chore(release): 0.5.72 [skip ci]

## [0.5.72](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.71...v0.5.72) (2023-12-18)

### Bug Fixes

* **collabora:** Update image to 23.05.6.3.1 ([8c378c6](8c378c6f91))
* **docs:** Update scaling.md ([d342efe](d342efe9a9))
* **open-xchange:** Update Helm chart removing yaml templating doublettes ([c21dd46](c21dd46289))

.gitlab-ci.yml

@@ -56,14 +56,11 @@ variables:
     options:
       - "yes"
       - "no"
-  DEPLOY_UCS:
+  DEPLOY_UMS:
-    description: >-
+    description: "Enable Univention Management Stack deployment."
-      Enable Univention Corporate Server deployment.
-      "ums-eval" does deploy the Univention Management Stack instead of the UCS container.
     value: "no"
     options:
       - "yes"
-      - "ums-eval"
       - "no"
   DEPLOY_PROVISIONING:
     description: "Enable Provisioning Components."
@@ -89,12 +86,6 @@ variables:
     options:
       - "yes"
       - "no"
-  DEPLOY_KEYCLOAK:
-    description: "Enable Keycloak deployment."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
   DEPLOY_OX:
     description: "Enable OX AppSuite8 deployment."
     value: "no"
@@ -154,7 +145,8 @@ variables:
   cache: {}
   dependencies: []
   extends: ".environments"
-  image: "registry.souvap-univention.de/souvap/tooling/images/helm:latest"
+  image: "external-registry.souvap-univention.de/registry-souvap-univention-de/souvap/tooling/images/helm\
+          @sha256:5a53455af45f4af5c97a01ee2dd5f9ef683f365b59f1ab0102505bc0fd37f6c5"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
     # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD
@@ -233,18 +225,6 @@ services-deploy:
   variables:
     COMPONENT: "services"
 
-ucs-deploy:
-  stage: "component-deploy-stage-1"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UCS == "yes")
-      when: "always"
-  variables:
-    COMPONENT: "univention-corporate-container"
-
 provisioning-deploy:
   stage: "component-deploy-stage-2"
   extends: ".deploy-common"
@@ -252,7 +232,7 @@ provisioning-deploy:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
           $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UCS != "no" || $DEPLOY_PROVISIONING != "no")
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no" || $DEPLOY_PROVISIONING != "no")
       when: "always"
   variables:
     COMPONENT: "provisioning"
@@ -264,36 +244,11 @@ ums-deploy:
     - if: >
           $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
           $NAMESPACE =~ /.+/ &&
-          $DEPLOY_UCS == "ums-eval"
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no")
       when: "always"
   variables:
     COMPONENT: "univention-management-stack"
 
-keycloak-deploy:
-  stage: "component-deploy-stage-1"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_KEYCLOAK != "no")
-      when: "always"
-  variables:
-    COMPONENT: "keycloak"
-
-keycloak-bootstrap-deploy:
-  stage: "component-deploy-stage-1"
-  extends: ".deploy-common"
-  timeout: "30m"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_KEYCLOAK != "no")
-      when: "always"
-  variables:
-    COMPONENT: "keycloak-bootstrap"
-
 ox-deploy:
   stage: "component-deploy-stage-1"
   extends: ".deploy-common"
@@ -434,6 +389,19 @@ env-stop:
   variables:
     GIT_STRATEGY: "none"
 
+.ums-default-password: &ums-default-password
+  - |
+    UMS_PASSWORDS=$( \
+      kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}' \
+      | yq '.properties.password' > passwords.txt \
+    )
+    DEFAULT_USER_PASSWORD=$( \
+      awk 'NR==1{print $1}' passwords.txt \
+    )
+    DEFAULT_ADMIN_PASSWORD=$(
+      awk 'NR==3{print $1}' passwords.txt \
+    )
+
 run-tests:
   extends: ".deploy-common"
   environment:
@@ -444,24 +412,8 @@ run-tests:
           $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
       when: "always"
   script:
+    - *ums-default-password
     - |
-      UCS_CONTAINER_NAME=$( \
-        kubectl -n ${NAMESPACE} get pods --no-headers --selector \
-          'app.kubernetes.io/instance=univention-corporate-container' \
-        | grep Running \
-        | awk '{print $1}' \
-      )
-      DEFAULT_USER_PASSWORD=$( \
-        kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
-        | grep DEFAULT_ACCOUNT_USER_PASSWORD \
-        | awk '{print $2}' \
-      )
-      DEFAULT_ADMIN_PASSWORD=$(
-        kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
-        | grep DEFAULT_ACCOUNT_ADMIN_PASSWORD \
-        | awk '{print $2}' \
-      )
-
       curl --request POST \
       --header "Content-Type: application/json" \
       --data "{ \
@@ -478,12 +430,12 @@ run-tests:
           \"DEPLOY_ELEMENT\": \"${DEPLOY_ELEMENT}\", \
           \"DEPLOY_ICS\": \"${DEPLOY_ICS}\", \
           \"DEPLOY_JITSI\": \"${DEPLOY_JITSI}\", \
-          \"DEPLOY_KEYCLOAK\": \"${DEPLOY_KEYCLOAK}\", \
+          \"DEPLOY_KEYCLOAK\": \"${DEPLOY_UMS}\", \
           \"DEPLOY_NEXTCLOUD\": \"${DEPLOY_NEXTCLOUD}\", \
           \"DEPLOY_OPENPROJECT\": \"${DEPLOY_OPENPROJECT}\", \
           \"DEPLOY_OX\": \"${DEPLOY_OX}\", \
           \"DEPLOY_SERVICES\": \"${DEPLOY_SERVICES}\", \
-          \"DEPLOY_UCS\": \"${DEPLOY_UCS}\", \
+          \"DEPLOY_UCS\": \"${DEPLOY_UMS}\", \
           \"DEPLOY_XWIKI\": \"${DEPLOY_XWIKI}\", \
           \"DEPLOY_PROVISIONING\": \"${DEPLOY_PROVISIONING}\" \
         } \
@@ -500,24 +452,8 @@ run-souvap-dev-tests:
         $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/ && $RUN_UMS_TESTS == "yes"
       when: "always"
   script:
+    - *ums-default-password
     - |
-      UCS_CONTAINER_NAME=$( \
-        kubectl -n ${NAMESPACE} get pods --no-headers --selector \
-          'app.kubernetes.io/instance=univention-corporate-container' \
-        | grep Running \
-        | awk '{print $1}' \
-      )
-      DEFAULT_USER_PASSWORD=$( \
-        kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
-        | grep DEFAULT_ACCOUNT_USER_PASSWORD \
-        | awk '{print $2}' \
-      )
-      DEFAULT_ADMIN_PASSWORD=$(
-        kubectl -n ${NAMESPACE} describe pod ${UCS_CONTAINER_NAME} \
-        | grep DEFAULT_ACCOUNT_ADMIN_PASSWORD \
-        | awk '{print $2}' \
-      )
-
       curl --request POST \
       --header "Content-Type: application/json" \
       --data "{ \
@@ -570,6 +506,14 @@ generate-release-assets:
   image: "registry.souvap-univention.de/souvap/tooling/images/semantic-release-patched:latest"
   tags: []
 
+
+conventional-commits-linter:
+  rules:
+    - if: "$JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'"
+      when: "never"
+    - when: "always"
+
+
 common-yaml-linter:
   rules:
     - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"

CHANGELOG.md

@@ -1,3 +1,27 @@
+## [0.5.72](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.71...v0.5.72) (2023-12-18)
+
+
+### Bug Fixes
+
+* **collabora:** Update image to 23.05.6.3.1 ([8c378c6](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/8c378c6f91a88da3b45c209da5360cabfeb911aa))
+* **docs:** Update scaling.md ([d342efe](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/d342efe9a9bbc8f018831e2723e664e5365abba3))
+* **open-xchange:** Update Helm chart removing yaml templating doublettes ([c21dd46](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/c21dd462895870fd6ba98bbb167ac063e747a501))
+
+## [0.5.71](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.70...v0.5.71) (2023-12-15)
+
+
+### Bug Fixes
+
+* **docs:** Security.md ([36bbbae](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/36bbbae57918036f44ddb23e47b550b2f46e5f35))
+* **univention-management-stack:** Switch to Univention Keycloak ([902076c](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/902076c62909889f8ffcf90328bc06ebb908b9b8))
+
+## [0.5.70](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.69...v0.5.70) (2023-12-14)
+
+
+### Bug Fixes
+
+* **univention-management-stack:** Remove UCS container monolith and make UMS standard IAM ([450c434](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/450c434ed08120ad0757d672dc269a78362e780d))
+
 ## [0.5.69](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.68...v0.5.69) (2023-12-12)
 
 

COMPONENTS-SERVICE.md

@@ -21,7 +21,9 @@ This services is used by:
 ## Database - PostgreSQL
 
 This services is used by:
-- Keycloak
+- Univention Management Stack
+  - Self Service
+  - Keycloak
 - OpenProject
 
 ## Redis
@@ -33,11 +35,12 @@ This service is used by:
 ## Postfix
 
 This service is used by:
-- Keycloak (e.g. new device login notification)
 - Nextcloud (e.g. share file notifictions)
 - Open-Xchange (emails)
 - OpenProject (general notifications)
-- UCS (e.g. password reset emails)
+- Univention Management Stack
+  - Self Service (e.g. password reset emails)
+  - Keycloak (e.g. new device login notification)
 - XWiki (e.g. change notifications)
 
 ## TURN Server

CONTRIBUTING.md

@@ -52,14 +52,12 @@ Valid commit scopes:
 - `collabora`
 - `ìntercom-service`
 - `jitsi`
-- `keycloak`
-- `keycloak-bootstrap`
 - `nextcloud`
 - `open-xchange`
 - `openproject`
 - `provisioning`
 - `services`
-- `univention-corporate-container`
+- `univention-management-stack`
 - `xwiki`
 
 ## Semantic Release

README.md

@@ -48,7 +48,6 @@ While most components support upgrades, major configuration or component changes
 at the moment always installing from scratch.
 
