest}}"
+{{- else if .Values.images.keycloakExtensionHandler.tag }}
    tag: "{{ .Values.images.keycloakExtensionHandler.tag }}"
+{{- end }}
    imagePullPolicy: "Always"
  appConfig:
    smtpPassword: "{{ .Values.smtp.password }}"
@@ -31,7 +35,11 @@ proxy:
  image:
    registry: "{{ .Values.global.imageRegistry }}"
    repository: "{{ .Values.images.keycloakExtensionProxy.repository }}"
+{{- if .Values.images.keycloakExtensionProxy.digest }}
+    sha256: "{{ .Values.images.keycloakExtensionProxy.digest}}"
+{{- else if .Values.images.keycloakExtensionProxy.tag }}
    tag: "{{ .Values.images.keycloakExtensionProxy.tag }}"
+{{- end }}
    imagePullPolicy: "Always"
  ingress:
    enabled: "{{ .Values.ingress.enabled }}"
--- a/helmfile/apps/keycloak/values-keycloak-idp.yaml
+++ b/helmfile/apps/keycloak/values-keycloak-idp.yaml
@@ -116,9 +116,9 @@ keycloakConfigCli:
            "enabled": true,
            "alwaysDisplayInConsole": false,
            "clientAuthenticatorType": "client-secret",
-            "secret": "$(CLIENT_SECRET_JITSI_PLAIN_PASSWORD)",
+            "secret": "$(CLIENT_SECRET_JITSI_PASSWORD)",
            "redirectUris": [
-              "https://$(JITSI_PLAIN_DOMAIN)/*"
+              "https://$(JITSI_DOMAIN)/*"
            ],
            "webOrigins": [
              "*"
@@ -135,7 +135,7 @@ keycloakConfigCli:
            "frontchannelLogout": true,
            "protocol": "openid-connect",
            "attributes": {
-              "post.logout.redirect.uris": "https://$(JITSI_PLAIN_DOMAIN)/*##https://$(UNIVENTION_CORPORATE_SERVER_DOMAIN)/*"
+              "post.logout.redirect.uris": "https://$(JITSI_DOMAIN)/*##https://$(UNIVENTION_CORPORATE_SERVER_DOMAIN)/*"
            },
            "authenticationFlowBindingOverrides": {},
            "fullScopeAllowed": true,
--- a/helmfile/apps/keycloak/values-keycloak.gotmpl
+++ b/helmfile/apps/keycloak/values-keycloak.gotmpl
@@ -55,8 +55,8 @@ keycloakConfigCli:
      value: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
    - name: "MATRIX_DOMAIN"
      value: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
-    - name: "JITSI_PLAIN_DOMAIN"
-      value: "{{ .Values.global.hosts.jitsiPlain }}.{{ .Values.global.domain }}"
+    - name: "JITSI_DOMAIN"
+      value: "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
    - name: "ELEMENT_DOMAIN"
      value: "{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}"
    - name: "INTERCOM_SERVICE_DOMAIN"
@@ -65,8 +65,8 @@ keycloakConfigCli:
      value: {{ .Values.secrets.keycloak.clientSecret.intercom }}
    - name: "CLIENT_SECRET_MATRIX_PASSWORD"
      value: {{ .Values.secrets.keycloak.clientSecret.matrix }}
-    - name: "CLIENT_SECRET_JITSI_PLAIN_PASSWORD"
-      value: {{ .Values.secrets.keycloak.clientSecret.jitsiPlain }}
+    - name: "CLIENT_SECRET_JITSI_PASSWORD"
+      value: {{ .Values.secrets.keycloak.clientSecret.jitsi }}
    - name: "CLIENT_SECRET_NCOIDC_PASSWORD"
      value: {{ .Values.secrets.keycloak.clientSecret.ncoidc }}
    - name: "CLIENT_SECRET_OPENPROJECT_PASSWORD"
--- a/helmfile/apps/open-xchange/helmfile.yaml
+++ b/helmfile/apps/open-xchange/helmfile.yaml
@@ -13,7 +13,7 @@ repositories:
 releases:
  - name: "dovecot"
    chart: "dovecot/dovecot"
-    version: "1.2.0"
+    version: "1.3.1"
    values:
      - "values-dovecot.yaml"
      - "values-dovecot.gotmpl"
--- a/helmfile/apps/open-xchange/values-openxchange.yaml
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml
@@ -65,6 +65,7 @@ appsuite:
      com.openexchange.capability.smime: "true"
      # Secondary Accounts
      com.openexchange.mail.secondary.authType: "XOAUTH2"
+      com.openexchange.mail.transport.secondary.authType: "xoauth2"
