chore(release): 0.5.7 [skip ci]

## [0.5.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.6...v0.5.7) (2023-10-09) ### Bug Fixes * **openproject:** Mail sender address ([711d29e](711d29e374))
fix(openproject): Mail sender address
2025-12-06 07:21:36 +01:00 · 2023-10-09 09:41:26 +00:00 · 2023-10-09 09:31:39 +00:00 · 2023-10-09 09:30:56 +00:00 · 2023-10-09 11:19:50 +02:00 · 2023-10-09 11:19:50 +02:00
44 changed files with 578 additions and 107 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -5,4 +5,8 @@

 # Ignore changes to sample environments
 helmfile/environments/dev/values.yaml
+helmfile/environments/dev/values.gotmpl
+helmfile/environments/test/values.yaml
+helmfile/environments/test/values.gotmpl
 helmfile/environments/prod/values.yaml
+helmfile/environments/prod/values.gotmpl
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -183,8 +183,16 @@ env-cleanup:
          $ENV_STOP_BEFORE != "no"
      when: "always"
  script:
-    - "helmfile destroy --namespace ${NAMESPACE}"
-    - "kubectl delete pvc --all --namespace ${NAMESPACE}"
+    - |
+      if [ "${OPENDESK_SLEDGEHAMMER_DESTROY_ENABLED}" = "yes" ]; then
+        for OPENDESK_RELEASE in $(helm ls -n ${NAMESPACE} -aq); do
+          helm uninstall -n ${NAMESPACE} ${OPENDESK_RELEASE};
+        done
+        kubectl delete pvc --all --namespace ${NAMESPACE};
+        kubectl delete jobs --all --namespace ${NAMESPACE};
+      else
+        helmfile destroy --namespace ${NAMESPACE};
+      fi
  stage: "env-cleanup"

 env-start:
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,140 @@
+## [0.5.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.6...v0.5.7) (2023-10-09)
+
+
+### Bug Fixes
+
+* **openproject:** Mail sender address ([711d29e](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/711d29e374d13a3c8b7bcdf3e8440d03e0ef2b7d))
+
+## [0.5.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.5...v0.5.6) (2023-10-09)
+
+
+### Bug Fixes
+
+* **helmfile:** Use signed bitnami charts from openDesk Mirror Builds ([70744d0](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/70744d04c66f32d65dc968c8570ed7a397f4efcc))
+* **services:** Bump redis chart to 18.1.2 ([d4c751d](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/d4c751d29f15c718957f6bc388a99347e2923c87))
+
+## [0.5.5](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.4...v0.5.5) (2023-10-09)
+
+
+### Bug Fixes
+
+* **openproject:** Switch image to fix central navigation; set email sender address ([e42feb4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/e42feb4c260fc24692bc2742c97754230f8e2857))
+
+## [0.5.4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.3...v0.5.4) (2023-10-02)
+
+
+### Bug Fixes
+
+* **helmfile:** Add third environment (test) ([7dbcbfe](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/7dbcbfe7237b365cf53f4c850b149e8b95149901))
+
+## [0.5.3](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.2...v0.5.3) (2023-09-28)
+
+
+### Bug Fixes
+
+* **open-xchange:** Rollback MariaDB version to fix OX Guard initialization ([e33acd3](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/e33acd33e79740144e8fe318fe34dc705834ddf3))
+
+## [0.5.2](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.1...v0.5.2) (2023-09-28)
+
+
+### Bug Fixes
+
+* **ci:** Add Gitlab-CI sledgehammer deployment removal ([6fd655a](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6fd655a0b1afd40303ac11130692202146bab215))
+
+## [0.5.1](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.0...v0.5.1) (2023-09-28)
+
+
+### Bug Fixes
+
+* **docs:** Add 'Helm Chart Trust Chain' section ([b6b4972](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/b6b4972a5dd426bcc8fa00137d7e7b60056376c8))
+* **docs:** Highlight that Helmfile >= 0.157.0 is required ([d86f516](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/d86f516747323d117f620658c4368408926c507a))
+* **element:** Use OCI registry and verify chart signatures ([a41b9a6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/a41b9a699c79bf90163bbb3c233c805b8d0a999e))
+* **helmfile:** Add cleanup flag for job resources ([0f01b94](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/0f01b94aa19b40b4774ba11d9886fe6f12090e73))
+* **helmfile:** Create directory for gpg pubkeys ([4c5731e](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/4c5731e6bb057cb272f660b4df0369b67709c203))
+* **intercom-service:** Use OCI registry and verify chart signatures ([74b3d41](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/74b3d41381474efd2fbc5a9f3a0f1c0713811106))
+* **jitsi:** Verify chart signatures ([1dd6582](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/1dd6582ec7d742250ba08f69eba9a4679984b1ae))
+* **keycloak-bootstrap:** Use OCI registry and verify chart signatures ([ca5d5f8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/ca5d5f82800ea6d7ecfa38eb2b5d8b85e709bb9f))
+* **keycloak:** Use OCI registry and verify chart signatures ([095059c](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/095059c7e53bbe8a874773f574cc6794ef8af6e4))
+* **nextcloud:** Use OCI registry and verify chart signatures ([41dfdc0](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/41dfdc0c8f83e3d79fa5a763ac449f6edfc76676))
+* **open-xchange:** Use OCI registry and verify chart signatures ([2d5d370](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/2d5d3708f7f45600961c22ce11e750561de1fd27))
+* **open-xchange:** Use renamed istio gateway ([65d2642](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/65d2642d34c1c21a00a29278f7e1143f7fabb2aa))
+* **openproject:** Use OCI registry and verify chart signatures ([5343840](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/5343840bed01992b3132eace362f91588c705a98))
+* **services:** Add wildcard certifcate request support ([15ad8ca](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/15ad8ca7ab34b079252f7b69219ede81ad43aa1c))
+* **services:** Bump opendesk-certificates to 2.1.0 ([4372f06](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/4372f063e0a27d5156da963d44d3ed4e72490fc4))
+* **services:** Only create istio gateway with webmail domain ([6a39011](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/6a390112dab11afaca06118a0ca7a18afe633a30))
+* **services:** Use OCI registry for all services and add gpg verify mechanism ([892920b](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/892920b0487b41a35b5a96596c61101827e8dd6d))
+* **univention-corporate-container:** Use OCI registry and verify chart signatures ([424317e](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/424317ed585f7bd5036259d7e3d77d081d2aec1b))
+
+# [0.5.0](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.9...v0.5.0) (2023-09-27)
+
+
+### Bug Fixes
+
+* **element:** Move the static configuration into the values.yaml ([f22619b](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/f22619bd8ef11cb43147ef19dcff2c02d9fe0503))
+* **element:** Specify resources for the guest module init container ([275798c](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/275798c1d6aa47ef33fbb0da3bb03a86d3e4b0ee))
+
+
+### Features
+
+* **element:** Activate the guest module ([5ad25ac](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/5ad25acafd54d19dd2ed330b19f7860aff5d49f4))
+
+## [0.4.9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.8...v0.4.9) (2023-09-27)
+
+
+### Bug Fixes
+
+* **nextcloud:** Bump Helm chart to add app "groupfolders" ([62b767e](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/62b767ef38c8eae2874b20a9aa51e85d2a3fe5a3))
+
+## [0.4.8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.7...v0.4.8) (2023-09-26)
+
+
+### Bug Fixes
+
+* **openproject:** Digest rollback ([9acce08](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/9acce081397c06426820b61f39c9aa0dcc1234a5))
+
+## [0.4.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.6...v0.4.7) (2023-09-26)
+
+
+### Bug Fixes
+
+* **helmfile:** Add timeout for database services ([98ec02f](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/98ec02f230f1691eb8c17d8d3552fceda329bf7c))
+* **openproject:** Image digest ([b340373](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/b340373133ad973cfd6a3632adc9a74a23419cc7))
+
+## [0.4.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.5...v0.4.6) (2023-09-26)
+
+
+### Bug Fixes
+
+* **openproject:** Use renamed registry open_desk ([a37faf3](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/a37faf3b5769aea9944ffa7626096c16296dcc85))
+
+## [0.4.5](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.4...v0.4.5) (2023-09-26)
+
+
+### Bug Fixes
+
+* **helmfile:** Streamline timeouts ([2703615](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/2703615dffb2ba5c70704a4f08bb0485629218f3))
+
+## [0.4.4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.3...v0.4.4) (2023-09-25)
+
+
+### Bug Fixes
+
+* **open-xchange:** Updates for mail templates and mail export ([ae3d0da](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/ae3d0daa117d3d0ff307f379590394914a757546))
+
+## [0.4.3](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.2...v0.4.3) (2023-09-25)
+
+
+### Bug Fixes
+
+* **nextcloud:** Update image to 27.1.1 ([ce7e5f6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/ce7e5f670a4dbc980eb8be73e5f7d15b27e8b1de))
+
+## [0.4.2](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.1...v0.4.2) (2023-09-21)
+
+
+### Bug Fixes
+
+* **nextcloud:** Add Nextcloud app for OpenProject integration; Bump Collabora Image ([f46c8a9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/commit/f46c8a9a5f4f9778cb171d65e9a0280e4ce61c16))
+
 ## [0.4.1](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.0...v0.4.1) (2023-09-19)


--- a/README.md
+++ b/README.md
@@ -66,11 +66,12 @@ up your own instance for development purposes. Please see the project

 These are the requirements of the Sovereign Workplace deployment:

- Vanilla K8s cluster
+- K8s cluster >= 1.24, [CNCF Certified Kubernetes Distro](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
 - Ingress controller (supported are nginx-ingress, ingress-nginx, HAProxy)
- [Helm](https://helm.sh/), [HelmFile](https://helmfile.readthedocs.io/en/latest/) and
-[HelmDiff](https://github.com/databus23/helm-diff)
+- [Helm](https://helm.sh/) >= v3.9.0
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v0.157.0**
+- [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
 - Volume provisioner supporting RWO (read-write-once)
 - Certificate handling with [cert-manager](https://cert-manager.io/)
 - [Istio](https://istio.io/) is currently required to deploy and operate OX AppSuite8, we are talking to Open-Xchange and will try to get rid of this dependency.
@@ -155,6 +156,12 @@ and wait a little. After the deployment is finished some bootstrapping is
 executed which might take some more minutes before you can log in your new
 instance.