 Components that are going to be replaced soon are:
-- the UCS dev container monolith will be substituted by multiple Univention Management Stack containers,
 - the Nextcloud community container is going to be replaced by an openDesk specific Nextcloud distroless container and
 - Dovecot Community is going to be replaced by a Dovecot container tailored for the needs of the public sector.
 
@@ -68,19 +67,19 @@ If you want to address other topics, please check the section
 
 # Requirements
 
-⟶ Visit our detailed [Requirements](docs/requirements.md) overview.
+⟶ Visit our detailed [Requirements](./docs/requirements.md) overview.
 
 # Getting started
 
-⟶ Visit our detailed [Getting started](docs/getting-started.md) guide.
+⟶ Visit our detailed [Getting started](./docs/getting-started.md) guide.
 
 # Advanced customization
 
-- [External services](docs/external-services.md)
+- [External services](./docs/external-services.md)
-- [Security](docs/security.md)
+- [Security](./docs/security.md)
-- [Scaling](docs/scaling.md)
+- [Scaling](./docs/scaling.md)
-- [Monitoring](docs/monitoring.md)
+- [Monitoring](./docs/monitoring.md)
-- [Theming](docs/theming.md)
+- [Theming](./docs/theming.md)
 
 # Releases
 
@@ -96,7 +95,7 @@ The following release artefacts are provided beside the default source code asse
 
 # Components
 
-⟶ Visit our detailed [Component](docs/getting-started.md) docs.
+⟶ Visit our detailed [Component](./docs/components.md) docs.
 
 
 # License

docs/ci.md

@@ -7,11 +7,11 @@ SPDX-License-Identifier: Apache-2.0
 This page will cover openDesk automation via Gitlab CI.
 
 <!-- TOC -->
-  * [Deployment](#deployment)
+* [Deployment](#deployment)
-  * [Tests](#tests)
+* [Tests](#tests)
 <!-- TOC -->
 
-## Deployment
+# Deployment
 
 The project includes a `.gitlab-ci.yml` that allows you to execute the deployment from a Gitlab instance of your choice.
 
@@ -30,8 +30,7 @@ Based on your input, the following variables will be set:
 
 You might want to set credential variables in the Gitlab project at `Settings` > `CI/CD` > `Variables`.
 
-
+# Tests
-## Tests
 
 The gitlab-ci pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another gitlab project.
 The `DEPLOY_`-variables are used to determine which components should be tested.

docs/components.md

@@ -7,20 +7,20 @@ SPDX-License-Identifier: Apache-2.0
 This section covers the internal system requirements as well as external service requirements for productive use.
 
 <!-- TOC -->
-  * [Overview](#overview)
+* [Overview](#overview)
-  * [Component integration](#component-integration)
+* [Component integration](#component-integration)
-    * [Intercom Service (ICS)](#intercom-service-ics)
+  * [Intercom Service (ICS)](#intercom-service-ics)
-    * [Filepicker](#filepicker)
+  * [Filepicker](#filepicker)
-    * [Central Navigation](#central-navigation)
+  * [Central Navigation](#central-navigation)
-    * [(Read & write) Central contacts](#read--write-central-contacts)
+  * [(Read \& write) Central contacts](#read--write-central-contacts)
-    * [OpenProject Filestore](#openproject-filestore)
+  * [OpenProject Filestore](#openproject-filestore)
-  * [Identity data flows](#identity-data-flows)
+* [Identity data flows](#identity-data-flows)
-  * [Provisioning](#provisioning)
+* [Provisioning](#provisioning)
-  * [Component specific documentation](#component-specific-documentation)
+* [Component specific documentation](#component-specific-documentation)
-  * [Links to component docs](#links-to-component-docs)
+* [Links to component docs](#links-to-component-docs)
 <!-- TOC -->
 
-## Overview
+# Overview
 
 openDesk consists out of a variety of open-source projects. Here is a list with the description and type.
 
@@ -38,7 +38,6 @@ they need to be replaced in production deployments.
 | Element                     | Secure communications platform | Functional |
 | Intercom Service            | Cross service data exchange    | Functional |
 | Jitsi                       | Videoconferencing              | Functional |
-| Keycloak                    | Identity Provider              | Functional |
 | MariaDB                     | Database                       | Eval       |
 | Memcached                   | Cache Database                 | Eval       |
 | MinIO                       | Object Storage                 | Eval       |
@@ -49,18 +48,17 @@ they need to be replaced in production deployments.
 | Postfix                     | MTA                            | Eval       |
 | PostgreSQL                  | Database                       | Eval       |
 | Redis                       | Cache Database                 | Eval       |
-| Univention Corporate Server | Identity Management & Portal   | Functional |
+| Univention Management Stack | Identity Management & Portal   | Functional |
-| Univention Management Stack | Identity Management & Portal   | Eval       |
 | XWiki                       | Knowledgebase                  | Functional |
 
-## Component integration
+# Component integration
 
 Some use cases require inter component integration.
 
 ```mermaid
 flowchart TD
   OXAppSuiteFrontend-->|SilentLogin, Filepicker, CentralNavigation|IntercomService
-  IntercomService-->|SilentLogin, TokenExchange|Keycloak
+  IntercomService-->|SilentLogin, TokenExchange|IdP
   IntercomService-->|Filepicker|Nextcloud
   IntercomService-->|CentralNavigation|Portal
   OXAppSuiteBackend-->|Filepicker|Nextcloud
@@ -71,7 +69,7 @@ flowchart TD
   OXAppSuiteFrontend-->|Filepicker|OXAppSuiteBackend
 ```
 
-### Intercom Service (ICS)
+## Intercom Service (ICS)
 
 The UCS Intercom Service's role is to enable cross-application integration based on browser interaction.
 Handling authentication when the frontend of an application is using the API from another application is often a
@@ -84,7 +82,7 @@ login.
 Currently only OX AppSuite is using the frontend-based integration, and therefore it is right now the only consumer of
 the ICS API.
 
-### Filepicker
+## Filepicker
 
 The Nextcloud filepicker which is integrated into the OX AppSuite allows you to add attachments or links to files from
 and saving attachments to Nextcloud.
@@ -94,34 +92,33 @@ Frontend-based integration means that OX AppSuite in the browser is communicatin
 While using backend-based integration, OX AppSuite middleware is communicating with Nextcloud, which is especially used
 when adding a file to an email or storing a file into Nextcloud.
 
-### Central Navigation
+## Central Navigation
 
 Central navigation is based on an API endpoint in the portal that provides the contents of the portal for a user to
 allow components to render the menu showing all available SWP applications for the user.
 
-### (Read & write) Central contacts
+## (Read & write) Central contacts
 
 Open-Xchange App Suite is used to manage contacts within openDesk. There is an API in the AppSuite that is being used by
 Nextcloud to lookup contacts as well as to create contacts. This is maybe done when a file is shared with a not yet
 available personal contact.
 
-### OpenProject Filestore
+## OpenProject Filestore
 
 By default, Nextcloud is a configured option for storing attachments in OpenProject.
 The Filestore can be enabled on a per-project level in OpenProject's project admin section.
 
-
+# Identity data flows
-## Identity data flows
 
 An overview of
 - components that consume the LDAP service. Mostly by using a dedicated LDAP search account.
-- components using Keycloak as identity provider. If not otherwise denoted based on the OAuth2 / OIDC flows.
+- components using Univention Keycloak as identity provider (IdP). If not otherwise denoted based on the OAuth2 / OIDC flows.
 
 Some components trust others to handle authentication for them.
 
 ```mermaid
 flowchart TD
-    K[Keycloak]-->L[LDAP]
+    K[IdP]-->L[LDAP]
     N[Nextcloud]-->L
     O[OpenProject] --> L
     A[OX AppSuite]-->L
@@ -142,7 +139,7 @@ flowchart TD
     F[Postfix]-->D
 ```
 
-## Provisioning
+# Provisioning
 
 Currently, active provisioning is only done for OX AppSuite. The OX-Connector is synchronizing, creating, modifying and
 deleting activities for the following objects to the OX AppSuite using the AppSuite's SOAP API:
@@ -153,7 +150,7 @@ deleting activities for the following objects to the OX AppSuite using the AppSu
 - Functional Mailboxes
 - Resources
 
-## Component specific documentation
+# Component specific documentation
 
 We want to provide more information per component in separate, component-specific markdown file.
 To establish a common view on the components, we are going to cover various aspects:
@@ -173,6 +170,6 @@ To establish a common view on the components, we are going to cover various aspe
   - **Uninstall**: Documented and working complete uninstallation of the component.
 - **Debugging**: Some helpful information when it comes to debugging a component, e.g. setting log level.
 
-## Links to component docs
+# Links to component docs
 
 - [Intercom-Service](./components/intercom-service.md)

docs/external-services.md

@@ -8,12 +8,12 @@ SPDX-License-Identifier: Apache-2.0
 This document will cover the additional configuration to use external services like databases, caches or buckets.
 
 <!-- TOC -->
-  * [Database](#database)
+* [Database](#database)
-  * [Objectstore](#objectstore)
+* [Objectstore](#objectstore)
-  * [Cache](#cache)
+* [Cache](#cache)
 <!-- TOC -->
 
-## Database
+# Database
 
 When deploying this suite to production, you need to configure the applications to use your production grade database
 service.
@@ -72,7 +72,7 @@ service.
 |             |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
 |             |                    |            | Password  | `databases.xwiki.password`               |                            |
 
-## Objectstore
+# Objectstore
 
 When deploying this suite to production, you need to configure the applications to use your production grade objectstore
 service.
@@ -89,7 +89,7 @@ service.
 |             |             | Username        | `objectstores.openproject.username`      | `openproject_user` |
 |             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |
 
-## Cache
+# Cache
 
 When deploying this suite to production, you need to configure the applications to use your production grade cache
 service.

docs/getting-started.md

@@ -8,38 +8,38 @@ SPDX-License-Identifier: Apache-2.0
 This documentation should enable you to create your own evaluation instance of openDesk on your Kubernetes cluster.
 
