chore(release): 0.5.67 [skip ci]

## [0.5.67](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.66...v0.5.67) (2023-12-11)

### Bug Fixes

* **services:** Use Charts from openCoDE registry ([cc0daa2](cc0daa2a22))

.gitlab-ci.yml

@@ -620,4 +620,6 @@ release:
       }
       EOF
     - "semantic-release"
+  needs:
+    - "generate-release-assets"
 ...

CHANGELOG.md

@@ -1,3 +1,107 @@
+## [0.5.67](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.66...v0.5.67) (2023-12-11)
+
+
+### Bug Fixes
+
+* **services:** Use Charts from openCoDE registry ([cc0daa2](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/cc0daa2a22837c00583038ffd9df7e669004e84e))
+
+## [0.5.66](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.65...v0.5.66) (2023-12-08)
+
+
+### Bug Fixes
+
+* **element:** Update Element and Widgets ([6a26299](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/6a26299a7507ae749ffcf25288d2cf5b24d220db))
+
+## [0.5.65](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.64...v0.5.65) (2023-12-08)
+
+
+### Bug Fixes
+
+* **univention-management-stack:** Bump OX Connector ([83192b7](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/83192b78345c62465e2979195d9a1c882ddbf0ea))
+
+## [0.5.64](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.63...v0.5.64) (2023-12-06)
+
+
+### Bug Fixes
+
+* **openproject:** Switch to release container and set home url link ([e67ab8f](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/e67ab8f4304a525b50a3a723c86d1e610313c594))
+
+## [0.5.63](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.62...v0.5.63) (2023-12-06)
+
+
+### Bug Fixes
+
+* **nextcloud:** Remove Talk folder ([0ea5856](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/0ea585633b4bf72fe180ca744cc99d9e9f84998f))
+
+## [0.5.62](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.61...v0.5.62) (2023-12-06)
+
+
+### Bug Fixes
+
+* **nextcloud:** Bump image to 27.1.4 and update Helm chart to configure "Shared_with_me" folder ([d04a603](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/d04a60349dbbff2d64ca2b36b9c44b75526bf859))
+* **univention-management-stack:** Update optional UMS preview state ([94ae3da](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/94ae3da78bd79c61fd7a22db5a541d473eea6a2e))
+
+## [0.5.61](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.60...v0.5.61) (2023-12-05)
+
+
+### Bug Fixes
+
+* **services:** Fix port declaration for Postfix ([bf5dcda](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/bf5dcda3b59e1dc98cbee7e67f50a960d344b8e0))
+
+## [0.5.60](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.59...v0.5.60) (2023-12-05)
+
+
+### Bug Fixes
+
+* **ci:** Ensure release creation with artifacts ([dc7ce0b](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/dc7ce0bc4b9501b63274f68352e6d9e76b5424e8))
+
+## [0.5.59](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.58...v0.5.59) (2023-12-05)
+
+
+### Bug Fixes
+
+* **helmfile:** Add configurable objectstore ([3b5493d](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/3b5493d78dc027cd1f3206b26cf347dc6ce6e265))
+
+## [0.5.58](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.57...v0.5.58) (2023-12-01)
+
+
+### Bug Fixes
+
+* **cryptpad:** Add websocket annotation ([c41643e](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/c41643ee3e5610ef27a63a0355804159030a7452))
+* **openproject:** Add seederJob intent ([05cc82d](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/05cc82d7c5c5f93fb5de7df555a22e8e90279621))
+* **openproject:** Bump to 2.6.2 ([c8bc8b3](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/c8bc8b3172cfef3396379e3969dc087d67a228ee))
+* **services:** Add NetworkPolicy section to docs/security.md ([24812b6](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/24812b667cded720a0ac09b8b3eb89df39b02afb))
+* **services:** Add Otterize based security settings ([bec9a2d](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/bec9a2d46b2b563b7001ed8c6625c10111d5f151))
+* **univention-management-stack:** Add Otterize annotations for jobs ([2628a0e](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/2628a0e13e5957475ce81b12d4230400c9ffeafe))
+
+## [0.5.57](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.56...v0.5.57) (2023-12-01)
+
+
+### Bug Fixes
+
+* **helmfile:** Using correct private registry for  postfix helm-chart ([d367739](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/d367739248ed43b3bad6a00b059b2c949dde4cb7))
+
+## [0.5.56](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.55...v0.5.56) (2023-11-30)
+
+
+### Bug Fixes
+
+* **element:** Raise treshold for login rate limit to avoid too early barrier hitting normal users ([466e741](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/466e7414942837fdb1aecabfb08eae49f9dab272))
+
+## [0.5.55](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.54...v0.5.55) (2023-11-30)
+
+
+### Bug Fixes
+
+* **cryptpad:** Update Helm chart to enable readiness and liveness probes ([6d3e484](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/6d3e484855540569be53130e133e0821a04b2ca5))
+
+## [0.5.54](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.53...v0.5.54) (2023-11-29)
+
+
+### Bug Fixes
+
+* **helmfile:** Add and document security context for components ([519db51](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/519db51be2be3ce292a88965ac0ec049b4c8bb8e))
+
 ## [0.5.53](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.52...v0.5.53) (2023-11-29)
 
 

README.md

@@ -9,14 +9,15 @@ openDesk is a Kubernetes based, open-source and cloud-native digital workplace s
 Aufbau ZenDiS" of Germany's Federal Ministry of the Interior.
 
 It features:
-- Fully integrated Identity Management (Univention, Keycloak)
+- Fully integrated Identity Management (Univention)
 - File storage (Nextcloud)
 - Weboffice (Collabora)
-- Videoconference (Jitsi)
+- Videoconference (Nordeck w/ Jitsi)
-- Encrypted Chat (Synapse, Element)
+- Chat and Collaboration (Element w/ Nordeck)
 - Groupware (OX Appsuite)
 - Wiki (XWiki)
-- Notes and Diagrams (Cryptpad, Draw.io)
+- Project Management (OpenProject)
+- Notes and Diagrams (Cryptpad)
 
 openDesk integrates these components and is working towards a seamless user experience.
 
@@ -40,7 +41,7 @@ Basic knowledge of Kubernetes and Devops is required though.
 
 # Active development notice
 openDesk will face breaking changes in the near future without upgrade paths before
-[technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases
+[technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
 v1.0.0 is reached.
 
 While most components support upgrades, major configuration or component changes may occur, therefore we recommend

docs/external-services.md

@@ -9,6 +9,7 @@ This document will cover the additional configuration to use external services l
 
 <!-- TOC -->
   * [Database](#database)
+  * [Objectstore](#objectstore)
   * [Cache](#cache)
 <!-- TOC -->
 
@@ -17,53 +18,76 @@ This document will cover the additional configuration to use external services l
 When deploying this suite to production, you need to configure the applications to use your production grade database
 service.
 
-| Component   | Name               | Type       | Parameter | Key                                    | Default                    |
+| Component   | Name               | Type       | Parameter | Key                                      | Default                    |
-|-------------|--------------------|------------|-----------|----------------------------------------|----------------------------|
+|-------------|--------------------|------------|-----------|------------------------------------------|----------------------------|
-| Element     | Synapse            | PostgreSQL |           |                                        |                            |
+| Element     | Synapse            | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.synapse.name`               | `matrix`                   |
+|             |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
-|             |                    |            | Host      | `databases.synapse.host`               | `postgresql`               |
+|             |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
-|             |                    |            | Port      | `databases.synapse.port`               | `5432`                     |
+|             |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
-|             |                    |            | Username  | `databases.synapse.username`           | `matrix_user`              |
+|             |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
-|             |                    |            | Password  | `databases.synapse.password`           |                            |
+|             |                    |            | Password  | `databases.synapse.password`             |                            |
-| Keycloak    | Keycloak           | PostgreSQL |           |                                        |                            |
+| Keycloak    | Keycloak           | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloak.name`              | `keycloak`                 |
+|             |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
-|             |                    |            | Host      | `databases.keycloak.host`              | `postgresql`               |
+|             |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloak.port`              | `5432`                     |
+|             |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
-|             |                    |            | Username  | `databases.keycloak.username`          | `keycloak_user`            |
+|             |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
-|             |                    |            | Password  | `databases.keycloak.password`          |                            |
+|             |                    |            | Password  | `databases.keycloak.password`            |                            |
-|             | Keycloak Extension | PostgreSQL |           |                                        |                            |
+|             | Keycloak Extension | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloakExtension.name`     | `keycloak_extensions`      |
+|             |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
-|             |                    |            | Host      | `databases.keycloakExtension.host`     | `postgresql`               |
+|             |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloakExtension.port`     | `5432`                     |
+|             |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
-|             |                    |            | Username  | `databases.keycloakExtension.username` | `keycloak_extensions_user` |
+|             |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
-|             |                    |            | Password  | `databases.keycloakExtension.password` |                            |
+|             |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
-| UMS         | Notifications API  | PostgreSQL |           |                                        |                            |
+| UMS         | Notifications API  | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.notificationsApi.name`      | `notificationsapi`         |
+|             |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
-|             |                    |            | Host      | `databases.notificationsApi.host`      | `postgresql`               |
+|             |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
-|             |                    |            | Port      | `databases.notificationsApi.port`      | `5432`                     |
+|             |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
-|             |                    |            | Username  | `databases.notificationsApi.username`  | `notificationsapi_user`    |
+|             |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
-|             |                    |            | Password  | `databases.notificationsApi.password`  |                            |
+|             |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
-| Nextcloud   | Nextcloud          | MariaDB    |           |                                        |                            |
+|             | Self Service       | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.nextcloud.name`             | `nextcloud`                |
+|             |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
-|             |                    |            | Host      | `databases.nextcloud.host`             | `mariadb`                  |
+|             |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
-|             |                    |            | Username  | `databases.nextcloud.username`         | `nextcloud_user`           |
+|             |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
-|             |                    |            | Password  | `databases.nextcloud.password`         |                            |
+|             |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
-| OpenProject | OpenProject        | PostgreSQL |           |                                        |                            |
+|             |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
-|             |                    |            | Name      | `databases.openproject.name`           | `openproject`              |
+| Nextcloud   | Nextcloud          | MariaDB    |           |                                          |                            |
-|             |                    |            | Host      | `databases.openproject.host`           | `postgresql`               |
+|             |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
-|             |                    |            | Port      | `databases.openproject.port`           | `5432`                     |
+|             |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
-|             |                    |            | Username  | `databases.openproject.username`       | `openproject_user`         |
+|             |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
-|             |                    |            | Password  | `databases.openproject.password`       |                            |
+|             |                    |            | Password  | `databases.nextcloud.password`           |                            |
-| OX Appsuite | OX Appsuite        | MariaDB    |           |                                        |                            |
+| OpenProject | OpenProject        | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.oxAppsuite.name`            | `CONFIGDB`                 |
+|             |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
-|             |                    |            | Host      | `databases.oxAppsuite.host`            | `mariadb`                  |
+|             |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
-|             |                    |            | Username  | `databases.oxAppsuite.username`        | `root`                     |
+|             |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
-|             |                    |            | Password  | `databases.oxAppsuite.password`        |                            |
+|             |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
-| XWiki       | XWiki              | MariaDB    |           |                                        |                            |
+|             |                    |            | Password  | `databases.openproject.password`         |                            |
-|             |                    |            | Name      | `databases.xwiki.name`                 | `xwiki`                    |
+| OX Appsuite | OX Appsuite        | MariaDB    |           |                                          |                            |
-|             |                    |            | Host      | `databases.xwiki.host`                 | `mariadb`                  |
+|             |                    |            | Name      | `databases.oxAppsuite.name`              | `CONFIGDB`                 |
-|             |                    |            | Username  | `databases.xwiki.username`             | `xwiki_user`               |
+|             |                    |            | Host      | `databases.oxAppsuite.host`              | `mariadb`                  |
-|             |                    |            | Password  | `databases.xwiki.password`             |                            |
+|             |                    |            | Username  | `databases.oxAppsuite.username`          | `root`                     |
+|             |                    |            | Password  | `databases.oxAppsuite.password`          |                            |
+| XWiki       | XWiki              | MariaDB    |           |                                          |                            |
+|             |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
+|             |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
+|             |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
+|             |                    |            | Password  | `databases.xwiki.password`               |                            |
+
+## Objectstore
+
+When deploying this suite to production, you need to configure the applications to use your production grade objectstore
+service.
+
+| Component   | Name        | Parameter       | Key                                      | Default            |
+|-------------|-------------|-----------------|------------------------------------------|--------------------|
+| OpenProject | OpenProject |                 |                                          |                    |
+|             |             | Backend         | `objectstores.openproject.backend`       | `minio`            |
+|             |             | Bucket          | `objectstores.openproject.bucket`        | `openproject`      |
+|             |             | Endpoint        | `objectstores.openproject.endpoint`      |                    |
+|             |             | Provider        | `objectstores.openproject.provider`      | `AWS`              |
+|             |             | Region          | `objectstores.openproject.region`        |                    |
+|             |             | Secret          | `objectstores.openproject.secret`        |                    |
+|             |             | Username        | `objectstores.openproject.username`      | `openproject_user` |
+|             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |
 