      # Nextcloud integration
      com.openexchange.file.storage.nextcloud.oauth.url: "http://nextcloud/"
      com.openexchange.file.storage.nextcloud.oauth.webdav.username.strategy: "user"
--- a/helmfile/apps/services/helmfile.yaml
+++ b/helmfile/apps/services/helmfile.yaml
@@ -20,7 +20,7 @@ repositories:
 releases:
  - name: "sovereign-workplace-certificates"
    chart: "sovereign-workplace-certificates/sovereign-workplace-certificates"
-    version: "1.2.1"
+    version: "1.2.2"
    values:
      - "values-certificates.gotmpl"
    condition: "certificates.enabled"
--- a/helmfile/environments/default/database.gotmpl
+++ b/helmfile/environments/default/database.gotmpl
@@ -32,6 +32,12 @@ databases:
    name: "CONFIGDB"
    username: "root"
    password: ""
+  synapse:
+    host: "postgresql"
+    name: "matrix"
+    username: "matrix_user"
+    password: ""
+    port: 5432
  xwiki:
    name: "xwiki"
    host: "mariadb"
--- a/helmfile/environments/default/global.gotmpl
+++ b/helmfile/environments/default/global.gotmpl
@@ -12,16 +12,14 @@ global:
  hosts:
    collabora: "collabora"
    dimension: "integration"
-    element: "ucc"
+    element: "chat"
    etherpad: "etherpad"
    intercomService: "ics"
-    jitsi: "av"
-    jitsiPlain: "jitsi"
+    jitsi: "meet"
    keycloak: "id"
    meetingWidgetsBot: "meeting-widgets-bot"
    meetingWidgets: "meeting-widgets"
    newWorkBoardWidget: "whiteboard-widget"
-    moodle: "learn"
    nextcloud: "fs"
    openproject: "project"
    openxchange: "webmail"
--- a/helmfile/environments/default/images.gotmpl
+++ b/helmfile/environments/default/images.gotmpl
@@ -13,6 +13,9 @@ images:
  dovecot:
    repository: "dovecot/dovecot"
    tag: "2.3.20"
+  element:
+    repository: "vectorim/element-web"
+    tag: "v1.11.35"
  freshclam:
    repository: "clamav/clamav"
    tag: "1.1.0_base"
@@ -48,11 +51,11 @@ images:
    repository: "souvap/tooling/images/ansible"
    tag: "4.10.0"
  keycloakExtensionHandler:
-    repository: "souvap/tooling/images/keycloak-extensions/keycloak-handler@sha256"
-    tag: "cdaaab8fb1b658ee2ca45557e76570153bb306c43061db5b5ee0f418c40e2200"
+    repository: "souvap/tooling/images/keycloak-extensions/keycloak-handler"
+    digest: "cdaaab8fb1b658ee2ca45557e76570153bb306c43061db5b5ee0f418c40e2200"
  keycloakExtensionProxy:
-    repository: "souvap/tooling/images/keycloak-extensions/keycloak-proxy@sha256"
-    tag: "15ad665620368178d98721c0bd91744dd9c965c2e470abc3838e353fff530093"
+    repository: "souvap/tooling/images/keycloak-extensions/keycloak-proxy"
+    digest: "15ad665620368178d98721c0bd91744dd9c965c2e470abc3838e353fff530093"
  mariadb:
    repository: "mariadb"
    tag: "10"
@@ -107,9 +110,18 @@ images:
  redis:
    repository: "bitnami/redis"
    tag: "7.0.12-debian-11-r0"
+  synapse:
+    repository: "matrixdotorg/synapse"
+    tag: "v1.87.0"
+  synapseWeb:
+    repository: "library/haproxy"
+    tag: "2.4"
  univentionCorporateServer:
-    repository: "souvap/tooling/images/univention-corporate-server-swp/ucs"
-    tag: "20230806T234258"
+    repository: "souvap/tooling/images/univention-corporate-server-swp/ucs@sha256"
+    tag: "286503f13726399284b49d4521f45fdbed81216875d78e76dcae20e0d8301f65"
+  wellKnown:
+    repository: "library/nginx"
+    tag: "1.23"
  xwiki:
    repository: "xwikisas/swp/xwiki"
    tag: "0.8-mariadb-tomcat"
--- a/helmfile/environments/default/persistence.gotmpl
+++ b/helmfile/environments/default/persistence.gotmpl
@@ -19,6 +19,7 @@ persistence:
    postgresql: "1Gi"
    prosody: "1Gi"
    redis: "1Gi"
+    synapse: "1Gi"
    univentionCorporateServer: "1Gi"
    xwiki: "1Gi"
 ...