 <!-- TOC -->
-  * [Requirements](#requirements)
+* [Requirements](#requirements)
-  * [Customize environment](#customize-environment)
+* [Customize environment](#customize-environment)
-    * [Domain](#domain)
+  * [Domain](#domain)
     * [Apps](#apps)
-    * [Private Image registry](#private-image-registry)
+  * [Private Image registry](#private-image-registry)
-    * [Private Helm registry](#private-helm-registry)
+  * [Private Helm registry](#private-helm-registry)
-    * [Cluster capabilities](#cluster-capabilities)
+  * [Cluster capabilities](#cluster-capabilities)
-      * [Service](#service)
+    * [Service](#service)
-      * [Networking](#networking)
+    * [Networking](#networking)
-      * [Ingress](#ingress)
+    * [Ingress](#ingress)
-      * [Container runtime](#container-runtime)
+    * [Container runtime](#container-runtime)
-      * [Volumes](#volumes)
+    * [Volumes](#volumes)
-    * [Connectivity](#connectivity)
+  * [Connectivity](#connectivity)
-      * [Mail/SMTP configuration](#mailsmtp-configuration)
+    * [Mail/SMTP configuration](#mailsmtp-configuration)
-      * [TURN configuration](#turn-configuration)
+    * [TURN configuration](#turn-configuration)
-      * [Certificate issuer](#certificate-issuer)
+    * [Certificate issuer](#certificate-issuer)
-    * [Password seed](#password-seed)
+  * [Password seed](#password-seed)
   * [Install](#install)
-    * [Install single app](#install-single-app)
+  * [Install single app](#install-single-app)
-    * [Install single release/chart](#install-single-releasechart)
+  * [Install single release/chart](#install-single-releasechart)
-  * [Access deployment](#access-deployment)
+* [Access deployment](#access-deployment)
-  * [Uninstall](#uninstall)
+* [Uninstall](#uninstall)
 <!-- TOC -->
 
 Thanks for looking into the openDesk Getting started guide. This documents covers essentials configuration steps to
 deploy openDesk onto your kubernetes infrastructure.
 
-## Requirements
+# Requirements
 
 Detailed system requirements are covered on [requirements](requirements.md) page.
 
-## Customize environment
+# Customize environment
 
 Before deploying openDesk, you have to configure the deployment to suit your environment.
 To keep your deployment up to date, we recommend customizing in `dev`, `test` or `prod` and not in `default` environment
@@ -50,9 +50,9 @@ files.
 For the following guide, we will use `dev` as environment, where variables can be set in
 `helmfile/environments/dev/values.yaml`.
 
-### Domain
+## Domain
 
-The deployment is designed to deploy each app under a subdomains. For your convenience, we recommend to create a 
+The deployment is designed to deploy each app under a subdomains. For your convenience, we recommend to create a
 `*.domain.tld` A-Record to your cluster ingress controller, otherwise you need to create an A-Record for each subdomain.
 
 A list of all subdomains can be found in `helmfile/environments/default/global.yaml`.
@@ -107,7 +107,6 @@ All available apps and their default value can be found in `helmfile/environment
 | Element                     | `element.enabled`                   | `true`  | Secure communications platform |
 | Intercom Service            | `intercom.enabled`                  | `true`  | Cross service data exchange    |
 | Jitsi                       | `jitsi.enabled`                     | `true`  | Videoconferencing              |
-| Keycloak                    | `keycloak.enabled`                  | `true`  | Identity Provider              |
 | MariaDB                     | `mariadb.enabled`                   | `true`  | Database                       |
 | Memcached                   | `memcached.enabled`                 | `true`  | Cache Database                 |
 | MinIO                       | `minio.enabled`                     | `true`  | Object Storage                 |
@@ -118,8 +117,7 @@ All available apps and their default value can be found in `helmfile/environment
 | Postfix                     | `postfix.enabled`                   | `true`  | MTA                            |
 | PostgreSQL                  | `postgresql.enabled`                | `true`  | Database                       |
 | Redis                       | `redis.enabled`                     | `true`  | Cache Database                 |
-| Univention Corporate Server | `univentionCorporateServer.enabled` | `true`  | Identity Management & Portal   |
+| Univention Management Stack | `univentionManagementStack.enabled` | `true`  | Identity Management & Portal   |
-| Univention Management Stack | `univentionManagementStack.enabled` | `false` | Identity Management & Portal   |
 | XWiki                       | `xwiki.enabled`                     | `true`  | Knowledgebase                  |
 
 Exemplary, Jitsi can be disabled like:
@@ -129,7 +127,7 @@ jitsi:
   enabled: false
 ```
 
-### Private Image registry
+## Private Image registry
 
 By default, all OCI artifacts are proxied via the project's image registry, which should get replaced soon by the
 OCI registries provided by Open CoDE.
@@ -154,7 +152,7 @@ global:
     - "external-registry"
 ```
 
-### Private Helm registry
+## Private Helm registry
 
 Some apps use OCI style registry and some use Helm chart museum style registries.
 In `helmfile/environments/default/charts.yaml` you can find all helm charts used and modify their registry, repository
@@ -181,10 +179,9 @@ The following environment variables have to be exposed when using the example:
 | `OD_PRIVATE_HELM_REGISTRY_USERNAME` | Username                                                                                   |
 | `OD_PRIVATE_HELM_REGISTRY_PASSWORD` | Password                                                                                   |
 
+## Cluster capabilities
 
-### Cluster capabilities
+### Service
-
-#### Service
 
 Some apps, like Jitsi or Dovecot, require HTTP and external TCP connections.
 These apps create a Kubernetes service object.
@@ -197,7 +194,7 @@ cluster:
     type: "NodePort"
 ```
 
-#### Networking
+### Networking
 
 If your cluster has not the default `cluster.local` domain configured, you need to provide the domain via:
 
@@ -215,7 +212,7 @@ cluster:
     cidr: "127.0.0.0/8"
 ```
 
-#### Ingress
+### Ingress
 
 By default, the `ingressClassName` is empty to choose your default ingress controller, you may want to customize it by
 setting:
@@ -225,7 +222,7 @@ ingress:
   ingressClassName: "cilium"
 ```
 
-#### Container runtime
+### Container runtime
 
 Some apps require specific configuration for container runtimes. You can set your container runtime like `cri-o`,
 `containerd` or `docker` by:
@@ -236,7 +233,7 @@ cluster:
     engine: "containerd"
 ```
 
-#### Volumes
+### Volumes
 
 When your cluster has a `ReadWriteMany` volume provisioner, you can benefit from distributed or scaling of apps. By
 default, only `ReadWriteOnce` is enabled. To enable `ReadWriteMany` you can set:
@@ -256,9 +253,9 @@ persistence:
     RWO: "my-read-write-once-class"
 ```
 
-### Connectivity
+## Connectivity
 
-#### Mail/SMTP configuration
+### Mail/SMTP configuration
 
 To use the full potential of the openDesk, you need to set up an SMTP Smarthost/Relay which allows to send emails from
 the whole subdomain.
@@ -270,7 +267,7 @@ smtp:
   password: "secret"
 ```
 
-#### TURN configuration
+### TURN configuration
 
 Some components (Jitsi, Element) use for direct communication a TURN server. You can configure your own TURN server with
 these options:
@@ -287,7 +284,7 @@ turn:
     port: "5349"
 ```
 
-#### Certificate issuer
+### Certificate issuer
 
 As mentioned in [requirements](requirements.md#certificate-management) you can provide your own valid certificate. A TLS
 secret with name `opendesk-certificates-tls` needs to be present in application namespace. For deployment, you can
@@ -314,9 +311,9 @@ certificate:
   wildcard: true
 ```
 
-### Password seed
+## Password seed
 
-All secrets are generated from a single master password via Master Password (algorithm). 
+All secrets are generated from a single master password via Master Password (algorithm).
 To prevent others from using your openDesk instance, we highly recommend setting an individual master password via:
 
 ```shell
@@ -338,7 +335,7 @@ helmfile apply -e dev -n <NAMESPACE> [-l <label>] [--suppress-diff]
 - `-l <label>`: Label selector
 - `--suppress-diff`: Disable diff printing
 
-### Install single app
+## Install single app
 
 You can also install or upgrade only a single app like Collabora, either by label selector:
 
@@ -353,7 +350,7 @@ cd helmfile/apps/collabora
 helmfile apply -e dev -n <NAMESPACE>
 ```
 
-### Install single release/chart
+## Install single release/chart
 
 Instead of iteration through all services, you can also deploy a single release like mariadb by:
 
@@ -361,7 +358,7 @@ Instead of iteration through all services, you can also deploy a single release
 helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
 ```
 
-## Access deployment
+# Access deployment
 
 When all apps are successfully deployed and pod status' went to `Running` or `Succeeded`, you can navigate to
 
@@ -369,7 +366,7 @@ When all apps are successfully deployed and pod status' went to `Running` or `Su
 https://portal.domain.tld
 ```
 
-If you change the subdomain of `univentionCorporateServer` or `univentionManagementStack`, you need to replace `portal`
+If you change the subdomain of `univentionManagementStack`, you need to replace `portal`
 by your specified subdomain.
 