 ## Cache
 
@@ -81,3 +105,6 @@ service.
 | OpenProject      | OpenProject      | Memcached |           |                              |                  |
 |                  |                  |           | Host      | `cache.openproject.host`     | `memcached`      |
 |                  |                  |           | Port      | `cache.openproject.port`     | `11211`          |
+| UMS              | Self Service     | Memcached |           |                              |                  |
+|                  |                  |           | Host      | `cache.umsSelfservice.host`  | `memcached`      |
+|                  |                  |           | Port      | `cache.umsSelfservice.port`  | `11211`          |

docs/getting-started.md

@@ -12,7 +12,7 @@ This documentation should enable you to create your own evaluation instance of o
   * [Customize environment](#customize-environment)
     * [Domain](#domain)
     * [Apps](#apps)
-    * [Private OCI registry](#private-oci-registry)
+    * [Private Image registry](#private-image-registry)
     * [Private Helm registry](#private-helm-registry)
     * [Cluster capabilities](#cluster-capabilities)
       * [Service](#service)
@@ -129,9 +129,9 @@ jitsi:
   enabled: false
 ```
 
-### Private OCI registry
+### Private Image registry
 
-By default, all OCI artifacts are proxied via the project's container registry, which should get replaced soon by the
+By default, all OCI artifacts are proxied via the project's image registry, which should get replaced soon by the
 OCI registries provided by Open CoDE.
 
 You also can set your own registry by:
@@ -156,12 +156,32 @@ global:
 
 ### Private Helm registry
 
-Some apps use Chart Museum style helm registries. You can use your own registry by setting this environment variable:
+Some apps use OCI style registry and some use Helm chart museum style registries.
+In `helmfile/environments/default/charts.yaml` you can find all helm charts used and modify their registry, repository
+or version.
 
-```shell
+As an example, you can also use helmfile methods to use just a single environment variable to set registry and
-export PRIVATE_CHART_REPOSITORY_URL=charts.open.desk
+authentication for all OCI helm charts.
+
+```yaml
+charts:
+  certificates:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
 ```
 
+There is a full example including http and OCI style registries in `examples/private-helm-registry.yaml.gotmpl`.
+The following environment variables have to be exposed when using the example:
+
+| Environment variable                | Description                                                                                |
+|-------------------------------------|--------------------------------------------------------------------------------------------|
+| `OD_PRIVATE_HELM_OCI_REGISTRY`      | Registry for OCI hosted helm charts, example: `external-registry.souvap-univention.de`     |
+| `OD_PRIVATE_HELM_HTTP_REGISTRY`     | Registry URI for http hosted helm charts, `https://external-registry.souvap-univention.de` |
+| `OD_PRIVATE_HELM_REGISTRY_USERNAME` | Username                                                                                   |
+| `OD_PRIVATE_HELM_REGISTRY_PASSWORD` | Password                                                                                   |
+
+
 ### Cluster capabilities
 
 #### Service

docs/security.md

@@ -10,6 +10,7 @@ This document should cover the current status of security measurements.
 <!-- TOC -->
   * [Helm Chart Trust Chain](#helm-chart-trust-chain)
   * [Kubernetes Security Enforcements](#kubernetes-security-enforcements)
+  * [NetworkPolicies](#networkpolicies)
 <!-- TOC -->
 
 ## Helm Chart Trust Chain
@@ -36,7 +37,7 @@ Helm Charts which are released via openDesk CI/CD process are always signed. The
 | opendesk-keycloak-bootstrap-repo     | yes | :white_check_mark: |
 | opendesk-nextcloud-bootstrap-repo    | yes | :white_check_mark: |
 | opendesk-open-xchange-bootstrap-repo | yes | :white_check_mark: |
-| openproject-repo                     | no  |        :x:         |
+| openproject-repo                     | yes | :white_check_mark: |
 | openxchange-repo                     | yes |        :x:         |
 | ox-connector-repo                    | no  |        :x:         |
 | postfix-repo                         | yes | :white_check_mark: |
@@ -50,43 +51,71 @@ Helm Charts which are released via openDesk CI/CD process are always signed. The
 This list gives you an overview of default security settings and if they comply with security standards:
 
 
-| Component    | Process                    |         =          | allowPrivilegeEscalation (`false`) |                                                           capabilities (`drop: ALL`)                                                           | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
+| Component       | Process                        |         =          | allowPrivilegeEscalation (`false`) |                                                           capabilities (`drop: ALL`)                                                           | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
-|--------------|----------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
+|-----------------|--------------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
-| ClamAV       | clamd                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+| ClamAV          | clamd                          | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-|              | freshclam                  | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+|                 | freshclam                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-|              | icap                       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+|                 | icap                           | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-|              | milter                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+|                 | milter                         | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-| Collabora    | collabora                  |        :x:         |                :x:                 | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   100   |
+| Collabora       | collabora                      |        :x:         |                :x:                 | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   100   |
-| CryptPad     | npm                        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   4001    |   4001     |  4001   |
+| CryptPad        | npm                            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   4001    |    4001    |  4001   |
-| Dovecot      | dovecot                    |        :x:         |         :white_check_mark:         |                              :x: (`CHOWN`, `DAC_OVERRIDE`, `NET_BIND_SERVICE`, `SETGID`, `SETUID`, `SYS_CHROOT`)                               |        :white_check_mark:         |       :white_check_mark:        |          :x:          |      -    |      -     |  1000   |
+| Dovecot         | dovecot                        |        :x:         |         :white_check_mark:         |                          :x: (`CHOWN`, `DAC_OVERRIDE`, `KILL`, `NET_BIND_SERVICE`, `SETGID`, `SETUID`, `SYS_CHROOT`)                           |        :white_check_mark:         |       :white_check_mark:        |          :x:          |     -     |     -      |  1000   |
-| Element      | element                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
+| Element         | element                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
-|              | synapse                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   10991   |     -      |  10991  |
+|                 | synapse                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   10991   |     -      |  10991  |
-|              | synapseWeb                 | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
+|                 | synapseWeb                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
-|              | wellKnown                  | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
+|                 | wellKnown                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
-| Jitsi        | jibri                      |        :x:         |                :x:                 |                                                               :x: (`SYS_ADMIN`)                                                                |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+| IntercomService | intercom-service               | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-|              | jicofo                     |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+| Jitsi           | jibri                          |        :x:         |                :x:                 |                                                               :x: (`SYS_ADMIN`)                                                                |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|              | jitsiKeycloakAdapter       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1993    |    1993    |    -    |
+|                 | jicofo                         |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|              | jvb                        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                 | jitsiKeycloakAdapter           | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1993    |    1993    |    -    |
-|              | prosody                    |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                 | jvb                            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|              | web                        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                 | prosody                        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-| Keycloak     | keycloak                   |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   1001    |    1001    |  1001   |
+|                 | web                            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|              | keycloakConfigCli          | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+| Keycloak        | keycloak                       |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   1001    |    1001    |  1001   |
-|              | keycloakExtensionHandler   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | keycloakConfigCli              | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
-|              | keycloakExtensionProxy     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | keycloakExtensionHandler       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-| MariaDB      | mariadb                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+|                 | keycloakExtensionProxy         | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-| Memcached    | memcached                  | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |     -      |  1001   |
+| MariaDB         | mariadb                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
-| Postfix      | postfix                    |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   |
+| Memcached       | memcached                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |     -      |  1001   |
-| Open-Xchange | core-documentconverter     |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    987    |    1000    |    -    |
+| Minio           | minio                          | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-|              | core-guidedtours           | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+| Nextcloud       | nextcloud                      |        :x:         |         :white_check_mark:         |                                                  :x: (`NET_BIND_SERVICE`, `SETGID`, `SETUID`)                                                  |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   33    |
-|              | core-imageconverter        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |              :x:                |  :white_check_mark:   |    987    |    1000    |    -    |
+|                 | nextcloud-cron                 |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   33    |
-|              | core-mw-default            |        :x:         |                :x:                 |                                                                      :x:                                                                       |               :x:                 |              :x:                |         :x:           |      -    |       -    |    -    |
+|                 | opendesk-nextcloud-bootstrap   |        :x:         |         :white_check_mark:         |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   33    |
-|              | core-ui                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+| Open-Xchange    | core-documentconverter         |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    987    |    1000    |    -    |
-|              | core-ui-middleware         | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | core-guidedtours               | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|              | core-ui-middleware-updater | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | core-imageconverter            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    987    |    1000    |    -    |
-|              | core-user-guide            | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | core-mw-default                |        :x:         |                :x:                 |                                                                      :x:                                                                       |                :x:                |               :x:               |          :x:          |     -     |     -      |    -    |
-|              | gotenberg                  | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | core-ui                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|              | guard-ui                   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | core-ui-middleware             | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|              | nextlcoud-integration-ui   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | core-ui-middleware-updater     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|              | public-sector-ui           | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | core-user-guide                | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-| OpenProject  | openproject                |        :x:         |         :white_check_mark:         |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                 | gotenberg                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-| PostgreSQL   | postgresql                 | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+|                 | guard-ui                       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | nextlcoud-integration-ui       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                 | public-sector-ui               | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+| OpenProject     | openproject                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
+| Postfix         | postfix                        |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   |
+| PostgreSQL      | postgresql                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+| Redis           | redis                          |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |     0      |  1001   |
+| UCC             | univention-corporate-container |        :x:         |                :x:                 |                                                                      :x:                                                                       |                :x:                |               :x:               |          :x:          |     -     |     -      |    -    |
+| XWiki           | xwiki                          |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   101   |
+|                 | xwiki initContainers           |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   | 
+
+## NetworkPolicies
+
+Kubernetes NetworkPolicies are an important measure to secure your kubernetes apps and clusters.
+When applied, they restrict the traffic to your services.
+This protects other deployments in your cluster or other services in your deployment to get compromised when one
+component is compromised.
+
+We ship a default set of Otterize ClientIntents via
+[Otterize intents operator](https://github.com/otterize/intents-operator) which translates intent-based access control
+(IBAC) into kubernetes native NetworkPolicies.
+
+This requires the Otterize intents operator to be installed.
+
+```yaml
+security:
+  otterizeIntents:
+    enabled: true
+```

examples/private-helm-registry.yaml.gotmpl

@@ -0,0 +1,266 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+charts:
+  certificates:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  clamav:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  clamavSimple:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  collabora:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  cryptpad:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  dovecot:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  element:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  elementWellKnown:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  intercomService:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  istioResources:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  jitsi:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  keycloak:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  keycloakBootstrap:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  keycloakExtensions:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  keycloakTheme:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  mariadb:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  matrixNeoboardWidget:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  matrixNeochoiseWidget:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  matrixNeodatefixBot:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  matrixNeodatefixWidget:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  matrixUserVerificationService:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  memcached:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  minio:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  nextcloud:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  nextcloudBootstrap:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  nginx:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  openproject:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  openprojectBootstrap:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  openXchangeAppSuite:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  openXchangeAppSuiteBootstrap:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  otterize:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  oxConnector:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  postfix:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  postgresql:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  redis:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  synapse:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  synapseCreateAccount:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  synapseWeb:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsLdapNotifier:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsLdapServer:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsNotificationsApi:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsPortalFrontend:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsPortalListener:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsPortalServer:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsStackDataSwp:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsStackDataUms:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsStoreDav:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsUdmRestApi:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsUmcGateway:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsUmcServer:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  univentionCorporateServer:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  xwiki:
+    registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+...

helmfile/apps/collabora/helmfile.yaml

@@ -3,25 +3,19 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # Collabora Online
   # Source: https://github.com/CollaboraOnline/online
   - name: "collabora-online-repo"
-    url: >-
+    username: "{{ .Values.charts.collabora.username }}"
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
+    password: {{ .Values.charts.collabora.password | quote }}
-         default "https://collaboraonline.github.io/online" }}
+    url: "{{ .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://collaboraonline.github.io/online
-  # packageName=collabora-online
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "collabora-online"
-    chart: "collabora-online-repo/collabora-online"
+    chart: "collabora-online-repo/{{ .Values.charts.collabora.name }}"
-    version: "1.0.2"
+    version: "{{ .Values.charts.collabora.version }}"
     values:
       - "values.yaml"
       - "values.gotmpl"

helmfile/apps/cryptpad/helmfile.yaml

@@ -3,25 +3,19 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # CryptPad
   # Source: https://github.com/cryptpad/helm
-  - name: "cryptpad-online-repo"
+  - name: "cryptpad-repo"
-    url: >-
+    username: "{{ .Values.charts.cryptpad.username }}"
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
+    password: {{ .Values.charts.cryptpad.password | quote }}
-         default "https://cryptpad.github.io/helm" }}
+    url: "{{ .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://cryptpad.github.io/helm
-  # packageName=cryptpad
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "cryptpad"
-    chart: "cryptpad-online-repo/cryptpad"
+    chart: "cryptpad-repo/{{ .Values.charts.cryptpad.name }}"
-    version: "0.0.13"
+    version: "{{ .Values.charts.cryptpad.version }}"
     values:
       - "values.yaml"
       - "values.gotmpl"

helmfile/apps/cryptpad/values.yaml

@@ -22,6 +22,10 @@ enableEmbedding: true
 
 fullnameOverride: "cryptpad"
 
