chore(release): 0.2.10 [skip ci]

## [0.2.10](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.9...v0.2.10) (2023-09-06) ### Bug Fixes * **helmfile:** Add imagePullPolicy default env variable ([f988644](f9886448b6)) * **helmfile:** Update images and add jitsi, keycloak to security section in docs ([0eceb85](0eceb85e7d)) * **jitsi:** Update chart to 1.4.2 with improved security and fixed change on each deployment ([1349181](1349181d80)) * **jitsi:** Update jitsi to 1.5.1 and fix prosody image ([ed7e5e4](ed7e5e428e)) * **keycloak:** Improve default security settings ([3b90533](3b90533063)) * **nextcloud:** Fix yamllint disable comment ([4380e78](4380e78981)) * **services:** Disable https redirect in istio to fix cert-manager issues ([1ef4a86](1ef4a861ac)) * **services:** Fix capabilities of postifix ([a6fa846](a6fa846afc)) * **services:** Fix OCI registry address of postgresql, mariadb ([be82243](be82243966))
fix(jitsi): Update jitsi to 1.5.1 and fix prosody image
2025-12-06 07:21:36 +01:00 · 2023-09-06 17:12:09 +00:00 · 2023-09-06 19:09:59 +02:00 · 2023-09-06 07:53:01 +00:00 · 2023-09-05 21:50:31 +02:00 · 2023-09-05 20:31:32 +02:00
50 changed files with 425 additions and 149 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -7,8 +7,10 @@ include:
    file:
      - "ci/common/lint.yml"
      - "ci/release-automation/semantic-release.yml"
-  - project: "souvap/devops/sovereign-workplace-env"
+  - project: "${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
    file: "gitlab/environments.yaml"
+    rules:
+      - if: "$INCLUDE_ENVIRONMENTS_ENABLED != 'false'"

 stages:
  - ".pre"
@@ -20,7 +22,7 @@ stages:
  - "component-deploy-stage-2"
  - "tests"
  - "env-stop"
-  - "generate-release-artefacts"
+  - "generate-release-assets"
  - ".post"

 variables:
@@ -28,7 +30,8 @@ variables:
    description: "The name of namespaces to deploy to."
    value: ""
  CLUSTER:
-    description: "Define which cluster to use. Cluster must be defined in gitlab/environments.yaml of sovereign-workplace-env included above."
+    description: "Define which cluster to use. Cluster must be defined in gitlab/environments.yaml of
+      sovereign-workplace-env included above."
    value: "dev"
  BASE_DOMAIN:
    description: "Define the Cluster Base Domain."
@@ -451,8 +454,8 @@ run-tests:
        -F "variables[components]=\"${COMPONENTS}\"" \
        https://${TESTS_PROJECT_URL}/trigger/pipeline

-generate-release-artefacts:
-  stage: "generate-release-artefacts"
+generate-release-assets:
+  stage: "generate-release-assets"
  image: "registry.souvap-univention.de/souvap/tooling/images/ansible:4.10.0"
  rules:
    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
@@ -460,47 +463,56 @@ generate-release-artefacts:
    - when: "never"
  script:
    - |
-      git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/souvap/devops/generate-deployment-artefacts
-      cd generate-deployment-artefacts
+      # yamllint disable-line rule:line-length
+      git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/bmi/souveraener_arbeitsplatz/tooling/opendesk-asset-generator
+      cd opendesk-asset-generator
      export OPENDESK_DEPLOYMENT_AUTOMATION_PATH=${CI_PROJECT_DIR}
-      ./artefact_generator.py
+      ./opendesk_asset_generator.py
      mv ./build_artefacts ${CI_PROJECT_DIR}
      cd ..
-      rm -rf generate-deployment-artefacts
+      rm -rf opendesk-asset-generator
      ls -l ./build_artefacts
  artifacts:
    paths:
      - "./build_artefacts/chart-index.json"
      - "./build_artefacts/image-index.json"
-  tags:
-    - "docker"
+  tags: []
+
+
+# Declare .environments which is in environments repository and only loaded when INCLUDE_ENVIRONMENTS_ENABLED not false.
+# 'cache' is used because job must contain at least one key, so cache is just a dummy key.
+.environments:
+  cache: {}

 # Overwrite shared settings
 .common-semantic-release:
  image: "registry.souvap-univention.de/souvap/tooling/images/semantic-release-patched:latest"
-  rules:
-    - if: "$CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"
-      when: "never"
-    - when: "always"
+  tags: []

 common-yaml-linter:
  rules:
-    - if: "$CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"
+    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"
      when: "never"
    - when: "always"

 reuse-linter:
  allow_failure: false
  rules:
-    - if: "$CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"
+    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"
      when: "never"
    - when: "always"

+generate-release-version:
+  rules:
+    - if: "$JOB_RELEASE_ENABLED != 'false'"
+      when: "always"
+
 release:
+  dependencies:
+    - "generate-release-assets"
  rules:
    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
      when: "always"
-    - when: "never"
  script:
    - |
      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,105 @@
+## [0.2.10](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.9...v0.2.10) (2023-09-06)
+
+
+### Bug Fixes
+
+* **helmfile:** Add imagePullPolicy default env variable ([f988644](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/f9886448b60bbbd917b5ba04d188401275293eec))
+* **helmfile:** Update images and add jitsi, keycloak to security section in docs ([0eceb85](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/0eceb85e7df7455fa61cb17a854807069fbcf51a))
+* **jitsi:** Update chart to 1.4.2 with improved security and fixed change on each deployment ([1349181](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/1349181d802ccb80d9e48cf50fe39f1505116c8e))
+* **jitsi:** Update jitsi to 1.5.1 and fix prosody image ([ed7e5e4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/ed7e5e428e5d9213a92f97dc03d72fa3e04334c2))
+* **keycloak:** Improve default security settings ([3b90533](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/3b90533063c151a9f3cdc9861a115481f6dc440a))
+* **nextcloud:** Fix yamllint disable comment ([4380e78](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/4380e789814ec2b0458fb2c341c8160ab2743afc))
+* **services:** Disable https redirect in istio to fix cert-manager issues ([1ef4a86](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/1ef4a861acc955e2e85715c62f715a6629ada940))
+* **services:** Fix capabilities of postifix ([a6fa846](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/a6fa846afc9744f2b399c37cc754f878b6b9e90b))
+* **services:** Fix OCI registry address of postgresql, mariadb ([be82243](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/be822439661f766c4db6044fd3581db0cce214bb))
+
+## [0.2.10](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.9...v0.2.10) (2023-09-06)
+
+
+### Bug Fixes
+
+* **helmfile:** Add imagePullPolicy default env variable ([f988644](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/f9886448b60bbbd917b5ba04d188401275293eec))
+* **helmfile:** Update images and add jitsi, keycloak to security section in docs ([0eceb85](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/0eceb85e7df7455fa61cb17a854807069fbcf51a))
+* **jitsi:** Update chart to 1.4.2 with improved security and fixed change on each deployment ([1349181](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/1349181d802ccb80d9e48cf50fe39f1505116c8e))
+* **keycloak:** Improve default security settings ([3b90533](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/3b90533063c151a9f3cdc9861a115481f6dc440a))
+* **nextcloud:** Fix yamllint disable comment ([4380e78](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/4380e789814ec2b0458fb2c341c8160ab2743afc))
+* **services:** Disable https redirect in istio to fix cert-manager issues ([1ef4a86](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/1ef4a861acc955e2e85715c62f715a6629ada940))
+* **services:** Fix capabilities of postifix ([a6fa846](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/a6fa846afc9744f2b399c37cc754f878b6b9e90b))
+* **services:** Fix OCI registry address of postgresql, mariadb ([be82243](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/be822439661f766c4db6044fd3581db0cce214bb))
+
+## [0.2.9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.8...v0.2.9) (2023-09-05)
+
+
+### Bug Fixes
+
+* **collabora:** Add websocket support for NGINX Inc. Ingress ([6e5ef63](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6e5ef639c22aad93fd2d0eb75f7a1ffc00d6cc9a))
+* **docs:** Add security part in README ([ff462ab](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/ff462ab0dc2252cc7b517874f5337427b8d19053))
+* **docs:** Update scaling docs ([63a1e25](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/63a1e2568e8c5ff62081c6e6594d2019c1aa4b74))
+* **helmfile:** Reduce icap resources in default enviroment ([c5ab1b8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/c5ab1b81fecbce46788c50b282ed6d1770124fa5))
+* **helmfile:** Update clamav and nextcloud images in default environment ([4f2a8ae](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/4f2a8aeee4ee6c3d27b1c8a99bad14f603486be5))
+* **nextcloud:** Add support for up to 4G large upload for Ingress NGINX and NGINX Inc. Ingress ([6e68f7f](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6e68f7f28c937319d93f8afe1dbb302012f77233))
+* **nextcloud:** Rename sovereign-workplace-nextcloud-bootstrap to opendesk-nextcloud-bootstrap and use OCI ([cef11ac](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/cef11acbae28510809f9bfa13224dc3a6996207f))
+* **nextcloud:** Use clamav-icap when clamavDistributed is activated ([41d40c9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/41d40c9b731b866da2666fa4ffa8cb6493737112))
+* **services:** Enable security context and use default increased security settings ([9a6d240](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/9a6d2409a697f7e9811a0f4f8d31bb18bac1b926))
+* **services:** Fix image registry templates for postfix ([6321ff5](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6321ff50a00203abbfb7f5822e67a3c0e00d4b01))
+* **services:** Replace image digest by tag ([f758293](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/f7582932412f13b1a087d40459e97cf633b1a97e))
+* **services:** Set readOnlyRootFilesystem to true on master ([5fbf86b](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/5fbf86b6bc7b63c81b3ac07c5e0fa8cd464fdad1))
+* **services:** Update clamav to 4.0.0, redis to 18.0.0, postgresql to 2.0.2, mariadb to 2.0.2 and use OCI registries ([9d78664](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/9d7866480cee889fd3b3003b2eea313a6ed73344))
+
+## [0.2.8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.7...v0.2.8) (2023-08-31)
+
+
+### Bug Fixes
+
+* **open-xchange:** Update images and Helm chart ([39565c7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/39565c7cfd89a8d1c2e645e3ecea28fba703ccc1))
+
+## [0.2.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.6...v0.2.7) (2023-08-30)
+
+
+### Bug Fixes
+
+* **jitsi:** Update Jitsi Helm chart to set the user's display name as default ([387bd87](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/387bd8715c5a1cf54733c6642cf57c6ef9a44316))
+
+## [0.2.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.5...v0.2.6) (2023-08-30)
+
+
+### Bug Fixes
+
+* **ci:** Change path of asset_generator ([6ab4fa0](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6ab4fa078b0bb3939c54f46d6475770fa9901936))
+* **ci:** Include deployment environments ([0f59736](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/0f59736c5dcff905400ae2e1bbf7ae496ffb9b2c))
+* **ci:** Release artefacts ([2a61b5f](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/2a61b5f2a66bf1dc1ad06f7111ef7ecaf9247b39))
+
+## [0.2.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.5...v0.2.6) (2023-08-30)
+
+
+### Bug Fixes
+
+* **ci:** Change path of asset_generator ([6ab4fa0](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6ab4fa078b0bb3939c54f46d6475770fa9901936))
+* **ci:** Include deployment environments ([0f59736](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/0f59736c5dcff905400ae2e1bbf7ae496ffb9b2c))
+* **ci:** Release artefacts ([2a61b5f](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/2a61b5f2a66bf1dc1ad06f7111ef7ecaf9247b39))
+
+## [0.2.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.5...v0.2.6) (2023-08-30)
+
+
+### Bug Fixes
+
+* **ci:** Change path of asset_generator ([6ab4fa0](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6ab4fa078b0bb3939c54f46d6475770fa9901936))
+* **ci:** Release artefacts ([2a61b5f](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/2a61b5f2a66bf1dc1ad06f7111ef7ecaf9247b39))
+
+## [0.2.5](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.2.4...v0.2.5) (2023-08-30)
+
+
+### Bug Fixes
+
+* **xwiki:** Theming and language of central navigation ([3d4d45f](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/commit/3d4d45f7114e6e3bc353b8d6c5fdbcac4cb2460f))
+
+## [0.2.4](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.2.3...v0.2.4) (2023-08-29)
+
+
+### Bug Fixes
+
+* **element:** Apply the global theme to Element ([7f7eae8](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/commit/7f7eae8f99a6d8ad8085ad99c63af27b858ff9b7))
+
 ## [0.2.3](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.2.2...v0.2.3) (2023-08-29)