 **Credentials:**
@@ -378,20 +375,13 @@ by your specified subdomain.
 # Replace with your namespace
 NAMESPACE=your-namespace
 
-# Get UCS container, which contains passwords as env var.
+# Get credentials from ConfigMap
-CONTAINER=$(kubectl -n ${NAMESPACE} get po -l app.kubernetes.io/name=univention-corporate-container -o jsonpath='{.items[0].metadata.name}')
+kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}' \
-# $ kubectl -n ${NAMESPACE} get po -l app.kubernetes.io/name=univention-corporate-container
+  | yq '.properties.username,.properties.password'
-#
+# default.user
-# NAME                                              READY   STATUS    RESTARTS   AGE
-# univention-corporate-container-8665c6f8b7-nlhc6   1/1     Running   0          10m
-
-
-# Password of `default.user`
-kubectl -n ${NAMESPACE} get po ${CONTAINER} -o=jsonpath='{.spec.containers[0].env[?(@.name=="DEFAULT_ACCOUNT_USER_PASSWORD")].value}'
 # 40615..............................e9e2f
-
+# ---
-# Password of `default.admin`
+# default.admin
-kubectl -n ${NAMESPACE} get po ${CONTAINER} -o=jsonpath='{.spec.containers[0].env[?(@.name=="DEFAULT_ACCOUNT_ADMIN_PASSWORD")].value}'
 # bdbbb..............................04db6
 ```
 
@@ -402,7 +392,7 @@ Now you can log in with obtained credentials:
 | `default.user`  | `40615..............................e9e2f` | Application user |
 | `default.admin` | `bdbbb..............................04db6` | Administrator    |
 
-## Uninstall
+# Uninstall
 
 You can uninstall the deployment by:
 

docs/monitoring.md

@@ -9,15 +9,15 @@ This document will cover how you can enable observability with Prometheus based
 well as the overall status of monitoring integration.
 
 <!-- TOC -->
-  * [Technology](#technology)
+* [Technology](#technology)
-  * [Defaults](#defaults)
+* [Defaults](#defaults)
-  * [Metrics](#metrics)
+* [Metrics](#metrics)
-  * [Alerts](#alerts)
+* [Alerts](#alerts)
-  * [Dashboards for Grafana](#dashboards-for-grafana)
+* [Dashboards for Grafana](#dashboards-for-grafana)
-  * [Components](#components)
+* [Components](#components)
 <!-- TOC -->
 
-## Technology
+# Technology
 
 We provide integration into the Prometheus based monitoring.
 Together with
@@ -27,12 +27,12 @@ easily leverage the full potential of open-source cloud-native observability sta
 Before enabling the following options, you need to install the respective CRDs from the kube-prometheus-stack
 repository or prometheus operator.
 
-## Defaults
+# Defaults
 
 All configurable options and their defaults can be found in
 [`monitoring.yaml`](../helmfile/environments/default/monitoring.yaml).
 
-## Metrics
+# Metrics
 
 To deploy podMonitor and serviceMonitor custom resources, enable it by:
 
@@ -44,7 +44,7 @@ prometheus:
     enabled: true
 ```
 
-## Alerts
+# Alerts
 
 Some helm-charts provide a default set of prometheusRules for alerting, enable it by:
 
@@ -54,7 +54,7 @@ prometheus:
     enabled: true
 ```
 
-## Dashboards for Grafana
+# Dashboards for Grafana
 
 To deploy optional ConfigMaps with Grafana dashboards, enable it by:
 
@@ -64,7 +64,8 @@ grafana:
     enabled: true
 ```
 
-## Components
+# Components
+
 | Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
 |:----------|-----------------------------------|-------------------------|---------------------|
 | Collabora | :white_check_mark:                | :white_check_mark:      | :white_check_mark:  |

docs/requirements.md

@@ -7,17 +7,17 @@ SPDX-License-Identifier: Apache-2.0
 This section covers the internal system requirements as well as external service requirements for productive use.
 
 <!-- TOC -->
-  * [TL;DR;](#tldr)
+* [TL;DR;](#tldr)
-  * [Hardware](#hardware)
+* [Hardware](#hardware)
-  * [Kubernetes](#kubernetes)
+* [Kubernetes](#kubernetes)
-  * [Ingress controller](#ingress-controller)
+* [Ingress controller](#ingress-controller)
-  * [Volume provisioner](#volume-provisioner)
+* [Volume provisioner](#volume-provisioner)
-  * [Certificate management](#certificate-management)
+* [Certificate management](#certificate-management)
-  * [External services](#external-services)
+* [External services](#external-services)
-  * [Deployment](#deployment)
+* [Deployment](#deployment)
 <!-- TOC -->
 
-## TL;DR;
+# TL;DR;
 openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s) cluster.
 
 - K8s cluster >= 1.24, [CNCF Certified Kubernetes Distro](https://www.cncf.io/certification/software-conformance/)
@@ -30,7 +30,7 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)
 - Certificate handling with [cert-manager](https://cert-manager.io/)
 - [Istio](https://istio.io/) is currently required to deploy and operate OX AppSuite8
 
-## Hardware
+# Hardware
 
 The following minimal requirements are thought for initial evaluation deployment:
 
@@ -40,7 +40,7 @@ The following minimal requirements are thought for initial evaluation deployment
 | RAM  | 16 GB, recommended 32 GB                             |
 | Disk | HDD or SSD, >10 GB                                   |
 
-## Kubernetes
+# Kubernetes
 
 Any self-hosted or managed K8s cluster >= 1.24 listed in
 [CNCF Certified Kubernetes Distros](https://www.cncf.io/certification/software-conformance/) should be supported.
@@ -49,7 +49,7 @@ The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/
 
 > **Note:** The deployment is not tested against OpenShift.
 
-## Ingress controller
+# Ingress controller
 
 The deployment is intended to use only over HTTPS via a configured FQDN, therefor it is required to have a proper
 configured ingress controller deployed.
@@ -63,14 +63,14 @@ configured ingress controller deployed.
 
 When you want to use Open-Xchange Appsuite 8, you need to deploy and configure additionally [Istio](https://istio.io/)
 
-## Volume provisioner
+# Volume provisioner
 
 Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment a local- or hostPath-
 provisioner is sufficient.
 
 > **Note:** Some components requiring a `ReadWriteMany` volume provisioner for distributed mode or scaling.
 
-## Certificate management
+# Certificate management
 
 This deployment leverages [cert-manager](https://cert-manager.io/) to generate valid certificates. This is **optional**,
 but a secret containing a valid TLS certificate is required.
@@ -78,16 +78,16 @@ but a secret containing a valid TLS certificate is required.
 Only `Certificate` resources will be deployed, the `cert-manager` including its CRD must be installed prior to this or
 openDesk certificate management disabled.
 
-## External services
+# External services
 
 Evaluation the openDesk deployment does not require any external service to start, but features may be limited.
 
 
-| Group    | Type                | Version | Tested against        | 
+| Group    | Type                | Version | Tested against        |
-|----------|---------------------|---------|-----------------------| 
+|----------|---------------------|---------|-----------------------|
-| Cache    | Memached            | `1.6.x` | Memached              | 
+| Cache    | Memached            | `1.6.x` | Memached              |
-|          | Redis               | `7.x.x` | Redis                 | 
+|          | Redis               | `7.x.x` | Redis                 |
-| Database | MariaDB             | `10.x`  | MariaDB               | 
+| Database | MariaDB             | `10.x`  | MariaDB               |
 |          | PostgreSQL          | `15.x`  | PostgreSQL            |
 | Mail     | Mail Transfer Agent |         | Postfix               |
 |          | PKI/CI (SMIME)      |         |                       |
@@ -97,7 +97,7 @@ Evaluation the openDesk deployment does not require any external service to star
 |          | Object Storage      |         | MinIO                 |
 | Voice    | TURN                |         | Coturn                |
 
-## Deployment
+# Deployment
 
 The deployment of each individual component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
 templated via [Helmfile](https://helmfile.readthedocs.io/en/latest/) to provide a streamlined deployment experience.

docs/scaling.md

@@ -8,10 +8,10 @@ SPDX-License-Identifier: Apache-2.0
 This document should cover the abilities to scale apps.
 
 <!-- TOC -->
-  * [Replicas](#replicas)
+* [Replicas](#replicas)
 <!-- TOC -->
 
-## Replicas
+# Replicas
 
 The Replicas can be increased of almost any component, but is only effective for high-availability or load-balancing for
 apps with a check-mark in `Scaling (effective)` column.
@@ -47,6 +47,6 @@ marked with a gear.
 | Keycloak    | `replicas.keycloak`                      | :white_check_mark:  |       :gear:       |
 | Minio       | `replicas.minioDistributed`              | :white_check_mark:  | :white_check_mark: |
 | Nextcloud   | `replicas.nextcloud`                     | :white_check_mark:  |       :gear:       |
-| OpenProject | `replicas.openproject`                   | :white_check_mark:  |       :gear:       |
+| OpenProject | `replicas.openproject`                   | :white_check_mark:  | :white_check_mark: |
 | Postfix     | `replicas.postfix`                       |         :x:         |       :gear:       |
-| XWiki       | `replicas.xwiki`                         | :white_check_mark:  |       :gear:       |
+| XWiki       | `replicas.xwiki`                         |         :x:         |       :gear:       |

docs/security.md

@@ -8,12 +8,12 @@ SPDX-License-Identifier: Apache-2.0
 This document should cover the current status of security measurements.
 
