mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-06 15:31:38 +01:00
Compare commits
42 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
fe40b7cfa1 | ||
|
|
d04a60349d | ||
|
|
94ae3da78b | ||
|
|
3ca54159f7 | ||
|
|
bf5dcda3b5 | ||
|
|
08ca525d3e | ||
|
|
dc7ce0bc4b | ||
|
|
729a1ea849 | ||
|
|
3b5493d78d | ||
|
|
6711791009 | ||
|
|
c41643ee3e | ||
|
|
2628a0e13e | ||
|
|
c8bc8b3172 | ||
|
|
24812b667c | ||
|
|
bec9a2d46b | ||
|
|
05cc82d7c5 | ||
|
|
82be996d97 | ||
|
|
d367739248 | ||
|
|
ef870ae385 | ||
|
|
466e741494 | ||
|
|
00fafb6a1b | ||
|
|
6d3e484855 | ||
|
|
845a0a3189 | ||
|
|
519db51be2 | ||
|
|
7ef3a10577 | ||
|
|
1c35ca67ce | ||
|
|
e0c6c14dca | ||
|
|
3cf348c7ae | ||
|
|
b3d45c45e1 | ||
|
|
c246edd8f9 | ||
|
|
c19bca2be0 | ||
|
|
a5f263ce48 | ||
|
|
cbe8fb2d65 | ||
|
|
8b6a4b2e88 | ||
|
|
a61d00482f | ||
|
|
0c7a77c4b6 | ||
|
|
211bee94bb | ||
|
|
b3ac0ae6d9 | ||
|
|
4c52a5aaa8 | ||
|
|
7a9ecf7b85 | ||
|
|
86b48188e1 | ||
|
|
7bbab22939 |
@@ -620,4 +620,6 @@ release:
|
||||
}
|
||||
EOF
|
||||
- "semantic-release"
|
||||
needs:
|
||||
- "generate-release-assets"
|
||||
...
|
||||
|
||||
91
CHANGELOG.md
91
CHANGELOG.md
@@ -1,3 +1,94 @@
|
||||
## [0.5.62](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.61...v0.5.62) (2023-12-06)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **nextcloud:** Bump image to 27.1.4 and update Helm chart to configure "Shared_with_me" folder ([d04a603](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/d04a60349dbbff2d64ca2b36b9c44b75526bf859))
|
||||
* **univention-management-stack:** Update optional UMS preview state ([94ae3da](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/94ae3da78bd79c61fd7a22db5a541d473eea6a2e))
|
||||
|
||||
## [0.5.61](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.60...v0.5.61) (2023-12-05)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **services:** Fix port declaration for Postfix ([bf5dcda](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/bf5dcda3b59e1dc98cbee7e67f50a960d344b8e0))
|
||||
|
||||
## [0.5.60](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.59...v0.5.60) (2023-12-05)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **ci:** Ensure release creation with artifacts ([dc7ce0b](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/dc7ce0bc4b9501b63274f68352e6d9e76b5424e8))
|
||||
|
||||
## [0.5.59](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.58...v0.5.59) (2023-12-05)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **helmfile:** Add configurable objectstore ([3b5493d](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/3b5493d78dc027cd1f3206b26cf347dc6ce6e265))
|
||||
|
||||
## [0.5.58](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.57...v0.5.58) (2023-12-01)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **cryptpad:** Add websocket annotation ([c41643e](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/c41643ee3e5610ef27a63a0355804159030a7452))
|
||||
* **openproject:** Add seederJob intent ([05cc82d](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/05cc82d7c5c5f93fb5de7df555a22e8e90279621))
|
||||
* **openproject:** Bump to 2.6.2 ([c8bc8b3](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/c8bc8b3172cfef3396379e3969dc087d67a228ee))
|
||||
* **services:** Add NetworkPolicy section to docs/security.md ([24812b6](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/24812b667cded720a0ac09b8b3eb89df39b02afb))
|
||||
* **services:** Add Otterize based security settings ([bec9a2d](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/bec9a2d46b2b563b7001ed8c6625c10111d5f151))
|
||||
* **univention-management-stack:** Add Otterize annotations for jobs ([2628a0e](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/2628a0e13e5957475ce81b12d4230400c9ffeafe))
|
||||
|
||||
## [0.5.57](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.56...v0.5.57) (2023-12-01)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **helmfile:** Using correct private registry for postfix helm-chart ([d367739](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/d367739248ed43b3bad6a00b059b2c949dde4cb7))
|
||||
|
||||
## [0.5.56](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.55...v0.5.56) (2023-11-30)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **element:** Raise treshold for login rate limit to avoid too early barrier hitting normal users ([466e741](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/466e7414942837fdb1aecabfb08eae49f9dab272))
|
||||
|
||||
## [0.5.55](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.54...v0.5.55) (2023-11-30)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **cryptpad:** Update Helm chart to enable readiness and liveness probes ([6d3e484](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/6d3e484855540569be53130e133e0821a04b2ca5))
|
||||
|
||||
## [0.5.54](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.53...v0.5.54) (2023-11-29)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **helmfile:** Add and document security context for components ([519db51](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/519db51be2be3ce292a88965ac0ec049b4c8bb8e))
|
||||
|
||||
## [0.5.53](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.52...v0.5.53) (2023-11-29)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **univention-managemen-stack:** Integrate Attribute to Group Mapper into the containerized stack ([7bbab22](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/7bbab229396075c7d10f94f42bef14551faefe26))
|
||||
* **univention-management-stack:** Add Announcements icon into "umc-gateway" ([7a9ecf7](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/7a9ecf7b8595edf0949d9c200d01b3409f25b9a7))
|
||||
* **univention-management-stack:** Add Announcements module into "umc-server" ([4c52a5a](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/4c52a5aaa83ffb6f4c49faa039c94cb1855987bb))
|
||||
* **univention-management-stack:** Add branding related configuration to stack-gateway ([a5f263c](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/a5f263ce489f88b90cf1151de249f36616a51632))
|
||||
* **univention-management-stack:** Apply styling ([b3d45c4](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/b3d45c45e1b754e14ab0519efcb6b6a359f0ad1e))
|
||||
* **univention-management-stack:** Configure openDesk branding in frontend chart ([cbe8fb2](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/cbe8fb2d65e6ce73f9da95ef9b0ed3ffbb16d367))
|
||||
* **univention-management-stack:** Document database of UMS Notifications API ([3cf348c](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/3cf348c7ae8f438daf3e64addbf839230816f3d2))
|
||||
* **univention-management-stack:** Move static settings from gotmpl into yaml for umc-gateway ([b3ac0ae](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/b3ac0ae6d91a058265fcd26c6653bb8a13d3e780))
|
||||
* **univention-management-stack:** Quote all composed strings ([1c35ca6](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/1c35ca67ce0673e1b2f9a350bd07c82c22a05354))
|
||||
* **univention-management-stack:** Remove frontend-custom ([8b6a4b2](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/8b6a4b2e88e8be1d299af91ed1ffff4405db88e6))
|
||||
* **univention-management-stack:** Set SMTP host for self-service notifications ([0c7a77c](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/0c7a77c4b6f20c6d83e977dabfc4e555b652f6ac))
|
||||
* **univention-management-stack:** UMC uses external memcached ([211bee9](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/211bee94bb7675860f867f0335fec9f14fc96875))
|
||||
* **univention-management-stack:** Update ums-dependencies ([e0c6c14](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/e0c6c14dcaefc0755495270bbf45898721e27985))
|
||||
* **univention-management-stack:** Update ums-dependencies ([c246edd](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/c246edd8f9753e37bc9c32683faf41f5b46d7675))
|
||||
* **univention-management-stack:** Update ums-dependencies ([86b4818](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/86b48188e160c1f7d15f2c33f1f3cd0cc0e68bf2))
|
||||
* **univention-management-stack:** Use "stack-gateway" in all deployments ([c19bca2](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/c19bca2be0d14750bbef661e45c5c424f7da8e77))
|
||||
|
||||
## [0.5.52](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.51...v0.5.52) (2023-11-28)
|
||||
|
||||
|
||||
|
||||
11
README.md
11
README.md
@@ -9,14 +9,15 @@ openDesk is a Kubernetes based, open-source and cloud-native digital workplace s
|
||||
Aufbau ZenDiS" of Germany's Federal Ministry of the Interior.
|
||||
|
||||
It features:
|
||||
- Fully integrated Identity Management (Univention, Keycloak)
|
||||
- Fully integrated Identity Management (Univention)
|
||||
- File storage (Nextcloud)
|
||||
- Weboffice (Collabora)
|
||||
- Videoconference (Jitsi)
|
||||
- Encrypted Chat (Synapse, Element)
|
||||
- Videoconference (Nordeck w/ Jitsi)
|
||||
- Chat and Collaboration (Element w/ Nordeck)
|
||||
- Groupware (OX Appsuite)
|
||||
- Wiki (XWiki)
|
||||
- Notes and Diagrams (Cryptpad, Draw.io)
|
||||
- Project Management (OpenProject)
|
||||
- Notes and Diagrams (Cryptpad)
|
||||
|
||||
openDesk integrates these components and is working towards a seamless user experience.
|
||||
|
||||
@@ -40,7 +41,7 @@ Basic knowledge of Kubernetes and Devops is required though.
|
||||
|
||||
# Active development notice
|
||||
openDesk will face breaking changes in the near future without upgrade paths before
|
||||
[technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases
|
||||
[technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
|
||||
v1.0.0 is reached.
|
||||
|
||||
While most components support upgrades, major configuration or component changes may occur, therefore we recommend
|
||||
|
||||
@@ -9,6 +9,7 @@ This document will cover the additional configuration to use external services l
|
||||
|
||||
<!-- TOC -->
|
||||
* [Database](#database)
|
||||
* [Objectstore](#objectstore)
|
||||
* [Cache](#cache)
|
||||
<!-- TOC -->
|
||||
|
||||
@@ -17,47 +18,76 @@ This document will cover the additional configuration to use external services l
|
||||
When deploying this suite to production, you need to configure the applications to use your production grade database
|
||||
service.