+Deployments can be removed with:
+
+```shell
+helmfile destroy -n <NAMESPACE>
+```
+
 ## Offline deployment

 Before executing a [local deployment](#local-deployment), you can set following
@@ -336,6 +343,10 @@ turn:

 ## Security

+This section summarizes various aspects of security and compliance aspects.
+
+### Kubernetes Security Enforcements
+
 This list gives you an overview of default security settings and if they comply with security standards:


@@ -365,6 +376,39 @@ This list gives you an overview of default security settings and if they comply
 | PostgreSQL | postgresql               | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |


+### Helm Chart Trust Chain
+
+Helm Charts which are released via openDesk CI/CD process are always signed. The public GPG keys are present in
+`pubkey.gpg` file and are validated during helmfile installation.
+
+| Repository                           | OCI |     Verifiable     |
+|--------------------------------------|:---:|:------------------:|
+| bitnami-repo (openDesk build)        | yes | :white_check_mark: |
+| clamav-repo                          | yes | :white_check_mark: |
+| collabora-online-repo                | no  |        :x:         |
+| intercom-service-repo                | yes | :white_check_mark: |
+| istio-resources-repo                 | yes | :white_check_mark: |
+| jitsi-repo                           | yes | :white_check_mark: |
+| keycloak-extensions-repo             | no  |        :x:         |
+| keycloak-theme-repo                  | yes | :white_check_mark: |
+| mariadb-repo                         | yes | :white_check_mark: |
+| nextcloud-repo                       | no  |        :x:         |
+| opendesk-certificates-repo           | yes | :white_check_mark: |
+| opendesk-dovecot-repo                | yes | :white_check_mark: |
+| opendesk-element-repo                | yes | :white_check_mark: |
+| opendesk-keycloak-bootstrap-repo     | yes | :white_check_mark: |
+| opendesk-nextcloud-bootstrap-repo    | yes | :white_check_mark: |
+| opendesk-open-xchange-bootstrap-repo | yes | :white_check_mark: |
+| openproject-repo                     | no  |        :x:         |
+| openxchange-repo                     | yes |        :x:         |
+| ox-connector-repo                    | no  |        :x:         |
+| postfix-repo                         | yes | :white_check_mark: |
+| postgresql-repo                      | yes | :white_check_mark: |
+| univention-corporate-container-repo  | yes | :white_check_mark: |
+| ums-repo                             | no  |        :x:         |
+| xwiki-repo                           | no  |        :x:         |
+
+
 # Component integration

 ## Functional use cases
--- a/helmfile.yaml
+++ b/helmfile.yaml
@@ -29,6 +29,7 @@ missingFileHandler: "Error"
 # - Installing a single release from root via helmfile apply -f helmfile/apps/<app>/helmfile.yaml
 # - Installing a single release from app directory via helmfile apply
 # Issue: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/-/issues/2
+
 environments:
  default:
    values:
@@ -39,9 +40,17 @@ environments:
      - "helmfile/environments/default/*.gotmpl"
      - "helmfile/environments/default/*.yaml"
      - "helmfile/environments/dev/values.yaml"
+      - "helmfile/environments/dev/values.gotmpl"
+  test:
+    values:
+      - "helmfile/environments/default/*.gotmpl"
+      - "helmfile/environments/default/*.yaml"
+      - "helmfile/environments/test/values.yaml"
+      - "helmfile/environments/test/values.gotmpl"
  prod:
    values:
      - "helmfile/environments/default/*.gotmpl"
      - "helmfile/environments/default/*.yaml"
      - "helmfile/environments/prod/values.yaml"
+      - "helmfile/environments/prod/values.gotmpl"
 ...
--- a/helmfile/apps/collabora/helmfile.yaml
+++ b/helmfile/apps/collabora/helmfile.yaml
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # Collabora Online
+  # Source: https://github.com/CollaboraOnline/online
  - name: "collabora-online-repo"
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
--- a/helmfile/apps/element/helmfile.yaml
+++ b/helmfile/apps/element/helmfile.yaml
@@ -2,15 +2,22 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # openDesk Element
+  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/sovereign-workplace-element
  - name: "opendesk-element-repo"
+    oci: true
+    # yamllint disable rule:line-length
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/148/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element" }}
+    # yamllint enable rule:line-length
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"

 releases:
  - name: "opendesk-element"
    chart: "opendesk-element-repo/opendesk-element"
-    version: "2.0.1"
+    version: "2.2.0"
    values:
      - "values-element.yaml"
      - "values-element.gotmpl"
@@ -18,7 +25,7 @@ releases:

  - name: "opendesk-well-known"
    chart: "opendesk-element-repo/opendesk-well-known"
-    version: "2.0.1"
+    version: "2.2.0"
    values:
      - "values-well-known.yaml"
      - "values-well-known.gotmpl"
@@ -26,7 +33,7 @@ releases:

  - name: "opendesk-synapse-web"
    chart: "opendesk-element-repo/opendesk-synapse-web"
-    version: "2.0.1"
+    version: "2.2.0"
    values:
      - "values-synapse-web.yaml"
      - "values-synapse-web.gotmpl"
@@ -34,7 +41,7 @@ releases:

  - name: "opendesk-synapse"
    chart: "opendesk-element-repo/opendesk-synapse"
-    version: "2.0.1"
+    version: "2.2.0"
    values:
      - "values-synapse.yaml"
      - "values-synapse.gotmpl"
--- a/helmfile/apps/element/values-synapse.gotmpl
+++ b/helmfile/apps/element/values-synapse.gotmpl
@@ -41,6 +41,13 @@ configuration:
          port: {{ .Values.turn.server.port }}
          transport: {{ .Values.turn.transport }}
        {{- end }}
+    
+    guestModule:
+      image:
+        imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
+        registry: "{{ .Values.global.imageRegistry }}"
+        repository: "{{ .Values.images.synapseGuestModule.repository }}"
+        tag: "{{ .Values.images.synapseGuestModule.tag }}"

 persistence:
  size: "{{ .Values.persistence.size.synapse }}"
--- a/helmfile/apps/element/values-synapse.yaml
+++ b/helmfile/apps/element/values-synapse.yaml
@@ -1,6 +1,11 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
+configuration:
+  homeserver:
+    guestModule:
+      enabled: false
+
 containerSecurityContext:
  allowPrivilegeEscalation: false
  capabilities:
--- a/helmfile/apps/intercom-service/helmfile.yaml
+++ b/helmfile/apps/intercom-service/helmfile.yaml
@@ -2,10 +2,15 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # Intercom Service
+  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
  - name: "intercom-service-repo"
+    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/66/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/intercom-service" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"

 releases:
  - name: "intercom-service"
--- a/helmfile/apps/jitsi/helmfile.yaml
+++ b/helmfile/apps/jitsi/helmfile.yaml
@@ -2,11 +2,16 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # openDesk Jitsi
+  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-jitsi
  - name: "jitsi-repo"
    oci: true
    url: >-
      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-jitsi" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+
 releases:
  - name: "jitsi"
    chart: "jitsi-repo/sovereign-workplace-jitsi"
@@ -14,6 +19,7 @@ releases:
    values:
      - "values-jitsi.gotmpl"
    condition: "jitsi.enabled"
+    timeout: 900

 commonLabels:
  deploy-stage: "component-1"
--- a/helmfile/apps/jitsi/values-jitsi.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.gotmpl
@@ -11,6 +11,9 @@ global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