 <!-- TOC -->
-  * [Helm Chart Trust Chain](#helm-chart-trust-chain)
+* [Helm Chart Trust Chain](#helm-chart-trust-chain)
-  * [Kubernetes Security Enforcements](#kubernetes-security-enforcements)
+* [Kubernetes Security Enforcements](#kubernetes-security-enforcements)
-  * [NetworkPolicies](#networkpolicies)
+* [NetworkPolicies](#networkpolicies)
 <!-- TOC -->
 
-## Helm Chart Trust Chain
+# Helm Chart Trust Chain
 
 Helm Charts which are released via openDesk CI/CD process are always signed. The public GPG keys are present in
 `pubkey.gpg` file and are validated during helmfile installation.
@@ -28,7 +28,6 @@ Helm Charts which are released via openDesk CI/CD process are always signed. The
 | istio-resources-repo                 | yes | :white_check_mark: |
 | jitsi-repo                           | yes | :white_check_mark: |
 | keycloak-extensions-repo             | no  |        :x:         |
-| keycloak-theme-repo                  | yes | :white_check_mark: |
 | mariadb-repo                         | yes | :white_check_mark: |
 | nextcloud-repo                       | no  |        :x:         |
 | opendesk-certificates-repo           | yes | :white_check_mark: |
@@ -42,66 +41,80 @@ Helm Charts which are released via openDesk CI/CD process are always signed. The
 | ox-connector-repo                    | no  |        :x:         |
 | postfix-repo                         | yes | :white_check_mark: |
 | postgresql-repo                      | yes | :white_check_mark: |
-| univention-corporate-container-repo  | yes | :white_check_mark: |
 | ums-repo                             | no  |        :x:         |
+| univention-keycloak-repo             | yes | :white_check_mark: |
+| univention-keycloak-bootstrap-repo   | yes | :white_check_mark: |
 | xwiki-repo                           | no  |        :x:         |
 
-## Kubernetes Security Enforcements
+# Kubernetes Security Enforcements
 
 This list gives you an overview of default security settings and if they comply with security standards:
 
 
-| Component       | Process                        |         =          | allowPrivilegeEscalation (`false`) |                                                           capabilities (`drop: ALL`)                                                           | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
+| Component                   | Process                      |         =          | allowPrivilegeEscalation (`false`) |                                                           capabilities (`drop: ALL`)                                                           | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
-|-----------------|--------------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
+|-----------------------------|------------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
-| ClamAV          | clamd                          | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+| ClamAV                      | clamd                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-|                 | freshclam                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+|                             | freshclam                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-|                 | icap                           | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+|                             | icap                         | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-|                 | milter                         | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
+|                             | milter                       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    100    |    101     |   101   |
-| Collabora       | collabora                      |        :x:         |                :x:                 | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   100   |
+| Collabora                   | collabora                    |        :x:         |                :x:                 | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   100   |
-| CryptPad        | npm                            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   4001    |    4001    |  4001   |
+| CryptPad                    | npm                          |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   4001    |    4001    |  4001   |
-| Dovecot         | dovecot                        |        :x:         |         :white_check_mark:         |                          :x: (`CHOWN`, `DAC_OVERRIDE`, `KILL`, `NET_BIND_SERVICE`, `SETGID`, `SETUID`, `SYS_CHROOT`)                           |        :white_check_mark:         |       :white_check_mark:        |          :x:          |     -     |     -      |  1000   |
+| Dovecot                     | dovecot                      |        :x:         |         :white_check_mark:         |                          :x: (`CHOWN`, `DAC_OVERRIDE`, `KILL`, `NET_BIND_SERVICE`, `SETGID`, `SETUID`, `SYS_CHROOT`)                           |        :white_check_mark:         |       :white_check_mark:        |          :x:          |     -     |     -      |  1000   |
-| Element         | element                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
+| Element                     | element                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
-|                 | synapse                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   10991   |     -      |  10991  |
+|                             | synapse                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   10991   |     -      |  10991  |
-|                 | synapseWeb                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
+|                             | synapseWeb                   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
-|                 | wellKnown                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
+|                             | wellKnown                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |    101    |    101     |   101   |
-| IntercomService | intercom-service               | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
+| IntercomService             | intercom-service             | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-| Jitsi           | jibri                          |        :x:         |                :x:                 |                                                               :x: (`SYS_ADMIN`)                                                                |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+| Jitsi                       | jibri                        |        :x:         |                :x:                 |                                                               :x: (`SYS_ADMIN`)                                                                |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                 | jicofo                         |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | jicofo                       |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                 | jitsiKeycloakAdapter           | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1993    |    1993    |    -    |
+|                             | jitsiKeycloakAdapter         | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1993    |    1993    |    -    |
-|                 | jvb                            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | jvb                          |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                 | prosody                        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | prosody                      |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                 | web                            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | web                          |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-| Keycloak        | keycloak                       |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   1001    |    1001    |  1001   |
+| MariaDB                     | mariadb                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
-|                 | keycloakConfigCli              | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+| Memcached                   | memcached                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |     -      |  1001   |
-|                 | keycloakExtensionHandler       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+| Minio                       | minio                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-|                 | keycloakExtensionProxy         | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+| Nextcloud                   | nextcloud                    |        :x:         |         :white_check_mark:         |                                                  :x: (`NET_BIND_SERVICE`, `SETGID`, `SETUID`)                                                  |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   33    |
-| MariaDB         | mariadb                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+|                             | nextcloud-cron               |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   33    |
-| Memcached       | memcached                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |     -      |  1001   |
+|                             | opendesk-nextcloud-bootstrap |        :x:         |         :white_check_mark:         |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   33    |
-| Minio           | minio                          | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
+| Open-Xchange                | core-documentconverter       |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    987    |    1000    |    -    |
-| Nextcloud       | nextcloud                      |        :x:         |         :white_check_mark:         |                                                  :x: (`NET_BIND_SERVICE`, `SETGID`, `SETUID`)                                                  |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   33    |
+|                             | core-guidedtours             | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                 | nextcloud-cron                 |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   33    |
+|                             | core-imageconverter          |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    987    |    1000    |    -    |
-|                 | opendesk-nextcloud-bootstrap   |        :x:         |         :white_check_mark:         |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   33    |
+|                             | core-mw-default              |        :x:         |                :x:                 |                                                                      :x:                                                                       |                :x:                |               :x:               |          :x:          |     -     |     -      |    -    |
-| Open-Xchange    | core-documentconverter         |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    987    |    1000    |    -    |
+|                             | core-ui                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                 | core-guidedtours               | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                             | core-ui-middleware           | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                 | core-imageconverter            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    987    |    1000    |    -    |
+|                             | core-ui-middleware-updater   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                 | core-mw-default                |        :x:         |                :x:                 |                                                                      :x:                                                                       |                :x:                |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | core-user-guide              | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                 | core-ui                        | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                             | gotenberg                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                 | core-ui-middleware             | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                             | guard-ui                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                 | core-ui-middleware-updater     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                             | nextlcoud-integration-ui     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                 | core-user-guide                | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                             | public-sector-ui             | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-|                 | gotenberg                      | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+| OpenProject                 | openproject                  | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-|                 | guard-ui                       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+|                             | opendeskOpenprojectBootstrap | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
-|                 | nextlcoud-integration-ui       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+| Postfix                     | postfix                      |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   |
-|                 | public-sector-ui               | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
+| PostgreSQL                  | postgresql                   | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
-| OpenProject     | openproject                    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
+| Redis                       | redis                        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |     0      |  1001   |
-| Postfix         | postfix                        |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   |
+| Univention Management Stack | keycloak                     |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   1000    |    1000    |  1000   |
-| PostgreSQL      | postgresql                     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+|                             | keycloakBootstrap            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |   1000    |    1000    |  1000   |
-| Redis           | redis                          |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |     0      |  1001   |
+|                             | keycloakExtensionHandler     | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-| UCC             | univention-corporate-container |        :x:         |                :x:                 |                                                                      :x:                                                                       |                :x:                |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | keycloakExtensionProxy       | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |    -    |
-| XWiki           | xwiki                          |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   101   |
+|                             | ldap-notifier                |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
-|                 | xwiki initContainers           |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   | 
+|                             | ldap-server                  |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | notifications-api            |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | opendeskKeycloakBootstrap    | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1000    |    1000    |  1000   |
+|                             | portal-frontend              |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | portal-listener              |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | portal-server                |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | selfservice-listener         |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | stack-gateway                | :white_check_mark: |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |       :white_check_mark:        |  :white_check_mark:   |   1001    |    1001    |  1001   |
+|                             | store-dav                    |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | udm-rest-api                 |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | umc-gateway                  |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+|                             | umc-server                   |        :x:         |         :white_check_mark:         |     :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`)      |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |    -    |
+| XWiki                       | xwiki                        |        :x:         |         :white_check_mark:         |                                                               :white_check_mark:                                                               |        :white_check_mark:         |               :x:               |  :white_check_mark:   |    100    |    101     |   101   |
+|                             | xwiki initContainers         |        :x:         |                :x:                 |                                                                      :x:                                                                       |        :white_check_mark:         |               :x:               |          :x:          |     -     |     -      |   101   |
 
-## NetworkPolicies
+# NetworkPolicies
 
 Kubernetes NetworkPolicies are an important measure to secure your kubernetes apps and clusters.
 When applied, they restrict the traffic to your services.

docs/theming.md

@@ -8,13 +8,13 @@ SPDX-License-Identifier: Apache-2.0
 This document will cover the theming and customization of your openDesk deployment.
 
 <!-- TOC -->
-  * [Strings and texts](#strings-and-texts)
+* [Strings and texts](#strings-and-texts)
-  * [Colors](#colors)
+* [Colors](#colors)
   * [Images and Logos](#images-and-logos)
-  * [Known limits](#known-limits)
+* [Known limits](#known-limits)
 <!-- TOC -->
 
-## Strings and texts
+# Strings and texts
 
 The deployment name can be changed by:
 
@@ -24,7 +24,7 @@ theme:
     productName: "openDesk Cloud"
 ```
 
-## Colors
+# Colors
 
 The primary color and their derivates with lesser opacity be customized by:
 
@@ -50,10 +50,10 @@ theme:
     faviconIco: "..."
 ```
 
-## Known limits
+# Known limits
 
 Not all applications support theming. Known exceptions are:
-  - Univention Corporate Container (should be superseded by the Univention Management Stack which has planned support 
+  - Univention Corporate Container (should be superseded by the Univention Management Stack which has planned support
     for theming through the deployment).
   - OpenProject
   - Jitsi

examples/private-helm-registry.yaml.gotmpl

@@ -59,26 +59,26 @@ charts:
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
 
-  keycloak:
+  umsKeycloak:
    registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
 
-  keycloakBootstrap:
+  umsKeycloakBootstrap:
    registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
 
-  keycloakExtensions:
+  opendeskKeycloakBootstrap:
+   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
+    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
+
+  umsKeycloakExtensions:
     registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
 
-  keycloakTheme:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
   mariadb:
     registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
@@ -254,11 +254,6 @@ charts:
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
 