+ingress:
+  annotations:
+    nginx.org/websocket-services: "cryptpad"
+
 persistence:
   enabled: false
 

helmfile/apps/element/helmfile.yaml

@@ -7,177 +7,176 @@ bases:
 repositories:
   # openDesk Element
   # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/sovereign-workplace-element
-  - name: "opendesk-element-repo"
+  - name: "element-repo"
     oci: true
-    # yamllint disable rule:line-length
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element" }}
-    # yamllint enable rule:line-length
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.element.verify }}
+    username: "{{ .Values.charts.element.username }}"
+    password: {{ .Values.charts.element.password | quote }}
+    url: "{{ .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
+  - name: "element-well-known-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.element.verify }}
+    username: "{{ .Values.charts.elementWellKnown.username }}"
+    password: {{ .Values.charts.elementWellKnown.password | quote }}
+    url: "{{ .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
+  - name: "synapse-web-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.element.verify }}
+    username: "{{ .Values.charts.synapseWeb.username }}"
+    password: {{ .Values.charts.synapseWeb.password | quote }}
+    url: "{{ .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
+  - name: "synapse-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.element.verify }}
+    username: "{{ .Values.charts.synapse.username }}"
+    password: {{ .Values.charts.synapse.password | quote }}
+    url: "{{ .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+  - name: "synapse-create-account-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.element.verify }}
+    username: "{{ .Values.charts.synapseCreateAccount.username }}"
+    password: {{ .Values.charts.synapseCreateAccount.password | quote }}
+    url: "{{ .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
 
   # openDesk Matrix Widgets
   # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/opendesk-matrix-widgets
-  - name: "opendesk-matrix-widgets-repo"
+  - name: "matrix-user-verification-service-repo"
     oci: true
-    # yamllint disable rule:line-length
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/opendesk-matrix-widgets" }}
-    # yamllint enable rule:line-length
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.matrixUserVerificationService.verify }}
+    username: "{{ .Values.charts.matrixUserVerificationService.username }}"
+    password: {{ .Values.charts.matrixUserVerificationService.password | quote }}
+    url: "{{ .Values.charts.matrixUserVerificationService.registry }}/\
+      {{ .Values.charts.matrixUserVerificationService.repository }}"
+  - name: "matrix-neoboard-widget-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
+    username: "{{ .Values.charts.matrixNeoboardWidget.username }}"
+    password: {{ .Values.charts.matrixNeoboardWidget.password | quote }}
+    url: "{{ .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+  - name: "matrix-neochoice-widget-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
+    username: "{{ .Values.charts.matrixNeoboardWidget.username }}"
+    password: {{ .Values.charts.matrixNeoboardWidget.password | quote }}
+    url: "{{ .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+  - name: "matrix-neodatefix-widget-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
+    username: "{{ .Values.charts.matrixNeodatefixWidget.username }}"
+    password: {{ .Values.charts.matrixNeodatefixWidget.password | quote }}
+    url: "{{ .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
+  - name: "matrix-neodatefix-bot-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
+    username: "{{ .Values.charts.matrixNeodatefixBot.username }}"
+    password: {{ .Values.charts.matrixNeodatefixBot.password | quote }}
+    url: "{{ .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
+
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-element
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-element"
-    chart: "opendesk-element-repo/opendesk-element"
+    chart: "element-repo/{{ .Values.charts.element.name }}"
-    version: "2.5.1"
+    version: "{{ .Values.charts.element.version }}"
     values:
       - "values-element.yaml"
       - "values-element.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-well-known
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-well-known"
-    chart: "opendesk-element-repo/opendesk-well-known"
+    chart: "element-well-known-repo/{{ .Values.charts.elementWellKnown.name }}"
-    version: "2.5.1"
+    version: "{{ .Values.charts.elementWellKnown.version }}"
     values:
       - "values-well-known.yaml"
       - "values-well-known.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-synapse-web
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-synapse-web"
-    chart: "opendesk-element-repo/opendesk-synapse-web"
+    chart: "synapse-web-repo/{{ .Values.charts.synapseWeb.name }}"
-    version: "2.5.1"
+    version: "{{ .Values.charts.synapseWeb.version }}"
     values:
       - "values-synapse-web.yaml"
       - "values-synapse-web.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-synapse
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-synapse"
-    chart: "opendesk-element-repo/opendesk-synapse"
+    chart: "synapse-repo/{{ .Values.charts.synapse.name }}"
-    version: "2.5.1"
+    version: "{{ .Values.charts.synapse.version }}"
     values:
       - "values-synapse.yaml"
       - "values-synapse.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-synapse-create-account
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-matrix-user-verification-service-bootstrap"
-    chart: "opendesk-element-repo/opendesk-synapse-create-account"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
-    version: "2.5.1"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
     values:
       - "values-matrix-user-verification-service-bootstrap.yaml"
       - "values-matrix-user-verification-service-bootstrap.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-matrix-user-verification-service
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-matrix-user-verification-service"
-    chart: "opendesk-element-repo/opendesk-matrix-user-verification-service"
+    chart: "matrix-user-verification-service-repo/{{ .Values.charts.matrixUserVerificationService.name }}"
-    version: "2.5.1"
+    version: "{{ .Values.charts.matrixUserVerificationService.version }}"
     values:
       - "values-matrix-user-verification-service.yaml"
       - "values-matrix-user-verification-service.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/opendesk-matrix-widgets/matrix-neoboard-widget
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "matrix-neoboard-widget"
-    chart: "opendesk-matrix-widgets-repo/matrix-neoboard-widget"
+    chart: "matrix-neoboard-widget-repo/{{ .Values.charts.matrixNeoboardWidget.name }}"
-    version: "3.2.0"
+    version: "{{ .Values.charts.matrixNeoboardWidget.version }}"
     values:
       - "values-matrix-neoboard-widget.yaml"
       - "values-matrix-neoboard-widget.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/opendesk-matrix-widgets/matrix-neochoice-widget
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "matrix-neochoice-widget"
-    chart: "opendesk-matrix-widgets-repo/matrix-neochoice-widget"
+    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiseWidget.name }}"
-    version: "3.2.0"
+    version: "{{ .Values.charts.matrixNeochoiseWidget.version }}"
     values:
       - "values-matrix-neochoice-widget.yaml"
       - "values-matrix-neochoice-widget.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/opendesk-matrix-widgets/matrix-neodatefix-widget
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "matrix-neodatefix-widget"
-    chart: "opendesk-matrix-widgets-repo/matrix-neodatefix-widget"
+    chart: "matrix-neodatefix-widget-repo/{{ .Values.charts.matrixNeodatefixWidget.name }}"
-    version: "3.2.0"
+    version: "{{ .Values.charts.matrixNeodatefixWidget.version }}"
     values:
       - "values-matrix-neodatefix-widget.yaml"
       - "values-matrix-neodatefix-widget.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-synapse-create-account
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "matrix-neodatefix-bot-bootstrap"
-    chart: "opendesk-element-repo/opendesk-synapse-create-account"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
-    version: "2.5.1"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
     values:
       - "values-matrix-neodatefix-bot-bootstrap.yaml"
       - "values-matrix-neodatefix-bot-bootstrap.gotmpl"
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/opendesk-matrix-widgets/matrix-neodatefix-bot
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "matrix-neodatefix-bot"
-    chart: "opendesk-matrix-widgets-repo/matrix-neodatefix-bot"
+    chart: "matrix-neodatefix-bot-repo/{{ .Values.charts.matrixNeodatefixBot.name }}"
-    version: "3.2.0"
+    version: "{{ .Values.charts.matrixNeodatefixBot.version }}"
     values:
       - "values-matrix-neodatefix-bot.yaml"
       - "values-matrix-neodatefix-bot.gotmpl"

helmfile/apps/element/values-synapse.yaml

@@ -11,6 +11,16 @@ configuration:
         - "m.space.parent"
         - "net.nordeck.meetings.metadata"
         - "m.room.power_levels"
+    # When a user logs into Element a parallel request is done through Intercom Service to allow Synapse API
+    # interaction, to avoid (temporary) blocking of the user for followup logins we want to raise the limits.
+    # https://matrix-org.github.io/synapse/v1.59/usage/configuration/config_documentation.html#ratelimiting
+    rc_login:
+      account:
+        per_second: 2
+        burst_count: 8
+      address:
+        per_second: 2
+        burst_count: 12
 
   homeserver:
     guestModule:

helmfile/apps/intercom-service/helmfile.yaml

@@ -3,29 +3,24 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # Intercom Service
   # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
   - name: "intercom-service-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/intercom-service" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.intercomService.verify }}
+    username: "{{ .Values.charts.intercomService.username }}"
+    password: {{ .Values.charts.intercomService.password | quote }}
+    url: "{{ .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/intercom-service/intercom-service
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "intercom-service"
-    chart: "intercom-service-repo/intercom-service"
+    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
-    version: "2.0.1"
+    version: "{{ .Values.charts.intercomService.version }}"
     values:
+      - "values.yaml"
       - "values.gotmpl"
     installed: {{ .Values.intercom.enabled }}
 

helmfile/apps/intercom-service/values.yaml

@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  enabled: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 1000
+  fsGroupChangePolicy: "Always"
+...

helmfile/apps/jitsi/helmfile.yaml

@@ -3,28 +3,22 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # openDesk Jitsi
   # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-jitsi
   - name: "jitsi-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
-         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-jitsi" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.jitsi.verify }}
+    username: "{{ .Values.charts.jitsi.username }}"
+    password: {{ .Values.charts.jitsi.password | quote }}
+    url: "{{ .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-jitsi/sovereign-workplace-jitsi
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "jitsi"
-    chart: "jitsi-repo/sovereign-workplace-jitsi"
+    chart: "jitsi-repo/{{ .Values.charts.jitsi.name }}"
-    version: "1.7.1"
+    version: "{{ .Values.charts.jitsi.version }}"
     values:
       - "values-jitsi.gotmpl"
     installed: {{ .Values.jitsi.enabled }}

helmfile/apps/keycloak-bootstrap/helmfile.yaml

@@ -3,30 +3,22 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # openDesk Keycloak Bootstrap
   # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-keycloak-bootstrap
   - name: "opendesk-keycloak-bootstrap-repo"
     oci: true
-    # yamllint disable rule:line-length
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-keycloak-bootstrap" }}
-    # yamllint enable rule:line-length
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.keycloakBootstrap.verify }}
+    username: "{{ .Values.charts.keycloakBootstrap.username }}"
+    password: {{ .Values.charts.keycloakBootstrap.password | quote }}
+    url: "{{ .Values.charts.keycloakBootstrap.registry }}/{{ .Values.charts.keycloakBootstrap.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/opendesk-keycloak-bootstrap/opendesk-keycloak-bootstrap
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-keycloak-bootstrap"
-    chart: "opendesk-keycloak-bootstrap-repo/sovereign-workplace-keycloak-bootstrap"
+    chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.keycloakBootstrap.name }}"
-    version: "1.1.12"
+    version: "{{ .Values.charts.keycloakBootstrap.version }}"
     values:
       - "values-bootstrap.gotmpl"
       - "values-bootstrap.yaml"

helmfile/apps/keycloak-bootstrap/values-bootstrap.gotmpl

@@ -27,4 +27,8 @@ image:
 
 resources:
   {{ .Values.resources.keycloakBootstrap | toYaml | nindent 2 }}
+
+additionalAnnotations:
+  annotations:
+    intents.otterize.com/service-name: "keycloak-bootstrap"
 ...