|
||||
|
||||
| Component | Name | Type | Parameter | Key | Default |
|
||||
|-------------|--------------------|------------|-----------|----------------------------------------|----------------------------|
|
||||
| Element | Synapse | PostgreSQL | | | |
|
||||
| | | | Name | `databases.synapse.name` | `matrix` |
|
||||
| | | | Host | `databases.synapse.host` | `postgresql` |
|
||||
| | | | Port | `databases.synapse.port` | `5432` |
|
||||
| | | | Username | `databases.synapse.username` | `matrix_user` |
|
||||
| | | | Password | `databases.synapse.password` | |
|
||||
| Keycloak | Keycloak | PostgreSQL | | | |
|
||||
| | | | Name | `databases.keycloak.name` | `keycloak` |
|
||||
| | | | Host | `databases.keycloak.host` | `postgresql` |
|
||||
| | | | Port | `databases.keycloak.port` | `5432` |
|
||||
| | | | Username | `databases.keycloak.username` | `keycloak_user` |
|
||||
| | | | Password | `databases.keycloak.password` | |
|
||||
| | Keycloak Extension | PostgreSQL | | | |
|
||||
| | | | Name | `databases.keycloakExtension.name` | `keycloak_extensions` |
|
||||
| | | | Host | `databases.keycloakExtension.host` | `postgresql` |
|
||||
| | | | Port | `databases.keycloakExtension.port` | `5432` |
|
||||
| | | | Username | `databases.keycloakExtension.username` | `keycloak_extensions_user` |
|
||||
| | | | Password | `databases.keycloakExtension.password` | |
|
||||
| Nextcloud | Nextcloud | MariaDB | | | |
|
||||
| | | | Name | `databases.nextcloud.name` | `nextcloud` |
|
||||
| | | | Host | `databases.nextcloud.host` | `mariadb` |
|
||||
| | | | Username | `databases.nextcloud.username` | `nextcloud_user` |
|
||||
| | | | Password | `databases.nextcloud.password` | |
|
||||
| OpenProject | OpenProject | PostgreSQL | | | |
|
||||
| | | | Name | `databases.openproject.name` | `openproject` |
|
||||
| | | | Host | `databases.openproject.host` | `postgresql` |
|
||||
| | | | Port | `databases.openproject.port` | `5432` |
|
||||
| | | | Username | `databases.openproject.username` | `openproject_user` |
|
||||
| | | | Password | `databases.openproject.password` | |
|
||||
| OX Appsuite | OX Appsuite | MariaDB | | | |
|
||||
| | | | Name | `databases.oxAppsuite.name` | `CONFIGDB` |
|
||||
| | | | Host | `databases.oxAppsuite.host` | `mariadb` |
|
||||
| | | | Username | `databases.oxAppsuite.username` | `root` |
|
||||
| | | | Password | `databases.oxAppsuite.password` | |
|
||||
| XWiki | XWiki | MariaDB | | | |
|
||||
| | | | Name | `databases.xwiki.name` | `xwiki` |
|
||||
| | | | Host | `databases.xwiki.host` | `mariadb` |
|
||||
| | | | Username | `databases.xwiki.username` | `xwiki_user` |
|
||||
| | | | Password | `databases.xwiki.password` | |
|
||||
| Component | Name | Type | Parameter | Key | Default |
|
||||
|-------------|--------------------|------------|-----------|------------------------------------------|----------------------------|
|
||||
| Element | Synapse | PostgreSQL | | | |
|
||||
| | | | Name | `databases.synapse.name` | `matrix` |
|
||||
| | | | Host | `databases.synapse.host` | `postgresql` |
|
||||
| | | | Port | `databases.synapse.port` | `5432` |
|
||||
| | | | Username | `databases.synapse.username` | `matrix_user` |
|
||||
| | | | Password | `databases.synapse.password` | |
|
||||
| Keycloak | Keycloak | PostgreSQL | | | |
|
||||
| | | | Name | `databases.keycloak.name` | `keycloak` |
|
||||
| | | | Host | `databases.keycloak.host` | `postgresql` |
|
||||
| | | | Port | `databases.keycloak.port` | `5432` |
|
||||
| | | | Username | `databases.keycloak.username` | `keycloak_user` |
|
||||
| | | | Password | `databases.keycloak.password` | |
|
||||
| | Keycloak Extension | PostgreSQL | | | |
|
||||
| | | | Name | `databases.keycloakExtension.name` | `keycloak_extensions` |
|
||||
| | | | Host | `databases.keycloakExtension.host` | `postgresql` |
|
||||
| | | | Port | `databases.keycloakExtension.port` | `5432` |
|
||||
| | | | Username | `databases.keycloakExtension.username` | `keycloak_extensions_user` |
|
||||
| | | | Password | `databases.keycloakExtension.password` | |
|
||||
| UMS | Notifications API | PostgreSQL | | | |
|
||||
| | | | Name | `databases.umsNotificationsApi.name` | `notificationsapi` |
|
||||
| | | | Host | `databases.umsNotificationsApi.host` | `postgresql` |
|
||||
| | | | Port | `databases.umsNotificationsApi.port` | `5432` |
|
||||
| | | | Username | `databases.umsNotificationsApi.username` | `notificationsapi_user` |
|
||||
| | | | Password | `databases.umsNotificationsApi.password` | |
|
||||
| | Self Service | PostgreSQL | | | |
|
||||
| | | | Name | `databases.umsSelfservice.name` | `selfservice` |
|
||||
| | | | Host | `databases.umsSelfservice.host` | `postgresql` |
|
||||
| | | | Port | `databases.umsSelfservice.port` | `5432` |
|
||||
| | | | Username | `databases.umsSelfservice.username` | `selfservice_user` |
|
||||
| | | | Password | `databases.umsSelfservice.password` | |
|
||||
| Nextcloud | Nextcloud | MariaDB | | | |
|
||||
| | | | Name | `databases.nextcloud.name` | `nextcloud` |
|
||||
| | | | Host | `databases.nextcloud.host` | `mariadb` |
|
||||
| | | | Username | `databases.nextcloud.username` | `nextcloud_user` |
|
||||
| | | | Password | `databases.nextcloud.password` | |
|
||||
| OpenProject | OpenProject | PostgreSQL | | | |
|
||||
| | | | Name | `databases.openproject.name` | `openproject` |
|
||||
| | | | Host | `databases.openproject.host` | `postgresql` |
|
||||
| | | | Port | `databases.openproject.port` | `5432` |
|
||||
| | | | Username | `databases.openproject.username` | `openproject_user` |
|
||||
| | | | Password | `databases.openproject.password` | |
|
||||
| OX Appsuite | OX Appsuite | MariaDB | | | |
|
||||
| | | | Name | `databases.oxAppsuite.name` | `CONFIGDB` |
|
||||
| | | | Host | `databases.oxAppsuite.host` | `mariadb` |
|
||||
| | | | Username | `databases.oxAppsuite.username` | `root` |
|
||||
| | | | Password | `databases.oxAppsuite.password` | |
|
||||
| XWiki | XWiki | MariaDB | | | |
|
||||
| | | | Name | `databases.xwiki.name` | `xwiki` |
|
||||
| | | | Host | `databases.xwiki.host` | `mariadb` |
|
||||
| | | | Username | `databases.xwiki.username` | `xwiki_user` |
|
||||
| | | | Password | `databases.xwiki.password` | |
|
||||
|
||||
## Objectstore
|
||||
|
||||
When deploying this suite to production, you need to configure the applications to use your production grade objectstore
|
||||
service.
|
||||
|
||||
| Component | Name | Parameter | Key | Default |
|
||||
|-------------|-------------|-----------------|------------------------------------------|--------------------|
|
||||
| OpenProject | OpenProject | | | |
|
||||
| | | Backend | `objectstores.openproject.backend` | `minio` |
|
||||
| | | Bucket | `objectstores.openproject.bucket` | `openproject` |
|
||||
| | | Endpoint | `objectstores.openproject.endpoint` | |
|
||||
| | | Provider | `objectstores.openproject.provider` | `AWS` |
|
||||
| | | Region | `objectstores.openproject.region` | |
|
||||
| | | Secret | `objectstores.openproject.secret` | |
|
||||
| | | Username | `objectstores.openproject.username` | `openproject_user` |
|
||||
| | | Use IAM profile | `objectstores.openproject.useIAMProfile` | |
|
||||
|
||||
## Cache
|
||||
|
||||
@@ -75,3 +105,6 @@ service.
|
||||
| OpenProject | OpenProject | Memcached | | | |
|
||||
| | | | Host | `cache.openproject.host` | `memcached` |
|
||||
| | | | Port | `cache.openproject.port` | `11211` |
|
||||
| UMS | Self Service | Memcached | | | |
|
||||
| | | | Host | `cache.umsSelfservice.host` | `memcached` |
|
||||
| | | | Port | `cache.umsSelfservice.port` | `11211` |
|
||||
|
||||
109
docs/security.md
109
docs/security.md
@@ -10,6 +10,7 @@ This document should cover the current status of security measurements.
|
||||
<!-- TOC -->
|
||||
* [Helm Chart Trust Chain](#helm-chart-trust-chain)
|
||||
* [Kubernetes Security Enforcements](#kubernetes-security-enforcements)
|
||||
* [NetworkPolicies](#networkpolicies)
|
||||
<!-- TOC -->
|
||||
|
||||
## Helm Chart Trust Chain
|
||||
@@ -50,43 +51,71 @@ Helm Charts which are released via openDesk CI/CD process are always signed. The
|
||||
This list gives you an overview of default security settings and if they comply with security standards:
|
||||
|
||||
|
||||
| Component | Process | = | allowPrivilegeEscalation (`false`) | capabilities (`drop: ALL`) | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
|
||||
|--------------|----------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
|
||||
| ClamAV | clamd | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | freshclam | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | icap | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | milter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| Collabora | collabora | :x: | :x: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) | :white_check_mark: | :x: | :white_check_mark: | 100 | 101 | 100 |
|
||||
| CryptPad | npm | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 4001 | 4001 | 4001 |
|
||||
| Dovecot | dovecot | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `NET_BIND_SERVICE`, `SETGID`, `SETUID`, `SYS_CHROOT`) | :white_check_mark: | :white_check_mark: | :x: | - | - | 1000 |
|
||||
| Element | element | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
||||
| | synapse | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 10991 | - | 10991 |
|
||||
| | synapseWeb | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
||||
| | wellKnown | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
||||
| Jitsi | jibri | :x: | :x: | :x: (`SYS_ADMIN`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | jicofo | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | jitsiKeycloakAdapter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1993 | 1993 | - |
|
||||
| | jvb | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | prosody | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | web | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| Keycloak | keycloak | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| | keycloakConfigCli | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| | keycloakExtensionHandler | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | keycloakExtensionProxy | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| MariaDB | mariadb | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| Memcached | memcached | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | - | 1001 |
|
||||
| Postfix | postfix | :x: | :x: | :x: | :white_check_mark: | :x: | :x: | - | - | 101 |
|
||||
| Open-Xchange | core-documentconverter | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 987 | 1000 | - |
|
||||
| | core-guidedtours | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | core-imageconverter | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 987 | 1000 | - |
|
||||
| | core-mw-default | :x: | :x: | :x: | :x: | :x: | :x: | - | - | - |
|
||||
| | core-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | core-ui-middleware | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | core-ui-middleware-updater | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | core-user-guide | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | gotenberg | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | guard-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | nextlcoud-integration-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | public-sector-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| OpenProject | openproject | :x: | :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| PostgreSQL | postgresql | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| Component | Process | = | allowPrivilegeEscalation (`false`) | capabilities (`drop: ALL`) | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
|
||||
|-----------------|--------------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
|
||||
| ClamAV | clamd | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | freshclam | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | icap | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | milter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| Collabora | collabora | :x: | :x: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) | :white_check_mark: | :x: | :white_check_mark: | 100 | 101 | 100 |
|
||||
| CryptPad | npm | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 4001 | 4001 | 4001 |
|
||||
| Dovecot | dovecot | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `KILL`, `NET_BIND_SERVICE`, `SETGID`, `SETUID`, `SYS_CHROOT`) | :white_check_mark: | :white_check_mark: | :x: | - | - | 1000 |
|
||||
| Element | element | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
||||
| | synapse | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 10991 | - | 10991 |
|
||||
| | synapseWeb | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
||||
| | wellKnown | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
||||
| IntercomService | intercom-service | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
||||
| Jitsi | jibri | :x: | :x: | :x: (`SYS_ADMIN`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | jicofo | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | jitsiKeycloakAdapter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1993 | 1993 | - |
|
||||
| | jvb | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | prosody | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| | web | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| Keycloak | keycloak | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| | keycloakConfigCli | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| | keycloakExtensionHandler | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | keycloakExtensionProxy | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| MariaDB | mariadb | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| Memcached | memcached | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | - | 1001 |
|
||||
| Minio | minio | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
||||
| Nextcloud | nextcloud | :x: | :white_check_mark: | :x: (`NET_BIND_SERVICE`, `SETGID`, `SETUID`) | :white_check_mark: | :x: | :x: | - | - | 33 |
|
||||
| | nextcloud-cron | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | 33 |
|
||||
| | opendesk-nextcloud-bootstrap | :x: | :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | - | - | 33 |
|
||||
| Open-Xchange | core-documentconverter | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 987 | 1000 | - |
|
||||
| | core-guidedtours | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | core-imageconverter | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 987 | 1000 | - |
|
||||
| | core-mw-default | :x: | :x: | :x: | :x: | :x: | :x: | - | - | - |
|
||||
| | core-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | core-ui-middleware | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | core-ui-middleware-updater | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | core-user-guide | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | gotenberg | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | guard-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | nextlcoud-integration-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| | public-sector-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||
| OpenProject | openproject | :x: | :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||
| Postfix | postfix | :x: | :x: | :x: | :white_check_mark: | :x: | :x: | - | - | 101 |
|
||||
| PostgreSQL | postgresql | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||
| Redis | redis | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 0 | 1001 |
|
||||
| UCC | univention-corporate-container | :x: | :x: | :x: | :x: | :x: | :x: | - | - | - |
|
||||
| XWiki | xwiki | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 100 | 101 | 101 |
|
||||
| | xwiki initContainers | :x: | :x: | :x: | :white_check_mark: | :x: | :x: | - | - | 101 |
|
||||
|
||||
## NetworkPolicies
|
||||
|
||||
Kubernetes NetworkPolicies are an important measure to secure your kubernetes apps and clusters.