+cleanup:
+  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+
 image:
  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  registry: "{{ .Values.global.imageRegistry }}"
--- a/helmfile/apps/keycloak-bootstrap/helmfile.yaml
+++ b/helmfile/apps/keycloak-bootstrap/helmfile.yaml
@@ -2,14 +2,21 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
-  - name: "sovereign-workplace-keycloak-bootstrap-repo"
+  # openDesk Keycloak Bootstrap
+  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-keycloak-bootstrap
+  - name: "opendesk-keycloak-bootstrap-repo"
+    oci: true
+    # yamllint disable rule:line-length
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/138/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-keycloak-bootstrap" }}
+    # yamllint enable rule:line-length
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"

 releases:
-  - name: "sovereign-workplace-keycloak-bootstrap"
-    chart: "sovereign-workplace-keycloak-bootstrap-repo/sovereign-workplace-keycloak-bootstrap"
+  - name: "opendesk-keycloak-bootstrap"
+    chart: "opendesk-keycloak-bootstrap-repo/sovereign-workplace-keycloak-bootstrap"
    version: "1.1.11"
    values:
      - "values-bootstrap.gotmpl"
--- a/helmfile/apps/keycloak-bootstrap/values-bootstrap.gotmpl
+++ b/helmfile/apps/keycloak-bootstrap/values-bootstrap.gotmpl
@@ -11,6 +11,10 @@ global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}

+cleanup:
+  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+
 config:
  administrator:
    password: "{{ .Values.secrets.keycloak.adminPassword }}"
--- a/helmfile/apps/keycloak-bootstrap/values-bootstrap.yaml
+++ b/helmfile/apps/keycloak-bootstrap/values-bootstrap.yaml
@@ -4,7 +4,4 @@
 config:
  administrator:
    username: "kcadmin"
-
-cleanup:
-  deletePodsOnSuccess: true
 ...
--- a/helmfile/apps/keycloak/helmfile.yaml
+++ b/helmfile/apps/keycloak/helmfile.yaml
@@ -2,15 +2,25 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # VMWare Bitnami
+  # Source: https://github.com/bitnami/charts/
  - name: "bitnami-repo"
    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "registry-1.docker.io/bitnamicharts" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/bitnami-charts" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # openDesk Keycloak Theme
+  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-keycloak-theme
  - name: "keycloak-theme-repo"
+    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/96/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/keycloak-theme" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # openDesk Keycloak Extensions
  - name: "keycloak-extensions-repo"
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
@@ -18,14 +28,14 @@ repositories:

 releases:
  - name: "keycloak-theme"
-    chart: "keycloak-theme-repo/sovereign-workplace-theme"
-    version: "1.1.0"
+    chart: "keycloak-theme-repo/opendesk-keycloak-theme"
+    version: "2.0.0"
    values:
      - "values-theme.gotmpl"
    condition: "keycloak.enabled"
  - name: "keycloak"
    chart: "bitnami-repo/keycloak"
-    version: "12.2.0"
+    version: "12.1.5"
    values:
      - "values-keycloak.gotmpl"
      - "values-keycloak.yaml"
--- a/helmfile/apps/nextcloud/helmfile.yaml
+++ b/helmfile/apps/nextcloud/helmfile.yaml
@@ -2,6 +2,9 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # openDesk Keycloak Bootstrap
+  # Source:
+  #  https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/sovereign-workplace-nextcloud-bootstrap
  - name: "opendesk-nextcloud-bootstrap-repo"
    oci: true
    # yamllint disable rule:line-length
@@ -9,6 +12,10 @@ repositories:
      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-nextcloud-bootstrap" }}
    # yamllint enable rule:line-length
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # Nextcloud
+  # Source: https://github.com/nextcloud/helm/
  - name: "nextcloud-repo"
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
@@ -17,14 +24,14 @@ repositories:
 releases:
  - name: "opendesk-nextcloud-bootstrap"
    chart: "opendesk-nextcloud-bootstrap-repo/opendesk-nextcloud-bootstrap"
-    version: "3.0.0"
+    version: "3.1.2"
    wait: true
    waitForJobs: true
    values:
      - "values-bootstrap.gotmpl"
      - "values-bootstrap.yaml"
    condition: "nextcloud.enabled"
-    timeout: 1800
+    timeout: 900

  - name: "nextcloud"
    chart: "nextcloud-repo/nextcloud"
@@ -35,7 +42,7 @@ releases:
      - "values-nextcloud.gotmpl"
      - "values-nextcloud.yaml"
    condition: "nextcloud.enabled"
-    timeout: 1800
+    timeout: 900

 commonLabels:
  deploy-stage: "component-1"
--- a/helmfile/apps/nextcloud/values-bootstrap.gotmpl
+++ b/helmfile/apps/nextcloud/values-bootstrap.gotmpl
@@ -43,6 +43,11 @@ config:
    username: "{{ .Values.smtp.username }}"
    password: "{{ .Values.smtp.password }}"

+cleanup:
+  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+
 image:
  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
  registry: "{{ .Values.global.imageRegistry }}"
--- a/helmfile/apps/nextcloud/values-bootstrap.yaml
+++ b/helmfile/apps/nextcloud/values-bootstrap.yaml
@@ -13,7 +13,4 @@ config:

  ldapSearch:
    host: "univention-corporate-container"
-
-cleanup:
-  deletePodsOnSuccess: false
 ...
--- a/helmfile/apps/open-xchange/helmfile.yaml
+++ b/helmfile/apps/open-xchange/helmfile.yaml
@@ -2,43 +2,60 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
-  - name: "dovecot-repo"
+  # openDesk Dovecot
+  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-dovecot
+  - name: "opendesk-dovecot-repo"
+    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/80/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
+         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/dovecot" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # Open-Xchange
  - name: "openxchange-repo"
    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "registry.open-xchange.com" }}
-  - name: "sovereign-workplace-open-xchange-bootstrap-repo"
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default "registry.open-xchange.com" }}
+  # openDesk Open-Xchange Bootstrap
+  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-open-xchange-bootstrap
+  - name: "opendesk-open-xchange-bootstrap-repo"
+    oci: true
+    # yamllint disable rule:line-length
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/139/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
+         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-open-xchange-bootstrap" }}
+    # yamllint enable rule:line-length
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"

 releases:
  - name: "dovecot"
-    chart: "dovecot-repo/dovecot"
+    chart: "opendesk-dovecot-repo/dovecot"
    version: "1.3.1"
    values:
      - "values-dovecot.yaml"
      - "values-dovecot.gotmpl"
    condition: "dovecot.enabled"
+    timeout: 900
+
  - name: "open-xchange"
    chart: "openxchange-repo/appsuite-public-sector/charts/appsuite-public-sector"
-    version: "2.0.3"
+    version: "2.0.4"
    values:
      - "values-openxchange.yaml"
      - "values-openxchange.gotmpl"
      - "values-openxchange-enterprise-contact-picker.yaml"
      - "values-openxchange-enterprise-contact-picker.gotmpl"
    condition: "oxAppsuite.enabled"
-  - name: "sovereign-workplace-open-xchange-bootstrap"
-    chart: "sovereign-workplace-open-xchange-bootstrap-repo/sovereign-workplace-open-xchange-bootstrap"
+    timeout: 900
+
+  - name: "opendesk-open-xchange-bootstrap"
+    chart: "opendesk-open-xchange-bootstrap-repo/sovereign-workplace-open-xchange-bootstrap"
    version: "1.3.1"
    values:
-      - "values-openxchange-bootstrap.yaml"
+      - "values-openxchange-bootstrap.gotmpl"
    condition: "oxAppsuite.enabled"
+    timeout: 900

 commonLabels:
  deploy-stage: "component-1"
--- a/helmfile/apps/open-xchange/values-openxchange-bootstrap.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-bootstrap.gotmpl
@@ -3,6 +3,10 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+cleanup:
+  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+
 image:
  registry: "{{ .Values.global.imageRegistry }}"
  url: "{{ .Values.images.openxchangeBootstrap.repository }}"
--- a/helmfile/apps/open-xchange/values-openxchange.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.gotmpl
@@ -53,6 +53,15 @@ appsuite:
  core-mw:
    masterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
    hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
+    gotenberg:
+      imagePullSecrets:
+      {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . }}
+      {{- end }}
+      image:
+        repository: {{ .Values.global.imageRegistry }}/{{ .Values.images.openxchangeGotenberg.repository }}
+        tag: {{ .Values.images.openxchangeGotenberg.tag }}
+        pullPolicy: "{{ .Values.global.imagePullPolicy }}"
    properties:
      "com.openexchange.oauth.provider.jwt.jwksUri": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/certs"
      "com.openexchange.oauth.provider.allowedIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap"
--- a/helmfile/apps/open-xchange/values-openxchange.yaml
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml
@@ -4,11 +4,13 @@
 appsuite:
  istio:
    ingressGateway:
-      name: "sovereign-workplace-gateway-istio-gateway"
+      name: "opendesk-gateway-istio-gateway"