helmfile/apps/keycloak/helmfile.yaml

@@ -3,54 +3,45 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # VMWare Bitnami
   # Source: https://github.com/bitnami/charts/
-  - name: "bitnami-repo"
+  - name: "keycloak-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/bitnami-charts" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.keycloak.verify }}
+    username: "{{ .Values.charts.keycloak.username }}"
+    password: {{ .Values.charts.keycloak.password | quote }}
+    url: "{{ .Values.charts.keycloak.registry }}/{{ .Values.charts.keycloak.repository }}"
+
   # openDesk Keycloak Theme
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-keycloak-theme
   - name: "keycloak-theme-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/keycloak-theme" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.keycloakTheme.verify }}
+    username: "{{ .Values.charts.keycloakTheme.username }}"
+    password: {{ .Values.charts.keycloakTheme.password | quote }}
+    url: "{{ .Values.charts.keycloakTheme.registry }}/{{ .Values.charts.keycloakTheme.repository }}"
+
   # openDesk Keycloak Extensions
   - name: "keycloak-extensions-repo"
-    url: >-
+    username: "{{ .Values.charts.keycloakExtensions.username }}"
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
+    password: {{ .Values.charts.keycloakExtensions.password | quote }}
-         default "https://gitlab.souvap-univention.de/api/v4/projects/77/packages/helm/stable" }}
+    url: "{{ .Values.charts.keycloakExtensions.registry }}/{{ .Values.charts.keycloakExtensions.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/keycloak-theme/opendesk-keycloak-theme
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "keycloak-theme"
-    chart: "keycloak-theme-repo/opendesk-keycloak-theme"
+    chart: "keycloak-theme-repo/{{ .Values.charts.keycloakTheme.name }}"
-    version: "2.0.0"
+    version: "{{ .Values.charts.keycloakTheme.version }}"
     values:
       - "values-theme.gotmpl"
     installed: {{ .Values.keycloak.enabled }}
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/bitnami-charts/keycloak
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "keycloak"
-    chart: "bitnami-repo/keycloak"
+    chart: "keycloak-repo/{{ .Values.charts.keycloak.name }}"
-    version: "12.1.5"
+    version: "{{ .Values.charts.keycloak.version }}"
     values:
       - "values-keycloak.gotmpl"
       - "values-keycloak.yaml"
@@ -58,14 +49,9 @@ releases:
     wait: true
     installed: {{ .Values.keycloak.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/77/packages/helm/stable
-  # packageName=keycloak-extensions
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "keycloak-extensions"
-    chart: "keycloak-extensions-repo/keycloak-extensions"
+    chart: "keycloak-extensions-repo/{{ .Values.charts.keycloakExtensions.name }}"
-    version: "0.1.0"
+    version: "{{ .Values.charts.keycloakExtensions.version }}"
     needs:
       - "keycloak"
     values:

helmfile/apps/nextcloud/helmfile.yaml

@@ -3,37 +3,30 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # openDesk Keycloak Bootstrap
   # Source:
   #  https://gitlab.opencode.de/bmi/opendesk/components/charts/sovereign-workplace-nextcloud-bootstrap
-  - name: "opendesk-nextcloud-bootstrap-repo"
+  - name: "nextcloud-bootstrap-repo"
     oci: true
-    # yamllint disable rule:line-length
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
-         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-nextcloud-bootstrap" }}
-    # yamllint enable rule:line-length
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.nextcloudBootstrap.verify }}
+    username: "{{ .Values.charts.nextcloudBootstrap.username }}"
+    password: {{ .Values.charts.nextcloudBootstrap.password | quote }}
+    url: "{{ .Values.charts.nextcloudBootstrap.registry }}/{{ .Values.charts.nextcloudBootstrap.repository }}"
+
   # Nextcloud
   # Source: https://github.com/nextcloud/helm/
   - name: "nextcloud-repo"
-    url: >-
+    username: "{{ .Values.charts.nextcloud.username }}"
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
+    password: {{ .Values.charts.nextcloud.password | quote }}
-         default "https://nextcloud.github.io/helm/" }}
+    url: "{{ .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-nextcloud-bootstrap/opendesk-nextcloud-bootstrap
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-nextcloud-bootstrap"
-    chart: "opendesk-nextcloud-bootstrap-repo/opendesk-nextcloud-bootstrap"
+    chart: "nextcloud-bootstrap-repo/{{ .Values.charts.nextcloudBootstrap.name }}"
-    version: "3.2.4"
+    version: "{{ .Values.charts.nextcloudBootstrap.version }}"
     wait: true
     waitForJobs: true
     values:
@@ -42,14 +35,9 @@ releases:
     installed: {{ .Values.nextcloud.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://nextcloud.github.io/helm
-  # packageName=nextcloud
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "nextcloud"
-    chart: "nextcloud-repo/nextcloud"
+    chart: "nextcloud-repo/{{ .Values.charts.nextcloud.name }}"
-    version: "3.5.19"
+    version: "{{ .Values.charts.nextcloud.version }}"
     needs:
       - "opendesk-nextcloud-bootstrap"
     values:

helmfile/apps/nextcloud/values-bootstrap.yaml

@@ -15,4 +15,17 @@ config:
 
   cryptpad:
     enabled: true
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  enabled: true
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 33
+  fsGroupChangePolicy: "Always"
 ...

helmfile/apps/nextcloud/values-nextcloud.yaml

@@ -20,6 +20,11 @@ cronjob:
       - >
         sed -i "s/\*\/5 \* \* \* \* php -f \/var\/www\/html\/cron.php/\*\/1 \* \* \* \* php -f
         \/var\/www\/html\/cron.php/g" /var/spool/cron/crontabs/www-data
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
 
 ingress:
   annotations:
@@ -52,6 +57,20 @@ nextcloud:
       {
         "drawio": ["application/x-drawio"]
       }
+  podSecurityContext:
+    fsGroup: 33
+    seccompProfile:
+      type: "RuntimeDefault"
+
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+      add:
+        - "NET_BIND_SERVICE"
+        - "SETGID"
+        - "SETUID"
 
 # this is not documented but can be found in values.yaml
 service:

helmfile/apps/open-xchange/helmfile.yaml

@@ -3,58 +3,49 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # openDesk Dovecot
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-dovecot
-  - name: "opendesk-dovecot-repo"
+  - name: "dovecot-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
-         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/dovecot" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.dovecot.verify }}
+    username: "{{ .Values.charts.dovecot.username }}"
+    password: {{ .Values.charts.dovecot.password | quote }}
+    url: "{{ .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+
   # Open-Xchange
-  - name: "openxchange-repo"
+  - name: "open-xchange-repo"
     oci: true
-    url: >-
+    username: "{{ .Values.charts.openXchangeAppSuite.username }}"
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default "registry.open-xchange.com" }}
+    password: {{ .Values.charts.openXchangeAppSuite.password | quote }}
+    url: "{{ .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
+
   # openDesk Open-Xchange Bootstrap
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-open-xchange-bootstrap
-  - name: "opendesk-open-xchange-bootstrap-repo"
+  - name: "open-xchange-bootstrap-repo"
     oci: true
-    # yamllint disable rule:line-length
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
-         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-open-xchange-bootstrap" }}
-    # yamllint enable rule:line-length
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.openXchangeAppSuiteBootstrap.verify }}
+    username: "{{ .Values.charts.openXchangeAppSuiteBootstrap.username }}"
+    password: {{ .Values.charts.openXchangeAppSuiteBootstrap.password | quote }}
+    url: "{{ .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
+      {{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/dovecot/dovecot
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "dovecot"
-    chart: "opendesk-dovecot-repo/dovecot"
+    chart: "dovecot-repo/{{ .Values.charts.dovecot.name }}"
-    version: "1.3.6"
+    version: "{{ .Values.charts.dovecot.version }}"
     values:
       - "values-dovecot.yaml"
       - "values-dovecot.gotmpl"
     installed: {{ .Values.dovecot.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.open-xchange.com
-  # packageName=appsuite-public-sector/charts/appsuite-public-sector
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "open-xchange"
-    chart: "openxchange-repo/appsuite-public-sector/charts/appsuite-public-sector"
+    chart: "open-xchange-repo/{{ .Values.charts.openXchangeAppSuite.name }}"
-    version: "2.1.1"
+    version: "{{ .Values.charts.openXchangeAppSuite.version }}"
     values:
       - "values-openxchange.yaml"
       - "values-openxchange.gotmpl"
@@ -63,14 +54,9 @@ releases:
     installed: {{ .Values.oxAppsuite.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/sovereign-workplace-open-xchange-bootstrap/sovereign-workplace-open-xchange-bootstrap
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-open-xchange-bootstrap"
-    chart: "opendesk-open-xchange-bootstrap-repo/sovereign-workplace-open-xchange-bootstrap"
+    chart: "open-xchange-bootstrap-repo/{{ .Values.charts.openXchangeAppSuiteBootstrap.name }}"
-    version: "1.3.1"
+    version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
     values:
       - "values-openxchange-bootstrap.gotmpl"
     installed: {{ .Values.oxAppsuite.enabled }}

helmfile/apps/openproject-bootstrap/helmfile.yaml

@@ -3,30 +3,22 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # openDesk OpenProject Bootstrap
   # Source: Set when repo is managed on Open CoDE
-  - name: "opendesk-openproject-bootstrap-repo"
+  - name: "openproject-bootstrap-repo"
     oci: true
-    # yamllint disable rule:line-length
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/opendesk-openproject-bootstrap" }}
-    # yamllint enable rule:line-length
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.openprojectBootstrap.verify }}
+    username: "{{ .Values.charts.openprojectBootstrap.username }}"
+    password: {{ .Values.charts.openprojectBootstrap.password | quote }}
+    url: "{{ .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/opendesk-openproject-bootstrap/opendesk-openproject-bootstrap
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "opendesk-openproject-bootstrap"
-    chart: "opendesk-openproject-bootstrap-repo/opendesk-openproject-bootstrap"
+    chart: "openproject-bootstrap-repo/{{ .Values.charts.openprojectBootstrap.name }}"
-    version: "1.2.1"
+    version: "{{ .Values.charts.openprojectBootstrap.version }}"
     wait: true
     waitForJobs: true
     values:

helmfile/apps/openproject/helmfile.yaml

@@ -3,25 +3,22 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # OpenProject
   # Source: https://github.com/opf/helm-charts
   - name: "openproject-repo"
-    url: >-
+    oci: true
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
+    keyring: "../../files/gpg-pubkeys/openproject-com.gpg"
-         default "https://charts.openproject.org" }}
+    verify: {{ .Values.charts.openproject.verify }}
+    username: "{{ .Values.charts.openproject.username }}"
+    password: {{ .Values.charts.openproject.password | quote }}
+    url: "{{ .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://charts.openproject.org
-  # packageName=openproject
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "openproject"
-    chart: "openproject-repo/openproject"
+    chart: "openproject-repo/{{ .Values.charts.openproject.name }}"
-    version: "2.4.0"
+    version: "{{ .Values.charts.openproject.version }}"
     wait: true
     waitForJobs: true
     values:

helmfile/apps/openproject/values.gotmpl

@@ -77,9 +77,17 @@ environment:
   OPENPROJECT_MAIL__FROM: "do-not-reply@{{ .Values.global.domain }}"
   # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
   OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.univentionCorporateServer.ldapSearch.openproject | quote }}
-  OPENPROJECT_FOG_CREDENTIALS_HOST: "{{ .Values.global.hosts.minioApi }}.{{ .Values.global.domain }}"
+  {{ if ne .Values.objectstores.openproject.backend "aws" }}
-  OPENPROJECT_FOG_CREDENTIALS_ENDPOINT: "https://{{ .Values.global.hosts.minioApi }}.{{ .Values.global.domain }}"
+  OPENPROJECT_FOG_CREDENTIALS_ENDPOINT: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
-  OPENPROJECT_FOG_CREDENTIALS_AWS__SECRET__ACCESS__KEY: {{ .Values.secrets.minio.openprojectUser | quote }}
+  OPENPROJECT_FOG_CREDENTIALS_PATH__STYLE: "true"
+  {{ end }}
+  OPENPROJECT_FOG_CREDENTIALS_AWS__ACCESS__KEY__ID: {{ .Values.objectstores.openproject.username | quote }}
+  OPENPROJECT_FOG_CREDENTIALS_AWS__SECRET__ACCESS__KEY: {{ .Values.objectstores.openproject.secret | default .Values.secrets.minio.openprojectUser | quote }}
+  OPENPROJECT_FOG_CREDENTIALS_PROVIDER: {{ .Values.objectstores.openproject.provider | default "AWS" | quote }}
+  OPENPROJECT_FOG_CREDENTIALS_REGION: {{ .Values.objectstores.openproject.region | quote }}
+  OPENPROJECT_FOG_DIRECTORY: {{ .Values.objectstores.openproject.bucket | quote }}
+  OPENPROJECT_FOG_CREDENTIALS_USE__IAM__PROFILE: {{ .Values.objectstores.openproject.useIAMProfile | default "false" | quote }}
+  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
 
 replicaCount: {{ .Values.replicas.openproject }}
 

helmfile/apps/openproject/values.yaml

@@ -30,11 +30,18 @@ openproject:
   # seed will only be executed on initial installation
   seed_locale: "de"
 
-securityContext:
+containerSecurityContext:
+  enabled: true
+  runAsUser: 1000
+  runAsGroup: 1000
   allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
   seccompProfile:
     type: "RuntimeDefault"
-  readOnlyRootFilesystem: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
 
 persistence:
   enabled: false
@@ -75,11 +82,12 @@ environment:
   OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_GROUP__ATTRIBUTE: "cn"
   # Details: https://www.openproject.org/docs/installation-and-operations/configuration/#attachments-storage
   OPENPROJECT_ATTACHMENTS__STORAGE: "fog"
-  OPENPROJECT_FOG_DIRECTORY: "openproject"
-  OPENPROJECT_FOG_CREDENTIALS_PROVIDER: "AWS"
   OPENPROJECT_FOG_CREDENTIALS_PATH__STYLE: "true"
-  OPENPROJECT_FOG_CREDENTIALS_AWS__ACCESS__KEY__ID: "openproject_user"
   # Define an admin mapping from the claim
   # The attribute mapping cannot currently be defined in the value
   OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ATTRIBUTE__MAP_ADMIN: "openproject_admin"
+
+seederJob:
+  annotations:
+    intents.otterize.com/service-name: "openproject-seeder"
 ...