|
||||
When applied, they restrict the traffic to your services.
|
||||
This protects other deployments in your cluster or other services in your deployment to get compromised when one
|
||||
component is compromised.
|
||||
|
||||
We ship a default set of Otterize ClientIntents via
|
||||
[Otterize intents operator](https://github.com/otterize/intents-operator) which translates intent-based access control
|
||||
(IBAC) into kubernetes native NetworkPolicies.
|
||||
|
||||
This requires the Otterize intents operator to be installed.
|
||||
|
||||
```yaml
|
||||
security:
|
||||
otterizeIntents:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
@@ -21,7 +21,7 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "cryptpad"
|
||||
chart: "cryptpad-online-repo/cryptpad"
|
||||
version: "0.0.13"
|
||||
version: "0.0.14"
|
||||
values:
|
||||
- "values.yaml"
|
||||
- "values.gotmpl"
|
||||
|
||||
@@ -22,6 +22,10 @@ enableEmbedding: true
|
||||
|
||||
fullnameOverride: "cryptpad"
|
||||
|
||||
ingress:
|
||||
annotations:
|
||||
nginx.org/websocket-services: "cryptpad"
|
||||
|
||||
persistence:
|
||||
enabled: false
|
||||
|
||||
|
||||
@@ -11,6 +11,16 @@ configuration:
|
||||
- "m.space.parent"
|
||||
- "net.nordeck.meetings.metadata"
|
||||
- "m.room.power_levels"
|
||||
# When a user logs into Element a parallel request is done through Intercom Service to allow Synapse API
|
||||
# interaction, to avoid (temporary) blocking of the user for followup logins we want to raise the limits.
|
||||
# https://matrix-org.github.io/synapse/v1.59/usage/configuration/config_documentation.html#ratelimiting
|
||||
rc_login:
|
||||
account:
|
||||
per_second: 2
|
||||
burst_count: 8
|
||||
address:
|
||||
per_second: 2
|
||||
burst_count: 12
|
||||
|
||||
homeserver:
|
||||
guestModule:
|
||||
|
||||
@@ -26,6 +26,7 @@ releases:
|
||||
chart: "intercom-service-repo/intercom-service"
|
||||
version: "2.0.1"
|
||||
values:
|
||||
- "values.yaml"
|
||||
- "values.gotmpl"
|
||||
installed: {{ .Values.intercom.enabled }}
|
||||
|
||||
|
||||
21
helmfile/apps/intercom-service/values.yaml
Normal file
21
helmfile/apps/intercom-service/values.yaml
Normal file
@@ -0,0 +1,21 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
enabled: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: "Always"
|
||||
...
|
||||
@@ -27,4 +27,8 @@ image:
|
||||
|
||||
resources:
|
||||
{{ .Values.resources.keycloakBootstrap | toYaml | nindent 2 }}
|
||||
|
||||
additionalAnnotations:
|
||||
annotations:
|
||||
intents.otterize.com/service-name: "keycloak-bootstrap"
|
||||
...
|
||||
|
||||
@@ -23,6 +23,7 @@ handler:
|
||||
appConfig:
|
||||
smtpPassword: {{ .Values.smtp.password | quote }}
|
||||
smtpHost: {{ .Values.smtp.host | quote }}
|
||||
smtpPort: {{ .Values.smtp.port | quote }}
|
||||
smtpUsername: {{ .Values.smtp.username | quote }}
|
||||
mailFrom: "noreply@{{ .Values.global.domain }}"
|
||||
resources:
|
||||
|
||||
@@ -33,7 +33,7 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "opendesk-nextcloud-bootstrap"
|
||||
chart: "opendesk-nextcloud-bootstrap-repo/opendesk-nextcloud-bootstrap"
|
||||
version: "3.2.4"
|
||||
version: "3.2.5"
|
||||
wait: true
|
||||
waitForJobs: true
|
||||
values:
|
||||
|
||||
@@ -44,6 +44,7 @@ config:
|
||||
|
||||
smtp:
|
||||
host: {{ .Values.smtp.host | quote }}
|
||||
port: {{ .Values.smtp.port | quote }}
|
||||
username: {{ .Values.smtp.username | quote }}
|
||||
password: {{ .Values.smtp.password | quote }}
|
||||
|
||||
|
||||
@@ -15,4 +15,17 @@ config:
|
||||
|
||||
cryptpad:
|
||||
enabled: true
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
enabled: true
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: false
|
||||
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
fsGroup: 33
|
||||
fsGroupChangePolicy: "Always"
|
||||
...
|
||||
|
||||
@@ -20,6 +20,11 @@ cronjob:
|
||||
- >
|
||||
sed -i "s/\*\/5 \* \* \* \* php -f \/var\/www\/html\/cron.php/\*\/1 \* \* \* \* php -f
|
||||
\/var\/www\/html\/cron.php/g" /var/spool/cron/crontabs/www-data
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
|
||||
ingress:
|
||||
annotations:
|
||||
@@ -52,6 +57,20 @@ nextcloud:
|
||||
{
|
||||
"drawio": ["application/x-drawio"]
|
||||
}
|
||||
podSecurityContext:
|
||||
fsGroup: 33
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
add:
|
||||
- "NET_BIND_SERVICE"
|
||||
- "SETGID"
|
||||
- "SETUID"
|
||||
|
||||
# this is not documented but can be found in values.yaml
|
||||
service:
|
||||
|
||||
@@ -12,6 +12,8 @@ repositories:
|
||||
url: >-
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
default "https://charts.openproject.org" }}
|
||||
verify: true
|
||||
keyring: "../../files/gpg-pubkeys/openproject-com.gpg"
|
||||
|
||||
releases:
|
||||
# renovate:
|
||||
@@ -21,7 +23,7 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "openproject"
|
||||
chart: "openproject-repo/openproject"
|
||||
version: "2.4.0"
|
||||
version: "2.6.2"
|
||||
wait: true
|
||||
waitForJobs: true
|
||||
values:
|
||||
|
||||
@@ -77,9 +77,16 @@ environment:
|
||||
OPENPROJECT_MAIL__FROM: "do-not-reply@{{ .Values.global.domain }}"
|
||||
# Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
|
||||
OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.univentionCorporateServer.ldapSearch.openproject | quote }}
|
||||
OPENPROJECT_FOG_CREDENTIALS_HOST: "{{ .Values.global.hosts.minioApi }}.{{ .Values.global.domain }}"
|
||||
OPENPROJECT_FOG_CREDENTIALS_ENDPOINT: "https://{{ .Values.global.hosts.minioApi }}.{{ .Values.global.domain }}"
|
||||
OPENPROJECT_FOG_CREDENTIALS_AWS__SECRET__ACCESS__KEY: {{ .Values.secrets.minio.openprojectUser | quote }}
|
||||
{{ if ne .Values.objectstores.openproject.backend "aws" }}
|
||||
OPENPROJECT_FOG_CREDENTIALS_ENDPOINT: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
|
||||
OPENPROJECT_FOG_CREDENTIALS_PATH__STYLE: "true"
|
||||
{{ end }}
|
||||
OPENPROJECT_FOG_CREDENTIALS_AWS__ACCESS__KEY__ID: {{ .Values.objectstores.openproject.username | quote }}
|
||||
OPENPROJECT_FOG_CREDENTIALS_AWS__SECRET__ACCESS__KEY: {{ .Values.objectstores.openproject.secret | default .Values.secrets.minio.openprojectUser | quote }}
|
||||
OPENPROJECT_FOG_CREDENTIALS_PROVIDER: {{ .Values.objectstores.openproject.provider | default "AWS" | quote }}
|
||||
OPENPROJECT_FOG_CREDENTIALS_REGION: {{ .Values.objectstores.openproject.region | quote }}
|
||||
OPENPROJECT_FOG_DIRECTORY: {{ .Values.objectstores.openproject.bucket | quote }}
|
||||
OPENPROJECT_FOG_CREDENTIALS_USE__IAM__PROFILE : {{ .Values.objectstores.openproject.useIAMProfile | default "false" | quote }}
|
||||
|
||||
replicaCount: {{ .Values.replicas.openproject }}
|
||||
|
||||
|
||||
@@ -75,11 +75,12 @@ environment:
|
||||
OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_GROUP__ATTRIBUTE: "cn"
|
||||
# Details: https://www.openproject.org/docs/installation-and-operations/configuration/#attachments-storage
|
||||
OPENPROJECT_ATTACHMENTS__STORAGE: "fog"
|
||||
OPENPROJECT_FOG_DIRECTORY: "openproject"
|
||||
OPENPROJECT_FOG_CREDENTIALS_PROVIDER: "AWS"
|
||||
OPENPROJECT_FOG_CREDENTIALS_PATH__STYLE: "true"
|
||||
OPENPROJECT_FOG_CREDENTIALS_AWS__ACCESS__KEY__ID: "openproject_user"
|
||||
# Define an admin mapping from the claim
|
||||
# The attribute mapping cannot currently be defined in the value
|
||||
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ATTRIBUTE__MAP_ADMIN: "openproject_admin"
|
||||
|
||||
seederJob:
|
||||
annotations:
|
||||
intents.otterize.com/service-name: "openproject-seeder"
|
||||
...
|
||||
|
||||
@@ -6,6 +6,17 @@ bases:
|
||||
|
||||
---
|
||||
repositories:
|
||||
# openDesk Otterize
|
||||
# Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-otterize
|
||||
- name: "opendesk-otterize-repo"
|
||||
oci: true
|
||||
# yamllint disable rule:line-length
|
||||
url: >-
|
||||
{{ env "PRIVATE_IMAGE_REGISTRY_URL" |
|
||||
default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/opendesk-otterize" }}
|
||||
# yamllint enable rule:line-length
|
||||
verify: true
|
||||
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
||||
# openDesk Certificates
|
||||
# Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-certificates
|
||||
- name: "opendesk-certificates-repo"
|
||||
@@ -40,7 +51,7 @@ repositories:
|
||||
- name: "postfix-repo"
|
||||
oci: true
|
||||
url: >-
|
||||
{{ env "PRIVATE_CHART_REPOSITORY_URL" |
|
||||
{{ env "PRIVATE_IMAGE_REGISTRY_URL" |
|
||||
default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/postfix" }}
|
||||
verify: true
|
||||
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
||||
@@ -75,6 +86,17 @@ repositories:
|
||||
releases:
|
||||
# renovate:
|
||||
# registryUrl=https://registry.souvap-univention.de
|
||||
# packageName=souvap/tooling/charts/opendesk-otterize/opendesk-otterize
|
||||
# dataSource=docker
|
||||
# dependencyType=service
|
||||
- name: "opendesk-otterize"
|
||||
chart: "opendesk-otterize-repo/opendesk-otterize"
|
||||
version: "1.1.3"
|
||||
values:
|
||||
- "values-otterize.gotmpl"
|
||||
installed: {{ .Values.security.otterizeIntents.enabled }}
|
||||
# renovate:
|
||||
# registryUrl=https://registry.souvap-univention.de
|
||||
# packageName=souvap/tooling/charts/sovereign-workplace-certificates/opendesk-certificates
|
||||
# dataSource=docker
|
||||
# dependencyType=service
|
||||
|
||||
56
helmfile/apps/services/values-otterize.gotmpl
Normal file
56
helmfile/apps/services/values-otterize.gotmpl
Normal file
@@ -0,0 +1,56 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
apps:
|
||||
clamavDistributed:
|
||||
enabled: {{ .Values.clamavDistributed.enabled }}
|
||||
clamavSimple:
|
||||
enabled: {{ .Values.clamavSimple.enabled }}
|
||||
collabora:
|
||||
enabled: {{ .Values.collabora.enabled }}
|
||||
cryptpad:
|
||||
enabled: {{ .Values.cryptpad.enabled }}
|
||||
dovecot:
|
||||
enabled: {{ .Values.dovecot.enabled }}
|
||||
element:
|
||||
enabled: {{ .Values.element.enabled }}
|
||||
intercom:
|
||||
enabled: {{ .Values.intercom.enabled }}
|
||||
jitsi:
|
||||
enabled: {{ .Values.jitsi.enabled }}
|
||||
keycloak:
|
||||
enabled: {{ .Values.keycloak.enabled }}
|
||||
mariadb:
|
||||
enabled: {{ .Values.mariadb.enabled }}
|
||||
memcached:
|
||||
enabled: {{ .Values.memcached.enabled }}
|
||||
minio:
|
||||
enabled: {{ .Values.minio.enabled }}
|
||||
nextcloud:
|
||||
enabled: {{ .Values.nextcloud.enabled }}
|
||||
openproject:
|
||||
enabled: {{ .Values.openproject.enabled }}
|
||||
oxAppsuite:
|
||||
enabled: {{ .Values.oxAppsuite.enabled }}
|
||||
oxConnector:
|
||||
enabled: {{ .Values.oxConnector.enabled }}
|
||||
postfix:
|
||||
enabled: {{ .Values.postfix.enabled }}
|
||||
postgresql:
|
||||
enabled: {{ .Values.postgresql.enabled }}
|
||||
redis:
|
||||
enabled: {{ .Values.redis.enabled }}
|
||||
univentionCorporateServer:
|
||||
enabled: {{ .Values.univentionCorporateServer.enabled }}
|
||||
univentionManagementStack:
|
||||
enabled: {{ .Values.univentionManagementStack.enabled }}
|
||||
xwiki:
|
||||
enabled: {{ .Values.xwiki.enabled }}
|
||||
|
||||
extraApps:
|
||||
clusterPostfix:
|
||||
enabled: {{ .Values.security.clusterPostfix.enabled }}
|
||||
namespace: {{ .Values.security.clusterPostfix.namespace }}
|
||||
...