  core-mw:
    enabled: true
    masterAdmin: "admin"
+    gotenberg:
+      enabled: true
    features:
      status:
        # enable admin pack
@@ -22,6 +24,13 @@ appsuite:
        open-xchange-authentication-oauth: "enabled"
    properties:
      com.openexchange.UIWebPath: "/appsuite/"
+      # PDF Export
+      com.openexchange.capability.mail_export_pdf: "true"
+      com.openexchange.mail.exportpdf.gotenberg.enabled: "true"
+      com.openexchange.mail.exportpdf.collabora.enabled: "true"
+      com.openexchange.mail.exportpdf.pdfa.collabora.enabled: "true"
+      com.openexchange.mail.exportpdf.collabora.url: "http://collabora:9980"
+      com.openexchange.mail.exportpdf.gotenberg.url: "http://open-xchange-gotenberg:3000"
      # OIDC
      com.openexchange.oidc.enabled: "true"
      com.openexchange.oidc.autologinCookieMode: "ox_direct"
@@ -120,6 +129,8 @@ appsuite:
      # io.ox.public-sector//ics/url: "https://ics.<DOMAIN>/"
      io.ox/core//apps/quickLaunchCount: "0"
      io.ox/core//coloredIcons: "false"
+      # Mail templates
+      io.ox/core//features/templates: "true"

    asConfig:
      default:
--- a/helmfile/apps/openproject/helmfile.yaml
+++ b/helmfile/apps/openproject/helmfile.yaml
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # OpenProject
+  # Source: https://github.com/opf/helm-charts
  - name: "openproject-repo"
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
--- a/helmfile/apps/openproject/values.gotmpl
+++ b/helmfile/apps/openproject/values.gotmpl
@@ -51,14 +51,15 @@ environment:
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_HOST: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_END__SESSION__ENDPOINT: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/logout"
-  OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey }}
+  OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
  OPENPROJECT_SMTP__DOMAIN: "{{ .Values.global.domain }}"
  OPENPROJECT_SMTP__USER__NAME: "{{ .Values.smtp.username }}"
  OPENPROJECT_SMTP__PASSWORD: "{{ .Values.smtp.password }}"
-  OPENPROJECT_SMTP__PORT: "587" # (default=587)
+  OPENPROJECT_SMTP__PORT: "{{ .Values.smtp.port }}"
  OPENPROJECT_SMTP__SSL: "false" # (default=false)
  OPENPROJECT_SMTP__ADDRESS: "{{ .Values.smtp.host }}"
+  OPENPROJECT_MAIL__FROM: "do-not-reply@{{ .Values.global.domain }}"
  # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: "{{ .Values.secrets.univentionCorporateServer.ldapSearch.openproject }}"

--- a/helmfile/apps/openproject/values.yaml
+++ b/helmfile/apps/openproject/values.yaml
@@ -34,12 +34,14 @@ environment:
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ATTRIBUTE__MAP_LOGIN: "phoenixusername"
  OPENPROJECT_LOGIN__REQUIRED: "true"
  OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
+  OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_DISPLAY__NAME: "Keycloak"
  OPENPROJECT_PER__PAGE__OPTIONS: "20, 50, 100, 200"
  OPENPROJECT_EMAIL__DELIVERY__METHOD: "smtp"
  OPENPROJECT_SMTP__AUTHENTICATION: "plain"
  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
+  OPENPROJECT_DEFAULT__COMMENT__SORT__ORDER: "desc"
  # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
  OPENPROJECT_SEED_LDAP_OPENDESK_HOST: "univention-corporate-container"
  OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
--- a/helmfile/apps/provisioning/helmfile.yaml
+++ b/helmfile/apps/provisioning/helmfile.yaml
@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # OX Connector
  - name: "ox-connector-repo"
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
--- a/helmfile/apps/services/helmfile.yaml
+++ b/helmfile/apps/services/helmfile.yaml
@@ -2,49 +2,82 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
-  - name: "sovereign-workplace-certificates-repo"
+  # openDesk Certificates
+  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-certificates
+  - name: "opendesk-certificates-repo"
+    oci: true
+    # yamllint disable rule:line-length
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/133/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-certificates" }}
+    # yamllint enable rule:line-length
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # openDesk PostgreSQL
+  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-postgresql
  - name: "postgresql-repo"
    oci: true
    url: >-
      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/postgresql" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # openDesk MariaDB
+  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-mariadb
  - name: "mariadb-repo"
    oci: true
    url: >-
      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/mariadb" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # openDesk Postfix
+  # https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-postfix
  - name: "postfix-repo"
+    oci: true
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/85/packages/helm/stable" }}
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/postfix" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # openDesk Istio Resources
+  # https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-istio-resources
  - name: "istio-resources-repo"
+    oci: true
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/69/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/istio-ressources" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # openDesk ClamAV
+  # https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-clamav
  - name: "clamav-repo"
    oci: true
    url: >-
      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/clamav" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+  # VMWare Bitnami
+  # Source: https://github.com/bitnami/charts/
  - name: "bitnami-repo"
    oci: true
    url: >-
      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "registry-1.docker.io/bitnamicharts" }}
+         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/bitnami-charts" }}
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"

 releases:
-  - name: "sovereign-workplace-certificates"
-    chart: "sovereign-workplace-certificates-repo/sovereign-workplace-certificates"
-    version: "1.2.2"
+  - name: "opendesk-certificates"
+    chart: "opendesk-certificates-repo/opendesk-certificates"
+    version: "2.1.0"
    values:
      - "values-certificates.gotmpl"
    condition: "certificates.enabled"
  - name: "redis"
    chart: "bitnami-repo/redis"
-    version: "18.0.4"
+    version: "18.1.2"
    values:
      - "values-redis.gotmpl"
      - "values-redis.yaml"
@@ -56,13 +89,15 @@ releases:
      - "values-postgresql.yaml"
      - "values-postgresql.gotmpl"
    condition: "postgresql.enabled"
+    timeout: 900
  - name: "mariadb"
    chart: "mariadb-repo/mariadb"
-    version: "2.1.0"
+    version: "2.0.2"
    values:
      - "values-mariadb.yaml"
      - "values-mariadb.gotmpl"
    condition: "mariadb.enabled"
+    timeout: 900
  - name: "postfix"
    chart: "postfix-repo/postfix"
    version: "2.0.3"
@@ -84,9 +119,9 @@ releases:
      - "values-clamav-simple.yaml"
      - "values-clamav-simple.gotmpl"
    condition: "clamavSimple.enabled"
-  - name: "sovereign-workplace-gateway"
+  - name: "opendesk-gateway"
    chart: "istio-resources-repo/istio-gateway"
-    version: "1.1.2"
+    version: "2.0.0"
    values:
      - "values-istio-gateway.yaml"
      - "values-istio-gateway.gotmpl"
--- a/helmfile/apps/services/values-certificates.gotmpl
+++ b/helmfile/apps/services/values-certificates.gotmpl
@@ -18,4 +18,9 @@ istio:
  issuerRef:
    name: "{{ .Values.istio.issuerRef.name }}"
 {{- end }}
+
+cleanup:
+  keepRessourceOnDelete: {{ .Values.cleanup.keepRessourceOnDelete }}
+
+wildcard: {{ .Values.certificate.wildcard }}
 ...
--- a/helmfile/apps/services/values-istio-gateway.gotmpl
+++ b/helmfile/apps/services/values-istio-gateway.gotmpl
@@ -6,7 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 global:
  domain: "{{ .Values.istio.domain }}"
  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
+    openxchange: "{{ .Values.global.hosts.openxchange }}"

 tls:
  secretName: "{{ .Values.istio.domain }}-tls"
--- a/helmfile/apps/univention-corporate-container/helmfile.yaml
+++ b/helmfile/apps/univention-corporate-container/helmfile.yaml
@@ -2,10 +2,16 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # openDesk Univention Corporate Server (as eval Container)
  - name: "univention-corporate-container-repo"
+    oci: true
+    # yamllint disable rule:line-length
    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "https://gitlab.souvap-univention.de/api/v4/projects/132/packages/helm/stable" }}
+      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
+         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/univention-corporate-container" }}
+    # yamllint enable rule:line-length
+    verify: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"

 releases:
  - name: "univention-corporate-container"
--- a/helmfile/apps/univention-management-stack/helmfile.yaml
+++ b/helmfile/apps/univention-management-stack/helmfile.yaml
@@ -5,14 +5,15 @@ bases:
  - "../../bases/environments.yaml"

 repositories:
-  - name: "univention"
+  # Univention Management Stack
+  - name: "ums-repo"
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
         default "https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable" }}