--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,17 +9,17 @@ Please read the [project's overall CONTRIBUTING.md](https://gitlab.opencode.de/b

 # How to contribute?

-When providing contributes to this project, please adhere to the standards and conventions described in further down in this document. Doing so please feel free to create merge requests.
+When providing contributes to this project, please adhere to the standards and conventions described further down in this document. Doing so please feel free to create merge requests.

 # Standards and conventions

 ## Branching

-We use of [Github flow](https://docs.github.com/en/get-started/quickstart/github-flow).
+We use [Github flow](https://docs.github.com/en/get-started/quickstart/github-flow).

 ## Verified commits

-We only allow verify commits:
+We only allow verified commits:
 - https://docs.gitlab.com/ee/user/project/repository/ssh_signed_commits/
 - https://docs.gitlab.com/ee/user/project/repository/gpg_signed_commits/
 - https://docs.gitlab.com/ee/user/project/repository/x509_signed_commits/
@@ -80,7 +80,7 @@ Due to DVS requirements:
 - we should avoid stand alone Manifests.
 - we do not use Operators and CRDs.

-In order to align the Helm files from various sources into an unified deployment of the SWP we make use of to [Helmfile](https://github.com/helmfile/helmfile).
+In order to align the Helm files from various sources into an unified deployment of the SWP we make use of [Helmfile](https://github.com/helmfile/helmfile).

 ## Tooling

--- a/README.md
+++ b/README.md
@@ -45,6 +45,15 @@ repository please use the [issues within this project](https://gitlab.opencode.d
 If you want to address other topics, please check the section
 ["Rückmeldungen und Beteiligung" of the Infos' project OVERVIEW.md](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung).

+# Releases
+
+All technical releases are created using [Semantic Versioning](https://semver.org/lang/de/).
+
+Gitlab provides an [overview on the releases](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/-/releases) of this project.
+
+The following release artefacts are provided beside the default source code assets:
+- `chart-index.json`: An overview of all Helm charts used by the release.
+- `image-index.json`: An overview of all container images used by the release.
 # Deployment

 **Note for project members:** You can use the project's `dev` K8s cluster to set
@@ -271,30 +280,56 @@ the application to your own database instances.
 ### Scaling

 The Replicas of components can be increased, while we still have to look in the
-actual scalability of the components (see column `Scales at least to 2`).
+actual scalability of the components (see column `Scaling (verified)`).

-| Component   | Name                   | Default | Service            | Scaling            | Scales at least to 2 |
-|-------------|------------------------|---------|--------------------|--------------------|----------------------|
-| ClamAV      | `replicas.clamav`      | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-|             | `replicas.clamd`       | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-|             | `replicas.freshclam`   | `1`     | :white_check_mark: | :x:                | not tested           |
-|             | `replicas.icap`        | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-|             | `replicas.milter`      | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-| Collabora   | `replicas.collabora`   | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-| Dovecot     | `replicas.dovecot`     | `1`     | :white_check_mark: | :x:                | not tested           |
-| Element     | `replicas.element`     | `2`     | :white_check_mark: | :white_check_mark: | :white_check_mark:   |
-|             | `replicas.synapse`     | `1`     | :white_check_mark: | :x:                | not tested           |
-|             | `replicas.synapseWeb`  | `2`     | :white_check_mark: | :white_check_mark: | :white_check_mark:   |
-|             | `replicas.wellKnown`   | `2`     | :white_check_mark: | :white_check_mark: | :white_check_mark:   |
-| Jitsi       | `replicas.jibri`       | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-|             | `replicas.jicofo`      | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-|             | `replicas.jitsi `      | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-|             | `replicas.jvb `        | `1`     | :white_check_mark: | :x:                | :x:                  |
-| Keycloak    | `replicas.keycloak`    | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-| Nextcloud   | `replicas.nextcloud`   | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-| OpenProject | `replicas.openproject` | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
-| Postfix     | `replicas.postfix`     | `1`     | :white_check_mark: | :x:                | not tested           |
-| XWiki       | `replicas.xwiki`       | `1`     | :white_check_mark: | :white_check_mark: | not tested           |
+| Component   | Name                   | Scaling (effective) | Scaling (verified) |
+|-------------|------------------------|:-------------------:|:------------------:|
+| ClamAV      | `replicas.clamav`      | :white_check_mark:  | :white_check_mark: |
+|             | `replicas.clamd`       | :white_check_mark:  | :white_check_mark: |
+|             | `replicas.freshclam`   |         :x:         |        :x:         |
+|             | `replicas.icap`        | :white_check_mark:  | :white_check_mark: |
+|             | `replicas.milter`      | :white_check_mark:  | :white_check_mark: |
+| Collabora   | `replicas.collabora`   | :white_check_mark:  |       :gear:       |
+| Dovecot     | `replicas.dovecot`     |         :x:         |       :gear:       |
+| Element     | `replicas.element`     | :white_check_mark:  | :white_check_mark: |
+|             | `replicas.synapse`     |         :x:         |       :gear:       |
+|             | `replicas.synapseWeb`  | :white_check_mark:  | :white_check_mark: |
+|             | `replicas.wellKnown`   | :white_check_mark:  | :white_check_mark: |
+| Jitsi       | `replicas.jibri`       | :white_check_mark:  |       :gear:       |
+|             | `replicas.jicofo`      | :white_check_mark:  |       :gear:       |
+|             | `replicas.jitsi `      | :white_check_mark:  |       :gear:       |
+|             | `replicas.jvb `        |         :x:         |        :x:         |
+| Keycloak    | `replicas.keycloak`    | :white_check_mark:  |       :gear:       |
+| Nextcloud   | `replicas.nextcloud`   | :white_check_mark:  |       :gear:       |
+| OpenProject | `replicas.openproject` | :white_check_mark:  |       :gear:       |
+| Postfix     | `replicas.postfix`     |         :x:         |       :gear:       |
+| XWiki       | `replicas.xwiki`       | :white_check_mark:  |       :gear:       |
+
+
+## Security
+
+This list gives you an overview of default security settings and if they comply with security standards:
+
+
+| Component  | Process                  |         =          | allowPrivilegeEscalation (`false`) |                                   capabilities (`drop: ALL`)                                   | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
+|------------|--------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
+| ClamAV     | clamd                    | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+|            | freshclam                | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+|            | icap                     | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+|            | milter                   | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+| Jitsi      | jibri                    |        :x:         |         :white_check_mark:         |                                       :x: (`SYS_ADMIN`)                                        |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|            | jicofo                   |        :x:         |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|            | jitsiKeycloakAdapter     | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1993    |    1993    |    -    |
+|            | jvb                      |        :x:         |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|            | prosody                  |        :x:         |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|            | web                      |        :x:         |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+| Keycloak   | keycloak                 |        :x:         |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   1001    |    1001    |  1001   |
+|            | keycloakConfigCli        | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+|            | keycloakExtensionHandler | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|            | keycloakExtensionProxy   | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+| MariaDB    | mariadb                  | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+| Postfix    | postfix                  |        :x:         |         :white_check_mark:         | :x: (`DAC_OVERRIDE`, `FOWNER`, `SETUID`, `SETGID`, `NET_BIND_SERVICE`, `NET_ADMIN`, `NET_RAW`) |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   |
+| PostgreSQL | postgresql               | :white_check_mark: |         :white_check_mark:         |                                       :white_check_mark:                                       |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |


 # Component integration
--- a/helmfile.yaml
+++ b/helmfile.yaml
@@ -32,12 +32,15 @@ environments:
  default:
    values:
      - "helmfile/environments/default/*.gotmpl"
+      - "helmfile/environments/default/*.yaml"
  dev:
    values:
      - "helmfile/environments/default/*.gotmpl"
+      - "helmfile/environments/default/*.yaml"
      - "helmfile/environments/dev/values.yaml"
  prod:
    values:
      - "helmfile/environments/default/*.gotmpl"
+      - "helmfile/environments/default/*.yaml"
      - "helmfile/environments/prod/values.yaml"
 ...
--- a/helmfile/apps/collabora/values.gotmpl
+++ b/helmfile/apps/collabora/values.gotmpl
@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 image:
  repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.collabora.repository }}"
  tag: "{{ .Values.images.collabora.tag }}"
+  pullPolicy: "{{ .Values.global.imagePullPolicy }}"

 imagePullSecrets:
 {{- range .Values.global.imagePullSecrets }}
--- a/helmfile/apps/collabora/values.yaml
+++ b/helmfile/apps/collabora/values.yaml
@@ -26,7 +26,8 @@ ingress:
      http-request track-sc1 url_param(WOPISrc)
      stick match url_param(WOPISrc) if { var(txn.wopisrcconns) -m int gt 0 }
      stick store-request url_param(WOPISrc)
-
+    nginx.org/websocket-services: "collabora"
+    nginx.org/lb-method: "hash $arg_WOPISrc consistent"
 autoscaling:
  enabled: false
 ...
--- a/helmfile/apps/element/helmfile.yaml
+++ b/helmfile/apps/element/helmfile.yaml
@@ -10,28 +10,29 @@ repositories:
 releases:
  - name: "sovereign-workplace-element"
    chart: "sovereign-workplace-element-repo/sovereign-workplace-element"
-    version: "1.1.2"
+    version: "1.3.0"
    values:
      - "values-element.gotmpl"
    condition: "element.enabled"

  - name: "sovereign-workplace-well-known"
    chart: "sovereign-workplace-element-repo/sovereign-workplace-well-known"
-    version: "1.1.2"
+    version: "1.3.0"
    values:
+      - "values-well-known.yaml"
      - "values-well-known.gotmpl"
    condition: "element.enabled"

  - name: "sovereign-workplace-synapse-web"
    chart: "sovereign-workplace-element-repo/sovereign-workplace-synapse-web"
-    version: "1.1.2"
+    version: "1.3.0"
    values:
      - "values-synapse-web.gotmpl"
    condition: "element.enabled"

  - name: "sovereign-workplace-synapse"
    chart: "sovereign-workplace-element-repo/sovereign-workplace-synapse"
-    version: "1.1.2"
+    version: "1.3.0"
    values:
      - "values-synapse.gotmpl"
    condition: "element.enabled"
--- a/helmfile/apps/element/values-element.gotmpl
+++ b/helmfile/apps/element/values-element.gotmpl
@@ -11,7 +11,12 @@ global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

+configuration:
+  additionalConfiguration:
+    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
+
 image:
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.element.repository }}"
  tag: "{{ .Values.images.element.tag }}"
@@ -24,6 +29,9 @@ ingress:
    enabled: "{{ .Values.ingress.tls.enabled }}"
    secretName: "{{ .Values.ingress.tls.secretName }}"

+theme:
+  {{ .Values.theme | toYaml | nindent 2 }}
+
 replicaCount: {{ .Values.replicas.element }}

 resources:
--- a/helmfile/apps/element/values-synapse-web.gotmpl
+++ b/helmfile/apps/element/values-synapse-web.gotmpl
@@ -12,6 +12,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.synapseWeb.repository }}"
  tag: "{{ .Values.images.synapseWeb.tag }}"
--- a/helmfile/apps/element/values-synapse.gotmpl
+++ b/helmfile/apps/element/values-synapse.gotmpl
@@ -12,6 +12,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.synapse.repository }}"
  tag: "{{ .Values.images.synapse.tag }}"
--- a/helmfile/apps/element/values-well-known.gotmpl
+++ b/helmfile/apps/element/values-well-known.gotmpl
@@ -12,6 +12,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.wellKnown.repository }}"
  tag: "{{ .Values.images.wellKnown.tag }}"
--- a/helmfile/apps/element/values-well-known.yaml
+++ b/helmfile/apps/element/values-well-known.yaml
@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+configuration:
+  e2ee:
+    forceDisable: true
+...
--- a/helmfile/apps/intercom-service/values.gotmpl
+++ b/helmfile/apps/intercom-service/values.gotmpl
@@ -29,6 +29,7 @@ ics:
    url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"

 image:
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.intercom.repository }}"
  tag: "{{ .Values.images.intercom.tag }}"
--- a/helmfile/apps/jitsi/helmfile.yaml
+++ b/helmfile/apps/jitsi/helmfile.yaml
@@ -5,12 +5,12 @@ repositories:
  - name: "jitsi-repo"
    oci: true
    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-jitsi" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
+         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-jitsi" }}
 releases:
  - name: "jitsi"
    chart: "jitsi-repo/sovereign-workplace-jitsi"
-    version: "1.3.0"
+    version: "1.5.1"
    values:
      - "values-jitsi.gotmpl"
    condition: "jitsi.enabled"
--- a/helmfile/apps/jitsi/values-jitsi.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.gotmpl
@@ -12,6 +12,7 @@ global:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

 image:
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.jitsiKeycloakAdapter.repository }}"
  tag: "{{ .Values.images.jitsiKeycloakAdapter.tag }}"
@@ -118,6 +119,7 @@ patchJVB:
    staticLoadbalancerIP: "{{ .Values.cluster.networking.ingressGatewayIP }}"
    loadbalancerStatusField: "{{ .Values.cluster.networking.loadBalancerStatusField }}"
  image:
+    imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
    registry: "{{ .Values.global.imageRegistry }}"
    repository: "{{ .Values.images.jitsiPatchJVB.repository }}"
    tag: "{{ .Values.images.jitsiPatchJVB.tag }}"
--- a/helmfile/apps/keycloak-bootstrap/values-bootstrap.gotmpl
+++ b/helmfile/apps/keycloak-bootstrap/values-bootstrap.gotmpl
@@ -19,6 +19,7 @@ image:
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.keycloakBootstrap.repository }}"
  tag: "{{ .Values.images.keycloakBootstrap.tag }}"
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"

 resources:
  {{ .Values.resources.keycloakBootstrap | toYaml | nindent 2 }}
--- a/helmfile/apps/keycloak/values-extensions.gotmpl
+++ b/helmfile/apps/keycloak/values-extensions.gotmpl
@@ -23,7 +23,7 @@ handler:
 {{- else if .Values.images.keycloakExtensionHandler.tag }}
    tag: "{{ .Values.images.keycloakExtensionHandler.tag }}"
 {{- end }}
-    imagePullPolicy: "Always"
+    imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  appConfig:
    smtpPassword: "{{ .Values.smtp.password }}"
    smtpHost: "{{ .Values.smtp.host }}"
@@ -40,13 +40,10 @@ proxy:
 {{- else if .Values.images.keycloakExtensionProxy.tag }}
    tag: "{{ .Values.images.keycloakExtensionProxy.tag }}"
 {{- end }}
-    imagePullPolicy: "Always"
+    imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  ingress:
    enabled: "{{ .Values.ingress.enabled }}"
    ingressClassName: "{{ .Values.ingress.ingressClassName }}"
-    annotations:
-      nginx.org/proxy-buffer-size: "8k"
-      nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
    host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
    tls:
      enabled: "{{ .Values.ingress.tls.enabled }}"
--- a/helmfile/apps/keycloak/values-extensions.yaml
+++ b/helmfile/apps/keycloak/values-extensions.yaml
@@ -11,11 +11,35 @@ global:
 handler:
  appConfig:
    captchaProtectionEnable: "False"
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    runAsNonRoot: true