|
||||
@@ -24,7 +24,7 @@ postfix:
|
||||
- fileName: "sasl_passwd.map"
|
||||
content:
|
||||
- {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
|
||||
relayHost: {{ printf "[%s]:587" .Values.smtp.host | quote }}
|
||||
relayHost: {{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}
|
||||
relayNets: {{ .Values.cluster.networking.cidr | quote}}
|
||||
virtualTransport: "lmtps:dovecot:24"
|
||||
smtpdSASLPath: "inet:dovecot:3659"
|
||||
|
||||
@@ -24,7 +24,9 @@ job:
|
||||
- username: "matrix_user"
|
||||
password: {{ .Values.secrets.postgresql.matrixUser | quote }}
|
||||
- username: "notificationsapi_user"
|
||||
password: {{ .Values.secrets.postgresql.notificationsapiUser | quote }}
|
||||
password: {{ .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
|
||||
- username: "selfservice_user"
|
||||
password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
|
||||
databases:
|
||||
- name: "keycloak"
|
||||
user: "keycloak_user"
|
||||
@@ -37,6 +39,8 @@ job:
|
||||
additionalParams: "ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0"
|
||||
- name: "notificationsapi"
|
||||
user: "notificationsapi_user"
|
||||
- name: "selfservice"
|
||||
user: "selfservice_user"
|
||||
|
||||
persistence:
|
||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
@@ -22,9 +22,6 @@ repositories:
|
||||
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
||||
|
||||
releases:
|
||||
# TODO: Interim, until the UMS stack has a stack umbrella chart and provides a solution
|
||||
# {{- if eq .Values.ingress.ingressClassName "dedicated-haproxy-external" }}
|
||||
|
||||
# renovate:
|
||||
# registryUrl=https://registry.souvap-univention.de
|
||||
# packageName=souvap/tooling/charts/bitnami-charts/nginx
|
||||
@@ -35,8 +32,8 @@ releases:
|
||||
version: "15.3.5"
|
||||
values:
|
||||
- "values-ums-stack-gateway.gotmpl"
|
||||
- "values-ums-stack-gateway.yaml"
|
||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||
# {{- end }}
|
||||
|
||||
# renovate:
|
||||
# registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
|
||||
@@ -45,7 +42,7 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "ums-store-dav"
|
||||
chart: "ums-repo/store-dav"
|
||||
version: "0.5.2"
|
||||
version: "0.7.0"
|
||||
values:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
@@ -94,6 +91,7 @@ releases:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
- "values-udm-rest-api.gotmpl"
|
||||
- "values-udm-rest-api.yaml"
|
||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||
|
||||
# renovate:
|
||||
@@ -103,11 +101,12 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "ums-stack-data-ums"
|
||||
chart: "ums-repo/stack-data-ums"
|
||||
version: "0.33.0"
|
||||
version: "0.38.1"
|
||||
values:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
- "values-stack-data-ums.gotmpl"
|
||||
- "values-stack-data-ums.yaml"
|
||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||
|
||||
# renovate:
|
||||
@@ -117,11 +116,12 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "ums-stack-data-swp"
|
||||
chart: "ums-repo/stack-data-swp"
|
||||
version: "0.33.0"
|
||||
version: "0.38.1"
|
||||
values:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
- "values-stack-data-swp.gotmpl"
|
||||
- "values-stack-data-swp.yaml"
|
||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||
|
||||
# renovate:
|
||||
@@ -131,11 +131,12 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "ums-portal-server"
|
||||
chart: "ums-repo/portal-server"
|
||||
version: "0.4.3"
|
||||
version: "0.6.1"
|
||||
values:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
- "values-portal-server.gotmpl"
|
||||
- "values-portal-server.yaml"
|
||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||
|
||||
# renovate:
|
||||
@@ -145,7 +146,7 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "ums-notifications-api"
|
||||
chart: "ums-repo/notifications-api"
|
||||
version: "0.4.3"
|
||||
version: "0.6.1"
|
||||
values:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
@@ -160,7 +161,7 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "ums-portal-listener"
|
||||
chart: "ums-repo/portal-listener"
|
||||
version: "0.4.3"
|
||||
version: "0.6.1"
|
||||
values:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
@@ -175,25 +176,12 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "ums-portal-frontend"
|
||||
chart: "ums-repo/portal-frontend"
|
||||
version: "0.4.3"
|
||||
version: "0.6.1"
|
||||
values:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
- "values-portal-frontend.gotmpl"
|
||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||
|
||||
# renovate:
|
||||
# registryUrl=https://registry.souvap-univention.de
|
||||
# packageName=souvap/tooling/charts/bitnami-charts/nginx
|
||||
# dataSource=docker
|
||||
# dependencyType=vendor
|
||||
- name: "ums-portal-frontend-custom"
|
||||
# TODO: Replace with our own Nginx chart.
|
||||
chart: "bitnami-repo/nginx"
|
||||
version: "15.3.5"
|
||||
values:
|
||||
- "values-portal-frontend-custom.yaml"
|
||||
- "values-portal-frontend-custom.gotmpl"
|
||||
- "values-portal-frontend.yaml"
|
||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||
|
||||
# renovate:
|
||||
@@ -203,11 +191,12 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "ums-umc-gateway"
|
||||
chart: "ums-repo/umc-gateway"
|
||||
version: "0.5.1"
|
||||
version: "0.6.1"
|
||||
values:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
- "values-umc-gateway.gotmpl"
|
||||
- "values-umc-gateway.yaml"
|
||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||
|
||||
# renovate:
|
||||
@@ -217,7 +206,7 @@ releases:
|
||||
# dependencyType=vendor
|
||||
- name: "ums-umc-server"
|
||||
chart: "ums-repo/umc-server"
|
||||
version: "0.5.1"
|
||||
version: "0.6.1"
|
||||
values:
|
||||
- "values-common.gotmpl"
|
||||
- "values-common.yaml"
|
||||
|
||||
@@ -4,11 +4,7 @@ SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
ingress:
|
||||
enabled: {{ if eq .Values.ingress.ingressClassName "dedicated-haproxy-external" }}false{{ else }}{{ .Values.ingress.enabled }}{{ end }}
|
||||
host: "{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
||||
host: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
||||
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
|
||||
tls:
|
||||
# The TLS configuration is on the "master" Ingress, see "portal-frontend"
|
||||
enabled: false
|
||||
secretName: ""
|
||||
|
||||
...
|
||||
|
||||
@@ -6,5 +6,18 @@ global:
|
||||
configMapUcr: "ums-stack-data-swp-ucr"
|
||||
configMapUcrForced: null
|
||||
|
||||
ingress:
|
||||
# Intentionally not using the Ingress configuration of the UMS stack at the
|
||||
# moment, since it does depend on rewriting capabilities of the ingress
|
||||
# controller. Those are encapsulated into the release "stack-gateway" so that
|
||||
# the compatibility with all ingress controllers is increased.
|
||||
enabled: false
|
||||
tls:
|
||||
# The TLS configuration is on the "master" Ingress, see "portal-frontend"
|
||||
enabled: false
|
||||
secretName: ""
|
||||
|
||||
istio:
|
||||
enabled: false
|
||||
|
||||
...
|
||||
|
||||
@@ -5,15 +5,7 @@ SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
ldapServer:
|
||||
ldapSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
|
||||
ldapBaseDn: "dc=swp-ldap,dc=internal"
|
||||
|
||||
waitForSamlMetadata: true
|
||||
|
||||
# TODO: Certificates handling
|
||||
# caCert: ""
|
||||
# certPem: ""
|
||||
# privateKey: ""
|
||||
# dhParam: ""
|
||||
ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
|
||||
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | quote }}
|
||||
@@ -26,12 +18,11 @@ image:
|
||||
{{- end }}
|
||||
|
||||
waitForDependency:
|
||||
registry: "{{ .Values.global.imageRegistry }}"
|
||||
repository: "{{ .Values.images.umsWaitForDependency.repository }}"
|
||||
imagePullPolicy: "Always"
|
||||
tag: "{{ .Values.images.umsWaitForDependency.tag }}"
|
||||
registry: {{ .Values.global.imageRegistry | quote }}
|
||||
repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
|
||||
|
||||
# TODO: Pending upstream support, #199
|
||||
persistence:
|
||||
data:
|
||||
storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
|
||||
@@ -2,6 +2,9 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
|
||||
ldapServer:
|
||||
waitForSamlMetadata: true
|
||||
|
||||
service:
|
||||
type: "ClusterIP"
|
||||
|
||||
|
||||
@@ -6,12 +6,12 @@ SPDX-License-Identifier: Apache-2.0
|
||||
postgresql:
|
||||
bundled: false
|
||||
connection:
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
host: {{ .Values.databases.umsNotificationsApi.host | quote }}
|
||||
port: {{ .Values.databases.umsNotificationsApi.port | quote }}
|
||||
auth:
|
||||
username: "notificationsapi_user"
|
||||
database: "notificationsapi"
|
||||
password: {{ .Values.secrets.postgresql.notificationsapiUser | quote }}
|
||||
username: {{ .Values.databases.umsNotificationsApi.username | quote }}
|
||||
database: {{ .Values.databases.umsNotificationsApi.name | quote }}
|
||||
password: {{ .Values.databases.umsNotificationsApi.password | default .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
|
||||
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry }}
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
hostname: "{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
||||
ingressClassName: "nginx"
|
||||
annotations:
|
||||
nginx.org/mergeable-ingress-type: "minion"
|
||||
tls: false
|
||||
|
||||
pathType: Exact
|
||||
path: /favicon.ico
|
||||
|
||||
extraPaths:
|
||||
- pathType: Exact
|
||||
path: /univention/portal/css/custom.css
|
||||
backend:
|
||||
service:
|
||||
name: ums-portal-frontend-custom-nginx
|
||||
port:
|
||||
name: http
|
||||
- pathType: Exact
|
||||
path: /univention/portal/icons/logo.svg
|
||||
backend:
|
||||
service:
|
||||
name: ums-portal-frontend-custom-nginx
|
||||
port:
|
||||
name: http
|
||||
- pathType: Exact
|
||||
path: /univention/portal/icons/logo_small_border.svg
|
||||
backend:
|
||||
service:
|
||||
name: ums-portal-frontend-custom-nginx
|
||||
port:
|
||||
name: http
|
||||
- pathType: Exact
|
||||
path: /univention/portal/custom/portal_background_image.png
|
||||
backend:
|
||||
service:
|
||||
name: ums-portal-frontend-custom-nginx
|
||||
port:
|
||||
name: http
|
||||
- pathType: Exact
|
||||
path: /univention/portal/custom/portal_background_image.svg
|
||||
backend:
|
||||
service:
|
||||
name: ums-portal-frontend-custom-nginx
|
||||
port:
|
||||
name: http
|
||||
|
||||
...