 releases:
  - name: "ums-store-dav"
-    chart: "univention/store-dav"
+    chart: "ums-repo/store-dav"
    version: "0.2.0"
    values:
      - "values-common.gotmpl"
@@ -20,7 +21,7 @@ releases:
      - "values-store-dav.gotmpl"
    condition: "univentionManagementStack.enabled"
  - name: "ums-ldap-server"
-    chart: "univention/ldap-server"
+    chart: "ums-repo/ldap-server"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -28,7 +29,7 @@ releases:
      - "values-ldap-server.gotmpl"
    condition: "univentionManagementStack.enabled"
  - name: "ums-ldap-notifier"
-    chart: "univention/ldap-notifier"
+    chart: "ums-repo/ldap-notifier"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -37,7 +38,7 @@ releases:
      - "values-ldap-notifier.yaml"
    condition: "univentionManagementStack.enabled"
  - name: "ums-udm-rest-api"
-    chart: "univention/udm-rest-api"
+    chart: "ums-repo/udm-rest-api"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -45,7 +46,7 @@ releases:
      - "values-udm-rest-api.gotmpl"
    condition: "univentionManagementStack.enabled"
  - name: "ums-stack-data-ums"
-    chart: "univention/stack-data-ums"
+    chart: "ums-repo/stack-data-ums"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -53,7 +54,7 @@ releases:
      - "values-stack-data-ums.gotmpl"
    condition: "univentionManagementStack.enabled"
  - name: "ums-stack-data-swp"
-    chart: "univention/stack-data-swp"
+    chart: "ums-repo/stack-data-swp"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -61,7 +62,7 @@ releases:
      - "values-stack-data-swp.gotmpl"
    condition: "univentionManagementStack.enabled"
  - name: "ums-portal-server"
-    chart: "univention/portal-server"
+    chart: "ums-repo/portal-server"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -69,7 +70,7 @@ releases:
      - "values-portal-server.gotmpl"
    condition: "univentionManagementStack.enabled"
  - name: "ums-notifications-api"
-    chart: "univention/notifications-api"
+    chart: "ums-repo/notifications-api"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -78,7 +79,7 @@ releases:
      - "values-notifications-api.yaml"
    condition: "univentionManagementStack.enabled"
  - name: "ums-portal-listener"
-    chart: "univention/portal-listener"
+    chart: "ums-repo/portal-listener"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -87,7 +88,7 @@ releases:
      - "values-portal-listener.yaml"
    condition: "univentionManagementStack.enabled"
  - name: "ums-portal-frontend"
-    chart: "univention/portal-frontend"
+    chart: "ums-repo/portal-frontend"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -95,7 +96,7 @@ releases:
      - "values-portal-frontend.gotmpl"
    condition: "univentionManagementStack.enabled"
  - name: "ums-umc-gateway"
-    chart: "univention/umc-gateway"
+    chart: "ums-repo/umc-gateway"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
@@ -104,7 +105,7 @@ releases:
      - "values-umc-gateway.yaml"
    condition: "univentionManagementStack.enabled"
  - name: "ums-umc-server"
-    chart: "univention/umc-server"
+    chart: "ums-repo/umc-server"
    version: "0.1.0"
    values:
      - "values-common.gotmpl"
--- a/helmfile/apps/xwiki/helmfile.yaml
+++ b/helmfile/apps/xwiki/helmfile.yaml
@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
+  # XWiki
+  # Source: https://github.com/xwiki-contrib/xwiki-helm
  - name: "xwiki-repo"
    url: >-
      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
@@ -12,11 +14,11 @@ releases:
    chart: "xwiki-repo/xwiki"
    version: "1.1.3"
    wait: true
-    timeout: 600
    values:
      - "values.yaml"
      - "values.gotmpl"
    condition: "xwiki.enabled"
+    timeout: 900