 postgresql:
  enabled: false

 proxy:
-  image:
-    tag: "latest"
+  ingress:
+    annotations:
+      nginx.org/proxy-buffer-size: "8k"
+      nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    runAsNonRoot: true
 ...
--- a/helmfile/apps/keycloak/values-keycloak.gotmpl
+++ b/helmfile/apps/keycloak/values-keycloak.gotmpl
@@ -14,6 +14,7 @@ image:
  repository: "{{ .Values.images.keycloak.repository }}"
  tag: "{{ .Values.images.keycloak.tag }}"
  digest: "{{ .Values.images.keycloak.digest }}"
+  pullPolicy: "{{ .Values.global.imagePullPolicy }}"

 externalDatabase:
  host: "{{ .Values.databases.keycloak.host }}"
@@ -81,6 +82,8 @@ keycloakConfigCli:
      value: {{ .Values.secrets.univentionCorporateServer.ldapSearch.keycloak }}
    - name: "LDAPSEARCH_USERNAME"
      value: "ldapsearch_keycloak"
+  resources:
+    {{ .Values.resources.keycloak | toYaml | nindent 4 }}

 resources:
  {{ .Values.resources.keycloak | toYaml | nindent 2 }}
--- a/helmfile/apps/keycloak/values-keycloak.yaml
+++ b/helmfile/apps/keycloak/values-keycloak.yaml
@@ -54,5 +54,32 @@ keycloakConfigCli:
    - "--import.var-substitution.enabled=true"
  cache:
    enabled: false
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsUser: 1001
+    runAsGroup: 1001
+    runAsNonRoot: true

+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 1001
+  runAsGroup: 1001
+  runAsNonRoot: true
+
+podSecurityContext:
+  fsGroup: 1001
+  fsGroupChangePolicy: "OnRootMismatch"
 ...
--- a/helmfile/apps/nextcloud/helmfile.yaml
+++ b/helmfile/apps/nextcloud/helmfile.yaml
@@ -2,19 +2,22 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
-  - name: "sovereign-workplace-nextcloud-bootstrap-repo"
+  - name: "opendesk-nextcloud-bootstrap-repo"
+    oci: true
+    # yamllint disable rule:line-length
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/130/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
+         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-nextcloud-bootstrap" }}
+    # yamllint enable rule:line-length
  - name: "nextcloud-repo"
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
         default "https://nextcloud.github.io/helm/" }}

 releases:
-  - name: "sovereign-workplace-nextcloud-bootstrap"
-    chart: "sovereign-workplace-nextcloud-bootstrap-repo/sovereign-workplace-nextcloud-bootstrap"
-    version: "2.3.0"
+  - name: "opendesk-nextcloud-bootstrap"
+    chart: "opendesk-nextcloud-bootstrap-repo/opendesk-nextcloud-bootstrap"
+    version: "3.0.0"
    wait: true
    waitForJobs: true
    values:
@@ -27,7 +30,7 @@ releases:
    chart: "nextcloud-repo/nextcloud"
    version: "3.5.19"
    needs:
-      - "sovereign-workplace-nextcloud-bootstrap"
+      - "opendesk-nextcloud-bootstrap"
    values:
      - "values-nextcloud.gotmpl"
      - "values-nextcloud.yaml"
--- a/helmfile/apps/nextcloud/values-bootstrap.gotmpl
+++ b/helmfile/apps/nextcloud/values-bootstrap.gotmpl
@@ -18,7 +18,7 @@ config:

  antivirus:
    {{- if .Values.clamavDistributed.enabled }}
-    host: "clamav-sovereign-workplace-icap"
+    host: "clamav-icap"
    {{- else if .Values.clamavSimple.enabled }}
    host: "clamav-simple"
    {{- end }}
@@ -44,6 +44,7 @@ config:
    password: "{{ .Values.smtp.password }}"

 image:
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.nextcloud.repository }}"
  tag: "{{ .Values.images.nextcloud.tag }}"
--- a/helmfile/apps/nextcloud/values-nextcloud.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.gotmpl
@@ -25,7 +25,7 @@ ingress:
        - "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
 image:
  repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.nextcloud.repository }}"
-  pullPolicy: "Always"
+  pullPolicy: "{{ .Values.global.imagePullPolicy }}"
  tag: "{{ .Values.images.nextcloud.tag }}"
  pullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml
@@ -21,6 +21,11 @@ cronjob:
        sed -i "s/\*\/5 \* \* \* \* php -f \/var\/www\/html\/cron.php/\*\/1 \* \* \* \* php -f
        \/var\/www\/html\/cron.php/g" /var/spool/cron/crontabs/www-data

+ingress:
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "4G"
+    nginx.org/client-max-body-size: "4G"
+
 internalDatabase:
  enabled: false
 postgresql:
--- a/helmfile/apps/open-xchange/helmfile.yaml
+++ b/helmfile/apps/open-xchange/helmfile.yaml
@@ -26,7 +26,7 @@ releases:
    condition: "dovecot.enabled"
  - name: "open-xchange"
    chart: "openxchange-repo/appsuite-public-sector/charts/appsuite-public-sector"
-    version: "1.2.13"
+    version: "2.0.3"
    values:
      - "values-openxchange.yaml"
      - "values-openxchange.gotmpl"
--- a/helmfile/apps/open-xchange/values-dovecot.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.gotmpl
@@ -7,6 +7,7 @@ image:
  registry: "{{ .Values.global.imageRegistry }}"
  url: "{{ .Values.images.dovecot.repository }}"
  digest: "{{ .Values.images.dovecot.digest }}"
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"

 imagePullSecrets:
 {{- range .Values.global.imagePullSecrets }}
--- a/helmfile/apps/open-xchange/values-openxchange-bootstrap.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-bootstrap.gotmpl
@@ -7,6 +7,7 @@ image:
  registry: "{{ .Values.global.imageRegistry }}"
  url: "{{ .Values.images.openxchangeBootstrap.repository }}"
  digest: "{{ .Values.images.openxchangeBootstrap.digest }}"
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"

 imagePullSecrets:
 {{- range .Values.global.imagePullSecrets }}
--- a/helmfile/apps/open-xchange/values-openxchange.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.gotmpl
@@ -34,6 +34,7 @@ public-sector-ui:
  {{- range .Values.global.imagePullSecrets }}
    - name: {{ . }}
  {{- end }}
+  pullPolicy: "{{ .Values.global.imagePullPolicy }}"

 appsuite:
  istio:
@@ -96,6 +97,7 @@ appsuite:
    image:
      repository: {{ .Values.images.openxchangeCoreMW.repository }}
      tag: {{ .Values.images.openxchangeCoreMW.tag }}
+      pullPolicy: "{{ .Values.global.imagePullPolicy }}"
    update:
      image:
        repository: {{ .Values.images.openxchangeCoreMW.repository }}
@@ -113,6 +115,7 @@ appsuite:
    image:
      repository: {{ .Values.images.openxchangeCoreUI.repository }}
      tag: {{ .Values.images.openxchangeCoreUI.tag }}
+      pullPolicy: "{{ .Values.global.imagePullPolicy }}"

  core-ui-middleware:
    ingress:
@@ -126,6 +129,7 @@ appsuite:
    image:
      repository: {{ .Values.images.openxchangeCoreUIMiddleware.repository }}
      tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag }}
+      pullPolicy: "{{ .Values.global.imagePullPolicy }}"

  core-guidedtours:
    imagePullSecrets:
@@ -135,6 +139,7 @@ appsuite:
    image:
      repository: {{ .Values.images.openxchangeCoreGuidedtours.repository }}
      tag: {{ .Values.images.openxchangeCoreGuidedtours.tag }}
+      pullPolicy: "{{ .Values.global.imagePullPolicy }}"

  guard-ui:
    imagePullSecrets:
@@ -144,11 +149,13 @@ appsuite:
    image:
      repository: {{ .Values.global.imageRegistry }}/{{ .Values.images.openxchangeGuardUI.repository }}
      tag: {{ .Values.images.openxchangeGuardUI.tag }}
+      pullPolicy: "{{ .Values.global.imagePullPolicy }}"