|
||||
@@ -1,33 +0,0 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
|
||||
service:
|
||||
type: "ClusterIP"
|
||||
|
||||
extraVolumes:
|
||||
- name: "opendesk-branding"
|
||||
configMap:
|
||||
name: "ums-stack-data-swp-branding"
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/app/favicon.ico"
|
||||
subPath: "favicon.ico"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/app/univention/portal/css/custom.css"
|
||||
subPath: "custom.css"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/app/univention/portal/icons/logo.svg"
|
||||
subPath: "logo.svg"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/app/univention/portal/icons/logo_small_border.svg"
|
||||
subPath: "logo_small_border.svg"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/app/univention/portal/custom/portal_background_image.png"
|
||||
subPath: "portal_background_image.png"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/app/univention/portal/custom/portal_background_image.svg"
|
||||
subPath: "portal_background_image.svg"
|
||||
|
||||
...
|
||||
@@ -14,13 +14,7 @@ image:
|
||||
{{- end }}
|
||||
|
||||
extraIngresses:
|
||||
redirects:
|
||||
enabled: {{ if eq .Values.ingress.ingressClassName "dedicated-haproxy-external" }}false{{ else }}{{ .Values.ingress.enabled }}{{ end }}
|
||||
# The TLS configuration is on the "master" Ingress, see below.
|
||||
tls:
|
||||
enabled: false
|
||||
master:
|
||||
enabled: {{ if eq .Values.ingress.ingressClassName "dedicated-haproxy-external" }}false{{ else }}{{ .Values.ingress.enabled }}{{ end }}
|
||||
tls:
|
||||
enabled: {{ .Values.ingress.tls.enabled }}
|
||||
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||
|
||||
@@ -0,0 +1,73 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
|
||||
extraIngresses:
|
||||
redirects:
|
||||
# Using "stack-gateway" currently.
|
||||
enabled: false
|
||||
# The TLS configuration is on the "master" Ingress, see below.
|
||||
tls:
|
||||
enabled: false
|
||||
master:
|
||||
# Using "stack-gateway" currently.
|
||||
enabled: false
|
||||
|
||||
# See "extraVolumeMounts" below
|
||||
custom-favicon:
|
||||
# Using "stack-gateway" at the moment
|
||||
enabled: false
|
||||
annotations:
|
||||
nginx.org/mergeable-ingress-type: "minion"
|
||||
paths:
|
||||
- pathType: "Exact"
|
||||
path: "/favicon.ico"
|
||||
tls: {}
|
||||
|
||||
# See "extraVolumeMounts" below
|
||||
custom-branding:
|
||||
# Using "stack-gateway" at the moment
|
||||
enabled: false
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/configuration-snippet: |
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
nginx.org/location-snippets: |
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
nginx.org/mergeable-ingress-type: "minion"
|
||||
paths:
|
||||
# This relies on the correct implementation of the matching for paths of
|
||||
# type "Prefix" since "/univention/portal/icons/entries/" is owned by
|
||||
# store-dav.
|
||||
# See: https://kubernetes.io/docs/concepts/services-networking/ingress/#multiple-matches
|
||||
- pathType: "Prefix"
|
||||
path: "/univention/portal/icons/"
|
||||
- pathType: "Prefix"
|
||||
path: "/univention/portal/custom/"
|
||||
tls: {}
|
||||
|
||||
extraVolumes:
|
||||
- name: "opendesk-branding"
|
||||
configMap:
|
||||
name: "ums-stack-data-swp-branding"
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/var/www/html/favicon.ico"
|
||||
subPath: "favicon.ico"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/var/www/html/css/custom.css"
|
||||
subPath: "custom.css"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/var/www/html/icons/logo.svg"
|
||||
subPath: "logo.svg"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/var/www/html/icons/logo_small_border.svg"
|
||||
subPath: "logo_small_border.svg"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/var/www/html/custom/portal_background_image.png"
|
||||
subPath: "portal_background_image.png"
|
||||
- name: "opendesk-branding"
|
||||
mountPath: "/var/www/html/custom/portal_background_image.svg"
|
||||
subPath: "portal_background_image.svg"
|
||||
|
||||
...
|
||||
@@ -4,25 +4,20 @@ SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
portalListener:
|
||||
adminGroup: "cn=Domain Admins,cn=groups,dc=swp-ldap,dc=internal"
|
||||
environment: "staging"
|
||||
debugLevel: "4"
|
||||
assetsRoot: "http://portal-listener:{{ .Values.secrets.univentionManagementStack.storeDavUsers.portalListener }}@ums-store-dav/portal-assets/"
|
||||
ucsInternalUrl: "http://portal-listener:{{ .Values.secrets.univentionManagementStack.storeDavUsers.portalListener }}@ums-store-dav/portal-data/"
|
||||
umcGetUrl: "http://ums-umc-server/get"
|
||||
umcSessionUrl: "http://ums-umc-server/get/session-info"
|
||||
adminGroup: {{ printf "%s,%s" "cn=Domain Admins,cn=groups" .Values.ldap.baseDn | quote }}
|
||||
assetsRoot: {{ printf "%s%s%s" "http://portal-listener:" .Values.secrets.univentionManagementStack.storeDavUsers.portalListener "@ums-store-dav/portal-assets/" | quote }}
|
||||
ucsInternalUrl: {{ printf "%s%s%s" "http://portal-listener:" .Values.secrets.univentionManagementStack.storeDavUsers.portalListener "@ums-store-dav/portal-data" | quote }}
|
||||
|
||||
ldapBaseDn: "dc=swp-ldap,dc=internal"
|
||||
ldapHost: "{{ .Values.ldap.host }}"
|
||||
ldapHostDn: "cn=admin,dc=swp-ldap,dc=internal"
|
||||
ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
|
||||
ldapHost: {{ .Values.ldap.host | quote }}
|
||||
ldapHostDn: {{ printf "%s,%s" "cn=admin" .Values.ldap.baseDn | quote }}
|
||||
ldapSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
|
||||
machineSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
|
||||
notifierServer: {{ .Values.ldap.notifierHost | quote }}
|
||||
portalDefaultDn: "cn=domain,cn=portal,cn=portals,cn=univention,dc=swp-ldap,dc=internal"
|
||||
portalDefaultDn: {{ printf "%s,%s" "cn=domain,cn=portal,cn=portals,cn=univention" .Values.ldap.baseDn | quote }}
|
||||
udmApiUrl: "http://ums-udm-rest-api/udm/"
|
||||
udmApiUsername: "cn=admin"
|
||||
|
||||
tlsMode: "off"
|
||||
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | quote }}
|
||||
@@ -37,10 +32,9 @@ image:
|
||||
waitForDependency:
|
||||
registry: {{ .Values.global.imageRegistry | quote }}
|
||||
repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
|
||||
imagePullPolicy: "Always"
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
|
||||
|
||||
# TODO: Pending upstream support, #200
|
||||
persistence:
|
||||
storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.size.univentionManagementStack.portalListener | quote }}
|
||||
|
||||
@@ -2,6 +2,14 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
|
||||
portalListener:
|
||||
debugLevel: "4"
|
||||
tlsMode: "off"
|
||||
udmApiUrl: "http://ums-udm-rest-api/udm/"
|
||||
udmApiUsername: "cn=admin"
|
||||
umcGetUrl: "http://ums-umc-server/get"
|
||||
umcSessionUrl: "http://ums-umc-server/get/session-info"
|
||||
|
||||
store-dav:
|
||||
bundled: false
|
||||
|
||||
|
||||
@@ -4,16 +4,9 @@ SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
portalServer:
|
||||
adminGroup: "cn=Domain Admins,cn=groups,dc=swp-ldap,dc=internal"
|
||||
authMode: "saml"
|
||||
environment: "staging"
|
||||
editable: "false"
|
||||
logLevel: "DEBUG"
|
||||
ucsInternalUrl: "http://portal-server:{{ .Values.secrets.univentionManagementStack.storeDavUsers.portalServer }}@ums-store-dav/portal-data"
|
||||
umcGetUrl: "http://ums-umc-server/get"
|
||||
umcSessionUrl: "http://ums-umc-server/get/session-info"
|
||||
adminGroup: {{ printf "%s,%s" "cn=Domain Admins,cn=groups" .Values.ldap.baseDn | quote }}
|
||||
ucsInternalUrl: {{ printf "%s%s%s" "http://portal-server:" .Values.secrets.univentionManagementStack.storeDavUsers.portalServer "@ums-store-dav/portal-data" | quote }}
|
||||
centralNavigation:
|
||||
enabled: true
|
||||
authenticatorSecret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
|
||||
|
||||
image:
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
|
||||
portalServer:
|
||||
authMode: "saml"
|
||||
editable: "false"
|
||||
logLevel: "DEBUG"
|
||||
umcGetUrl: "http://ums-umc-server/get"
|
||||
umcSessionUrl: "http://ums-umc-server/get/session-info"
|
||||
centralNavigation:
|
||||
enabled: true
|
||||
|
||||
...
|
||||
@@ -4,31 +4,32 @@ SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
stackDataSwp:
|
||||
udmApiUser: "cn=admin"
|
||||
udmApiPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
|
||||
udmApiUrl: "http://ums-udm-rest-api/udm/"
|
||||
loadDevData: true
|
||||
|
||||
stackDataContext:
|
||||
ldapBase: "dc=swp-ldap,dc=internal"
|
||||
ldapSearchUsers:
|
||||
{{- range $k, $v := .Values.secrets.univentionCorporateServer.ldapSearch }}
|
||||
- username: {{ printf "ldapsearch_%s" $k | quote }}
|
||||
password: {{ $v | quote }}
|
||||
lastname: {{ "LDAP-Search-User" }}
|
||||
{{- range $username, $password := .Values.secrets.univentionCorporateServer.ldapSearch }}
|
||||
- username: {{ printf "ldapsearch_%s" $username | quote }}
|
||||
password: {{ $password | quote }}
|
||||
lastname: "LDAP-Search-User"
|
||||
{{- end }}
|
||||
|
||||
externalDomainName: "{{ .Values.global.domain }}"
|
||||
externalMailDomain: "{{ .Values.global.domain }}"
|
||||
externalDomainName: {{ .Values.global.domain | quote }}
|
||||
externalMailDomain: {{ .Values.global.domain | quote }}
|
||||
|
||||
portalGroupwareLinkBase: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
||||
portalFileshareLinkBase: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
|
||||
portalRealtimeCollaborationLinkBase: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}"
|
||||
portalRealtimeVideoconferenceLinkBase: "https://{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
|
||||
portalManagementProjectLinkBase: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
|
||||
portalManagementKnowledgeLinkBase: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
|
||||
portalGroupwareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openxchange .Values.istio.domain | quote }}
|
||||
portalFileshareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.nextcloud .Values.global.domain | quote }}
|
||||
portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain | quote }}
|
||||
portalRealtimeVideoconferenceLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.jitsi .Values.global.domain | quote }}
|
||||
portalManagementProjectLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openproject .Values.global.domain | quote }}
|
||||
portalManagementKnowledgeLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.xwiki .Values.global.domain | quote }}
|
||||
|
||||
oxDefaultContext: "10"
|
||||
smtpHost: {{ .Values.smtp.host | quote }}
|
||||
smtpPort: {{ .Values.smtp.port | quote }}
|
||||
smtpUser: {{ .Values.smtp.username | quote }}
|
||||
|
||||
userPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.userPassword | quote }}
|
||||
adminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
|
||||
|
||||
userPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.userPassword | quote }}
|
||||
adminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
stackDataSwp:
|
||||
udmApiUser: "cn=admin"
|
||||
udmApiUrl: "http://ums-udm-rest-api/udm/"
|
||||
loadDevData: true
|
||||
|
||||
stackDataContext:
|
||||
ldapBase: "dc=swp-ldap,dc=internal"
|
||||
oxDefaultContext: "10"
|
||||
smtpStartTls: true
|
||||
|
||||
additionalAnnotations:
|
||||
intents.otterize.com/service-name: "ums-stack-data-swp"
|
||||
...