--- a/helmfile/environments/default/replicas.gotmpl
+++ b/helmfile/environments/default/replicas.gotmpl
@@ -10,6 +10,7 @@ replicas:
  clamd: 1
  collabora: 1
  dovecot: 1
+  element: 2
  {{/* clamav-distributed */}}
  freshclam: 1
  {{/* clamav-distributed */}}
@@ -25,5 +26,8 @@ replicas:
  nextcloud: 1
  openproject: 1
  postfix: 1
+  synapse: 1
+  synapseWeb: 2
+  wellKnown: 2
  xwiki: 1
 ...
--- a/helmfile/environments/default/resources.gotmpl
+++ b/helmfile/environments/default/resources.gotmpl
@@ -14,17 +14,24 @@ resources:
  dovecot:
    limits:
      cpu: 0.5
-      memory: "0.25Gi"
+      memory: "250Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
+  element:
+    limits:
+      cpu: 1
+      memory: "250Mi"
+    requests:
+      cpu: 0.1
+      memory: "50Mi"
  freshclam:
    limits:
      cpu: 1
      memory: "1Gi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
  icap:
    limits:
      cpu: 2
@@ -35,24 +42,24 @@ resources:
  jibri:
    limits:
      cpu: 1
-      memory: "0.5Gi"
+      memory: "500Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "125Mi"
  jicofo:
    limits:
      cpu: 1
-      memory: "0.5Gi"
+      memory: "500Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
  jitsi:
    limits:
      cpu: 1
-      memory: "0.5Gi"
+      memory: "500Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
  jitsiKeycloakAdapter:
    limits:
      cpu: "100m"
@@ -63,45 +70,45 @@ resources:
  jvb:
    limits:
      cpu: 1
-      memory: "0.5Gi"
+      memory: "500Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
  keycloak:
    limits:
      cpu: 2
      memory: "2Gi"
    requests:
      cpu: 0.1
-      memory: "0.75Gi"
+      memory: "750Mi"
  keycloakExtension:
    limits:
      cpu: 1
-      memory: "0.5Gi"
+      memory: "500Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
  keycloakBootstrap:
    limits:
      cpu: 1
-      memory: "0.5Gi"
+      memory: "500Mi"
    requests:
      cpu: 0.1
-      memory: "0.25Gi"
+      memory: "250Mi"
  keycloakProxy:
    limits:
      cpu: 1
-      memory: "0.5Gi"
+      memory: "500Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
  mariadb:
    limits:
      cpu: 2
      memory: "2Gi"
    requests:
      cpu: 0.1
-      memory: "0.5Gi"
+      memory: "500Mi"
  milter:
    limits:
      cpu: 4
@@ -115,49 +122,63 @@ resources:
      memory: "1Gi"
    requests:
      cpu: 0.1
-      memory: "0.5Gi"
+      memory: "500Mi"
  openproject:
    limits:
      cpu: 2
      memory: "1Gi"
    requests:
      cpu: 0.1
-      memory: "0.25Gi"
+      memory: "250Mi"
  oxConnector:
    limits:
      cpu: 2
      memory: "2Gi"
    requests:
      cpu: 0.1
-      memory: "0.25Gi"
+      memory: "250Mi"
  postfix:
    limits:
      cpu: 0.5
-      memory: "0.25Gi"
+      memory: "250Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
  postgresql:
    limits:
      cpu: 2
      memory: "1Gi"
    requests:
      cpu: 0.1
-      memory: "0.25Gi"
+      memory: "250Mi"
  prosody:
    limits:
      cpu: 1
-      memory: "0.5Gi"
+      memory: "500Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
  redis:
    limits:
      cpu: 1
-      memory: "0.5Gi"
+      memory: "500Mi"
    requests:
      cpu: 0.1
-      memory: "0.1Gi"
+      memory: "100Mi"
+  synapse:
+    limits:
+      cpu: 4
+      memory: "4Gi"
+    requests:
+      cpu: 1
+      memory: "2Gi"
+  synapseWeb:
+    limits:
+      cpu: 1
+      memory: "250Mi"
+    requests:
+      cpu: 0.1
+      memory: "50Mi"
  univentionCorporateServer:
    limits:
      cpu: 2
@@ -165,6 +186,13 @@ resources:
    requests:
      cpu: 0.5
      memory: "1Gi"
+  wellKnown:
+    limits:
+      cpu: 1
+      memory: "250Mi"
+    requests:
+      cpu: 0.1
+      memory: "50Mi"
  xwiki:
    limits:
      cpu: 2
--- a/helmfile/environments/default/secrets.gotmpl
+++ b/helmfile/environments/default/secrets.gotmpl
@@ -40,7 +40,7 @@ secrets:
    clientSecret:
      intercom: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "intercom_client_secret" | sha1sum) }}
      matrix: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "matrix_client_secret" | sha1sum) }}
-      jitsiPlain: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "jitsi_plain_client_secret" | sha1sum) }}
+      jitsi: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "jitsi_plain_client_secret" | sha1sum) }}
      ncoidc: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "ncoidc_client_secret" | sha1sum) }}
      openproject: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "openproject_client_secret" | sha1sum) }}
      xwiki: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "xwiki_client_secret" | sha1sum) }}
@@ -54,17 +54,6 @@ secrets:
    adminPassword: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "collabora" "collabora_admin_user" | sha1sum) }}
  jitsi:
    synapseAsToken: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "as_token" | sha1sum) }}
-    synapseHsToken: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "hs_token" | sha1sum) }}
-    jicofoAuth: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "jicofo_auth" | sha1sum) }}
-    componentAuth: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "component_auth" | sha1sum) }}
-    jvbAuth: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "jvb_auth" | sha1sum) }}
-    jigasiAuth: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "jigasi_auth" | sha1sum) }}
-    jibriUserAuth: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "jibri_user_auth" | sha1sum) }}
-    jibriRecorderAuth: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "jibri_recorder_auth" | sha1sum) }}
-    rageshakeListingPass: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "rageshakeListingPass" | sha1sum) }}
-    conferencemapperSecret: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "conferencemapperSecret" | sha1sum) }}
-    jitsiFeedbackBackend: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jitsi" "jitsiFeedbackBackend" | sha1sum) }}
-  jitsiPlain:
    jwtAppSecret: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jistiStandalone" "jwtAppSecret" | sha1sum) }}
    jibriRecorderPassword: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jistiStandalone" "jibriRecorderPassword" | sha1sum) }}
    jibriXmppPassword: {{ (derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "jistiStandalone" "jibriXmppPassword" | sha1sum) }}
--- a/helmfile/environments/default/workplace.gotmpl
+++ b/helmfile/environments/default/workplace.gotmpl
@@ -15,6 +15,8 @@ collabora:
  enabled: true
 dovecot:
  enabled: true
+element:
+  enabled: true
 intercom:
  enabled: true
 jitsi:
Author	SHA1	Message	Date
Dominik Kaminski	bcee05d537	chore(release): 0.1.0 [skip ci] # [0.1.0](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.0.6...v0.1.0) (2023-08-14) ### Bug Fixes * docs: Typo ([`ee684a7`](`ee684a7891`)) ### Features * element: Add element component ([`5f0ca92`](`5f0ca92a05`))	2023-08-14 08:36:35 +00:00
Thorsten Rossner	ee684a7891	fix(docs): Typo	2023-08-14 08:34:08 +00:00
Dominik Kaminski	5f0ca92a05	feat(element): Add element component	2023-08-14 08:48:42 +02:00
Thorsten Rossner	152b4fb7b5	chore(release): 0.0.6 [skip ci] ## [0.0.6](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.0.5...v0.0.6) (2023-08-14) ### Bug Fixes * open-xchange: Functional mailboxes auth settings update in AppSuite and Dovecot ([`53948ea`](`53948eae76`))	2023-08-14 06:44:08 +00:00
Thorsten Rossner	53948eae76	fix(open-xchange): Functional mailboxes auth settings update in AppSuite and Dovecot	2023-08-14 06:42:59 +00:00
Thorsten Rossner	48a87fb839	chore(release): 0.0.5 [skip ci] ## [0.0.5](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.0.4...v0.0.5) (2023-08-11) ### Bug Fixes * keycloak: Improve digest image pinning ([`b8a8932`](`b8a8932221`))	2023-08-11 09:31:56 +00:00
Thorsten Rossner	b8a8932221	fix(keycloak): Improve digest image pinning	2023-08-11 09:30:37 +00:00