  core-user-guide:
    image:
      repository: {{ .Values.images.openxchangeCoreUserGuide.repository }}
      tag: {{ .Values.images.openxchangeCoreUserGuide.tag }}
+      pullPolicy: "{{ .Values.global.imagePullPolicy }}"
    imagePullSecrets:
    {{- range .Values.global.imagePullSecrets }}
      - name: {{ . }}
--- a/helmfile/apps/open-xchange/values-openxchange.yaml
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml
@@ -55,13 +55,17 @@ appsuite:
      com.openexchange.mail.filter.server: "dovecot"
      com.openexchange.mail.filter.preferredSaslMech: "XOAUTH2"
      # Capabilities
+      # Old capability can be used to toggle all integrations with a single switch
+      com.openexchange.capability.public-sector: "true"
+      # New capabilities in 2.0
+      com.openexchange.capability.public-sector-element: "false"
+      com.openexchange.capability.public-sector-navigation: "true"
      com.openexchange.capability.client-onboarding: "true"
      com.openexchange.capability.dynamic-theme: "true"
      com.openexchange.capability.filestorage_nextcloud: "true"
      com.openexchange.capability.filestorage_nextcloud_oauth: "true"
      com.openexchange.capability.guard: "true"
      com.openexchange.capability.guard-mail: "true"
-      com.openexchange.capability.public-sector: "true"
      com.openexchange.capability.smime: "true"
      com.openexchange.capability.share_links: "false"
      com.openexchange.capability.invite_guests: "false"
@@ -95,6 +99,11 @@ appsuite:
        bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"

    uiSettings:
+      # Show the Enterprise Picker in the top right corner instead of the launcher drop-down
+      io.ox/core//features/enterprisePicker/showLauncher: "false"
+      io.ox/core//features/enterprisePicker/showTopRightLauncher: "true"
+      # Text and icon color in the topbar
+      io.ox/dynamic-theme//topbarColor: "#000"
      io.ox/dynamic-theme//logoWidth: "82"
      io.ox/dynamic-theme//topbarHover: "rgba(0, 0, 0, 0.1)"
      # Resources
--- a/helmfile/apps/openproject/values.gotmpl
+++ b/helmfile/apps/openproject/values.gotmpl
@@ -10,7 +10,7 @@ global:
 image:
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.openproject.repository }}"
-  pullPolicy: "Always"
+  pullPolicy: "{{ .Values.global.imagePullPolicy }}"
  tag: "{{ .Values.images.openproject.tag }}"

 memcached:
--- a/helmfile/apps/openproject/values.yaml
+++ b/helmfile/apps/openproject/values.yaml
@@ -46,7 +46,8 @@ environment:
  OPENPROJECT_SEED_LDAP_OPENDESK_SECURITY: "plain_ldap"
  OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,dc=swp-ldap,dc=internal"
  OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "dc=swp-ldap,dc=internal"
-  OPENPROJECT_SEED_LDAP_OPENDESK_FILTER: "(&(objectClass=opendeskProjectmanagementUser)(opendeskProjectmanagementEnabled=TRUE))"
+  OPENPROJECT_SEED_LDAP_OPENDESK_FILTER:
+    "(&(objectClass=opendeskProjectmanagementUser)(opendeskProjectmanagementEnabled=TRUE))"
  OPENPROJECT_SEED_LDAP_OPENDESK_SYNC__USERS: "true"
  OPENPROJECT_SEED_LDAP_OPENDESK_LOGIN__MAPPING: "uid"
  OPENPROJECT_SEED_LDAP_OPENDESK_FIRSTNAME__MAPPING: "givenName"
@@ -54,7 +55,8 @@ environment:
  OPENPROJECT_SEED_LDAP_OPENDESK_MAIL__MAPPING: "mailPrimaryAddress"
  OPENPROJECT_SEED_LDAP_OPENDESK_ADMIN__MAPPING: "opendeskProjectmanagementAdmin"
  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_BASE: "dc=swp-ldap,dc=internal"
-  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_FILTER: "(&(objectClass=opendeskProjectmanagementGroup)(opendeskProjectmanagementEnabled=TRUE))"
+  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_FILTER:
+    "(&(objectClass=opendeskProjectmanagementGroup)(opendeskProjectmanagementEnabled=TRUE))"
  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_SYNC__USERS: "true"
  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_GROUP__ATTRIBUTE: "cn"

--- a/helmfile/apps/provisioning/values-oxconnector.gotmpl
+++ b/helmfile/apps/provisioning/values-oxconnector.gotmpl
@@ -6,7 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 image:
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.oxConnector.repository }}"
-  pullPolicy: "Always"
+  pullPolicy: "{{ .Values.global.imagePullPolicy }}"
  tag: "{{ .Values.images.oxConnector.tag }}"

 imagePullSecrets:
--- a/helmfile/apps/services/helmfile.yaml
+++ b/helmfile/apps/services/helmfile.yaml
@@ -7,13 +7,15 @@ repositories:
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
         default "https://gitlab.souvap-univention.de/api/v4/projects/133/packages/helm/stable" }}
  - name: "postgresql-repo"
+    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/83/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/postgresql" }}
  - name: "mariadb-repo"
+    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/86/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/mariadb" }}
  - name: "postfix-repo"
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
@@ -23,13 +25,14 @@ repositories:
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
         default "https://gitlab.souvap-univention.de/api/v4/projects/69/packages/helm/stable" }}
  - name: "clamav-repo"
+    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/73/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/clamav" }}
  - name: "bitnami-repo"
    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
         default "registry-1.docker.io/bitnamicharts" }}

 releases:
@@ -41,41 +44,41 @@ releases:
    condition: "certificates.enabled"
  - name: "redis"
    chart: "bitnami-repo/redis"
-    version: "17.9.3"
+    version: "18.0.0"
    values:
      - "values-redis.gotmpl"
      - "values-redis.yaml"
    condition: "redis.enabled"
  - name: "postgresql"
    chart: "postgresql-repo/postgresql"
-    version: "2.0.0"
+    version: "2.0.2"
    values:
      - "values-postgresql.yaml"
      - "values-postgresql.gotmpl"
    condition: "postgresql.enabled"
  - name: "mariadb"
    chart: "mariadb-repo/mariadb"
-    version: "2.0.0"
+    version: "2.0.2"
    values:
      - "values-mariadb.yaml"
      - "values-mariadb.gotmpl"
    condition: "mariadb.enabled"
  - name: "postfix"
    chart: "postfix-repo/postfix"
-    version: "1.13.0"
+    version: "2.0.1"
    values:
      - "values-postfix.yaml"
      - "values-postfix.gotmpl"
    condition: "postfix.enabled"
  - name: "clamav"
-    chart: "clamav-repo/sovereign-workplace-clamav"
-    version: "2.1.0"
+    chart: "clamav-repo/opendesk-clamav"
+    version: "4.0.0"
    values:
      - "values-clamav-distributed.gotmpl"
    condition: "clamavDistributed.enabled"
  - name: "clamav-simple"
    chart: "clamav-repo/clamav-simple"
-    version: "2.1.0"
+    version: "4.0.0"
    values:
      - "values-clamav-simple.gotmpl"
    condition: "clamavSimple.enabled"
@@ -83,6 +86,7 @@ releases:
    chart: "istio-resources-repo/istio-gateway"
    version: "1.1.2"
    values:
+      - "values-istio-gateway.yaml"
      - "values-istio-gateway.gotmpl"
    condition: "istio.enabled"

--- a/helmfile/apps/services/values-clamav-distributed.gotmpl
+++ b/helmfile/apps/services/values-clamav-distributed.gotmpl
@@ -5,25 +5,23 @@ SPDX-License-Identifier: Apache-2.0
 ---
 clamd:
  podSecurityContext:
-    {{/* Disabled until NFS Provisioner on IONOS is fixed */}}
-    enabled: false
  replicaCount: {{ .Values.replicas.clamd }}
  image:
    registry: "{{ .Values.global.imageRegistry }}"
    repository: "{{ .Values.images.clamd.repository }}"
    tag: "{{ .Values.images.clamd.tag }}"
+    imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  resources:
    {{ .Values.resources.clamd | toYaml | nindent 4 }}

 freshclam:
  podSecurityContext:
-    {{/* Disabled until NFS Provisioner on IONOS is fixed */}}
-    enabled: false
  replicaCount: {{ .Values.replicas.freshclam }}
  image:
    registry: "{{ .Values.global.imageRegistry }}"
    repository: "{{ .Values.images.freshclam.repository }}"
    tag: "{{ .Values.images.freshclam.tag }}"
+    imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  resources:
    {{ .Values.resources.freshclam | toYaml | nindent 4 }}

@@ -37,18 +35,18 @@ icap:
    registry: "{{ .Values.global.imageRegistry }}"
    repository: "{{ .Values.images.icap.repository }}"
    tag: "{{ .Values.images.icap.tag }}"
+    imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  resources:
    {{ .Values.resources.icap | toYaml | nindent 4 }}

 milter:
  podSecurityContext:
-    {{/* Disabled until NFS Provisioner on IONOS is fixed */}}
-    enabled: false
  replicaCount: {{ .Values.replicas.milter }}
  image:
    registry: "{{ .Values.global.imageRegistry }}"
    repository: "{{ .Values.images.milter.repository }}"
    tag: "{{ .Values.images.milter.tag }}"
+    imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  resources:
    {{ .Values.resources.milter | toYaml | nindent 4 }}