helmfile/apps/provisioning/helmfile.yaml

@@ -3,24 +3,18 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # OX Connector
   - name: "ox-connector-repo"
-    url: >-
+    username: "{{ .Values.charts.oxConnector.username }}"
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
+    password: {{ .Values.charts.oxConnector.password | quote }}
-         default "https://gitlab.souvap-univention.de/api/v4/projects/128/packages/helm/stable" }}
+    url: "{{ .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/128/packages/helm/stable
-  # packageName=ox-connector
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ox-connector"
-    chart: "ox-connector-repo/ox-connector"
+    chart: "ox-connector-repo/{{ .Values.charts.oxConnector.name }}"
-    version: "0.1.0-pre-jconde-listener-entrypoint-chaining"
+    version: "{{ .Values.charts.oxConnector.version }}"
     values:
       - "values-oxconnector.yaml"
       - "values-oxconnector.gotmpl"

helmfile/apps/services/helmfile.yaml

@@ -3,202 +3,194 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
+  # openDesk Otterize
+  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-otterize
+  - name: "otterize-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.otterize.verify }}
+    username: "{{ .Values.charts.otterize.username }}"
+    password: {{ .Values.charts.otterize.password | quote }}
+    url: "{{ .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
+
   # openDesk Certificates
   # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-certificates
-  - name: "opendesk-certificates-repo"
+  - name: "certificates-repo"
     oci: true
-    # yamllint disable rule:line-length
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/sovereign-workplace-certificates" }}
-    # yamllint enable rule:line-length
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.certificates.verify }}
+    username: "{{ .Values.charts.certificates.username }}"
+    password: {{ .Values.charts.certificates.password | quote }}
+    url: "{{ .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
+
   # openDesk PostgreSQL
   # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-postgresql
   - name: "postgresql-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/postgresql" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.postgresql.verify }}
+    username: "{{ .Values.charts.postgresql.username }}"
+    password: {{ .Values.charts.postgresql.password | quote }}
+    url: "{{ .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
+
   # openDesk MariaDB
-  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-mariadb
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-mariadb
   - name: "mariadb-repo"
     oci: true
-    url: >-
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
+    verify: {{ .Values.charts.mariadb.verify }}
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/mariadb" }}
+    username: "{{ .Values.charts.mariadb.username }}"
-    verify: true
+    password: {{ .Values.charts.mariadb.password | quote }}
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    url: "{{ .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
+
   # openDesk Postfix
   # https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-postfix
   - name: "postfix-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/postfix" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.postfix.verify }}
+    username: "{{ .Values.charts.postfix.username }}"
+    password: {{ .Values.charts.postfix.password | quote }}
+    url: "{{ .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
+
   # openDesk Istio Resources
   # https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-istio-resources
   - name: "istio-resources-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/istio-ressources" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.istioResources.verify }}
+    username: "{{ .Values.charts.istioResources.username }}"
+    password: {{ .Values.charts.istioResources.password | quote }}
+    url: "{{ .Values.charts.istioResources.registry }}/{{ .Values.charts.istioResources.repository }}"
+
   # openDesk ClamAV
   # https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-clamav
   - name: "clamav-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/clamav" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.clamav.verify }}
+    username: "{{ .Values.charts.clamav.username }}"
+    password: {{ .Values.charts.clamav.password | quote }}
+    url: "{{ .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
+  - name: "clamav-simple-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.clamavSimple.verify }}
+    username: "{{ .Values.charts.clamavSimple.username }}"
+    password: {{ .Values.charts.clamavSimple.password | quote }}
+    url: "{{ .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
+
   # VMWare Bitnami
   # Source: https://github.com/bitnami/charts/
-  - name: "bitnami-repo"
+  - name: "memcached-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/bitnami-charts" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.memcached.verify }}
+    username: "{{ .Values.charts.memcached.username }}"
+    password: {{ .Values.charts.memcached.password | quote }}
+    url: "{{ .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
+  - name: "redis-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.redis.verify }}
+    username: "{{ .Values.charts.redis.username }}"
+    password: {{ .Values.charts.redis.password | quote }}
+    url: "{{ .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
+  - name: "minio-repo"
+    oci: true
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.minio.verify }}
+    username: "{{ .Values.charts.minio.username }}"
+    password: {{ .Values.charts.minio.password | quote }}
+    url: "{{ .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
+
 
 releases:
-  # renovate:
+  - name: "opendesk-otterize"
-  # registryUrl=https://registry.souvap-univention.de
+    chart: "otterize-repo/{{ .Values.charts.otterize.name }}"
-  # packageName=souvap/tooling/charts/sovereign-workplace-certificates/opendesk-certificates
+    version: "{{ .Values.charts.otterize.version }}"
-  # dataSource=docker
+    values:
-  # dependencyType=service
+      - "values-otterize.gotmpl"
+    installed: {{ .Values.security.otterizeIntents.enabled }}
+
   - name: "opendesk-certificates"
-    chart: "opendesk-certificates-repo/opendesk-certificates"
+    chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
-    version: "2.1.0"
+    version: "{{ .Values.charts.certificates.version }}"
     values:
       - "values-certificates.gotmpl"
     installed: {{ .Values.certificates.enabled }}
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/bitnami-charts/redis
-  # dataSource=docker
-  # dependencyType=service
   - name: "redis"
-    chart: "bitnami-repo/redis"
+    chart: "redis-repo/{{ .Values.charts.redis.name }}"
-    version: "18.1.2"
+    version: "{{ .Values.charts.redis.version }}"
     values:
       - "values-redis.gotmpl"
       - "values-redis.yaml"
     installed: {{ .Values.redis.enabled }}
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/bitnami-charts/memcached
-  # dataSource=docker
-  # dependencyType=service
   - name: "memcached"
-    chart: "bitnami-repo/memcached"
+    chart: "memcached-repo/{{ .Values.charts.memcached.name }}"
-    version: "6.6.2"
+    version: "{{ .Values.charts.memcached.version }}"
     values:
       - "values-memcached.yaml"
       - "values-memcached.gotmpl"
     installed: {{ .Values.memcached.enabled }}
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/postgresql/postgresql
-  # dataSource=docker
-  # dependencyType=service
   - name: "postgresql"
-    chart: "postgresql-repo/postgresql"
+    chart: "postgresql-repo/{{ .Values.charts.postgresql.name }}"
-    version: "2.0.3"
+    version: "{{ .Values.charts.postgresql.version }}"
     values:
       - "values-postgresql.yaml"
       - "values-postgresql.gotmpl"
     installed: {{ .Values.postgresql.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/mariadb/mariadb
-  # dataSource=docker
-  # dependencyType=service
   - name: "mariadb"
-    chart: "mariadb-repo/mariadb"
+    chart: "mariadb-repo/{{ .Values.charts.mariadb.name }}"
-    version: "2.1.1"
+    version: "{{ .Values.charts.mariadb.version }}"
     values:
       - "values-mariadb.yaml"
       - "values-mariadb.gotmpl"
     installed: {{ .Values.mariadb.enabled }}
     timeout: 900
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/postfix/postfix
-  # dataSource=docker
-  # dependencyType=service
   - name: "postfix"
-    chart: "postfix-repo/postfix"
+    chart: "postfix-repo/{{ .Values.charts.postfix.name }}"
-    version: "2.0.4"
+    version: "{{ .Values.charts.postfix.version }}"
     values:
       - "values-postfix.yaml"
       - "values-postfix.gotmpl"
     installed: {{ .Values.postfix.enabled }}
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/clamav/opendesk-clamav
-  # dataSource=docker
-  # dependencyType=service
   - name: "clamav"
-    chart: "clamav-repo/opendesk-clamav"
+    chart: "clamav-repo/{{ .Values.charts.clamav.name }}"
-    version: "4.0.0"
+    version: "{{ .Values.charts.clamav.version }}"
     values:
       - "values-clamav-distributed.yaml"
       - "values-clamav-distributed.gotmpl"
     installed: {{ .Values.clamavDistributed.enabled }}
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/clamav/clamav-simple
-  # dataSource=docker
-  # dependencyType=service
   - name: "clamav-simple"
-    chart: "clamav-repo/clamav-simple"
+    chart: "clamav-simple-repo/{{ .Values.charts.clamavSimple.name }}"
-    version: "4.0.0"
+    version: "{{ .Values.charts.clamavSimple.version }}"
     values:
       - "values-clamav-simple.yaml"
       - "values-clamav-simple.gotmpl"
     installed: {{ .Values.clamavSimple.enabled }}
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/istio-ressources/istio-gateway
-  # dataSource=docker
-  # dependencyType=service
   - name: "opendesk-gateway"
-    chart: "istio-resources-repo/istio-gateway"
+    chart: "istio-resources-repo/{{ .Values.charts.istioResources.name }}"
-    version: "2.0.0"
+    version: "{{ .Values.charts.istioResources.version }}"
     values:
       - "values-istio-gateway.yaml"
       - "values-istio-gateway.gotmpl"
     installed: {{ .Values.istio.enabled }}
 
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/bitnami-charts/minio
-  # dataSource=docker
-  # dependencyType=service
   - name: "minio"
-    chart: "bitnami-repo/minio"
+    chart: "minio-repo/{{ .Values.charts.minio.name }}"
-    version: "12.8.19"
+    version: "{{ .Values.charts.minio.version }}"
     values:
       - "values-minio.yaml"
       - "values-minio.gotmpl"

helmfile/apps/services/values-mariadb.gotmpl

@@ -8,6 +8,9 @@ global:
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
+cleanup:
+  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+
 image:
   repository: {{ .Values.images.mariadb.repository | quote }}
   tag: {{ .Values.images.mariadb.tag | quote }}

helmfile/apps/services/values-otterize.gotmpl

@@ -0,0 +1,56 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+apps:
+  clamavDistributed:
+    enabled: {{ .Values.clamavDistributed.enabled }}
+  clamavSimple:
+    enabled: {{ .Values.clamavSimple.enabled }}
+  collabora:
+    enabled: {{ .Values.collabora.enabled }}
+  cryptpad:
+    enabled: {{ .Values.cryptpad.enabled }}
+  dovecot:
+    enabled: {{ .Values.dovecot.enabled }}
+  element:
+    enabled: {{ .Values.element.enabled }}
+  intercom:
+    enabled: {{ .Values.intercom.enabled }}
+  jitsi:
+    enabled: {{ .Values.jitsi.enabled }}
+  keycloak:
+    enabled: {{ .Values.keycloak.enabled }}
+  mariadb:
+    enabled: {{ .Values.mariadb.enabled }}
+  memcached:
+    enabled: {{ .Values.memcached.enabled }}
+  minio:
+    enabled: {{ .Values.minio.enabled }}
+  nextcloud:
+    enabled: {{ .Values.nextcloud.enabled }}
+  openproject:
+    enabled: {{ .Values.openproject.enabled }}
+  oxAppsuite:
+    enabled: {{ .Values.oxAppsuite.enabled }}
+  oxConnector:
+    enabled: {{ .Values.oxConnector.enabled }}
+  postfix:
+    enabled: {{ .Values.postfix.enabled }}
+  postgresql:
+    enabled: {{ .Values.postgresql.enabled }}
+  redis:
+    enabled: {{ .Values.redis.enabled }}
+  univentionCorporateServer:
+    enabled: {{ .Values.univentionCorporateServer.enabled }}
+  univentionManagementStack:
+    enabled: {{ .Values.univentionManagementStack.enabled }}
+  xwiki:
+    enabled: {{ .Values.xwiki.enabled }}
+
+extraApps:
+  clusterPostfix:
+    enabled: {{ .Values.security.clusterPostfix.enabled }}
+    namespace: {{ .Values.security.clusterPostfix.namespace }}
+...