|
||||
@@ -4,32 +4,22 @@ SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
stackDataUms:
|
||||
udmApiUser: "cn=admin"
|
||||
udmApiPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
|
||||
udmApiUrl: "http://ums-udm-rest-api/udm/"
|
||||
loadDevData: true
|
||||
|
||||
stackDataContext:
|
||||
domainname: "{{ .Values.global.domain }}"
|
||||
externalMailDomain: "{{ .Values.global.domain }}"
|
||||
hostname: "{{ .Values.global.hosts.univentionManagementStack }}"
|
||||
ldapHost: "{{ .Values.ldap.host }}"
|
||||
ldapBase: "dc=swp-ldap,dc=internal"
|
||||
# TODO: This should not be required, the machine account is not there
|
||||
# ldapHostDn: cn=stub-value,cn=dc,cn=computers,dc=swp-ldap,dc=internal
|
||||
ldapHostDn: cn=admin,dc=swp-ldap,dc=internal
|
||||
domainname: {{ .Values.global.domain | quote }}
|
||||
externalMailDomain: {{ .Values.global.domain | quote }}
|
||||
hostname: {{ .Values.global.hosts.univentionManagementStack | quote }}
|
||||
ldapHost: {{ .Values.ldap.host | quote }}
|
||||
ldapBase: {{ .Values.ldap.baseDn | quote }}
|
||||
ldapHostDn: {{ printf "%s,%s" "cn=admin" .Values.ldap.baseDn | quote }}
|
||||
|
||||
idpSamlMetadataUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/saml/descriptor"
|
||||
idpSamlMetadataUrlInternal: null
|
||||
umcSamlSpFqdn: "{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
||||
umcSamlSchemes: "https"
|
||||
idpFqdn: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||
ldapSamlSpUrls: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/saml/metadata"
|
||||
idpSamlMetadataUrl: {{ printf "https://%s.%s%s" .Values.global.hosts.keycloak .Values.global.domain "/realms/souvap/protocol/saml/descriptor" | quote }}
|
||||
umcSamlSpFqdn: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
||||
idpFqdn: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
|
||||
ldapSamlSpUrls: {{ printf "https://%s.%s%s" .Values.global.hosts.univentionManagementStack .Values.global.domain "/univention/saml/metadata" | quote }}
|
||||
|
||||
initialPasswordAdministrator: "{{ .Values.secrets.univentionManagementStack.defaultAccounts.administratorPassword }}"
|
||||
|
||||
# The SWP configuration brings its own UMC policies.
|
||||
installUmcPolicies: false
|
||||
initialPasswordAdministrator: {{ .Values.secrets.univentionManagementStack.defaultAccounts.administratorPassword | quote }}
|
||||
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | quote }}
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
stackDataUms:
|
||||
loadDevData: true
|
||||
udmApiUrl: "http://ums-udm-rest-api/udm/"
|
||||
udmApiUser: "cn=admin"
|
||||
|
||||
stackDataContext:
|
||||
idpSamlMetadataUrlInternal: null
|
||||
umcSamlSchemes: "https"
|
||||
# The openDesk configuration brings its own UMC policies.
|
||||
installUmcPolicies: false
|
||||
|
||||
additionalAnnotations:
|
||||
intents.otterize.com/service-name: "ums-stack-data-ums"
|
||||
...
|
||||
@@ -21,7 +21,6 @@ image:
|
||||
configHtpasswd:
|
||||
registry: {{ .Values.global.imageRegistry | quote }}
|
||||
repository: {{ .Values.images.umsConfigHtpasswd.repository | quote }}
|
||||
pullPolicy: "Always"
|
||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
tag: {{ .Values.images.umsConfigHtpasswd.tag | quote }}
|
||||
pullSecrets:
|
||||
@@ -29,7 +28,6 @@ image:
|
||||
- name: {{ . | quote }}
|
||||
{{- end }}
|
||||
|
||||
# TODO: Pending upstream support, #201
|
||||
persistence:
|
||||
storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||
size: {{ .Values.persistence.size.univentionManagementStack.storeDav | quote }}
|
||||
|
||||
@@ -7,12 +7,7 @@ udmRestApi:
|
||||
# TODO: Secret should be entered without b64enc
|
||||
ldapSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | b64enc | quote }}
|
||||
# TODO: Secret should be entered without b64enc
|
||||
machineSecret: "{{ .Values.secrets.univentionManagementStack.ldapSecret | b64enc }}"
|
||||
# TODO: Stub value currently
|
||||
caCert: ""
|
||||
# TODO: This should not be part of the udm-rest-api anymore
|
||||
loadJoinData:
|
||||
enabled: true
|
||||
machineSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | b64enc | quote }}
|
||||
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | quote }}
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
udmRestApi:
|
||||
# TODO: Stub value currently
|
||||
caCert: ""
|
||||
|
||||
extraVolumes:
|
||||
- name: "attribute-to-group-mapper-hook"
|
||||
configMap:
|
||||
name: "ums-stack-data-swp-attribute-to-group-mapper-hook"
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: "attribute-to-group-mapper-hook"
|
||||
mountPath: "/usr/lib/python3/dist-packages/univention/admin/hooks.d/AttributeToGroupMapper.py"
|
||||
subPath: "AttributeToGroupMapper.py"
|
||||
- name: "attribute-to-group-mapper-hook"
|
||||
mountPath: "/usr/share/attribute-to-group-mapper/flag_to_group_mapping.json"
|
||||
subPath: "flag_to_group_mapping.json"
|
||||
|
||||
...
|
||||
@@ -3,19 +3,6 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
umcGateway:
|
||||
|
||||
extraVolumes:
|
||||
- name: "entrypoint-swp-patches"
|
||||
configMap:
|
||||
name: "ums-stack-data-swp-umc-gateway-entrypoint"
|
||||
defaultMode: 0555
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: "entrypoint-swp-patches"
|
||||
mountPath: "/entrypoint.d/90-swp.sh"
|
||||
subPath: "90-swp.sh"
|
||||
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | quote }}
|
||||
repository: {{ .Values.images.umsUmcGateway.repository | quote }}
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
extraVolumes:
|
||||
- name: "entrypoint-swp-patches"
|
||||
configMap:
|
||||
name: "ums-stack-data-swp-umc-gateway-entrypoint"
|
||||
defaultMode: 0555
|
||||
- name: "announcements-customization"
|
||||
configMap:
|
||||
name: "ums-stack-data-swp-umc-server-announcements"
|
||||
defaultMode: 0444
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: "entrypoint-swp-patches"
|
||||
mountPath: "/entrypoint.d/90-swp.sh"
|
||||
subPath: "90-swp.sh"
|
||||
- name: "announcements-customization"
|
||||
mountPath:
|
||||
"/usr/share/univention-management-console-frontend/js/dijit/themes\
|
||||
/umc/icons/16x16/udm-portals-announcement.png"
|
||||
subPath: "udm-portals-announcement.png"
|
||||
...
|
||||
@@ -9,6 +9,21 @@ umcServer:
|
||||
# TODO: Secret should be entered without b64enc
|
||||
machineSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | b64enc | quote }}
|
||||
|
||||
smtpSecret: {{ .Values.smtp.password | quote }}
|
||||
|
||||
postgresql:
|
||||
connection:
|
||||
host: {{ .Values.databases.umsSelfservice.host | quote }}
|
||||
port: {{ .Values.databases.umsSelfservice.port | quote }}
|
||||
auth:
|
||||
username: {{ .Values.databases.umsSelfservice.username | quote }}
|
||||
database: {{ .Values.databases.umsSelfservice.name | quote }}
|
||||
password: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
|
||||
postgresPassword: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
|
||||
|
||||
memcached:
|
||||
server: {{ .Values.cache.umsSelfservice.host | quote }}
|
||||
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | quote }}
|
||||
repository: {{ .Values.images.umsUmcServer.repository | quote }}
|
||||
|
||||
@@ -17,6 +17,13 @@ extraVolumes:
|
||||
configMap:
|
||||
name: "ums-stack-data-swp-self-service-emails"
|
||||
defaultMode: 0444
|
||||
- name: "attribute-to-group-mapper-hook"
|
||||
configMap:
|
||||
name: "ums-stack-data-swp-attribute-to-group-mapper-hook"
|
||||
- name: "announcements-customization"
|
||||
configMap:
|
||||
name: "ums-stack-data-swp-umc-server-announcements"
|
||||
defaultMode: 0444
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: "certificates"
|
||||
@@ -26,5 +33,22 @@ extraVolumeMounts:
|
||||
subPath: "90-customization.sh"
|
||||
- name: "self-service-emails"
|
||||
mountPath: "/usr/share/univention-self-service/email_bodies"
|
||||
- name: "attribute-to-group-mapper-hook"
|
||||
mountPath: "/usr/lib/python3/dist-packages/univention/admin/hooks.d/AttributeToGroupMapper.py"
|
||||
subPath: "AttributeToGroupMapper.py"
|
||||
- name: "attribute-to-group-mapper-hook"
|
||||
mountPath: "/usr/share/attribute-to-group-mapper/flag_to_group_mapping.json"
|
||||
subPath: "flag_to_group_mapping.json"
|
||||
- name: "announcements-customization"
|
||||
mountPath: "/usr/share/univention-management-console/modules/udm-portals-announcement.xml"
|
||||
subPath: "udm-portals-announcement.xml"
|
||||
|
||||
postgresql:
|
||||
bundled: false
|
||||
|
||||
memcached:
|
||||
bundled: false
|
||||
auth:
|
||||
username: null
|
||||
password: null
|
||||
...
|
||||
|
||||
@@ -3,171 +3,11 @@
|
||||
---
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
hostname: "{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
||||
ingressClassName: "{{ .Values.ingress.ingressClassName }}"
|
||||
tls: false
|
||||
enabled: {{ .Values.ingress.enabled }}
|
||||
hostname: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
||||
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
|
||||
extraTls:
|
||||
- hosts:
|
||||
- "{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
||||
secretName: "{{ .Values.ingress.tls.secretName }}"
|
||||
|
||||
service:
|
||||
type: "ClusterIP"
|
||||
|
||||
# The content of the "serverBlock" does resemble the Ingress configuration of
|
||||
# the UMS components. The "location" entries do intentionally reflect precisely
|
||||
# the respective paths which are configured.
|
||||
serverBlock: |
|
||||
server {
|
||||
listen 8080;
|
||||
|
||||
## portal-frontend
|
||||
# The frontend does not own "/univention/portal", only these two bits
|
||||
location = /univention/portal/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80/;
|
||||
}
|
||||
location = /univention/portal/index.html {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80/;
|
||||
}
|
||||
|
||||
# The following prefixes are owned by the frontend
|
||||
location /univention/portal/css/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/fonts/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/i18n/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/media/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/js/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/oidc/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
|
||||
|
||||
## frontend redirects
|
||||
|
||||
location = / {
|
||||
absolute_redirect off;
|
||||
return 302 /univention/portal/;
|
||||
}
|
||||
location = /univention {
|
||||
absolute_redirect off;
|
||||
return 302 /univention/portal/;
|
||||
}
|
||||
location = /univention/ {
|
||||
absolute_redirect off;
|
||||
return 302 /univention/portal/;
|
||||
}
|
||||
location = /univention/portal {
|
||||
absolute_redirect off;
|
||||
return 302 /univention/portal/;
|
||||
}
|
||||
|
||||
|
||||
## portal-server
|
||||
location = /univention/portal/portal.json {
|
||||
proxy_pass http://ums-portal-server:80;
|
||||
}
|
||||
location = /univention/portal/navigation.json {
|
||||
proxy_pass http://ums-portal-server:80;
|
||||
}
|
||||
|
||||
|
||||
## store-dav
|
||||
location /univention/portal/icons/entries/ {
|
||||
rewrite ^/univention/portal(/icons/entries/.*)$ /portal-assets$1 break;
|
||||
proxy_pass http://ums-store-dav:80;
|
||||
}
|
||||
location /univention/portal/icons/logos/ {
|
||||
rewrite ^/univention/portal(/icons/logos/.*)$ /portal-assets$1 break;
|
||||
proxy_pass http://ums-store-dav:80;
|
||||
}
|
||||
|
||||
|
||||
## udm-rest-api
|
||||
location /univention/udm/ {
|
||||
rewrite ^/univention(/udm/.*)$ $1 break;
|
||||
proxy_pass http://ums-udm-rest-api:80;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
}
|
||||
|
||||
|
||||
## umc-gateway
|
||||
location = /univention/languages.json {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location = /univention/meta.json {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location = /univention/theme.css {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location /univention/js/ {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location /univention/login/ {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location /univention/management/ {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location /univention/themes/ {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
|
||||
|
||||
## umc-server
|
||||
location = /univention/auth {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/logout/ {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/saml/ {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/get/ {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/set/ {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/command/ {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/upload/ {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
|
||||
|
||||
## notifications-api
|
||||
|
||||
location /univention/portal/notifications-api/ {
|
||||
rewrite ^/univention/portal/notifications-api(/.*)$ $1 break;
|
||||
proxy_pass http://ums-notifications-api:80;
|
||||
}
|
||||
|
||||
}
|
||||
- {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
||||
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||
...