--- a/helmfile/apps/services/values-clamav-simple.gotmpl
+++ b/helmfile/apps/services/values-clamav-simple.gotmpl
@@ -3,11 +3,6 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
-
-podSecurityContext:
-  {{/* Disabled until NFS Provisioner on IONOS is fixed */}}
-  enabled: false
-
 replicaCount: {{ .Values.replicas.clamav }}

 image:
@@ -15,10 +10,12 @@ image:
    registry: "{{ .Values.global.imageRegistry }}"
    repository: "{{ .Values.images.clamd.repository }}"
    tag: "{{ .Values.images.clamd.tag }}"
+    imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  icap:
    registry: "{{ .Values.global.imageRegistry }}"
    repository: "{{ .Values.images.icap.repository }}"
    tag: "{{ .Values.images.icap.tag }}"
+    imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"

 resources:
  {{ .Values.resources.clamd | toYaml | nindent 4 }}
--- a/helmfile/apps/services/values-istio-gateway.yaml
+++ b/helmfile/apps/services/values-istio-gateway.yaml
@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+tls:
+  httpsRedirect: false
+...
--- a/helmfile/apps/services/values-mariadb.gotmpl
+++ b/helmfile/apps/services/values-mariadb.gotmpl
@@ -11,6 +11,7 @@ global:
 image:
  repository: "{{ .Values.images.mariadb.repository }}"
  tag: "{{ .Values.images.mariadb.tag }}"
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"

 # Open-Xchange and XWiki require the permission to create database schemas, so they use the `root` account anyway.
 # Please refer to `databases.yaml` for details.
--- a/helmfile/apps/services/values-postfix.gotmpl
+++ b/helmfile/apps/services/values-postfix.gotmpl
@@ -3,14 +3,16 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
-image:
-  url: "{{ .Values.global.imageRegistry }}/{{ .Values.images.postfix.repository }}"
-  digest: "{{ .Values.images.postfix.digest }}"
+global:
+  registry: {{ .Values.global.imageRegistry }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

-imagePullSecrets:
-{{- range .Values.global.imagePullSecrets }}
-  - name: {{ . }}
-{{- end }}
+image:
+  registry: {{ .Values.global.imageRegistry }}
+  repository: "{{ .Values.images.postfix.repository }}"
+  tag: "{{ .Values.images.postfix.tag }}"
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"

 certificate:
  secretName: "{{ .Values.ingress.tls.secretName }}"
--- a/helmfile/apps/services/values-postgresql.gotmpl
+++ b/helmfile/apps/services/values-postgresql.gotmpl
@@ -11,6 +11,7 @@ global:
 image:
  repository: "{{ .Values.images.postgresql.repository }}"
  tag: "{{ .Values.images.postgresql.tag }}"
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"

 job:
  users:
--- a/helmfile/apps/services/values-redis.gotmpl
+++ b/helmfile/apps/services/values-redis.gotmpl
@@ -16,6 +16,7 @@ image:
  registry: "{{ .Values.global.imageRegistry }}"
  repository: "{{ .Values.images.redis.repository }}"
  tag: "{{ .Values.images.redis.tag }}"
+  pullPolicy: "{{ .Values.global.imagePullPolicy }}"

 master:
  persistence:
--- a/helmfile/apps/services/values-redis.yaml
+++ b/helmfile/apps/services/values-redis.yaml
@@ -8,4 +8,8 @@ sentinel:

 metrics:
  enabled: false
+
+master:
+  containerSecurityContext:
+    readOnlyRootFilesystem: true
 ...
--- a/helmfile/apps/univention-corporate-container/values.gotmpl
+++ b/helmfile/apps/univention-corporate-container/values.gotmpl
@@ -13,7 +13,7 @@ global:

 image:
  registry: "{{ .Values.global.imageRegistry }}"
-  imagePullPolicy: "Always"
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  repository: "{{ .Values.images.univentionCorporateServer.repository }}"
  tag: "{{ .Values.images.univentionCorporateServer.tag }}"

--- a/helmfile/apps/xwiki/helmfile.yaml
+++ b/helmfile/apps/xwiki/helmfile.yaml
@@ -10,7 +10,7 @@ repositories:
 releases:
  - name: "xwiki"
    chart: "xwiki-repo/xwiki"
-    version: "1.1.2"
+    version: "1.1.3"
    wait: true
    timeout: 600
    values:
--- a/helmfile/apps/xwiki/values.gotmpl
+++ b/helmfile/apps/xwiki/values.gotmpl
@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 image:
  name: "{{ .Values.global.imageRegistry }}/{{ .Values.images.xwiki.repository }}"
  tag: "{{ .Values.images.xwiki.tag }}"
+  pullPolicy: "{{ .Values.global.imagePullPolicy }}"

 externalDB:
  password: "{{ .Values.databases.xwiki.password | default .Values.secrets.mariadb.rootPassword }}"
--- a/helmfile/apps/xwiki/values.yaml
+++ b/helmfile/apps/xwiki/values.yaml
@@ -2,9 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 image:
-  name: "git.xwikisas.com:5050/xwikisas/swp/xwiki"
-  tag: "0.4-mariadb-tomcat"
-  pullPolicy: "Always"
+  pullPolicy: "IfNotPresent"

 ingress:
  # enabled: true
@@ -32,9 +30,9 @@ mariadb:

 properties:
  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.colorTheme": "FlamingoThemes.Iceberg"
-  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.default_language": "de"
+  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.default_language": "de_DE"
  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.timezone": "Europe/Berlin"
-  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.languages": "de"
+  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.languages": "de_DE"
  "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.link-color": "@brand-primary"
  "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.btn-primary-bg": "@brand-primary"
  "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.navbar-default-color": "@brand-primary"
@@ -44,8 +42,7 @@ properties:
  "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.navbar-default-link-active-color":
    "@brand-primary"
  # yamllint disable-line rule:line-length
-  "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.lessCode": "'.navbar-default { background-color: white; border-bottom: 1px solid grey; height: 64px; } #menuview .navbar-brand img { padding: 5px; } div#companylogo { width: 96px; height: auto; padding-top: 6px; padding-left: 5px; } li#tmWorkplaceServices { padding-left: 16px; padding-top: 5px; } .navbar-right { padding-top: 8px; } button { background-color: #ffffff; } .drawer-nav, .drawer-brand { background-color: #ffffff; } #footerglobal { background-color: #ffffff; }'"
-  # "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.lessCode": "'@list-group-active-border: @list-group-border; @gray-light: #727272; @text-muted: @gray; @xwiki-drawer-menu-item-hover-bg: @list-group-hover-bg; @xwiki-drawer-menu-item-hover-color: @list-group-link-hover-color; @well-bg: @body-bg; .navbar-default { background-color: #ffffff; border-bottom: 1px solid #dddddd !important; height: 64px; } #menuview .navbar-brand img { padding: 5px; } div#companylogo { width: 96px; height: auto; padding-top: 6px; padding-left: 5px; } li#tmWorkplaceServices { padding-left: 16px; padding-top: 5px; } .navbar-right { padding-top: 8px; } #globalsearch .btn { background-color: #ffffff; color: @brand-primary; }'"
+  "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.lessCode": " li#tmWorkplaceServices { padding-left: 16px; padding-top: 5px; } .navbar-right { padding-top: 8px; } .navbar { border-bottom: 1px solid #ddd; height: 64px; } div#companylogo { width: 90px; height: auto; padding-top: 7px; padding-left: 9px; }"

  "property:xwiki:XWiki.AuthService.Configuration^XWiki.AuthService.ConfigurationClass.authService": "oidc"
  ## Fields to search in when importing users from the administration UI (not completely in scope for now)
--- a/helmfile/environments/default/global.yaml
+++ b/helmfile/environments/default/global.yaml
@@ -39,4 +39,8 @@ global:
  imagePullSecrets:
    - "external-registry"