helmfile/apps/services/values-postfix.gotmpl

@@ -24,7 +24,7 @@ postfix:
     - fileName: "sasl_passwd.map"
       content:
         - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
-  relayHost: {{ printf "[%s]:[%d]" .Values.smtp.host .Values.smtp.port | quote }}
+  relayHost: {{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}
   relayNets: {{ .Values.cluster.networking.cidr | quote}}
   virtualTransport: "lmtps:dovecot:24"
   smtpdSASLPath: "inet:dovecot:3659"

helmfile/apps/services/values-postgresql.gotmpl

@@ -24,7 +24,9 @@ job:
     - username: "matrix_user"
       password: {{ .Values.secrets.postgresql.matrixUser | quote }}
     - username: "notificationsapi_user"
-      password: {{ .Values.secrets.postgresql.notificationsApiUser | quote }}
+      password: {{ .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
+    - username: "selfservice_user"
+      password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
   databases:
     - name: "keycloak"
       user: "keycloak_user"
@@ -37,6 +39,8 @@ job:
       additionalParams: "ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0"
     - name: "notificationsapi"
       user: "notificationsapi_user"
+    - name: "selfservice"
+      user: "selfservice_user"
 
 persistence:
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

helmfile/apps/univention-corporate-container/helmfile.yaml

@@ -3,29 +3,22 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # openDesk Univention Corporate Server (as eval Container)
   - name: "univention-corporate-container-repo"
     oci: true
-    # yamllint disable rule:line-length
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" | default
-         "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/univention-corporate-container" }}
-    # yamllint enable rule:line-length
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.univentionCorporateServer.verify }}
+    username: "{{ .Values.charts.univentionCorporateServer.username }}"
+    password: {{ .Values.charts.univentionCorporateServer.password | quote }}
+    url: "{{ .Values.charts.univentionCorporateServer.registry }}/\
+      {{ .Values.charts.univentionCorporateServer.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/univention-corporate-container/univention-corporate-container
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "univention-corporate-container"
-    chart: "univention-corporate-container-repo/univention-corporate-container"
+    chart: "univention-corporate-container-repo/{{ .Values.charts.univentionCorporateServer.name }}"
-    version: "1.0.10"
+    version: "{{ .Values.charts.univentionCorporateServer.version }}"
     values:
       - "values.yaml"
       - "values.gotmpl"

helmfile/apps/univention-management-stack/helmfile.yaml

@@ -3,7 +3,6 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # Univention Management Stack
@@ -13,50 +12,35 @@ repositories:
          default "https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable" }}
   # VMWare Bitnami
   # Source: https://github.com/bitnami/charts/
-  - name: "bitnami-repo"
+  - name: "nginx-repo"
     oci: true
-    url: >-
-      {{ env "PRIVATE_IMAGE_REGISTRY_URL" |
-         default "external-registry.souvap-univention.de/sovereign-workplace/souvap/tooling/charts/bitnami-charts" }}
-    verify: true
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.nginx.verify }}
+    username: "{{ .Values.charts.nginx.username }}"
+    password: {{ .Values.charts.nginx.password | quote }}
+    url: "{{ .Values.charts.nginx.registry }}/{{ .Values.charts.nginx.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://registry.souvap-univention.de
-  # packageName=souvap/tooling/charts/bitnami-charts/nginx
-  # dataSource=docker
-  # dependencyType=vendor
   - name: "ums-stack-gateway"
-    chart: "bitnami-repo/nginx"
+    chart: "nginx-repo/{{ .Values.charts.nginx.name }}"
-    version: "15.3.5"
+    version: "{{ .Values.charts.nginx.version }}"
     values:
       - "values-ums-stack-gateway.gotmpl"
       - "values-ums-stack-gateway.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=store-dav
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-store-dav"
-    chart: "ums-repo/store-dav"
+    chart: "ums-repo/{{ .Values.charts.umsStoreDav.name }}"
-    version: "0.5.2"
+    version: "{{ .Values.charts.umsStoreDav.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
       - "values-store-dav.gotmpl"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=ldap-server
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-ldap-server"
-    chart: "ums-repo/ldap-server"
+    chart: "ums-repo/{{ .Values.charts.umsLdapServer.name }}"
-    version: "0.7.0"
+    version: "{{ .Values.charts.umsLdapServer.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -64,14 +48,9 @@ releases:
       - "values-ldap-server.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=ldap-notifier
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-ldap-notifier"
-    chart: "ums-repo/ldap-notifier"
+    chart: "ums-repo/{{ .Values.charts.umsLdapNotifier.name }}"
-    version: "0.7.0"
+    version: "{{ .Values.charts.umsLdapNotifier.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -79,14 +58,9 @@ releases:
       - "values-ldap-notifier.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=udm-rest-api
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-udm-rest-api"
-    chart: "ums-repo/udm-rest-api"
+    chart: "ums-repo/{{ .Values.charts.umsUdmRestApi.name }}"
-    version: "0.3.5"
+    version: "{{ .Values.charts.umsUdmRestApi.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -94,14 +68,9 @@ releases:
       - "values-udm-rest-api.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=stack-data-ums
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-stack-data-ums"
-    chart: "ums-repo/stack-data-ums"
+    chart: "ums-repo/{{ .Values.charts.umsStackDataUms.name }}"
-    version: "0.36.0"
+    version: "{{ .Values.charts.umsStackDataUms.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -109,14 +78,9 @@ releases:
       - "values-stack-data-ums.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=stack-data-swp
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-stack-data-swp"
-    chart: "ums-repo/stack-data-swp"
+    chart: "ums-repo/{{ .Values.charts.umsStackDataSwp.name }}"
-    version: "0.36.0"
+    version: "{{ .Values.charts.umsStackDataSwp.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -124,14 +88,9 @@ releases:
       - "values-stack-data-swp.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=portal-server
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-portal-server"
-    chart: "ums-repo/portal-server"
+    chart: "ums-repo/{{ .Values.charts.umsPortalServer.name }}"
-    version: "0.5.0"
+    version: "{{ .Values.charts.umsPortalServer.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -139,14 +98,9 @@ releases:
       - "values-portal-server.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=notifications-api
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-notifications-api"
-    chart: "ums-repo/notifications-api"
+    chart: "ums-repo/{{ .Values.charts.umsNotificationsApi.name }}"
-    version: "0.5.0"
+    version: "{{ .Values.charts.umsNotificationsApi.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -154,14 +108,9 @@ releases:
       - "values-notifications-api.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=portal-listener
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-portal-listener"
-    chart: "ums-repo/portal-listener"
+    chart: "ums-repo/{{ .Values.charts.umsPortalListener.name }}"
-    version: "0.5.0"
+    version: "{{ .Values.charts.umsPortalListener.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -169,14 +118,9 @@ releases:
       - "values-portal-listener.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=portal-frontend
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-portal-frontend"
-    chart: "ums-repo/portal-frontend"
+    chart: "ums-repo/{{ .Values.charts.umsPortalFrontend.name }}"
-    version: "0.5.0"
+    version: "{{ .Values.charts.umsPortalFrontend.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -184,14 +128,9 @@ releases:
       - "values-portal-frontend.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=umc-gateway
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-umc-gateway"
-    chart: "ums-repo/umc-gateway"
+    chart: "ums-repo/{{ .Values.charts.umsUmcGateway.name }}"
-    version: "0.6.1"
+    version: "{{ .Values.charts.umsUmcGateway.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
@@ -199,14 +138,9 @@ releases:
       - "values-umc-gateway.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
-  # renovate:
-  # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
-  # packageName=umc-server
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "ums-umc-server"
-    chart: "ums-repo/umc-server"
+    chart: "ums-repo/{{ .Values.charts.umsUmcServer.name }}"
-    version: "0.6.1"
+    version: "{{ .Values.charts.umsUmcServer.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"

helmfile/apps/univention-management-stack/values-notifications-api.gotmpl

@@ -6,12 +6,12 @@ SPDX-License-Identifier: Apache-2.0
 postgresql:
   bundled: false
   connection:
-    host: {{ .Values.databases.notificationsApi.host | quote }}
+    host: {{ .Values.databases.umsNotificationsApi.host | quote }}
-    port: {{ .Values.databases.notificationsApi.port | quote }}
+    port: {{ .Values.databases.umsNotificationsApi.port | quote }}
   auth:
-    username: {{ .Values.databases.notificationsApi.username | quote }}
+    username: {{ .Values.databases.umsNotificationsApi.username | quote }}
-    database: {{ .Values.databases.notificationsApi.name | quote }}
+    database: {{ .Values.databases.umsNotificationsApi.name | quote }}
-    password: {{ .Values.databases.notificationsApi.password | default .Values.secrets.postgresql.notificationsApiUser | quote }}
+    password: {{ .Values.databases.umsNotificationsApi.password | default .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
 
 image:
   registry: {{ .Values.global.imageRegistry }}

helmfile/apps/univention-management-stack/values-portal-listener.gotmpl

@@ -6,7 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 portalListener:
   adminGroup: {{ printf "%s,%s" "cn=Domain Admins,cn=groups" .Values.ldap.baseDn | quote }}
   assetsRoot: {{ printf "%s%s%s" "http://portal-listener:" .Values.secrets.univentionManagementStack.storeDavUsers.portalListener "@ums-store-dav/portal-assets/" | quote }}
-  ucsInternalUrl: {{ printf "%s%s%s" "http://portal-listener:" .Values.secrets.univentionManagementStack.storeDavUsers.portalListener "@ums-store-dav/portal-data/" | quote }}
+  ucsInternalUrl: {{ printf "%s%s%s" "http://portal-listener:" .Values.secrets.univentionManagementStack.storeDavUsers.portalListener "@ums-store-dav/portal-data" | quote }}
 
   ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
   ldapHost: {{ .Values.ldap.host | quote }}

helmfile/apps/univention-management-stack/values-stack-data-swp.gotmpl

@@ -31,6 +31,9 @@ stackDataContext:
   userPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.userPassword | quote }}
   adminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
 
+  userPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.userPassword | quote }}
+  adminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
+
 image:
   registry: {{ .Values.global.imageRegistry | quote }}
   repository: {{ .Values.images.umsDataLoader.repository | quote }}

helmfile/apps/univention-management-stack/values-stack-data-swp.yaml

@@ -11,4 +11,6 @@ stackDataContext:
   oxDefaultContext: "10"
   smtpStartTls: true
 
+additionalAnnotations:
+  intents.otterize.com/service-name: "ums-stack-data-swp"
 ...

helmfile/apps/univention-management-stack/values-stack-data-ums.yaml

@@ -12,4 +12,6 @@ stackDataContext:
   # The openDesk configuration brings its own UMC policies.
   installUmcPolicies: false
 
+additionalAnnotations:
+  intents.otterize.com/service-name: "ums-stack-data-ums"
 ...

helmfile/apps/univention-management-stack/values-umc-server.gotmpl

@@ -11,6 +11,19 @@ umcServer:
 
   smtpSecret: {{ .Values.smtp.password | quote }}
 
+postgresql:
+  connection:
+    host: {{ .Values.databases.umsSelfservice.host | quote }}
+    port: {{ .Values.databases.umsSelfservice.port | quote }}
+  auth:
+    username: {{ .Values.databases.umsSelfservice.username | quote }}
+    database: {{ .Values.databases.umsSelfservice.name | quote }}
+    password: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
+    postgresPassword: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
+
+memcached:
+  server: {{ .Values.cache.umsSelfservice.host | quote }}
+
 image:
   registry: {{ .Values.global.imageRegistry | quote }}
   repository: {{ .Values.images.umsUmcServer.repository | quote }}

helmfile/apps/univention-management-stack/values-umc-server.yaml

@@ -43,11 +43,12 @@ extraVolumeMounts:
     mountPath: "/usr/share/univention-management-console/modules/udm-portals-announcement.xml"
     subPath: "udm-portals-announcement.xml"
 
+postgresql:
+  bundled: false
+
 memcached:
   bundled: false
-  server: "memcached"
   auth:
     username: null
     password: null
-
 ...

helmfile/apps/univention-management-stack/values-ums-stack-gateway.gotmpl

@@ -10,3 +10,4 @@ ingress:
     - hosts:
         - {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
       secretName: {{ .Values.ingress.tls.secretName | quote }}
+...

helmfile/apps/univention-management-stack/values-ums-stack-gateway.yaml

@@ -7,6 +7,8 @@ ingress:
 service:
   type: "ClusterIP"
 
+fullnameOverride: "ums-stack-gateway"
+
 # The content of the "serverBlock" does resemble the Ingress configuration of
 # the UMS components. The "location" entries do intentionally reflect precisely
 # the respective paths which are configured.
@@ -15,7 +17,8 @@ serverBlock: |
     listen 8080;
 
     ## portal-frontend
-    # The frontend does not own "/univention/portal", only these two bits
+    # The frontend does not own "/univention/portal" nor
+    # "/univention/selfservice", only these two bits
     location = /univention/portal/ {
       rewrite ^/univention/portal(/.*)$ $1 break;
       proxy_pass http://ums-portal-frontend:80/;
@@ -24,6 +27,10 @@ serverBlock: |
       rewrite ^/univention/portal(/.*)$ $1 break;
       proxy_pass http://ums-portal-frontend:80/;
     }
+    location = /univention/selfservice/ {
+      rewrite ^/univention/selfservice(/.*)$ $1 break;
+      proxy_pass http://ums-portal-frontend:80/;
+    }
 
     # The following prefixes are owned by the frontend
     location /univention/portal/css/ {
@@ -50,6 +57,30 @@ serverBlock: |
       rewrite ^/univention/portal(/.*)$ $1 break;
       proxy_pass http://ums-portal-frontend:80;
     }
+    location /univention/selfservice/css/ {
+      rewrite ^/univention/selfservice(/.*)$ $1 break;
+      proxy_pass http://ums-portal-frontend:80;
+    }
+    location /univention/selfservice/fonts/ {
+      rewrite ^/univention/selfservice(/.*)$ $1 break;
+      proxy_pass http://ums-portal-frontend:80;
+    }
+    location /univention/selfservice/i18n/ {
+      rewrite ^/univention/selfservice(/.*)$ $1 break;
+      proxy_pass http://ums-portal-frontend:80;
+    }
+    location /univention/selfservice/media/ {
+      rewrite ^/univention/selfservice(/.*)$ $1 break;
+      proxy_pass http://ums-portal-frontend:80;
+    }
+    location /univention/selfservice/js/ {
+      rewrite ^/univention/selfservice(/.*)$ $1 break;
+      proxy_pass http://ums-portal-frontend:80;
+    }
+    location /univention/selfservice/oidc/ {
+      rewrite ^/univention/selfservice(/.*)$ $1 break;
+      proxy_pass http://ums-portal-frontend:80;
+    }
 