 commonLabels:
  deploy-stage: "component-1"
--- a/helmfile/bases/environments.yaml
+++ b/helmfile/bases/environments.yaml
@@ -11,9 +11,17 @@ environments:
      - "../../environments/default/*.gotmpl"
      - "../../environments/default/*.yaml"
      - "../../environments/dev/values.yaml"
+      - "../../environments/dev/values.gotmpl"
+  test:
+    values:
+      - "../../environments/default/*.gotmpl"
+      - "../../environments/default/*.yaml"
+      - "../../environments/test/values.yaml"
+      - "../../environments/test/values.gotmpl"
  prod:
    values:
      - "../../environments/default/*.gotmpl"
      - "../../environments/default/*.yaml"
      - "../../environments/prod/values.yaml"
+      - "../../environments/prod/values.gotmpl"
 ...
--- a/helmfile/environments/default/certificate.yaml
+++ b/helmfile/environments/default/certificate.yaml
@@ -4,4 +4,5 @@
 certificate:
  issuerRef:
    name: "letsencrypt-prod"
+  wildcard: false
 ...
--- a/helmfile/environments/default/debug.yaml
+++ b/helmfile/environments/default/debug.yaml
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+cleanup:
+  # Keep Pods/Job logs after successful run.
+  deletePodsOnSuccess: true
+  # When deletePodsOnSuccess is enabled, the pod will be deleted after configured seconds.
+  deletePodsOnSuccessTimeout: 60
+  # Keep persistence on deletion of this release.
+  keepPVCOnDelete: false
+  # Keep additional resources, like certificates on deletion of this release.
+  keepRessourceOnDelete: true
+...
--- a/helmfile/environments/default/images.yaml
+++ b/helmfile/environments/default/images.yaml
@@ -5,165 +5,228 @@ images:
  clamd:
    repository: "clamav/clamav"
    tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
+    # @supplier: "openDesk DevSecOps"
  collabora:
    repository: "souvap/tooling/images/collabora"
-    tag: "23.05.3.1.1@sha256:f1248a50e67940e3be3dfa58dc37eca73267cf73a679b459707d2520cee7720e"
+    tag: "23.05.4.2.1@sha256:ee9ce83811700f1ff57e1218d22388dbaca96306df33f82aa14b334c5302285a"
+    # @supplier: "Collabora"
  dovecot:
    repository: "dovecot/dovecot"
    tag: "2.3.20@sha256:96d414aa3f6978669b417f6468c16313a54ee6143a4846870e9f0eda280806e7"
+    # @supplier: "Open-Xchange"
  element:
    repository: "souvap/tooling/images/element-web"
-    tag: "latest@sha256:16506bba9da546b1bf5896892f6f4afefea3d0f1d8ed93eae511212627a029b9"
+    tag: "1.1.0@sha256:4fc2df523090cf012b50a681c92482f61231baf4cce67de467dd9f79c181bc93"
+    # @supplier: "Element"
  freshclam:
    repository: "clamav/clamav"
    tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
+    # @supplier: "openDesk DevSecOps"
  jibri:
    repository: "jitsi/jibri"
    tag: "stable-8922@sha256:87aa176b44b745b13769f13b8e2d22ddd6f6ba624244d5354c8dd3664787e936"
+    # @supplier: "Nordeck"
  jicofo:
    repository: "jitsi/jicofo"
    tag: "stable-8922@sha256:820fcd4b072b29f42c1c37389fbefda1065f1e9654694941485dc08123c8a93b"
+    # @supplier: "Nordeck"
  jitsi:
    repository: "jitsi/web"
    tag: "stable-8922@sha256:24bd4179998fe01ace1be74e53fea5308f4d91722953bb4334611e6886753f46"
+    # @supplier: "Nordeck"
  jitsiKeycloakAdapter:
    repository: "nordeck/jitsi-keycloak-adapter"
    tag: "v20230906@sha256:54d45ee1a1205f98641810ffb171bd92e6478e2957a349ee4ff599359239fbf2"
+    # @supplier: "Nordeck"
  jitsiPatchJVB:
    repository: "bitnami/kubectl"
    tag: "1.26.8@sha256:c6902a1fdce0a24c9f93ac8d1f317039b206a4b307d8fc76cab4a92911345757"
+    # @supplier: "Nordeck"
  jvb:
    repository: "jitsi/jvb"
    tag: "stable-8922@sha256:75dd613807e19cbbd440d071b60609fa9e4ee50a1396b14deb0ed779d882a554"
+    # @supplier: "Nordeck"
  icap:
    repository: "souvap/tooling/images/c-icap"
    tag: "0.5.10@sha256:cd665e77a42460bb1e6df4282bc1d8737be241fc9f4143d43509e31de3a7993d"
+    # @supplier: "openDesk DevSecOps"
  intercom:
    repository: "univention/intercom-service"
    tag: "1.4-kubernetes@sha256:e4fa2e0df49595bf9ba5bf73e36a50e8f1b44334a1a326a43488b8f9c8bbcb9c"
+    # @supplier: "Univention"
  keycloak:
    repository: "bitnami/keycloak"
    tag: "19.0.3-debian-11-r22@sha256:4ac04104d20d4861ecca24ff2d07d71b34a98ee1148c6e6b6e7969a6b2ad085e"
+    # @supplier: "Univention"
  keycloakBootstrap:
    repository: "souvap/tooling/images/ansible"
    tag: "4.10.0@sha256:89d8212c20e03b0fd079e08afaf3247c1b96b380c4db1b572d68d0b4a6abc0ac"
+    # @supplier: "Univention"
  keycloakExtensionHandler:
    repository: "souvap/tooling/images/keycloak-extensions/keycloak-handler"
    tag: "latest@sha256:e67bdfc655e43b7fb83b025e13f949b04fdd98e089b33401275d03e340e03e2e"
+    # @supplier: "Univention"
  keycloakExtensionProxy:
    repository: "souvap/tooling/images/keycloak-extensions/keycloak-proxy"
    tag: "latest@sha256:57026fb4ba7d4579461e7ddd4b1b8ce9585d1cac4adbe64040f5e1063c80a6ba"
+    # @supplier: "Univention"
  mariadb:
    repository: "mariadb"
-    tag: "11.1.2-jammy@sha256:b6440c4f4e1471bdcee202e4c4e21c1f93af87421f6d33028363dd224e54f481"
+    # For upgrades at least confirm compatibility of target version with OX (regarding AS Guard)
+    tag: "10.5@sha256:aa1ccc18000c32d1f39ac0b055117b27bffd93e622ec961d682de40fe2a1a95f"
+    # @supplier: "openDesk DevSecOps"
  memcached:
    repository: "bitnami/memcached"
    tag: "1.6.21-debian-11-r84@sha256:81747acd297d3fcd05706ea771d441a6f01b28d722c366a06f922b6b7d4033dd"
+    # @supplier: "OpenProject"
  milter:
    repository: "clamav/clamav"
    tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
+    # @supplier: "openDesk DevSecOps"
  nextcloud:
    repository: "nextcloud"
-    tag: "26.0.5-apache@sha256:2a129ba3258300424319e7023e8e60c28d79178ae4143e7ba2d41148646c30e1"
+    tag: "27.1.1-apache@sha256:47325758ffcd54563021e697905aaba6aac8c21bceefb245c67d40194813ce39"
+    # @supplier: "Nextcloud Community"
  openproject:
-    repository: "souvap/tooling/images/openproject/souvap"
-    tag: "dev@sha256:03eb1eacc0c0c4e9e7d0f0c3d265fd0c15fd01cda33bc4f89cbc487ad53474a8"
+    repository: "souvap/tooling/images/openproject/opendesk"
+    tag: "fat-dev@sha256:e5d0fb5125df968ba98cb3005b7051ddff25b05da54922c94bb2ee61e6ec842c"
+    # @supplier: "OpenProject"
  openxchangeBootstrap:
    repository: "alpine/k8s"
    tag: "1.26.8@sha256:acde24d2a8ebaafda76f464591a5ddc7d0acd08bb38b12560961c1b1c4fc85ec"
+    # @supplier: "Open-Xchange"
  openxchangeCoreGuidedtours:
    repository: "appsuite-public-sector/core-guidedtours"
    tag: "8.5.1@sha256:469457562a378cca50460e08d9437a954fc6f19622f18128fa74979f7905ecd9"
+    # @supplier: "Open-Xchange"
  openxchangeCoreMW:
    repository: "appsuite-public-sector/middleware-public-sector"
-    tag: "8.16.55@sha256:11317124714725d61204188ebfebc2220f295fd59b245adcef0b6c3186a68fd3"
+    tag: "8.16.60@sha256:269c5b72f380c49ba1888c4300c409745d2ce757ca0b269afe1e8ac9bb26f028"
+    # @supplier: "Open-Xchange"
  openxchangeCoreUI:
    repository: "appsuite-public-sector/core-ui"
    tag: "8.16.5@sha256:4f4dd4e36fb8a1b493c195e38e2f13b87c9582bfcdc3d23b646698fce2ffef8c"
+    # @supplier: "Open-Xchange"
  openxchangeCoreUIMiddleware:
    repository: "appsuite-public-sector/core-ui-middleware"
    tag: "1.8.4@sha256:c707fbd5496c894f201dab8f4e78aad98f1ad80c8058778f04dfa5e6e201ed64"
+    # @supplier: "Open-Xchange"
  openxchangeCoreUserGuide:
    repository: "appsuite-public-sector/core-user-guide"
    tag: "8.16.727397@sha256:5d8dbf9a91456dea59a235b495dcd002b971e2b23ef6c3a2ea5fd2071664e2a4"
+    # @supplier: "Open-Xchange"
  openxchangeGuardUI:
    repository: "appsuite-public-sector/guard-ui"
    tag: "4.0.6@sha256:7bb8fdf944228dd78a5c33bbd8d0019d5a9e4ce1c35bda674166f2febc5d9a02"
+    # @supplier: "Open-Xchange"
  openxchangeNextcloudIntegrationUI:
    repository: "appsuite-public-sector/nextcloud-integration-ui"
-    tag: "1.0.3@sha256:193fd07a8b83164d175cd55f7e28fb7ec6d81f1037945035ca709825725c038e"
+    tag: "1.0.5@sha256:cad4ecba431f84b8627d2e541cfea773d5ef54b65d847fa8f7e3fd0d63156497"
+    # @supplier: "Open-Xchange"
  openxchangePublicSectorUI:
    repository: "appsuite-public-sector/public-sector-ui"
    tag: "2.0.1@sha256:8df90f6dfb59008567d8ded0dbd17b8f92f409c78ba2cf4ab2a39e1b23e34d3b"
+    # @supplier: "Open-Xchange"
+  openxchangeGotenberg:
+    repository: "appsuite-public-sector/3rdparty/gotenberg"
+    tag: "7.8.2@sha256:34af7b6d21c02b8183785177f5f3f1731633d72ec69e1f2ecdb8b43747887f62"
+    # @supplier: "Open-Xchange"
  oxConnector:
    repository: "souvap/tooling/images/ox-connector/ox-connector-standalone"
    tag:
      "branch-jconde-listener-entrypoint-chaining\
      @sha256:54748d49e37d52529d4a857ff834d1217bd2cb8c89c7eed25c0873159ed6853c"
+    # @supplier: "Univention"