+  ## Define the policy to pull container images.
+  ## Ref: https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
+  #
+  imagePullPolicy: "IfNotPresent"
 ...
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -4,40 +4,42 @@
 images:
  clamd:
    repository: "clamav/clamav"
-    tag: "1.1.0_base"
+    tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
  collabora:
-    repository: "collabora/code"
-    tag: "23.05.2.2.1"
+    # repository: "collabora/code"
+    # tag: "23.05.2.2.1"
+    repository: "souvap/tooling/images/collabora"
+    tag: "23.05.3.1.1@sha256:f1248a50e67940e3be3dfa58dc37eca73267cf73a679b459707d2520cee7720e"
  dovecot:
    repository: "dovecot/dovecot"
    digest: "sha256:96d414aa3f6978669b417f6468c16313a54ee6143a4846870e9f0eda280806e7"
  element:
-    repository: "vectorim/element-web"
-    tag: "v1.11.35"
+    repository: "souvap/tooling/images/element-web@sha256"
+    tag: "16506bba9da546b1bf5896892f6f4afefea3d0f1d8ed93eae511212627a029b9"
  freshclam:
    repository: "clamav/clamav"
-    tag: "1.1.0_base"
+    tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
  jibri:
    repository: "jitsi/jibri"
-    tag: "stable-8615"
+    tag: "stable-8922@sha256:87aa176b44b745b13769f13b8e2d22ddd6f6ba624244d5354c8dd3664787e936"
  jicofo:
    repository: "jitsi/jicofo"
-    tag: "stable-8615"
+    tag: "stable-8922@sha256:820fcd4b072b29f42c1c37389fbefda1065f1e9654694941485dc08123c8a93b"
  jitsi:
    repository: "jitsi/web"
-    tag: "stable-8615"
+    tag: "stable-8922@sha256:24bd4179998fe01ace1be74e53fea5308f4d91722953bb4334611e6886753f46"
  jitsiKeycloakAdapter:
    repository: "nordeck/jitsi-keycloak-adapter"
-    tag: "v20230425"
+    tag: "v20230906@sha256:54d45ee1a1205f98641810ffb171bd92e6478e2957a349ee4ff599359239fbf2"
  jitsiPatchJVB:
    repository: "bitnami/kubectl"
-    tag: "1.26.6"
+    tag: "1.26.8@sha256:c6902a1fdce0a24c9f93ac8d1f317039b206a4b307d8fc76cab4a92911345757"
  jvb:
    repository: "jitsi/jvb"
-    tag: "stable-8615"
+    tag: "stable-8922@sha256:75dd613807e19cbbd440d071b60609fa9e4ee50a1396b14deb0ed779d882a554"
  icap:
-    repository: "souvap/tooling/images/c-icap/c-icap-clamav"
-    tag: "1.0.4"
+    repository: "souvap/tooling/images/c-icap"
+    tag: "0.5.10@sha256:cd665e77a42460bb1e6df4282bc1d8737be241fc9f4143d43509e31de3a7993d"
  intercom:
    repository: "univention/intercom-service"
    tag: "1.4-kubernetes"
@@ -62,10 +64,10 @@ images:
    tag: "1.6.21-debian-11-r4"
  milter:
    repository: "clamav/clamav"
-    tag: "1.1.0_base"
+    tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
  nextcloud:
    repository: "nextcloud"
-    tag: "26.0.1-apache"
+    tag: "26.0.5-apache"
  openproject:
    repository: "souvap/tooling/images/openproject/souvap@sha256"
    tag: "5da1ae8be3d7483bf0f3d9ec50c3470586528e0ff51b663e2c3a57bceb489423"
@@ -74,40 +76,40 @@ images:
    digest: "sha256:199a4457602b4e260d9781358cd2e342f63c177f4bcfa8053493be01e57beddf"
  openxchangeCoreGuidedtours:
    repository: "appsuite-public-sector/core-guidedtours"
-    tag: "8.5.0"
+    tag: "8.5.1"
  openxchangeCoreMW:
    repository: "appsuite-public-sector/middleware-public-sector"
-    tag: "8.15.43"
+    tag: "8.16.55"
  openxchangeCoreUI:
    repository: "appsuite-public-sector/core-ui"
-    tag: "8.15.2"
+    tag: "8.16.5"
  openxchangeCoreUIMiddleware:
    repository: "appsuite-public-sector/core-ui-middleware"
-    tag: "1.8.3"
+    tag: "1.8.4"
  openxchangeCoreUserGuide:
    repository: "appsuite-public-sector/core-user-guide"
-    tag: "8.15.702039"
+    tag: "8.16.727397"
  openxchangeGuardUI:
    repository: "appsuite-public-sector/guard-ui"
-    tag: "4.0.5"
+    tag: "4.0.6"
  openxchangeNextcloudIntegrationUI:
    repository: "appsuite-public-sector/nextcloud-integration-ui"
-    tag: "1.0.2"
+    tag: "1.0.3"
  openxchangePublicSectorUI:
    repository: "appsuite-public-sector/public-sector-ui"
-    tag: "1.0.3"
+    tag: "2.0.1"
  oxConnector:
    repository: "souvap/tooling/images/ox-connector/ox-connector-standalone"
    tag: "branch-jconde-listener-entrypoint-chaining"
  postfix:
    repository: "souvap/tooling/images/postfix"
-    digest: "sha256:69e0c53ade77ffb89673672f5c8183ec2edfc81d4e990aca3ec594f33c55a7ac"
+    tag: "1.0.0@sha256:69e0c53ade77ffb89673672f5c8183ec2edfc81d4e990aca3ec594f33c55a7ac"
  postgresql:
    repository: "postgres"
    tag: "15-alpine"
  prosody:
    repository: "jitsi/prosody"
-    tag: "stable-8615"
+    tag: "stable-8922@sha256:243547f24ae7d686d1f0c18ee230cf93119a66f095dda282bacbf45d4bb69f77"
  redis:
    repository: "bitnami/redis"
    tag: "7.0.12-debian-11-r0"
@@ -124,7 +126,8 @@ images:
    repository: "library/nginx"
    tag: "1.23"
  xwiki:
+    # repository: "xwikisas/swp/xwiki"
+    # tag: "0.10-mariadb-tomcat"
    repository: "xwikisas/swp/xwiki@sha256"
-    # tag: "0.9-mariadb-tomcat"
-    tag: "b77d83613a8f70d8d0f6ef784eb6186d13fcc28ff327a8fcfe22c06128b69836"
+    tag: "02f0ff6407ccdd8dab17814202e28991fe0aa8d44fa106ba171cff5249eaf58f"
 ...
--- a/helmfile/environments/default/replicas.yaml
+++ b/helmfile/environments/default/replicas.yaml
@@ -8,7 +8,7 @@ replicas:
  clamd: 1
  collabora: 1
  dovecot: 1
-  element: 2
+  element: 1
  # clamav-distributed
  freshclam: 1
  # clamav-distributed
@@ -25,7 +25,7 @@ replicas:
  openproject: 1
  postfix: 1
  synapse: 1
-  synapseWeb: 2
-  wellKnown: 2
+  synapseWeb: 1
+  wellKnown: 1
  xwiki: 1
 ...
--- a/helmfile/environments/default/resources.yaml
+++ b/helmfile/environments/default/resources.yaml
@@ -33,10 +33,10 @@ resources:
  icap:
    limits:
      cpu: 2
-      memory: "4Gi"
+      memory: "128Mi"
    requests:
      cpu: 0.1
-      memory: "2Gi"
+      memory: "16Mi"
  jibri:
    limits:
      cpu: 1
Author	SHA1	Message	Date
Thorsten Roßner	2125037a3c	chore(release): 0.2.10 [skip ci] ## [0.2.10](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.9...v0.2.10) (2023-09-06) ### Bug Fixes * helmfile: Add imagePullPolicy default env variable ([`f988644`](`f9886448b6`)) * helmfile: Update images and add jitsi, keycloak to security section in docs ([`0eceb85`](`0eceb85e7d`)) * jitsi: Update chart to 1.4.2 with improved security and fixed change on each deployment ([`1349181`](`1349181d80`)) * jitsi: Update jitsi to 1.5.1 and fix prosody image ([`ed7e5e4`](`ed7e5e428e`)) * keycloak: Improve default security settings ([`3b90533`](`3b90533063`)) * nextcloud: Fix yamllint disable comment ([`4380e78`](`4380e78981`)) * services: Disable https redirect in istio to fix cert-manager issues ([`1ef4a86`](`1ef4a861ac`)) * services: Fix capabilities of postifix ([`a6fa846`](`a6fa846afc`)) * services: Fix OCI registry address of postgresql, mariadb ([`be82243`](`be82243966`))	2023-09-06 17:12:09 +00:00
Dominik Kaminski	ed7e5e428e	fix(jitsi): Update jitsi to 1.5.1 and fix prosody image	2023-09-06 19:09:59 +02:00
Dominik Kaminski	d28a425673	chore(release): 0.2.10 [skip ci] ## [0.2.10](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.9...v0.2.10) (2023-09-06) ### Bug Fixes * helmfile: Add imagePullPolicy default env variable ([`f988644`](`f9886448b6`)) * helmfile: Update images and add jitsi, keycloak to security section in docs ([`0eceb85`](`0eceb85e7d`)) * jitsi: Update chart to 1.4.2 with improved security and fixed change on each deployment ([`1349181`](`1349181d80`)) * keycloak: Improve default security settings ([`3b90533`](`3b90533063`)) * nextcloud: Fix yamllint disable comment ([`4380e78`](`4380e78981`)) * services: Disable https redirect in istio to fix cert-manager issues ([`1ef4a86`](`1ef4a861ac`)) * services: Fix capabilities of postifix ([`a6fa846`](`a6fa846afc`)) * services: Fix OCI registry address of postgresql, mariadb ([`be82243`](`be82243966`))	2023-09-06 07:53:01 +00:00