 
     ## frontend redirects
@@ -69,12 +100,19 @@ serverBlock: |
        absolute_redirect off;
        return 302 /univention/portal/;
     }
+    location = /univention/selfservice {
+       absolute_redirect off;
+       return 302 /univention/selfservice/;
+    }
 
 
     ## portal-server
     location = /univention/portal/portal.json {
       proxy_pass http://ums-portal-server:80;
     }
+    location = /univention/selfservice/portal.json {
+      proxy_pass http://ums-portal-server:80;
+    }
     location = /univention/portal/navigation.json {
       proxy_pass http://ums-portal-server:80;
     }
@@ -89,6 +127,14 @@ serverBlock: |
       rewrite ^/univention/portal(/icons/logos/.*)$ /portal-assets$1 break;
       proxy_pass http://ums-store-dav:80;
     }
+    location /univention/selfservice/icons/entries/ {
+      rewrite ^/univention/selfservice(/icons/entries/.*)$ /portal-assets$1 break;
+      proxy_pass http://ums-store-dav:80;
+    }
+    location /univention/selfservice/icons/logos/ {
+      rewrite ^/univention/selfservice(/icons/logos/.*)$ /portal-assets$1 break;
+      proxy_pass http://ums-store-dav:80;
+    }
 
 
     ## udm-rest-api
@@ -128,27 +174,27 @@ serverBlock: |
       rewrite ^/univention(/.*)$ $1 break;
       proxy_pass http://ums-umc-server:80;
     }
-    location /univention/logout/ {
+    location /univention/logout {
       rewrite ^/univention(/.*)$ $1 break;
       proxy_pass http://ums-umc-server:80;
     }
-    location /univention/saml/ {
+    location /univention/saml {
       rewrite ^/univention(/.*)$ $1 break;
       proxy_pass http://ums-umc-server:80;
     }
-    location /univention/get/ {
+    location /univention/get {
       rewrite ^/univention(/.*)$ $1 break;
       proxy_pass http://ums-umc-server:80;
     }
-    location /univention/set/ {
+    location /univention/set {
       rewrite ^/univention(/.*)$ $1 break;
       proxy_pass http://ums-umc-server:80;
     }
-    location /univention/command/ {
+    location /univention/command {
       rewrite ^/univention(/.*)$ $1 break;
       proxy_pass http://ums-umc-server:80;
     }
-    location /univention/upload/ {
+    location /univention/upload {
       rewrite ^/univention(/.*)$ $1 break;
       proxy_pass http://ums-umc-server:80;
     }

helmfile/apps/xwiki/helmfile.yaml

@@ -3,25 +3,19 @@
 ---
 bases:
   - "../../bases/environments.yaml"
-
 ---
 repositories:
   # XWiki
   # Source: https://github.com/xwiki-contrib/xwiki-helm
   - name: "xwiki-repo"
-    url: >-
+    username: "{{ .Values.charts.xwiki.username }}"
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
+    password: {{ .Values.charts.xwiki.password | quote }}
-         default "https://xwiki-contrib.github.io/xwiki-helm" }}
+    url: "{{ .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
 
 releases:
-  # renovate:
-  # registryUrl=https://xwiki-contrib.github.io/xwiki-helm
-  # packageName=xwiki
-  # dataSource=helm
-  # dependencyType=vendor
   - name: "xwiki"
-    chart: "xwiki-repo/xwiki"
+    chart: "xwiki-repo/{{ .Values.charts.xwiki.name }}"
-    version: "1.2.3"
+    version: "{{ .Values.charts.xwiki.version }}"
     wait: true
     values:
       - "values.yaml"

helmfile/apps/xwiki/values.yaml

@@ -2,7 +2,14 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 containerSecurityContext:
+  allowPrivilegeEscalation: false
   enabled: true
+  runAsUser: 100
+  runAsGroup: 101
+  runAsNonRoot: true
+  capabilities:
+    drop:
+      - "ALL"
 
 customConfigs:
   xwiki.cfg:
@@ -87,6 +94,9 @@ properties:
 
 securityContext:
   enabled: true
+  fsGroup: 101
+  seccompProfile:
+    type: "RuntimeDefault"
 
 service:
   externalPort: 80

helmfile/environments/default/cache.yaml

@@ -13,4 +13,7 @@ cache:
   openproject:
     host: "memcached"
     port: 11211
+  umsSelfservice:
+    host: "memcached"
+    port: 11211
 ...

helmfile/environments/default/charts.yaml

@@ -0,0 +1,714 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+charts:
+  certificates:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-certificates/opendesk-certificates
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-certificates"
+    name: "opendesk-certificates"
+    version: "2.1.0"
+    verify: true
+    username: ~
+    password: ~
+
+  clamav:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/clamav/opendesk-clamav
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/clamav"
+    name: "opendesk-clamav"
+    version: "4.0.0"
+    verify: true
+    username: ~
+    password: ~
+
+  clamavSimple:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/clamav/clamav-simple
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/clamav"
+    name: "clamav-simple"
+    version: "4.0.0"
+    verify: true
+    username: ~
+    password: ~
+
+  collabora:
+    # renovate:
+    # registryUrl=https://collaboraonline.github.io/online
+    # packageName=collabora-online
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "https://collaboraonline.github.io"
+    repository: "online"
+    name: "collabora-online"
+    version: "1.0.2"
+    username: ~
+    password: ~
+
+  cryptpad:
+    # renovate:
+    # registryUrl=https://cryptpad.github.io/helm
+    # packageName=cryptpad
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "https://cryptpad.github.io"
+    repository: "helm"
+    name: "cryptpad"
+    version: "0.0.14"
+    username: ~
+    password: ~
+
+  dovecot:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/dovecot/dovecot
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/dovecot"
+    name: "dovecot"
+    version: "1.3.6"
+    verify: true
+    username: ~
+    password: ~
+
+  element:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-element
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
+    name: "opendesk-element"
+    version: "2.6.0"
+    verify: true
+    username: ~
+    password: ~
+
+  elementWellKnown:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-well-known
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
+    name: "opendesk-well-known"
+    version: "2.6.0"
+    verify: true
+    username: ~
+    password: ~
+
+  intercomService:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/intercom-service/intercom-service
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/intercom-service"
+    name: "intercom-service"
+    version: "2.0.1"
+    verify: true
+    username: ~
+    password: ~
+
+  istioResources:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/istio-ressources/istio-gateway
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/istio-ressources"
+    name: "istio-gateway"
+    version: "2.0.0"
+    verify: true
+    username: ~
+    password: ~
+
+  jitsi:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-jitsi/sovereign-workplace-jitsi
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-jitsi"
+    name: "sovereign-workplace-jitsi"
+    version: "1.7.1"
+    verify: true
+    username: ~
+    password: ~
+
+  keycloak:
+    # renovate:
+    # registryUrl=https://registry-1.docker.io
+    # packageName=bitnamicharts/keycloak
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
+    name: "keycloak"
+    version: "12.1.5"
+    verify: true
+    username: ~
+    password: ~
+
+  keycloakBootstrap:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-keycloak-bootstrap/sovereign-workplace-keycloak-bootstrap
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-keycloak-bootstrap"
+    name: "sovereign-workplace-keycloak-bootstrap"
+    version: "1.1.12"
+    verify: true
+    username: ~
+    password: ~
+
+  keycloakExtensions:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/77/packages/helm/stable
+    # packageName=keycloak-extensions
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "https://gitlab.souvap-univention.de"
+    repository: "api/v4/projects/77/packages/helm/stable"
+    name: "keycloak-extensions"
+    version: "0.1.0"
+    username: ~
+    password: ~
+
+  keycloakTheme:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/keycloak-theme/opendesk-keycloak-theme
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/keycloak-theme"
+    name: "opendesk-keycloak-theme"
+    version: "2.0.0"
+    verify: true
+    username: ~
+    password: ~
+
+  mariadb:
+    # renovate:
+    # registryUrl=https://registry.opencode.de
+    # packageName=bmi/opendesk/components/charts/opendesk-mariadb/mariadb
+    # dataSource=docker
+    # dependencyType=service
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/charts/opendesk-mariadb"
+    name: "mariadb"
+    version: "2.2.0"
+    verify: true
+    username: ~
+    password: ~
+
+  matrixNeoboardWidget:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/opendesk-matrix-widgets/matrix-neoboard-widget
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/opendesk-matrix-widgets"
+    name: "matrix-neoboard-widget"
+    version: "3.3.0"
+    verify: true
+    username: ~
+    password: ~
+
+  matrixNeochoiseWidget:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/opendesk-matrix-widgets/matrix-neochoice-widget
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/opendesk-matrix-widgets"
+    name: "matrix-neochoice-widget"
+    version: "3.3.0"
+    verify: true
+    username: ~
+    password: ~
+
+  matrixNeodatefixBot:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/opendesk-matrix-widgets/matrix-neodatefix-bot
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/opendesk-matrix-widgets"
+    name: "matrix-neodatefix-bot"
+    version: "3.3.0"
+    verify: true
+    username: ~
+    password: ~
+
+  matrixNeodatefixWidget:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/opendesk-matrix-widgets/matrix-neodatefix-widget
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/opendesk-matrix-widgets"
+    name: "matrix-neodatefix-widget"
+    version: "3.3.0"
+    verify: true
+    username: ~
+    password: ~
+
+  matrixUserVerificationService:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-matrix-user-verification-service
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
+    name: "opendesk-matrix-user-verification-service"
+    version: "2.6.0"
+    verify: true
+    username: ~
+    password: ~
+
+  memcached:
+    # renovate:
+    # registryUrl=https://registry-1.docker.io
+    # packageName=bitnamicharts/memcached
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
+    name: "memcached"
+    version: "6.6.2"
+    verify: true
+    username: ~
+    password: ~
+
+  minio:
+    # renovate:
+    # registryUrl=https://registry-1.docker.io
+    # packageName=bitnamicharts/minio
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
+    name: "minio"
+    version: "12.8.19"
+    verify: true
+    username: ~
+    password: ~
+
+  nextcloud:
+    # renovate:
+    # registryUrl=https://nextcloud.github.io/helm
+    # packageName=nextcloud
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "https://nextcloud.github.io"
+    repository: "helm"
+    name: "nextcloud"
+    version: "3.5.19"
+    username: ~
+    password: ~
+
+  nextcloudBootstrap:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-nextcloud-bootstrap/opendesk-nextcloud-bootstrap
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-nextcloud-bootstrap"
+    name: "opendesk-nextcloud-bootstrap"
+    version: "3.2.6"
+    verify: true
+    username: ~
+    password: ~
+
+  nginx:
+    # renovate:
+    # registryUrl=https://registry-1.docker.io
+    # packageName=bitnamicharts/nginx
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
+    name: "nginx"
+    version: "15.3.5"
+    verify: true
+    username: ~
+    password: ~
+
+  openproject:
+    # renovate:
+    # registryUrl=https://ghcr.io
+    # packageName=opf/helm-charts/openproject
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/opf/helm-charts"
+    name: "openproject"
+    version: "3.0.2"
+    verify: true
+    username: ~
+    password: ~
+
+  openprojectBootstrap:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/opendesk-openproject-bootstrap/opendesk-openproject-bootstrap
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/opendesk-openproject-bootstrap"
+    name: "opendesk-openproject-bootstrap"
+    version: "1.2.1"
+    verify: true
+    username: ~
+    password: ~
+
+  openXchangeAppSuite:
+    # renovate:
+    # registryUrl=https://registry.open-xchange.com
+    # packageName=appsuite-public-sector/charts/appsuite-public-sector
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/appsuite-public-sector/charts"
+    name: "appsuite-public-sector"
+    version: "2.1.1"
+    username: ~
+    password: ~
+
+  openXchangeAppSuiteBootstrap:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-open-xchange-bootstrap/sovereign-workplace-open-xchange-bootstrap
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-open-xchange-bootstrap"
+    name: "sovereign-workplace-open-xchange-bootstrap"
+    version: "1.3.1"
+    verify: true
+    username: ~
+    password: ~
+
+  otterize:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/opendesk-otterize/opendesk-otterize
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/opendesk-otterize"
+    name: "opendesk-otterize"
+    version: "1.1.3"
+    verify: true
+    username: ~
+    password: ~
+
+  oxConnector:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/128/packages/helm/stable
+    # packageName=ox-connector
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "https://gitlab.souvap-univention.de"
+    repository: "api/v4/projects/128/packages/helm/stable"
+    name: "ox-connector"
+    version: "0.1.0-pre-jconde-listener-entrypoint-chaining"
+    username: ~
+    password: ~
+
+  postfix:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/postfix/postfix
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/postfix"
+    name: "postfix"
+    version: "2.0.4"
+    verify: true
+    username: ~
+    password: ~
+
+  postgresql:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/postgresql/postgresql
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/postgresql"
+    name: "postgresql"
+    version: "2.0.3"
+    verify: true
+    username: ~
+    password: ~
+
+  redis:
+    # renovate:
+    # registryUrl=https://registry-1.docker.io
+    # packageName=bitnamicharts/redis
+    # dataSource=docker
+    # dependencyType=service
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
+    name: "redis"
+    version: "18.1.2"
+    verify: true
+    username: ~
+    password: ~
+
+  synapse:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-synapse
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
+    name: "opendesk-synapse"
+    version: "2.6.0"
+    verify: true
+    username: ~
+    password: ~
+
+  synapseCreateAccount:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-synapse-create-account
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
+    name: "opendesk-synapse-create-account"
+    version: "2.6.0"
+    verify: true
+    username: ~
+    password: ~
+
+  synapseWeb:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/sovereign-workplace-element/opendesk-synapse-web
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
+    name: "opendesk-synapse-web"
+    version: "2.6.0"
+    verify: true
+    username: ~
+    password: ~
+
+  umsLdapNotifier:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=ldap-notifier
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "ldap-notifier"
+    version: "0.7.0"
+    username: ~
+    password: ~
+
+  umsLdapServer:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=ldap-server
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "ldap-server"
+    version: "0.7.0"
+    username: ~
+    password: ~
+
+  umsNotificationsApi:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=notifications-api
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "notifications-api"
+    version: "0.6.1"
+    username: ~
+    password: ~
+
+  umsPortalFrontend:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=portal-frontend
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "portal-frontend"
+    version: "0.6.1"
+    username: ~
+    password: ~
+
+  umsPortalListener:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=portal-listener
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "portal-listener"
+    version: "0.6.1"
+    username: ~
+    password: ~
+
+  umsPortalServer:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=portal-server
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "portal-server"
+    version: "0.6.1"
+    username: ~
+    password: ~
+
+  umsStackDataSwp:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=stack-data-swp
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "stack-data-swp"
+    version: "0.38.1"
+    username: ~
+    password: ~
+
+  umsStackDataUms:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=stack-data-ums
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "stack-data-ums"
+    version: "0.38.1"
+    username: ~
+    password: ~
+
+  umsStoreDav:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=store-dav
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "store-dav"
+    version: "0.7.0"
+    username: ~
+    password: ~
+
+  umsUdmRestApi:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=udm-rest-api
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "udm-rest-api"
+    version: "0.3.5"
+    username: ~
+    password: ~
+
+  umsUmcGateway:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=umc-gateway
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "umc-gateway"
+    version: "0.6.1"
+    username: ~
+    password: ~
+
+  umsUmcServer:
+    # renovate:
+    # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable
+    # packageName=umc-server
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "gitlab.souvap-univention.de"
+    repository: "api/v4/projects/155/packages/helm/stable"
+    name: "umc-server"
+    version: "0.6.1"
+    username: ~
+    password: ~
+
+  univentionCorporateServer:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/univention-corporate-container/univention-corporate-container
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/univention-corporate-container"
+    name: "univention-corporate-container"
+    version: "1.0.10"
+    verify: true
+    username: ~
+    password: ~
+
+  xwiki:
+    # renovate:
+    # registryUrl=https://xwiki-contrib.github.io/xwiki-helm
+    # packageName=xwiki
+    # dataSource=helm
+    # dependencyType=vendor
+    registry: "https://xwiki-contrib.github.io"
+    repository: "xwiki-helm"
+    name: "xwiki"
+    version: "1.2.3"
+    verify: true
+    username: ~
+    password: ~
+...