  postfix:
    repository: "souvap/tooling/images/postfix"
    tag: "1.0.0@sha256:69e0c53ade77ffb89673672f5c8183ec2edfc81d4e990aca3ec594f33c55a7ac"
+    # @supplier: "openDesk DevSecOps"
  postgresql:
    repository: "postgres"
    tag: "15.4-alpine3.18@sha256:f36c528a2dc8747ea40b4cb8578da69fa75c5063fd6a71dcea3e3b2a6404ff7b"
+    # @supplier: "openDesk DevSecOps"
  prosody:
    repository: "jitsi/prosody"
    tag: "stable-8922@sha256:243547f24ae7d686d1f0c18ee230cf93119a66f095dda282bacbf45d4bb69f77"
+    # @supplier: "Nordeck"
  redis:
    repository: "bitnami/redis"
    tag: "7.2.1-debian-11-r5@sha256:e664fa63dfe88cd099180c32f2c9a109a958f053b75d195beb48b06ffd8a0b5b"
+    # @supplier: "openDesk DevSecOps"
  synapse:
    repository: "matrixdotorg/synapse"
    tag: "v1.91.2@sha256:1d19508db417bb2b911c8e086bd3dc3b719ee75c6f6194d58af59b4c32b11322"
+    # @supplier: "Element"
+  synapseGuestModule:
+    repository: "nordeck/synapse-guest-module"
+    tag: "1.0.0@sha256:e9c736d84a77df93b2dbe3e3afa7b0ca3efcbc4457677adaac5df3cc79a85923"
+    # @supplier: "Nordeck"
  synapseWeb:
    repository: "rapidfort/haproxy-official"
    tag: "2.6.6-bullseye@sha256:bf22cfb1301aae433213f5f8c687bc5d9ecc6b86daf1084be5f7a339bd27cadd"
+    # @supplier: "Element"
  univentionCorporateServer:
    repository: "souvap/tooling/images/univention-corporate-server-swp/ucs"
    tag: "20230829T094822@sha256:6415847851ee3b474cea756212698f4a110fbbde74882e22da92500a6358a4f8"
+    # @supplier: "Univention"
  umsConfigHtpasswd:
    repository: "souvap/tooling/images/univention/config-htpasswd"
-    tag: "latest@sha256:24c5e218baa62b169e7222d8ee4d3951ddc8622cd359def6b660bb23a1052f9e"
+    tag: "latest"
+    # @supplier: "Univention"
  umsDataLoader:
    repository: "souvap/tooling/images/univention/data-loader"
-    tag: "latest@sha256:857837c1810f82362d441544dc32bd2c1d6fe358bbb5ae0e2c60b7f8f4092190"
+    tag: "latest"
+    # @supplier: "Univention"
  umsLdapNotifier:
    repository: "souvap/tooling/images/univention/ldap-notifier"
-    tag: "latest@sha256:6eccf86fe78926247ec9b59d7ba83c53271bc3ca7d0195863c0489e22c836002"
+    tag: "latest"
+    # @supplier: "Univention"
  umsLdapServer:
    repository: "souvap/tooling/images/univention/ldap-server"
-    tag: "latest@sha256:4a7c44b37c727cdc03e4043c88e3dbf6b1f119772c5c1904eaed3298bdd49a3d"
+    tag: "latest"
+    # @supplier: "Univention"
  umsNotificationsApi:
    repository: "souvap/tooling/images/univention/notifications-api"
-    tag: "latest@sha256:87a047c2d0669fcbb3501ef94192812e17e09aecabc1edd2e4b92afbb7ea4b20"
+    tag: "latest"
+    # @supplier: "Univention"
  umsPortalListener:
    repository: "souvap/tooling/images/univention/portal-listener"
-    tag: "latest@sha256:bcf48d108bc2f1afd745659a1d4f11f1dd0d8ada034899aa401dfea32a29c87a"
+    tag: "latest"
+    # @supplier: "Univention"
  umsPortalFrontend:
    repository: "souvap/tooling/images/univention/portal-frontend"
-    tag: "latest@sha256:a1b11db009e992d91cfef2bc60a5022cd4498c38908194020c881ef6dd325bae"
+    tag: "latest"
+    # @supplier: "Univention"
  umsPortalServer:
    repository: "souvap/tooling/images/univention/portal-server"
-    tag: "latest@sha256:eb0b032c4cf4b207f78b80c69f3e593e01e577779d877e16908902f19b4fc2ee"
+    tag: "latest"
+    # @supplier: "Univention"
  umsWaitForDependency:
    repository: "souvap/tooling/images/univention/wait-for-dependency"
-    tag: "latest@sha256:5d8d5e9ed55af2d12fef25856e5e61c7d13081458e4b14e6a01b10488b8067d3"
+    tag: "latest"
+    # @supplier: "Univention"
  umsStoreDav:
    repository: "souvap/tooling/images/univention/store-dav"
-    tag: "latest@sha256:d65f705e46a497ba58e7373f19973835f731796baeace16a32d6331469bf0068"
+    tag: "latest"
+    # @supplier: "Univention"
  umsUdmRestApi:
    repository: "souvap/tooling/images/univention/udm-rest-api"
-    tag: "latest@sha256:dce4322646749692c5d4692ccd7ff55df080a4af3485585a50c82871715e0cae"
+    tag: "latest"
+    # @supplier: "Univention"
  umsUmcGateway:
    repository: "souvap/tooling/images/univention/umc-gateway"
-    tag: "latest@sha256:18172ee4317a9259291f251c0cc1d2be05e003558cbd18d6dc062098a127cc8d"
+    tag: "latest"
+    # @supplier: "Univention"
  umsUmcServer:
    repository: "souvap/tooling/images/univention/umc-server"
-    tag: "latest@sha256:6cbb1708109c5a0c13f3ee433989094d04cecfb8b32975e723d0f5a2e526f8db"
+    tag: "latest"
+    # @supplier: "Univention"
  wellKnown:
    repository: "library/nginx"
    tag: "1.25.2-bookworm@sha256:9504f3f64a3f16f0eaf9adca3542ff8b2a6880e6abfb13e478cca23f6380080a"
+    # @supplier: "Element"
  xwiki:
    repository: "xwikisas/swp/xwiki"
    tag: "0.10-mariadb-tomcat@sha256:02f0ff6407ccdd8dab17814202e28991fe0aa8d44fa106ba171cff5249eaf58f"
+    # @supplier: "XWiki"
 ...
--- a/helmfile/environments/default/ingress.yaml
+++ b/helmfile/environments/default/ingress.yaml
@@ -6,5 +6,5 @@ ingress:
  ingressClassName: ""
  tls:
    enabled: true
-    secretName: "sovereign-workplace-certificates-tls"
+    secretName: "opendesk-certificates-tls"
 ...
--- a/helmfile/environments/dev/values.gotmpl.sample
+++ b/helmfile/environments/dev/values.gotmpl.sample
@@ -0,0 +1,8 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
+
+...
--- a/helmfile/environments/prod/values.gotmpl.sample
+++ b/helmfile/environments/prod/values.gotmpl.sample
@@ -0,0 +1,8 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
+
+...
--- a/helmfile/environments/test/values.gotmpl.sample
+++ b/helmfile/environments/test/values.gotmpl.sample
@@ -0,0 +1,8 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+sampleWithTemplating: {{ env "YOUR_ENV_VARIABLE_FOR_TEMPLATING" | quote }}
+
+...
--- a/helmfile/environments/test/values.yaml.sample
+++ b/helmfile/environments/test/values.yaml.sample
@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+# This a sample file and could be filled with proper variable overload.
+sample: true
+...
--- a/helmfile/files/gpg-pubkeys/souvap-univention-de.gpg
+++ b/helmfile/files/gpg-pubkeys/souvap-univention-de.gpg
--- a/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml
+++ b/helmfile/apps/open-xchange/values-openxchange-bootstrap.yaml
@@ -1,6 +1,2 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
---
-cleanup:
-  deletePodsOnSuccess: true
-...
Author	SHA1	Message	Date
Thorsten Roßner	b1d4b2d8ea	chore(release): 0.5.7 [skip ci] ## [0.5.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.6...v0.5.7) (2023-10-09) ### Bug Fixes * openproject: Mail sender address ([`711d29e`](`711d29e374`))	2023-10-09 09:41:26 +00:00
Thorsten Roßner	711d29e374	fix(openproject): Mail sender address	2023-10-09 09:31:39 +00:00
Thorsten Roßner	0ba7be2a5f	chore(release): 0.5.6 [skip ci] ## [0.5.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.5...v0.5.6) (2023-10-09) ### Bug Fixes * helmfile: Use signed bitnami charts from openDesk Mirror Builds ([`70744d0`](`70744d04c6`)) * services: Bump redis chart to 18.1.2 ([`d4c751d`](`d4c751d29f`))	2023-10-09 09:30:56 +00:00
Dominik Kaminski	d4c751d29f	fix(services): Bump redis chart to 18.1.2	2023-10-09 11:19:50 +02:00
Dominik Kaminski	70744d04c6	fix(helmfile): Use signed bitnami charts from openDesk Mirror Builds	2023-10-09 11:19:50 +02:00
Thorsten Roßner	e4e6d2d60a	chore(release): 0.5.5 [skip ci] ## [0.5.5](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.4...v0.5.5) (2023-10-09) ### Bug Fixes * openproject: Switch image to fix central navigation; set email sender address ([`e42feb4`](`e42feb4c26`))	2023-10-09 07:24:26 +00:00
Thorsten Rossner	e42feb4c26	fix(openproject): Switch image to fix central navigation; set email sender address	2023-10-09 07:22:35 +00:00
Thorsten Roßner	f12c2ed0c2	chore(release): 0.5.4 [skip ci] ## [0.5.4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.3...v0.5.4) (2023-10-02) ### Bug Fixes * helmfile: Add third environment (test) ([`7dbcbfe`](`7dbcbfe723`))	2023-10-02 11:21:03 +00:00
Thorsten Rossner	7dbcbfe723	fix(helmfile): Add third environment (test)	2023-10-02 11:19:29 +00:00
Thorsten Roßner	1d8a0ccf1a	chore(release): 0.5.3 [skip ci] ## [0.5.3](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.2...v0.5.3) (2023-09-28) ### Bug Fixes * open-xchange: Rollback MariaDB version to fix OX Guard initialization ([`e33acd3`](`e33acd33e7`))	2023-09-28 16:38:21 +00:00
Thorsten Rossner	e33acd33e7	fix(open-xchange): Rollback MariaDB version to fix OX Guard initialization	2023-09-28 16:36:28 +00:00
Thorsten Roßner	74e206694e	chore(release): 0.5.2 [skip ci] ## [0.5.2](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.1...v0.5.2) (2023-09-28) ### Bug Fixes * ci: Add Gitlab-CI sledgehammer deployment removal ([`6fd655a`](`6fd655a0b1`))	2023-09-28 09:06:20 +00:00