-  univentionCorporateServer:
-   registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
-    username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
-
   xwiki:
     registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
     username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}

helmfile.yaml

@@ -7,10 +7,7 @@
 helmfiles:
   # Path to the helmfile state file being processed BEFORE releases in this state file
   - path: "helmfile/apps/services/helmfile.yaml"
-  - path: "helmfile/apps/keycloak/helmfile.yaml"
-  - path: "helmfile/apps/univention-corporate-container/helmfile.yaml"
   - path: "helmfile/apps/univention-management-stack/helmfile.yaml"
-  - path: "helmfile/apps/keycloak-bootstrap/helmfile.yaml"
   - path: "helmfile/apps/intercom-service/helmfile.yaml"
   - path: "helmfile/apps/open-xchange/helmfile.yaml"
   - path: "helmfile/apps/nextcloud/helmfile.yaml"

helmfile/apps/collabora/helmfile.yaml

@@ -8,8 +8,9 @@ repositories:
   # Collabora Online
   # Source: https://github.com/CollaboraOnline/online
   - name: "collabora-online-repo"
-    username: "{{ .Values.charts.collabora.username }}"
+    username: {{ .Values.charts.collabora.username | quote }}
     password: {{ .Values.charts.collabora.password | quote }}
+    oci: {{ .Values.charts.collabora.oci }}
     url: "{{ .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
 
 releases:

helmfile/apps/cryptpad/helmfile.yaml

@@ -8,8 +8,9 @@ repositories:
   # CryptPad
   # Source: https://github.com/cryptpad/helm
   - name: "cryptpad-repo"
-    username: "{{ .Values.charts.cryptpad.username }}"
+    username: {{ .Values.charts.cryptpad.username | quote }}
     password: {{ .Values.charts.cryptpad.password | quote }}
+    oci: {{ .Values.charts.cryptpad.oci }}
     url: "{{ .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
 
 releases:

helmfile/apps/element/helmfile.yaml

@@ -8,77 +8,77 @@ repositories:
   # openDesk Element
   # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/sovereign-workplace-element
   - name: "element-repo"
-    oci: true
+    oci: {{ .Values.charts.element.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.element.verify }}
-    username: "{{ .Values.charts.element.username }}"
+    username: {{ .Values.charts.element.username | quote }}
     password: {{ .Values.charts.element.password | quote }}
     url: "{{ .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
   - name: "element-well-known-repo"
-    oci: true
+    oci: {{ .Values.charts.elementWellKnown.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.element.verify }}
+    verify: {{ .Values.charts.elementWellKnown.verify }}
-    username: "{{ .Values.charts.elementWellKnown.username }}"
+    username: {{ .Values.charts.elementWellKnown.username | quote }}
     password: {{ .Values.charts.elementWellKnown.password | quote }}
     url: "{{ .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
   - name: "synapse-web-repo"
-    oci: true
+    oci: {{ .Values.charts.synapseWeb.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.element.verify }}
+    verify: {{ .Values.charts.synapseWeb.verify }}
-    username: "{{ .Values.charts.synapseWeb.username }}"
+    username: {{ .Values.charts.synapseWeb.username | quote }}
     password: {{ .Values.charts.synapseWeb.password | quote }}
     url: "{{ .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
   - name: "synapse-repo"
-    oci: true
+    oci: {{ .Values.charts.synapse.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.element.verify }}
+    verify: {{ .Values.charts.synapse.verify }}
-    username: "{{ .Values.charts.synapse.username }}"
+    username: {{ .Values.charts.synapse.username | quote }}
     password: {{ .Values.charts.synapse.password | quote }}
     url: "{{ .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
   - name: "synapse-create-account-repo"
-    oci: true
+    oci: {{ .Values.charts.synapseCreateAccount.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.element.verify }}
+    verify: {{ .Values.charts.synapseCreateAccount.verify }}
-    username: "{{ .Values.charts.synapseCreateAccount.username }}"
+    username: {{ .Values.charts.synapseCreateAccount.username | quote }}
     password: {{ .Values.charts.synapseCreateAccount.password | quote }}
     url: "{{ .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
 
   # openDesk Matrix Widgets
   # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/opendesk-matrix-widgets
   - name: "matrix-user-verification-service-repo"
-    oci: true
+    oci: {{ .Values.charts.matrixUserVerificationService.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.matrixUserVerificationService.verify }}
-    username: "{{ .Values.charts.matrixUserVerificationService.username }}"
+    username: {{ .Values.charts.matrixUserVerificationService.username | quote }}
     password: {{ .Values.charts.matrixUserVerificationService.password | quote }}
     url: "{{ .Values.charts.matrixUserVerificationService.registry }}/\
       {{ .Values.charts.matrixUserVerificationService.repository }}"
   - name: "matrix-neoboard-widget-repo"
-    oci: true
+    oci: {{ .Values.charts.matrixNeoboardWidget.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
-    username: "{{ .Values.charts.matrixNeoboardWidget.username }}"
+    username: {{ .Values.charts.matrixNeoboardWidget.username | quote }}
     password: {{ .Values.charts.matrixNeoboardWidget.password | quote }}
     url: "{{ .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
   - name: "matrix-neochoice-widget-repo"
-    oci: true
+    oci: {{ .Values.charts.matrixNeoboardWidget.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
-    username: "{{ .Values.charts.matrixNeoboardWidget.username }}"
+    username: {{ .Values.charts.matrixNeoboardWidget.username | quote }}
     password: {{ .Values.charts.matrixNeoboardWidget.password | quote }}
     url: "{{ .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
   - name: "matrix-neodatefix-widget-repo"
-    oci: true
+    oci: {{ .Values.charts.matrixNeodatefixWidget.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
-    username: "{{ .Values.charts.matrixNeodatefixWidget.username }}"
+    username: {{ .Values.charts.matrixNeodatefixWidget.username | quote }}
     password: {{ .Values.charts.matrixNeodatefixWidget.password | quote }}
     url: "{{ .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
   - name: "matrix-neodatefix-bot-repo"
-    oci: true
+    oci: {{ .Values.charts.matrixNeodatefixBot.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
-    username: "{{ .Values.charts.matrixNeodatefixBot.username }}"
+    username: {{ .Values.charts.matrixNeodatefixBot.username | quote }}
     password: {{ .Values.charts.matrixNeodatefixBot.password | quote }}
     url: "{{ .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
 

helmfile/apps/element/values-element.gotmpl

@@ -13,15 +13,15 @@ global:
 
 configuration:
   additionalConfiguration:
-    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
+    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
 
     "net.nordeck.element_web.module.opendesk":
       config:
         banner:
           ics_navigation_json_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/navigation.json"
           ics_silent_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/silent"
-          portal_logo_svg_url: "https://{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
+          portal_logo_svg_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
-          portal_url: "https://{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}/"
+          portal_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/"
         custom_css_variables:
           --cpd-color-text-action-accent: {{ .Values.theme.colors.primary | quote }}
         widget_types:

helmfile/apps/element/values-synapse.gotmpl

@@ -38,7 +38,7 @@ configuration:
 
     oidc:
       clientSecret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
-      issuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap"
+      issuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
 
     turn:
       sharedSecret: {{ .Values.turn.credentials | quote }}

helmfile/apps/element/values-synapse.yaml

@@ -25,6 +25,8 @@ configuration:
   homeserver:
     guestModule:
       enabled: true
+    oidc:
+      clientId: "opendesk-matrix"
 
 containerSecurityContext:
   allowPrivilegeEscalation: false

helmfile/apps/intercom-service/helmfile.yaml

@@ -8,10 +8,10 @@ repositories:
   # Intercom Service
   # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
   - name: "intercom-service-repo"
-    oci: true
+    oci: {{ .Values.charts.intercomService.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.intercomService.verify }}
-    username: "{{ .Values.charts.intercomService.username }}"
+    username: {{ .Values.charts.intercomService.username | quote }}
     password: {{ .Values.charts.intercomService.password | quote }}
     url: "{{ .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
 

helmfile/apps/intercom-service/values.gotmpl

@@ -13,8 +13,10 @@ global:
 
 ics:
   secret: {{ .Values.secrets.intercom.secret | quote }}
-  issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap"
+  issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
   originRegex: "{{ .Values.istio.domain }}|{{ .Values.global.domain }}"
+  keycloak:
+    realm: {{ .Values.platform.realm | quote }}
   default:
     domain: {{ .Values.global.domain | quote }}
   oidc:
@@ -33,7 +35,9 @@ ics:
     password: {{ .Values.cache.intercomService.password | default .Values.secrets.redis.password | quote }}
   openxchange:
     url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
-
+    audience: "opendesk-oxappsuite"
+  nextcloud:
+    audience: "opendesk-nextcloud"
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   repository: {{ .Values.images.intercom.repository | quote }}

helmfile/apps/intercom-service/values.yaml

@@ -1,6 +1,11 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
+
+ics:
+  oidc:
+    id: "opendesk-intercom"
+
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:

helmfile/apps/jitsi/helmfile.yaml

@@ -8,10 +8,10 @@ repositories:
   # openDesk Jitsi
   # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-jitsi
   - name: "jitsi-repo"
-    oci: true
+    oci: {{ .Values.charts.jitsi.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.jitsi.verify }}
-    username: "{{ .Values.charts.jitsi.username }}"
+    username: {{ .Values.charts.jitsi.username | quote }}
     password: {{ .Values.charts.jitsi.password | quote }}
     url: "{{ .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
 

helmfile/apps/jitsi/values-jitsi.gotmpl

@@ -22,6 +22,8 @@ image:
 
 settings:
   jwtAppSecret: {{ .Values.secrets.jitsi.jwtAppSecret | quote }}
+  keycloakRealm: {{ .Values.platform.realm | quote }}
+  keycloakClientId: "opendesk-jitsi"
 
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}

helmfile/apps/keycloak-bootstrap/helmfile.yaml

@@ -1,32 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-repositories:
-  # openDesk Keycloak Bootstrap
-  # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-keycloak-bootstrap
-  - name: "opendesk-keycloak-bootstrap-repo"
-    oci: true
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.keycloakBootstrap.verify }}
-    username: "{{ .Values.charts.keycloakBootstrap.username }}"
-    password: {{ .Values.charts.keycloakBootstrap.password | quote }}
-    url: "{{ .Values.charts.keycloakBootstrap.registry }}/{{ .Values.charts.keycloakBootstrap.repository }}"
-
-releases:
-  - name: "opendesk-keycloak-bootstrap"
-    chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.keycloakBootstrap.name }}"
-    version: "{{ .Values.charts.keycloakBootstrap.version }}"
-    values:
-      - "values-bootstrap.gotmpl"
-      - "values-bootstrap.yaml"
-    installed: {{ .Values.keycloak.enabled }}
-    # as we have seen some slow clusters we want to ensure we not just fail due to a timeout.
-    timeout: 1800
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "keycloak-bootstrap"
-...