helmfile/environments/default/database.yaml

@@ -19,12 +19,6 @@ databases:
     host: "mariadb"
     username: "nextcloud_user"
     password: ""
-  notificationsApi:
-    name: "notificationsapi"
-    host: "postgresql"
-    port: 5432
-    username: "notificationsapi_user"
-    password: ""
   openproject:
     name: "openproject"
     host: "postgresql"
@@ -42,6 +36,18 @@ databases:
     username: "matrix_user"
     password: ""
     port: 5432
+  umsNotificationsApi:
+    name: "notificationsapi"
+    host: "postgresql"
+    port: 5432
+    username: "notificationsapi_user"
+    password: ""
+  umsSelfservice:
+    name: "selfservice"
+    host: "postgresql"
+    port: 5432
+    username: "selfservice_user"
+    password: ""
   xwiki:
     name: "xwiki"
     host: "mariadb"

helmfile/environments/default/images.yaml

@@ -35,7 +35,7 @@ images:
     # registryUrl=https://registry.souvap-univention.de
     # dependencyType=vendor
     repository: "souvap/tooling/images/element-web"
-    tag: "1.6.0@sha256:a71cbd75ee88471e3df59f26a2a37b9b8ff83d2f71f726053acd381ecd87e234"
+    tag: "1.7.0@sha256:b8b59aff8ed3eb07dc22cec123a2d04acaf435f5637148698183773a695444c2"
     # @supplier: "Element"
   freshclam:
     # renovate:
@@ -149,21 +149,21 @@ images:
     # registryUrl=https://ghcr.io
     # dependencyType=vendor
     repository: "nordeck/matrix-neoboard-widget"
-    tag: "1.0.0@sha256:584b9c18ea3dfd4b7f1e73f3e114bc1dcd5731b400a8d037576bf2a797c8b086"
+    tag: "1.4.0@sha256:da04d6c3c3e07ec1fcb6ecec245adc48897f107a2ab84c39d8924de951744d9f"
     # @supplier: "Nordeck"
   matrixNeoChoiceWidget:
     # renovate:
     # registryUrl=https://ghcr.io
     # dependencyType=vendor
     repository: "nordeck/matrix-poll-widget"
-    tag: "1.3.0@sha256:19d2c8c7a15fe7d12c4a83a89310831da12323fd45ff0280cce808f1be0c7e0b"
+    tag: "1.3.1@sha256:ba7a0bcbcf278df523cef8d230dc44f31ef86f8aefe6dbea7d832b7234ff5c7a"
     # @supplier: "Nordeck"
   matrixNeoDateFixBot:
     # renovate:
     # registryUrl=https://ghcr.io
     # dependencyType=vendor
     repository: "nordeck/matrix-meetings-bot"
-    tag: "2.4.2@sha256:f5b3362560255470076f3e6c95a0dd93a8f781398afb992c1e1212764fa87297"
+    tag: "2.5.0@sha256:6ea92f7e48cd71ce2c552cb5222a1d4b3696136e61045bce8456bc52ce02b9c8"
     # @supplier: "Nordeck"
   matrixNeoDateFixWidget:
     # renovate:
@@ -205,7 +205,7 @@ images:
     # registryUrl=https://docker.io
     # dependencyType=vendor
     repository: "nextcloud"
-    tag: "27.1.3-apache@sha256:ec46e99164ee7fa5d49e84784833e022be47f9f54f401bcb5a2d789f8c0bc149"
+    tag: "27.1.4-apache@sha256:bd277bec9a8cf7cc009865e15410c05e0f66ccb6269ed96841cc95dd37c214fe"
     # @supplier: "Nextcloud Community"
   nextcloudExporter:
     # renovate:
@@ -219,7 +219,7 @@ images:
     # registryUrl=https://docker.io
     # dependencyType=vendor
     repository: "openproject/open_desk"
-    tag: "dev@sha256:3c9d110c0221621530a431b5899ba16956db8253f491a55a220ec642473cb61f"
+    tag: "release-13.1@sha256:b1e6d55d913bb2dfc34caae364c54ff524c0676a74da1c036d0e64557ef42795"
     # @supplier: "OpenProject"
   openprojectInitDb:
     # renovate:
@@ -324,8 +324,7 @@ images:
     # registryUrl=https://registry.souvap-univention.de
     # dependencyType=vendor
     repository: "souvap/tooling/images/ox-connector/ox-connector-standalone"
-    tag: "branch-jconde-listener-entrypoint-chaining\
+    tag: "0.3.4@sha256:db95466170613db46222e63aa0f69de9e60d08c6a409e27905ce5389e4b19074"
-      @sha256:54748d49e37d52529d4a857ff834d1217bd2cb8c89c7eed25c0873159ed6853c"
     # @supplier: "Univention"
   postfix:
     # renovate:
@@ -396,7 +395,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/config-htpasswd"
-    tag: "0.5.2@sha256:c8627e0b73ee1d92f74d2ae8b06e4593ac93b6bbde55d56d0497f3510912924c"
+    tag: "0.7.0@sha256:8ffa8ce61fc55f67cdf740b3cd30e21d979506a1796028f5c6329da344b2e5db"
     # @supplier: "Univention"
   umsDataLoader:
     # renovate:
@@ -404,7 +403,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/data-loader"
-    tag: "0.36.0@sha256:045e0e524cbdc93e174ce803a12e67dbb341211f3abbc0029200ee638a0a1eb7"
+    tag: "0.38.1@sha256:cef20b0224571eeda29f19e78340ab7d943e46b02275f9b9497605357be70e61"
     # @supplier: "Univention"
   umsLdapNotifier:
     # renovate:
@@ -428,7 +427,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/notifications-api"
-    tag: "0.5.2@sha256:192f0ebb77ec6191d1df1edb2427739c4a69a3733c7d423f55045db5b9209c64"
+    tag: "0.6.1@sha256:bdf0c5ba8b15c2e7f4daaf470254b13837bdc5fbaa98d9f441f33abd565acfc3"
     # @supplier: "Univention"
   umsPortalListener:
     # renovate:
@@ -436,7 +435,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/portal-listener"
-    tag: "0.5.2@sha256:a1834a98cf4f4686a74077cb6c2b094429a49875d05801745de7ee13eee38a07"
+    tag: "0.6.1@sha256:c418be054dfb2c6fe0e2e8870553c3b27269ae77b88a59cd6d790201cf7c3d17"
     # @supplier: "Univention"
   umsPortalFrontend:
     # renovate:
@@ -444,7 +443,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/portal-frontend"
-    tag: "0.5.2@sha256:aca1d481e23cbba7a33d5f261be6196690a6b7f1e593f7ff96fc6f22edab2c6b"
+    tag: "0.6.1@sha256:0a4dc8ed47fd86eedd7bfd826b4538564194fe951000cff016eaa271382ed822"
     # @supplier: "Univention"
   umsPortalServer:
     # renovate:
@@ -452,7 +451,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/portal-server"
-    tag: "0.5.2@sha256:ed982e41ac5b0b81946272acf00f76463901da4f4b3ad50282ec4c73fd4b5833"
+    tag: "0.6.1@sha256:dd9431c8a82e6fca89ef871de90947db2f594a349d634f0b1aa9669d0b3d5715"
     # @supplier: "Univention"
   umsWaitForDependency:
     # renovate:
@@ -460,7 +459,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/wait-for-dependency"
-    tag: "0.5.0@sha256:78cfcc52b81f620374c4b827f0055be5339a7dd469d9b8df67e3bed547abd6bc"
+    tag: "0.6.1@sha256:e83fe2d7535167d1d1effe443fca0be431aa551ab31f172a84073b7d9ffec54b"
     # @supplier: "Univention"
   umsStoreDav:
     # renovate:
@@ -468,7 +467,7 @@ images:
     # dependencyType=vendor
     # This is a preview and not part of the standard deployment.
     repository: "souvap/tooling/images/univention/store-dav"
-    tag: "0.5.2@sha256:1bc01b883a5ccd2612925e123da10f9d216389701d743f1cea4050633770639f"
+    tag: "0.7.0@sha256:732b0d2fdf320209de04403753d3bc80f9c73a46b237202a95305a332805f305"
     # @supplier: "Univention"
   umsUdmRestApi:
     # renovate:

helmfile/environments/default/objectstore.gotmpl

@@ -0,0 +1,16 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+objectstores:
+  openproject:
+    backend: "minio"
+    bucket: "openproject"
+    endpoint: ""
+    provider: "AWS"
+    region: ""
+    secret: ""
+    username: "openproject_user"
+    useIAMProfile: ""
+...

helmfile/environments/default/secrets.gotmpl

@@ -38,7 +38,8 @@ secrets:
     keycloakExtensionUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "keycloak_extensions_user" | sha1sum | quote }}
     matrixUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "matrix_user" | sha1sum | quote }}
     openprojectUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "openproject_user" | sha1sum | quote }}
-    notificationsApiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "notificationsapi_user" | sha1sum | quote }}
+    umsNotificationsApiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "notificationsapi_user" | sha1sum | quote }}
+    umsSelfserviceUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "selfservice_user" | sha1sum | quote }}
   mariadb:
     rootPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "mariadb" "root_password" | sha1sum | quote }}
     xwikiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "mariadb" "xwiki_user" | sha1sum | quote }}

helmfile/environments/default/security.yaml

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+security:
+  otterizeIntents:
+    enabled: false
+  clusterPostfix:
+    enabled: false
+    namespace: ""
+...

helmfile/files/gpg-pubkeys/opencode.gpg.license

@@ -0,0 +1,2 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0

helmfile/files/gpg-pubkeys/openproject-com.gpg.license

@@ -0,0 +1,2 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0