Dominik Kaminski	a6fa846afc	fix(services): Fix capabilities of postifix	2023-09-05 21:50:31 +02:00
Dominik Kaminski	4380e78981	fix(nextcloud): Fix yamllint disable comment	2023-09-05 20:31:32 +02:00
Dominik Kaminski	be82243966	fix(services): Fix OCI registry address of postgresql, mariadb	2023-09-05 20:15:03 +02:00
Dominik Kaminski	f9886448b6	fix(helmfile): Add imagePullPolicy default env variable	2023-09-05 19:59:18 +02:00
Dominik Kaminski	0eceb85e7d	fix(helmfile): Update images and add jitsi, keycloak to security section in docs	2023-09-05 18:49:09 +02:00
Dominik Kaminski	1ef4a861ac	fix(services): Disable https redirect in istio to fix cert-manager issues	2023-09-05 18:48:18 +02:00
Dominik Kaminski	3b90533063	fix(keycloak): Improve default security settings	2023-09-05 18:47:28 +02:00
Dominik Kaminski	1349181d80	fix(jitsi): Update chart to 1.4.2 with improved security and fixed change on each deployment	2023-09-05 18:47:04 +02:00
Thorsten Roßner	e1b84898c5	chore(release): 0.2.9 [skip ci] ## [0.2.9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.8...v0.2.9) (2023-09-05) ### Bug Fixes * collabora: Add websocket support for NGINX Inc. Ingress ([`6e5ef63`](`6e5ef639c2`)) * docs: Add security part in README ([`ff462ab`](`ff462ab0dc`)) * docs: Update scaling docs ([`63a1e25`](`63a1e2568e`)) * helmfile: Reduce icap resources in default enviroment ([`c5ab1b8`](`c5ab1b81fe`)) * helmfile: Update clamav and nextcloud images in default environment ([`4f2a8ae`](`4f2a8aeee4`)) * nextcloud: Add support for up to 4G large upload for Ingress NGINX and NGINX Inc. Ingress ([`6e68f7f`](`6e68f7f28c`)) * nextcloud: Rename sovereign-workplace-nextcloud-bootstrap to opendesk-nextcloud-bootstrap and use OCI ([`cef11ac`](`cef11acbae`)) * nextcloud: Use clamav-icap when clamavDistributed is activated ([`41d40c9`](`41d40c9b73`)) * services: Enable security context and use default increased security settings ([`9a6d240`](`9a6d2409a6`)) * services: Fix image registry templates for postfix ([`6321ff5`](`6321ff50a0`)) * services: Replace image digest by tag ([`f758293`](`f758293241`)) * services: Set readOnlyRootFilesystem to true on master ([`5fbf86b`](`5fbf86b6bc`)) * services: Update clamav to 4.0.0, redis to 18.0.0, postgresql to 2.0.2, mariadb to 2.0.2 and use OCI registries ([`9d78664`](`9d7866480c`))	2023-09-05 11:58:43 +00:00
Dominik Kaminski	63a1e2568e	fix(docs): Update scaling docs	2023-09-03 22:45:29 +02:00
Dominik Kaminski	ca4b1da84f	chore(helmfile): Fix linting errors for yamllint	2023-09-03 22:26:26 +02:00
Dominik Kaminski	ff462ab0dc	fix(docs): Add security part in README	2023-09-03 21:56:55 +02:00
Dominik Kaminski	4f2a8aeee4	fix(helmfile): Update clamav and nextcloud images in default environment	2023-09-03 21:56:45 +02:00
Dominik Kaminski	c5ab1b81fe	fix(helmfile): Reduce icap resources in default enviroment	2023-09-03 21:56:31 +02:00
Dominik Kaminski	9d7866480c	fix(services): Update clamav to 4.0.0, redis to 18.0.0, postgresql to 2.0.2, mariadb to 2.0.2 and use OCI registries	2023-09-03 21:53:09 +02:00
Dominik Kaminski	9a6d2409a6	fix(services): Enable security context and use default increased security settings	2023-09-03 21:51:33 +02:00
Dominik Kaminski	f758293241	fix(services): Replace image digest by tag	2023-09-03 21:49:39 +02:00
Dominik Kaminski	6321ff50a0	fix(services): Fix image registry templates for postfix	2023-09-03 21:46:40 +02:00
Dominik Kaminski	5fbf86b6bc	fix(services): Set readOnlyRootFilesystem to true on master	2023-09-03 21:44:42 +02:00
Dominik Kaminski	6e68f7f28c	fix(nextcloud): Add support for up to 4G large upload for Ingress NGINX and NGINX Inc. Ingress	2023-09-03 21:43:55 +02:00
Dominik Kaminski	41d40c9b73	fix(nextcloud): Use clamav-icap when clamavDistributed is activated	2023-09-03 21:43:00 +02:00
Dominik Kaminski	cef11acbae	fix(nextcloud): Rename sovereign-workplace-nextcloud-bootstrap to opendesk-nextcloud-bootstrap and use OCI	2023-09-03 21:40:45 +02:00
Dominik Kaminski	6e5ef639c2	fix(collabora): Add websocket support for NGINX Inc. Ingress	2023-09-03 21:40:06 +02:00
Thorsten Roßner	65b0ca5480	chore(release): 0.2.8 [skip ci] ## [0.2.8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.7...v0.2.8) (2023-08-31) ### Bug Fixes * open-xchange: Update images and Helm chart ([`39565c7`](`39565c7cfd`))	2023-08-31 10:57:35 +00:00
Thorsten Rossner	39565c7cfd	fix(open-xchange): Update images and Helm chart	2023-08-31 10:56:00 +00:00
Thorsten Roßner	0d374c1fea	chore(release): 0.2.7 [skip ci] ## [0.2.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.6...v0.2.7) (2023-08-30) ### Bug Fixes * jitsi: Update Jitsi Helm chart to set the user's display name as default ([`387bd87`](`387bd8715c`))	2023-08-30 17:08:35 +00:00
Thorsten Rossner	387bd8715c	fix(jitsi): Update Jitsi Helm chart to set the user's display name as default	2023-08-30 17:06:57 +00:00
Dominik Kaminski	f219c42afa	chore(release): 0.2.6 [skip ci] ## [0.2.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.5...v0.2.6) (2023-08-30) ### Bug Fixes * ci: Change path of asset_generator ([`6ab4fa0`](`6ab4fa078b`)) * ci: Include deployment environments ([`0f59736`](`0f59736c5d`)) * ci: Release artefacts ([`2a61b5f`](`2a61b5f2a6`))	2023-08-30 14:23:01 +00:00
Thorsten Roßner	4d3bc2799c	chore(release): 0.2.6 [skip ci] ## [0.2.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.5...v0.2.6) (2023-08-30) ### Bug Fixes * ci: Change path of asset_generator ([`6ab4fa0`](`6ab4fa078b`)) * ci: Include deployment environments ([`0f59736`](`0f59736c5d`)) * ci: Release artefacts ([`2a61b5f`](`2a61b5f2a6`))	2023-08-30 14:18:36 +00:00
Thorsten Rossner	0f59736c5d	fix(ci): Include deployment environments	2023-08-30 14:16:30 +00:00
Thorsten Roßner	7e9d39cc7f	chore(release): 0.2.6 [skip ci] ## [0.2.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.2.5...v0.2.6) (2023-08-30) ### Bug Fixes * ci: Change path of asset_generator ([`6ab4fa0`](`6ab4fa078b`)) * ci: Release artefacts ([`2a61b5f`](`2a61b5f2a6`))	2023-08-30 13:49:37 +00:00
Dominik Kaminski	6ab4fa078b	fix(ci): Change path of asset_generator	2023-08-30 11:37:09 +00:00
Dominik Kaminski	05361276c0	chore(ci): Improve rules	2023-08-30 11:19:03 +00:00
Dominik Kaminski	cda237a655	chore(ci): Fix gitlab pipeline	2023-08-30 11:16:01 +00:00
Dominik Kaminski	ea77d1712e	chore(ci): Fix runner tags on OpenCoDE	2023-08-30 11:13:47 +00:00
Thorsten Rossner	2a61b5f2a6	fix(ci): Release artefacts	2023-08-30 10:57:54 +00:00
Thorsten Rossner	f4dbdfb321	chore(release): 0.2.5 [skip ci] ## [0.2.5](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.2.4...v0.2.5) (2023-08-30) ### Bug Fixes * xwiki: Theming and language of central navigation ([`3d4d45f`](`3d4d45f711`))	2023-08-30 09:50:06 +00:00
Thorsten Rossner	3d4d45f711	fix(xwiki): Theming and language of central navigation	2023-08-30 09:48:20 +00:00
Johannes Bornhold	86fdb34735	chore(docs): Language pass in the contribution guide	2023-08-29 18:20:48 +02:00
Thorsten Rossner	7c9c6f9000	chore(release): 0.2.4 [skip ci] ## [0.2.4](https://gitlab.souvap-univention.de/souvap/devops/sovereign-workplace/compare/v0.2.3...v0.2.4) (2023-08-29) ### Bug Fixes * element: Apply the global theme to Element ([`7f7eae8`](`7f7eae8f99`))	2023-08-29 15:41:16 +00:00
Dominik Henneke	7f7eae8f99	fix(element): Apply the global theme to Element	2023-08-29 15:39:37 +00:00