helmfile/apps/keycloak-bootstrap/values-bootstrap.gotmpl

@@ -1,34 +0,0 @@
-{{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  registry: {{ .Values.global.imageRegistry | quote }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
-  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
-
-config:
-  administrator:
-    password: {{ .Values.secrets.keycloak.adminPassword | quote }}
-
-image:
-  registry: {{ .Values.global.imageRegistry | quote }}
-  repository: {{ .Values.images.keycloakBootstrap.repository | quote }}
-  tag: {{ .Values.images.keycloakBootstrap.tag | quote }}
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-
-resources:
-  {{ .Values.resources.keycloakBootstrap | toYaml | nindent 2 }}
-
-additionalAnnotations:
-  annotations:
-    intents.otterize.com/service-name: "keycloak-bootstrap"
-...

helmfile/apps/keycloak-bootstrap/values-bootstrap.yaml

@@ -1,7 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-config:
-  administrator:
-    username: "kcadmin"
-...

helmfile/apps/keycloak/helmfile.yaml

@@ -1,65 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-repositories:
-  # VMWare Bitnami
-  # Source: https://github.com/bitnami/charts/
-  - name: "keycloak-repo"
-    oci: true
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.keycloak.verify }}
-    username: "{{ .Values.charts.keycloak.username }}"
-    password: {{ .Values.charts.keycloak.password | quote }}
-    url: "{{ .Values.charts.keycloak.registry }}/{{ .Values.charts.keycloak.repository }}"
-
-  # openDesk Keycloak Theme
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-keycloak-theme
-  - name: "keycloak-theme-repo"
-    oci: true
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.keycloakTheme.verify }}
-    username: "{{ .Values.charts.keycloakTheme.username }}"
-    password: {{ .Values.charts.keycloakTheme.password | quote }}
-    url: "{{ .Values.charts.keycloakTheme.registry }}/{{ .Values.charts.keycloakTheme.repository }}"
-
-  # openDesk Keycloak Extensions
-  - name: "keycloak-extensions-repo"
-    username: "{{ .Values.charts.keycloakExtensions.username }}"
-    password: {{ .Values.charts.keycloakExtensions.password | quote }}
-    url: "{{ .Values.charts.keycloakExtensions.registry }}/{{ .Values.charts.keycloakExtensions.repository }}"
-
-releases:
-  - name: "keycloak-theme"
-    chart: "keycloak-theme-repo/{{ .Values.charts.keycloakTheme.name }}"
-    version: "{{ .Values.charts.keycloakTheme.version }}"
-    values:
-      - "values-theme.gotmpl"
-    installed: {{ .Values.keycloak.enabled }}
-
-  - name: "keycloak"
-    chart: "keycloak-repo/{{ .Values.charts.keycloak.name }}"
-    version: "{{ .Values.charts.keycloak.version }}"
-    values:
-      - "values-keycloak.gotmpl"
-      - "values-keycloak.yaml"
-      - "values-keycloak-idp.yaml"
-    wait: true
-    installed: {{ .Values.keycloak.enabled }}
-
-  - name: "keycloak-extensions"
-    chart: "keycloak-extensions-repo/{{ .Values.charts.keycloakExtensions.name }}"
-    version: "{{ .Values.charts.keycloakExtensions.version }}"
-    needs:
-      - "keycloak"
-    values:
-      - "values-extensions.yaml"
-      - "values-extensions.gotmpl"
-    installed: {{ .Values.keycloak.enabled }}
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "keycloak"
-...

helmfile/apps/keycloak/values-extensions.yaml

@@ -1,45 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-global:
-  keycloak:
-    host: "keycloak"
-    adminUsername: "kcadmin"
-    adminRealm: "master"
-    realm: "souvap"
-
-handler:
-  appConfig:
-    captchaProtectionEnable: "False"
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - "ALL"
-    seccompProfile:
-      type: "RuntimeDefault"
-    readOnlyRootFilesystem: true
-    runAsUser: 1000
-    runAsGroup: 1000
-    runAsNonRoot: true
-
-postgresql:
-  enabled: false
-
-proxy:
-  ingress:
-    annotations:
-      nginx.org/proxy-buffer-size: "8k"
-      nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
-  securityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - "ALL"
-    seccompProfile:
-      type: "RuntimeDefault"
-    readOnlyRootFilesystem: true
-    runAsUser: 1000
-    runAsGroup: 1000
-    runAsNonRoot: true
-...

helmfile/apps/keycloak/values-keycloak.gotmpl

@@ -1,89 +0,0 @@
-{{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-global:
-  imageRegistry: {{ .Values.global.imageRegistry | quote }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-
-image:
-  registry: {{ .Values.global.imageRegistry | quote }}
-  repository: {{ .Values.images.keycloak.repository | quote }}
-  tag: {{ .Values.images.keycloak.tag | quote }}
-  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-
-externalDatabase:
-  host: {{ .Values.databases.keycloak.host | quote }}
-  port: {{ .Values.databases.keycloak.port }}
-  user: {{ .Values.databases.keycloak.username | quote }}
-  database: {{ .Values.databases.keycloak.name | quote }}
-  password: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
-
-auth:
-  adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
-
-replicaCount: {{ .Values.replicas.keycloak }}
-
-keycloakConfigCli:
-  extraEnvVars:
-    - name: "LDAP_GROUPS_DN"
-      value: "cn=groups,dc=swp-ldap,dc=internal"
-    - name: "LDAP_USERS_DN"
-      value: "cn=users,dc=swp-ldap,dc=internal"
-    - name: "LDAP_SERVER_URL"
-      value: {{ .Values.ldap.host | quote }}
-    - name: "IDENTIFIER"
-      value: "souvap"
-    - name: "THEME"
-      value: "souvap"
-    - name: "KEYCLOAK_AVAILABILITYCHECK_TIMEOUT"
-      value: "600s"
-    - name: "UNIVENTION_CORPORATE_SERVER_DOMAIN"
-      value: "{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
-    - name: "KEYCLOAK_DOMAIN"
-      value: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-    - name: "OPENXCHANGE_8_DOMAIN"
-      value: "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
-    - name: "XWIKI_DOMAIN"
-      value: "{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
-    - name: "OPENPROJECT_DOMAIN"
-      value: "{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
-    - name: "NEXTCLOUD_DOMAIN"
-      value: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
-    - name: "MATRIX_DOMAIN"
-      value: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
-    - name: "JITSI_DOMAIN"
-      value: "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
-    - name: "ELEMENT_DOMAIN"
-      value: "{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}"
-    - name: "INTERCOM_SERVICE_DOMAIN"
-      value: "{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
-    - name: "CLIENT_SECRET_INTERCOM_PASSWORD"
-      value: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
-    - name: "CLIENT_SECRET_MATRIX_PASSWORD"
-      value: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
-    - name: "CLIENT_SECRET_JITSI_PASSWORD"
-      value: {{ .Values.secrets.keycloak.clientSecret.jitsi | quote }}
-    - name: "CLIENT_SECRET_NCOIDC_PASSWORD"
-      value: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
-    - name: "CLIENT_SECRET_OPENPROJECT_PASSWORD"
-      value: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
-    - name: "CLIENT_SECRET_XWIKI_PASSWORD"
-      value: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
-    - name: "CLIENT_SECRET_AS8OIDC_PASSWORD"
-      value: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
-    - name: "KEYCLOAK_STORAGEPROVICER_UCSLDAP_NAME"
-      value: "storage_provider_ucsldap"
-    - name: "LDAPSEARCH_PASSWORD"
-      value: {{ .Values.secrets.univentionCorporateServer.ldapSearch.keycloak | quote }}
-    - name: "LDAPSEARCH_USERNAME"
-      value: "ldapsearch_keycloak"
-  resources:
-    {{ .Values.resources.keycloak | toYaml | nindent 4 }}
-
-resources:
-  {{ .Values.resources.keycloak | toYaml | nindent 2 }}
-...

helmfile/apps/keycloak/values-keycloak.yaml

@@ -1,85 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-postgresql:
-  enabled: false
-externalDatabase:
-  existingSecret: ""
-  existingSecretPasswordKey: ""
-auth:
-  adminUser: "kcadmin"
-# not working as expected with older helm chart, check if it works with most recent one.
-# meanwhile we set the loglevel using the extraEnvVars a bit below.
-# logging:
-#   level: "DEBUG"
-extraEnvVars:
-  - name: "KC_LOG_LEVEL"
-    value: "INFO"
-extraStartupArgs: >
-  -Dkeycloak.profile.feature.token_exchange=enabled
-  -Dkeycloak.profile.feature.admin_fine_grained_authz=enabled
-
-service:
-  type: "ClusterIP"
-ingress:
-  enabled: false
-extraVolumes:
-  - name: "keycloak-theme"
-    configMap:
-      name: "keycloak-theme"
-      items:
-        - key: "theme.properties"
-          path: "souvap/login/theme.properties"
-        - key: "messages_de.properties"
-          path: "souvap/login/messages/messages_de.properties"
-        - key: "messages_en.properties"
-          path: "souvap/login/messages/messages_en.properties"
-        - key: "styles.css"
-          path: "souvap/login/resources/css/styles.css"
-        - key: "logo.svg"
-          path: "souvap/login/resources/img/logo_phoenix.svg"
-        - key: "login.ftl"
-          path: "souvap/login/login.ftl"
-extraVolumeMounts:
-  - name: "keycloak-theme"
-    mountPath: "/opt/bitnami/keycloak/themes"
-
-keycloakConfigCli:
-  enabled: true
-  command:
-    - "java"
-    - "-jar"
-    - "/opt/bitnami/keycloak-config-cli/keycloak-config-cli-19.0.3.jar"
-  args:
-    - "--import.var-substitution.enabled=true"
-  cache:
-    enabled: false
-  containerSecurityContext:
-    enabled: true
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - "ALL"
-    seccompProfile:
-      type: "RuntimeDefault"
-    readOnlyRootFilesystem: true
-    runAsUser: 1001
-    runAsGroup: 1001
-    runAsNonRoot: true
-
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  seccompProfile:
-    type: "RuntimeDefault"
-  readOnlyRootFilesystem: false
-  runAsUser: 1001
-  runAsGroup: 1001
-  runAsNonRoot: true
-
-podSecurityContext:
-  fsGroup: 1001
-  fsGroupChangePolicy: "OnRootMismatch"
-...