Dominik Kaminski	6fd655a0b1	fix(ci): Add Gitlab-CI sledgehammer deployment removal	2023-09-28 10:01:01 +02:00
Thorsten Roßner	d4c39025b6	chore(release): 0.5.1 [skip ci] ## [0.5.1](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.5.0...v0.5.1) (2023-09-28) ### Bug Fixes * docs: Add 'Helm Chart Trust Chain' section ([`b6b4972`](`b6b4972a5d`)) * docs: Highlight that Helmfile >= 0.157.0 is required ([`d86f516`](`d86f516747`)) * element: Use OCI registry and verify chart signatures ([`a41b9a6`](`a41b9a699c`)) * helmfile: Add cleanup flag for job resources ([`0f01b94`](`0f01b94aa1`)) * helmfile: Create directory for gpg pubkeys ([`4c5731e`](`4c5731e6bb`)) * intercom-service: Use OCI registry and verify chart signatures ([`74b3d41`](`74b3d41381`)) * jitsi: Verify chart signatures ([`1dd6582`](`1dd6582ec7`)) * keycloak-bootstrap: Use OCI registry and verify chart signatures ([`ca5d5f8`](`ca5d5f8280`)) * keycloak: Use OCI registry and verify chart signatures ([`095059c`](`095059c7e5`)) * nextcloud: Use OCI registry and verify chart signatures ([`41dfdc0`](`41dfdc0c8f`)) * open-xchange: Use OCI registry and verify chart signatures ([`2d5d370`](`2d5d3708f7`)) * open-xchange: Use renamed istio gateway ([`65d2642`](`65d2642d34`)) * openproject: Use OCI registry and verify chart signatures ([`5343840`](`5343840bed`)) * services: Add wildcard certifcate request support ([`15ad8ca`](`15ad8ca7ab`)) * services: Bump opendesk-certificates to 2.1.0 ([`4372f06`](`4372f063e0`)) * services: Only create istio gateway with webmail domain ([`6a39011`](`6a390112da`)) * services: Use OCI registry for all services and add gpg verify mechanism ([`892920b`](`892920b048`)) * univention-corporate-container: Use OCI registry and verify chart signatures ([`424317e`](`424317ed58`))	2023-09-28 07:23:23 +00:00
Dominik Kaminski	d86f516747	fix(docs): Highlight that Helmfile >= 0.157.0 is required	2023-09-28 09:00:34 +02:00
Dominik Kaminski	4c5731e6bb	fix(helmfile): Create directory for gpg pubkeys	2023-09-28 08:41:49 +02:00
Dominik Kaminski	6a390112da	fix(services): Only create istio gateway with webmail domain	2023-09-27 22:13:39 +02:00
Dominik Kaminski	65d2642d34	fix(open-xchange): Use renamed istio gateway	2023-09-27 22:03:41 +02:00
Dominik Kaminski	55f73924df	chore(univention-corporate-container): Add missing OCI flag	2023-09-27 21:49:13 +02:00
Dominik Kaminski	11cc708f6e	chore(open-xchange): Remove duplicate default key	2023-09-27 21:48:55 +02:00
Dominik Kaminski	b6b4972a5d	fix(docs): Add 'Helm Chart Trust Chain' section	2023-09-27 20:55:41 +02:00
Dominik Kaminski	2e3f5f6e53	chore(xwiki): Add source to repo description	2023-09-27 20:55:41 +02:00
Dominik Kaminski	3da2aaaed9	chore(univention-management-stack): Rename repostory to ums-repo	2023-09-27 20:55:41 +02:00
Dominik Kaminski	424317ed58	fix(univention-corporate-container): Use OCI registry and verify chart signatures	2023-09-27 20:55:40 +02:00
Dominik Kaminski	b335bc4c3b	chore(provisioning): Add respository comment	2023-09-27 20:55:40 +02:00
Dominik Kaminski	5343840bed	fix(openproject): Use OCI registry and verify chart signatures	2023-09-27 20:55:40 +02:00
Dominik Kaminski	2d5d3708f7	fix(open-xchange): Use OCI registry and verify chart signatures	2023-09-27 20:55:40 +02:00
Dominik Kaminski	41dfdc0c8f	fix(nextcloud): Use OCI registry and verify chart signatures	2023-09-27 20:55:40 +02:00
Dominik Kaminski	ca5d5f8280	fix(keycloak-bootstrap): Use OCI registry and verify chart signatures	2023-09-27 20:55:40 +02:00
Dominik Kaminski	095059c7e5	fix(keycloak): Use OCI registry and verify chart signatures	2023-09-27 20:55:40 +02:00
Dominik Kaminski	1dd6582ec7	fix(jitsi): Verify chart signatures	2023-09-27 20:55:40 +02:00
Dominik Kaminski	74b3d41381	fix(intercom-service): Use OCI registry and verify chart signatures	2023-09-27 20:55:40 +02:00
Dominik Kaminski	a41b9a699c	fix(element): Use OCI registry and verify chart signatures	2023-09-27 20:55:40 +02:00
Dominik Kaminski	0b4cd739fc	chore(collabora): Add souce link to repository	2023-09-27 20:55:40 +02:00
Dominik Kaminski	4372f063e0	fix(services): Bump opendesk-certificates to 2.1.0	2023-09-27 20:55:40 +02:00
Dominik Kaminski	15ad8ca7ab	fix(services): Add wildcard certifcate request support	2023-09-27 20:55:40 +02:00
Dominik Kaminski	1884a90e6f	chore(helmfile): Quote string and fix line endings	2023-09-27 20:55:40 +02:00
Dominik Kaminski	0997f2e4a7	chore(helmfile): Add license for gpg key	2023-09-27 20:55:40 +02:00
Dominik Kaminski	0f01b94aa1	fix(helmfile): Add cleanup flag for job resources	2023-09-27 20:55:40 +02:00
Dominik Kaminski	892920b048	fix(services): Use OCI registry for all services and add gpg verify mechanism	2023-09-27 20:55:40 +02:00
Thorsten Roßner	5c3568871b	chore(release): 0.5.0 [skip ci] # [0.5.0](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.9...v0.5.0) (2023-09-27) ### Bug Fixes * element: Move the static configuration into the values.yaml ([`f22619b`](`f22619bd8e`)) * element: Specify resources for the guest module init container ([`275798c`](`275798c1d6`)) ### Features * element: Activate the guest module ([`5ad25ac`](`5ad25acafd`))	2023-09-27 14:37:23 +00:00
Dominik Henneke	f22619bd8e	fix(element): Move the static configuration into the values.yaml	2023-09-27 16:33:22 +02:00
Dominik Henneke	275798c1d6	fix(element): Specify resources for the guest module init container	2023-09-27 16:33:22 +02:00
Dominik Henneke	5ad25acafd	feat(element): Activate the guest module	2023-09-27 16:18:00 +02:00
Thorsten Roßner	437633cda6	chore(release): 0.4.9 [skip ci] ## [0.4.9](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.8...v0.4.9) (2023-09-27) ### Bug Fixes * nextcloud: Bump Helm chart to add app "groupfolders" ([`62b767e`](`62b767ef38`))	2023-09-27 13:47:20 +00:00
Thorsten Rossner	62b767ef38	fix(nextcloud): Bump Helm chart to add app "groupfolders"	2023-09-27 13:44:47 +00:00
Thorsten Roßner	02be7c15bb	chore(release): 0.4.8 [skip ci] ## [0.4.8](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.7...v0.4.8) (2023-09-26) ### Bug Fixes * openproject: Digest rollback ([`9acce08`](`9acce08139`))	2023-09-26 16:11:15 +00:00
Thorsten Roßner	9acce08139	fix(openproject): Digest rollback	2023-09-26 18:02:31 +02:00
Thorsten Roßner	3f8bffbcf3	chore(release): 0.4.7 [skip ci] ## [0.4.7](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.6...v0.4.7) (2023-09-26) ### Bug Fixes * helmfile: Add timeout for database services ([`98ec02f`](`98ec02f230`)) * openproject: Image digest ([`b340373`](`b340373133`))	2023-09-26 14:49:31 +00:00
Thorsten Roßner	98ec02f230	fix(helmfile): Add timeout for database services	2023-09-26 16:32:19 +02:00
Thorsten Roßner	b340373133	fix(openproject): Image digest	2023-09-26 16:30:28 +02:00
Thorsten Roßner	6456f68b7b	chore(release): 0.4.6 [skip ci] ## [0.4.6](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.5...v0.4.6) (2023-09-26) ### Bug Fixes * openproject: Use renamed registry open_desk ([`a37faf3`](`a37faf3b57`))	2023-09-26 12:51:57 +00:00
Oliver Günther	a37faf3b57	fix(openproject): Use renamed registry open_desk	2023-09-26 12:50:26 +00:00
Thorsten Roßner	fbbf3f253b	chore(release): 0.4.5 [skip ci] ## [0.4.5](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.4...v0.4.5) (2023-09-26) ### Bug Fixes * helmfile: Streamline timeouts ([`2703615`](`2703615dff`))	2023-09-26 12:20:31 +00:00
Thorsten Rossner	2703615dff	fix(helmfile): Streamline timeouts	2023-09-26 12:18:13 +00:00
Thorsten Roßner	85ad5ecd6d	chore(release): 0.4.4 [skip ci] ## [0.4.4](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.3...v0.4.4) (2023-09-25) ### Bug Fixes * open-xchange: Updates for mail templates and mail export ([`ae3d0da`](`ae3d0daa11`))	2023-09-25 17:29:54 +00:00
Thorsten Rossner	ae3d0daa11	fix(open-xchange): Updates for mail templates and mail export	2023-09-25 17:27:48 +00:00
Thorsten Roßner	0a17976aca	chore(release): 0.4.3 [skip ci] ## [0.4.3](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.2...v0.4.3) (2023-09-25) ### Bug Fixes * nextcloud: Update image to 27.1.1 ([`ce7e5f6`](`ce7e5f670a`))	2023-09-25 11:24:24 +00:00
Thorsten Rossner	ce7e5f670a	fix(nextcloud): Update image to 27.1.1	2023-09-25 11:22:39 +00:00
Thorsten Roßner	917f9fb452	chore(release): 0.4.2 [skip ci] ## [0.4.2](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace/compare/v0.4.1...v0.4.2) (2023-09-21) ### Bug Fixes * nextcloud: Add Nextcloud app for OpenProject integration; Bump Collabora Image ([`f46c8a9`](`f46c8a9a5f`))	2023-09-21 12:38:44 +00:00
Thorsten Rossner	f46c8a9a5f	fix(nextcloud): Add Nextcloud app for OpenProject integration; Bump Collabora Image	2023-09-21 12:25:53 +00:00