|
||||
|
||||
@@ -0,0 +1,223 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
ingress:
|
||||
tls: false
|
||||
|
||||
service:
|
||||
type: "ClusterIP"
|
||||
|
||||
fullnameOverride: "ums-stack-gateway"
|
||||
|
||||
# The content of the "serverBlock" does resemble the Ingress configuration of
|
||||
# the UMS components. The "location" entries do intentionally reflect precisely
|
||||
# the respective paths which are configured.
|
||||
serverBlock: |
|
||||
server {
|
||||
listen 8080;
|
||||
|
||||
## portal-frontend
|
||||
# The frontend does not own "/univention/portal" nor
|
||||
# "/univention/selfservice", only these two bits
|
||||
location = /univention/portal/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80/;
|
||||
}
|
||||
location = /univention/portal/index.html {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80/;
|
||||
}
|
||||
location = /univention/selfservice/ {
|
||||
rewrite ^/univention/selfservice(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80/;
|
||||
}
|
||||
|
||||
# The following prefixes are owned by the frontend
|
||||
location /univention/portal/css/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/fonts/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/i18n/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/media/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/js/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/portal/oidc/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/selfservice/css/ {
|
||||
rewrite ^/univention/selfservice(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/selfservice/fonts/ {
|
||||
rewrite ^/univention/selfservice(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/selfservice/i18n/ {
|
||||
rewrite ^/univention/selfservice(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/selfservice/media/ {
|
||||
rewrite ^/univention/selfservice(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/selfservice/js/ {
|
||||
rewrite ^/univention/selfservice(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
location /univention/selfservice/oidc/ {
|
||||
rewrite ^/univention/selfservice(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80;
|
||||
}
|
||||
|
||||
|
||||
## frontend redirects
|
||||
location = / {
|
||||
absolute_redirect off;
|
||||
return 302 /univention/portal/;
|
||||
}
|
||||
location = /univention {
|
||||
absolute_redirect off;
|
||||
return 302 /univention/portal/;
|
||||
}
|
||||
location = /univention/ {
|
||||
absolute_redirect off;
|
||||
return 302 /univention/portal/;
|
||||
}
|
||||
location = /univention/portal {
|
||||
absolute_redirect off;
|
||||
return 302 /univention/portal/;
|
||||
}
|
||||
location = /univention/selfservice {
|
||||
absolute_redirect off;
|
||||
return 302 /univention/selfservice/;
|
||||
}
|
||||
|
||||
|
||||
## portal-server
|
||||
location = /univention/portal/portal.json {
|
||||
proxy_pass http://ums-portal-server:80;
|
||||
}
|
||||
location = /univention/selfservice/portal.json {
|
||||
proxy_pass http://ums-portal-server:80;
|
||||
}
|
||||
location = /univention/portal/navigation.json {
|
||||
proxy_pass http://ums-portal-server:80;
|
||||
}
|
||||
|
||||
|
||||
## store-dav
|
||||
location /univention/portal/icons/entries/ {
|
||||
rewrite ^/univention/portal(/icons/entries/.*)$ /portal-assets$1 break;
|
||||
proxy_pass http://ums-store-dav:80;
|
||||
}
|
||||
location /univention/portal/icons/logos/ {
|
||||
rewrite ^/univention/portal(/icons/logos/.*)$ /portal-assets$1 break;
|
||||
proxy_pass http://ums-store-dav:80;
|
||||
}
|
||||
location /univention/selfservice/icons/entries/ {
|
||||
rewrite ^/univention/selfservice(/icons/entries/.*)$ /portal-assets$1 break;
|
||||
proxy_pass http://ums-store-dav:80;
|
||||
}
|
||||
location /univention/selfservice/icons/logos/ {
|
||||
rewrite ^/univention/selfservice(/icons/logos/.*)$ /portal-assets$1 break;
|
||||
proxy_pass http://ums-store-dav:80;
|
||||
}
|
||||
|
||||
|
||||
## udm-rest-api
|
||||
location /univention/udm/ {
|
||||
rewrite ^/univention(/udm/.*)$ $1 break;
|
||||
proxy_pass http://ums-udm-rest-api:80;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
}
|
||||
|
||||
|
||||
## umc-gateway
|
||||
location = /univention/languages.json {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location = /univention/meta.json {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location = /univention/theme.css {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location /univention/js/ {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location /univention/login/ {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location /univention/management/ {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
location /univention/themes/ {
|
||||
proxy_pass http://ums-umc-gateway:80;
|
||||
}
|
||||
|
||||
|
||||
## umc-server
|
||||
location = /univention/auth {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/logout {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/saml {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/get {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/set {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/command {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
location /univention/upload {
|
||||
rewrite ^/univention(/.*)$ $1 break;
|
||||
proxy_pass http://ums-umc-server:80;
|
||||
}
|
||||
|
||||
|
||||
## notifications-api
|
||||
location /univention/portal/notifications-api/ {
|
||||
rewrite ^/univention/portal/notifications-api(/.*)$ $1 break;
|
||||
proxy_pass http://ums-notifications-api:80;
|
||||
}
|
||||
|
||||
## openDesk branding
|
||||
location = /favicon.ico {
|
||||
proxy_pass http://ums-portal-frontend:80/;
|
||||
}
|
||||
location /univention/portal/custom/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80/;
|
||||
}
|
||||
location /univention/portal/icons/ {
|
||||
rewrite ^/univention/portal(/.*)$ $1 break;
|
||||
proxy_pass http://ums-portal-frontend:80/;
|
||||
}
|
||||
|
||||
}
|
||||
...
|
||||
@@ -2,7 +2,14 @@
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
enabled: true
|
||||
runAsUser: 100
|
||||
runAsGroup: 101
|
||||
runAsNonRoot: true
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
|
||||
customConfigs:
|
||||
xwiki.cfg:
|
||||
@@ -87,6 +94,9 @@ properties:
|
||||
|
||||
securityContext:
|
||||
enabled: true
|
||||
fsGroup: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
|
||||
service:
|
||||
externalPort: 80
|
||||
|
||||
@@ -7,4 +7,5 @@ SPDX-License-Identifier: Apache-2.0
|
||||
ldap:
|
||||
host: {{ if eq (env "DEPLOY_UCS") "ums-eval" }} "ums-ldap-server" {{ else }} "univention-corporate-container" {{ end }}
|
||||
notifierHost: {{ if eq (env "DEPLOY_UCS") "ums-eval" }} "ums-ldap-notifier" {{ else }} "univention-corporate-container" {{ end }}
|
||||
baseDn: "dc=swp-ldap,dc=internal"
|
||||
...
|
||||
|
||||
@@ -13,4 +13,7 @@ cache:
|
||||
openproject:
|
||||
host: "memcached"
|
||||
port: 11211
|
||||
umsSelfservice:
|
||||
host: "memcached"
|
||||
port: 11211
|
||||
...
|
||||
|
||||
@@ -36,6 +36,18 @@ databases:
|
||||
username: "matrix_user"
|
||||
password: ""
|
||||
port: 5432
|
||||
umsNotificationsApi:
|
||||
name: "notificationsapi"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
username: "notificationsapi_user"
|
||||
password: ""
|
||||
umsSelfservice:
|
||||
name: "selfservice"
|
||||
host: "postgresql"
|
||||
port: 5432
|
||||
username: "selfservice_user"
|
||||
password: ""
|
||||
xwiki:
|
||||
name: "xwiki"
|
||||
host: "mariadb"
|
||||
|
||||
@@ -205,7 +205,7 @@ images:
|
||||
# registryUrl=https://docker.io
|
||||
# dependencyType=vendor
|
||||
repository: "nextcloud"
|
||||
tag: "27.1.3-apache@sha256:ec46e99164ee7fa5d49e84784833e022be47f9f54f401bcb5a2d789f8c0bc149"
|
||||
tag: "27.1.4-apache@sha256:bd277bec9a8cf7cc009865e15410c05e0f66ccb6269ed96841cc95dd37c214fe"
|
||||
# @supplier: "Nextcloud Community"
|
||||
nextcloudExporter:
|
||||
# renovate:
|
||||
@@ -396,7 +396,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/config-htpasswd"
|
||||
tag: "0.5.2@sha256:b63887af87ed4c496688d422a8881e806de4a2364eb07c7e24bb1635b539e7f3"
|
||||
tag: "0.7.0@sha256:8ffa8ce61fc55f67cdf740b3cd30e21d979506a1796028f5c6329da344b2e5db"
|
||||
# @supplier: "Univention"
|
||||
umsDataLoader:
|
||||
# renovate:
|
||||
@@ -404,7 +404,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/data-loader"
|
||||
tag: "0.33.0@sha256:2e9baf28cfe3eb6c740ce604d60ebc1ee6b3e0e2e8741730716a1c7375046039"
|
||||
tag: "0.38.1@sha256:cef20b0224571eeda29f19e78340ab7d943e46b02275f9b9497605357be70e61"
|
||||
# @supplier: "Univention"
|
||||
umsLdapNotifier:
|
||||
# renovate:
|
||||
@@ -412,7 +412,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/ldap-notifier"
|
||||
tag: "0.7.0@sha256:c5bd680dc85990aec2c3dde14f8e6b72f5a5d2d3c648bc434c57117836464faf"
|
||||
tag: "0.7.0@sha256:ae9acf8f1a5e28645edea62a25040b6dd77bb1c8773964f0cb0e885397586bbe"
|
||||
# @supplier: "Univention"
|
||||
umsLdapServer:
|
||||
# renovate:
|
||||
@@ -420,7 +420,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/ldap-server"
|
||||
tag: "0.7.0@sha256:a87b615fc97c574316f41e1e6dc9bef41d80583ba450aece9d9830bab4d5a09a"
|
||||
tag: "0.7.0@sha256:a637f8d11c3a17d18b8f4dfce252fd55150188ea16ed3b1605a779b7ff535f3e"
|
||||
# @supplier: "Univention"
|
||||
umsNotificationsApi:
|
||||
# renovate:
|
||||
@@ -428,7 +428,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/notifications-api"
|
||||
tag: "0.4.4@sha256:630905fd503ea5f4b17ccd4adccd68c20b85405a7372e7c71ac2c88aa6e1e47c"
|
||||
tag: "0.6.1@sha256:bdf0c5ba8b15c2e7f4daaf470254b13837bdc5fbaa98d9f441f33abd565acfc3"
|
||||
# @supplier: "Univention"
|
||||
umsPortalListener:
|
||||
# renovate:
|
||||
@@ -436,7 +436,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/portal-listener"
|
||||
tag: "0.4.4@sha256:689065bad9ab735be1cfd12e519934616e8c049afee4f78c46b630ab7c1a7aef"
|
||||
tag: "0.6.1@sha256:c418be054dfb2c6fe0e2e8870553c3b27269ae77b88a59cd6d790201cf7c3d17"
|
||||
# @supplier: "Univention"
|
||||
umsPortalFrontend:
|
||||
# renovate:
|
||||
@@ -444,7 +444,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/portal-frontend"
|
||||
tag: "0.4.4@sha256:b8955718ad4d2c973b4c1ee80867ac47c2d90e422234c7a2401b13ed606fd4d4"
|
||||
tag: "0.6.1@sha256:0a4dc8ed47fd86eedd7bfd826b4538564194fe951000cff016eaa271382ed822"
|
||||
# @supplier: "Univention"
|
||||
umsPortalServer:
|
||||
# renovate:
|
||||
@@ -452,7 +452,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/portal-server"
|
||||
tag: "0.4.4@sha256:21d279ede3a7cbdaf3a5c4e83375bb389785db4f2569cfaf8362896a9b30e287"
|
||||
tag: "0.6.1@sha256:dd9431c8a82e6fca89ef871de90947db2f594a349d634f0b1aa9669d0b3d5715"
|
||||
# @supplier: "Univention"
|
||||
umsWaitForDependency:
|
||||
# renovate:
|
||||
@@ -460,7 +460,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/wait-for-dependency"
|
||||
tag: "0.4.3@sha256:ff4b7f762860baa1415cfe9a24131cb28c2660a14058ca8a1e7a697468f72d69"
|
||||
tag: "0.6.1@sha256:e83fe2d7535167d1d1effe443fca0be431aa551ab31f172a84073b7d9ffec54b"
|
||||
# @supplier: "Univention"
|
||||
umsStoreDav:
|
||||
# renovate:
|
||||
@@ -468,7 +468,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/store-dav"
|
||||
tag: "0.5.2@sha256:a3cbb1df2024edf58aea029a280f660bcd2fb8e684eed638901f5d7cbf9db467"
|
||||
tag: "0.7.0@sha256:732b0d2fdf320209de04403753d3bc80f9c73a46b237202a95305a332805f305"
|
||||
# @supplier: "Univention"
|
||||
umsUdmRestApi:
|
||||
# renovate:
|
||||
@@ -484,7 +484,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/umc-gateway"
|
||||
tag: "0.5.1@sha256:9937efd54020e0782a26a1670d0cb8b29edbc802b1fd9eed5e308a594d4ce010"
|
||||
tag: "0.6.1@sha256:e023c6b4a66eb80dc165310aff9b869cf35c102196514741676a9dba68cfae89"
|
||||
# @supplier: "Univention"
|
||||
umsUmcServer:
|
||||
# renovate:
|
||||
@@ -492,7 +492,7 @@ images:
|
||||
# dependencyType=vendor
|
||||
# This is a preview and not part of the standard deployment.
|
||||
repository: "souvap/tooling/images/univention/umc-server"
|
||||
tag: "0.5.1@sha256:cfb626f8d0a949ce0ed36d7e01791006eae24d984573dfa3ed3f031808437da3"
|
||||
tag: "0.6.1@sha256:9fc3ad7c45c436698223fe3219c314420b4687c9c694f5d255612beb51df9347"
|
||||
# @supplier: "Univention"
|
||||
wellKnown:
|
||||
# renovate:
|
||||
|
||||
16
helmfile/environments/default/objectstore.gotmpl
Normal file
16
helmfile/environments/default/objectstore.gotmpl
Normal file
@@ -0,0 +1,16 @@
|
||||
{{/*
|
||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
*/}}
|
||||
---
|
||||
objectstores:
|
||||
openproject:
|
||||
backend: "minio"
|
||||
bucket: "openproject"
|
||||
endpoint: ""
|
||||
provider: "AWS"
|
||||
region: ""
|
||||
secret: ""
|
||||
username: "openproject_user"
|
||||
useIAMProfile: ""
|
||||
...
|
||||
@@ -38,7 +38,8 @@ secrets:
|
||||
keycloakExtensionUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "keycloak_extensions_user" | sha1sum | quote }}
|
||||
matrixUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "matrix_user" | sha1sum | quote }}
|
||||
openprojectUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "openproject_user" | sha1sum | quote }}
|
||||
notificationsapiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "notificationsapi_user" | sha1sum | quote }}
|
||||
umsNotificationsApiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "notificationsapi_user" | sha1sum | quote }}
|
||||
umsSelfserviceUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "selfservice_user" | sha1sum | quote }}
|
||||
mariadb:
|
||||
rootPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "mariadb" "root_password" | sha1sum | quote }}
|
||||
xwikiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "mariadb" "xwiki_user" | sha1sum | quote }}
|
||||
|
||||
10
helmfile/environments/default/security.yaml
Normal file
10
helmfile/environments/default/security.yaml
Normal file
@@ -0,0 +1,10 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
---
|
||||
security:
|
||||
otterizeIntents:
|
||||
enabled: false
|
||||
clusterPostfix:
|
||||
enabled: false
|
||||
namespace: ""
|
||||
...
|
||||
53
helmfile/files/gpg-pubkeys/openproject-com.gpg
Normal file
53
helmfile/files/gpg-pubkeys/openproject-com.gpg
Normal file
@@ -0,0 +1,53 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBGVSG3cBEACftfIFs1EO29wSL9kNN057w6S8qSKNRI6DNrGkgYxB/C3JsdTH
|
||||
iNtpv1g1pBbze6Efz/SxaeQ43eqEPkqa9nHBE8ypSWBEzu0EzrDt5bhjpvL4yK1A
|
||||
14T6A7cYm6Qtu+AvMDaJ6UVp1JS+1h4o52zmSvup0bD1xoUnpuhPa7WE0XQOgl3v
|
||||
2X/YBSrQpVV6hwoTWuag9z4qyfsyP/jzTrYtw8e39ff1Fm7jUeKEvmoOuxdH/fD7
|
||||
hGPDcpvDq+5uTXAlWPEMtCoN3uFRqg9BybeKo4VMzFhim334i8x+8vp3kQyT7xi8
|
||||
b72UluDPQur9zwv1T+knQw5T33nP3xqc8BAWo7fy7Co+x7snwprzTWyDq8kIJxyA
|
||||
l3jg/4WNUEdoJkesPtcQUl2lWIP62UZAwIINfOtjzJP7pNNnZrW21Bs/xwPB6lo/
|
||||
TyeLEYQcx6SZH1rPTCE3TlGfXSGI/UpAlMbmxPf4LxcE9J8d4ixUtTxGeMftWceb
|
||||
enn9SX15DIyHC1uO4E0QfUCtwmBTnfOiG7U042zRFD8fZhegq2ZuAxPDvON8sFEC
|
||||
v1y8YlR/j9IYFtgRCsaCuqMlE9VIQSADWHsKTr7l+W4ne5kDzIClzlh+kV0ViJLt
|
||||
SpzGlddHo5GViHmgDeOikRbAji5+jACqh6d5boNWGvflSFQX8FFyOW5rkQARAQAB
|
||||
tGxPcGVuUHJvamVjdCBPcGVyYXRpb25zIFRlYW0gKE9wZW5Qcm9qZWN0IE9wZXJh
|
||||
dGlvbnMgRGVwbG95bWVudCBhbmQgU2lnbmluZyBrZXkpIDxvcGVyYXRpb25zQG9w
|
||||
ZW5wcm9qZWN0LmNvbT6JAk4EEwEIADgWIQTLHKBIinW3Rx6hsIfPVt1qCuJg5QUC
|
||||
ZVIbdwIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDPVt1qCuJg5fwwD/wO
|
||||
hTZtfSTmWs+/lgspHtfd+FADCn4yq8eCwEWgtG1YCGjyU0yffAsOaDYaeQtujLk4
|
||||
GYIZypugM9BkclZNhtSRWDQhq0kH9bZLTbD5HqZjaVw8zje3SnmqlrKNXt4R4Emp
|
||||
EHhiQMlJDbjHdTHQQ3xoUqPSwhvW5icFkKO0TdM/DbF7X9CRUBo8Lp2oL6Bfd3Ji
|
||||
TvlLiVVQ3xPPLkH8zN83VsdgYl3oy1TfyOQTLfh3Ws+osf748WQDHbipmuo/dnXs
|
||||
8McNixeHuUaOUK78eSXMcEAesbweHG6hQcpfyMcHdB1Q/2eoqUGpTvvLLQ+ChOmJ
|
||||
rNNiZAUC8GpD2dxVtODr81vSS7FJNQfXIC4pOJGPXqoZBXajuD95zbRQUO/ndG4i
|
||||
CETkkcSY1m7BAbPV1uWDOpnMhxG+lzoVraQjKkXJQByakRnTyQWeZW96iLp/2E3H
|
||||
vYJ54wfw1DdpnaB8c/x4izwODjTQpMVDXzJ6I/snL5Yd/GJJplDqz4d031dbcwHR
|
||||
eHPUKerI8WLjj6+MF1j34gsd9pvWGPoR69RaYDrA3Hnq+DJL4omMpr7GrSr2KJ8N
|
||||
/RmYP4Y4dJ5N0sNuEt096AHx1aAduYGnQv67M4d6v9E7ZqugfifTvF4Aq68Vp4Pv
|
||||
eOgG5oVLLZU/h7EO6t7uHJgWw+ozJq/nTVb698nK2rkCDQRlUht3ARAAuvNrUSAA
|
||||
8Dqzi98RRhQ52KUGzub9OKZ/VfsaD1AINiG0CNYNXgUcCzWqXIs+wXRfyziS+x8G
|
||||
WGkqN4MCPe6k3KYuKw94t//aZZ8T1iN8QyjMCfn5VGnwq36rXLcmfvlec5r6opZe
|
||||
I0I+SzSbR2gXNWbU4on4fCVP8ZJc8luNC+mD0qUqP9KGJA6moCbc4eDwKi3sdyh7
|
||||
4wNdDNq0WbTPFoxuJUAlcZjrJhwgjMe+tvRTVyJl3Yi8hth83R8PKic8S84lDZxR
|
||||
KTydu7zl2yFTBi+3jQS+UUIze2Gdfj4Mh5ClLQj55bIPOzHxSAakITo5RNzmiQTV
|
||||
pVGTrO2XYiygO6XgvLOhsumO37nsXOR0zPldbXUrLTY1J4srcn9MB1UikWLGqKqj
|
||||
fgdhyv/I9t3ARBMmj8VASOBjgKN4juNir+AAm1lg/5NZf1YGVTsCVRhwF56kQLyl
|
||||
D3TXkIJPnWvNminknvgpPMzWmR+alh2+Fh16FC53zfXHp5d2Ggk6gcWh2bvD87AQ
|
||||
avNiQtEGv84qEEAqAyiy03OFWeYnxh2BC+J/XWsvP8ZlCSICtEqOnNCqErabB1na
|
||||
0Lb6gOmxuY4Mk4N+TK+975iYDYmAH0o7Z58x/YAfUpSWqrx4C6Jz/F6GYtV2cl9B
|
||||
v3FyU0230LrMssb9XDsP6YU7SoJDaonWNPMAEQEAAYkCNgQYAQgAIBYhBMscoEiK
|
||||
dbdHHqGwh89W3WoK4mDlBQJlUht3AhsMAAoJEM9W3WoK4mDlrVcP/ind6InjSM61
|
||||
E3CUCrS0ahZgYGZL2lPJopnPzvB662IUWMjG8f5rfDoOweI9WiWoJkkg5XvVvt2V
|
||||
RkMoG3FIpGzh760olcNhhIKxgU2IRl2a+uo8QMXakgFFdN+X7uHgro1uu0ftzas4
|
||||
YFyQyBDJYobCZlHlGiF1b/z7JDpY2zQWqBR8bNXlphtDIC6pk5haaJdy8WDG3Yns
|
||||
JT0R74S1xTIKXjU5YK3QE1kulMJFDB+b+c9RkqVsAmuOZyPqfU7I+KlemuxKgZgI
|
||||
5rzoFzkDVcWmaozogOLOM2VSSBiTXxIhHYK9uPYuCttIF4biRjWzaVvfTJjf+KPn
|
||||
6oq0+u7vLfWRomMa+y4na5vrcVifivPNqQphPVU6F6v3f3GK4FpbrQmXli2L5rUL
|
||||
lIDiKDTUtoHP/BnOvz2zXHEY7hfWh4xrEskMXhIiJNIr+UmG/PSjbY/rbPFA1o5b
|
||||
Ln/i8y2UMmSRGvK5i2n9OhaLkMUiL0qLyRnzPXk+2cjvNdp2q1spiz107EigHqKq
|
||||
UXUdRUNX7RtW3gAZRrMple6AHTrQhZhdO2uksMg4YaP/KjKx/GqFty1qwSPF4Zum
|
||||
gfslJ6EB53uJJt9awcGFdFLHHci5ClEH9aGrboWlhx0erFKEcfjCnh8dAA/1UQ0R
|
||||
Ecu2CcmkBOHGAnMirYCSEZqu9Uz+9g7P
|
||||
=nG7D
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
2
helmfile/files/gpg-pubkeys/openproject-com.gpg.license
Normal file
2
helmfile/files/gpg-pubkeys/openproject-com.gpg.license
Normal file
@@ -0,0 +1,2 @@
|
||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
Reference in New Issue
Block a user