helmfile/apps/keycloak/values-theme.gotmpl

@@ -1,13 +0,0 @@
-{{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-
-theme:
-  {{ .Values.theme | toYaml | nindent 2 }}
-...

helmfile/apps/nextcloud/helmfile.yaml

@@ -6,20 +6,20 @@ bases:
 ---
 repositories:
   # openDesk Keycloak Bootstrap
-  # Source:
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/sovereign-workplace-nextcloud-bootstrap
-  #  https://gitlab.opencode.de/bmi/opendesk/components/charts/sovereign-workplace-nextcloud-bootstrap
   - name: "nextcloud-bootstrap-repo"
-    oci: true
+    oci: {{ .Values.charts.nextcloudBootstrap.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.nextcloudBootstrap.verify }}
-    username: "{{ .Values.charts.nextcloudBootstrap.username }}"
+    username: {{ .Values.charts.nextcloudBootstrap.username | quote }}
     password: {{ .Values.charts.nextcloudBootstrap.password | quote }}
     url: "{{ .Values.charts.nextcloudBootstrap.registry }}/{{ .Values.charts.nextcloudBootstrap.repository }}"
 
   # Nextcloud
   # Source: https://github.com/nextcloud/helm/
   - name: "nextcloud-repo"
-    username: "{{ .Values.charts.nextcloud.username }}"
+    oci: {{ .Values.charts.nextcloud.oci }}
+    username: {{ .Values.charts.nextcloud.username | quote }}
     password: {{ .Values.charts.nextcloud.password | quote }}
     url: "{{ .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
 

helmfile/apps/nextcloud/values-bootstrap.gotmpl

@@ -28,6 +28,7 @@ config:
       password: {{ .Values.secrets.centralnavigation.apiKey | quote }}
     userOidc:
       password: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
+      realm: {{ .Values.platform.realm }}
 
   database:
     host: {{ .Values.databases.nextcloud.host | quote }}
@@ -37,7 +38,7 @@ config:
 
   ldapSearch:
     host: {{ .Values.ldap.host | quote }}
-    password: {{ .Values.secrets.univentionCorporateServer.ldapSearch.nextcloud | quote }}
+    password: {{ .Values.secrets.univentionManagementStack.ldapSearch.nextcloud | quote }}
 
   serverinfo:
     token: {{ .Values.secrets.nextcloud.metricsToken | quote }}

helmfile/apps/nextcloud/values-bootstrap.yaml

@@ -7,11 +7,10 @@ config:
 
   apps:
     integrationSwp:
-      username: "phoenixusername"
+      username: "opendesk_username"
     userOidc:
-      username: "ncoidc"
+      username: "opendesk-nextcloud"
-      userIdAttribute: "entryuuid"
+      userIdAttribute: "opendesk_useruuid"
-      realm: "souvap"
 
   cryptpad:
     enabled: true

helmfile/apps/open-xchange/helmfile.yaml

@@ -8,27 +8,27 @@ repositories:
   # openDesk Dovecot
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-dovecot
   - name: "dovecot-repo"
-    oci: true
+    oci: {{ .Values.charts.dovecot.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.dovecot.verify }}
-    username: "{{ .Values.charts.dovecot.username }}"
+    username: {{ .Values.charts.dovecot.username | quote }}
     password: {{ .Values.charts.dovecot.password | quote }}
     url: "{{ .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
 
   # Open-Xchange
   - name: "open-xchange-repo"
-    oci: true
+    oci: {{ .Values.charts.openXchangeAppSuite.oci }}
-    username: "{{ .Values.charts.openXchangeAppSuite.username }}"
+    username: {{ .Values.charts.openXchangeAppSuite.username | quote }}
     password: {{ .Values.charts.openXchangeAppSuite.password | quote }}
     url: "{{ .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
 
   # openDesk Open-Xchange Bootstrap
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-open-xchange-bootstrap
   - name: "open-xchange-bootstrap-repo"
-    oci: true
+    oci: {{ .Values.charts.openXchangeAppSuiteBootstrap.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.openXchangeAppSuiteBootstrap.verify }}
-    username: "{{ .Values.charts.openXchangeAppSuiteBootstrap.username }}"
+    username: {{ .Values.charts.openXchangeAppSuiteBootstrap.username | quote }}
     password: {{ .Values.charts.openXchangeAppSuiteBootstrap.password | quote }}
     url: "{{ .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
       {{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"

helmfile/apps/open-xchange/values-dovecot.gotmpl

@@ -20,12 +20,12 @@ dovecot:
   ldap:
     dn: "uid=ldapsearch_dovecot,cn=users,dc=swp-ldap,dc=internal"
     host: {{ .Values.ldap.host | quote }}
-    password: {{ .Values.secrets.univentionCorporateServer.ldapSearch.dovecot | quote }}
+    password: {{ .Values.secrets.univentionManagementStack.ldapSearch.dovecot | quote }}
   oidc:
     introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
-    introspectionPath: "/realms/souvap/protocol/openid-connect/token/introspect"
+    introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
-    clientSecret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
+    clientSecret: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
-    clientID: "as8oidc"
+    clientID: "opendesk-dovecot"
   loginTrustedNetworks: {{ .Values.cluster.networking.cidr | quote }}
 
 certificate:

helmfile/apps/open-xchange/values-dovecot.yaml

@@ -27,8 +27,8 @@ dovecot:
 
   oidc:
     enabled: true
-    clientID: "as8oidc"
+    clientID: "opendesk-dovecot"
-    usernameAttribute: "phoenixusername"
+    usernameAttribute: "opendesk_username"
 
   submission:
     enabled: true

helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.gotmpl

@@ -14,5 +14,5 @@ appsuite:
               port: 389
           auth:
             adminDN:
-              password: {{ .Values.secrets.univentionCorporateServer.ldapSearch.ox | quote }}
+              password: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
 ...

helmfile/apps/open-xchange/values-openxchange.gotmpl

@@ -69,33 +69,33 @@ appsuite:
       resources:
         {{ .Values.resources.openxchangeGotenberg | toYaml | nindent 8 }}
     properties:
-      "com.openexchange.oauth.provider.jwt.jwksUri": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/certs"
+      "com.openexchange.oauth.provider.jwt.jwksUri": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
-      "com.openexchange.oauth.provider.allowedIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap"
+      "com.openexchange.oauth.provider.allowedIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
-      "com.openexchange.authentication.oauth.tokenEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/token"
+      "com.openexchange.authentication.oauth.tokenEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
       "com.openexchange.authentication.oauth.clientSecret": {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
       "com.openexchange.oidc.rpRedirectURIAuth": "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/appsuite/api/oidc/auth"
-      "com.openexchange.oidc.opAuthorizationEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/auth"
+      "com.openexchange.oidc.opAuthorizationEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/auth"
-      "com.openexchange.oidc.opTokenEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/token"
+      "com.openexchange.oidc.opTokenEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
-      "com.openexchange.oidc.opIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap"
+      "com.openexchange.oidc.opIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
-      "com.openexchange.oidc.opJwkSetEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/certs"
+      "com.openexchange.oidc.opJwkSetEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
       "com.openexchange.oidc.clientSecret": {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
       "com.openexchange.oidc.rpRedirectURIPostSSOLogout": "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/appsuite/api/oidc/logout"
-      "com.openexchange.oidc.opLogoutEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/logout"
+      "com.openexchange.oidc.opLogoutEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
-      "com.openexchange.oidc.rpRedirectURILogout": "https://{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
+      "com.openexchange.oidc.rpRedirectURILogout": "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
     secretProperties:
       com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
       com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
       com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
     propertiesFiles:
       "/opt/open-xchange/etc/ldapauth.properties":
-        bindDNPassword: {{ .Values.secrets.univentionCorporateServer.ldapSearch.ox | quote }}
+        bindDNPassword: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
         java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/dc=swp-ldap,dc=internal"
     uiSettings:
       "io.ox.nextcloud//server": "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/fs/"
       "io.ox.public-sector//ics/url": "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/"
       # Dynamic theme
       io.ox/dynamic-theme//mainColor: {{ .Values.theme.colors.primary | quote }}
-      io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
+      io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
       io.ox/dynamic-theme//topbarBackground: {{ .Values.theme.colors.white | quote }}
       io.ox/dynamic-theme//topbarColor: {{ .Values.theme.colors.black | quote }}
       io.ox/dynamic-theme//listSelected: {{ .Values.theme.colors.primary15 | quote }}

helmfile/apps/open-xchange/values-openxchange.yaml

@@ -55,16 +55,16 @@ appsuite:
       com.openexchange.oidc.startDefaultBackend: "true"
       com.openexchange.oidc.ssoLogout: "true"
       com.openexchange.oidc.userLookupNamePart: "full"
-      com.openexchange.oidc.userLookupClaim: "phoenixusername"
+      com.openexchange.oidc.userLookupClaim: "opendesk_username"
-      com.openexchange.oidc.clientId: "as8oidc"
+      com.openexchange.oidc.clientId: "opendesk-oxappsuite"
       # OAUTH
       com.openexchange.oauth.provider.enabled: "true"
       com.openexchange.oauth.provider.contextLookupClaim: "context"
       com.openexchange.oauth.provider.contextLookupNamePart: "full"
       com.openexchange.oauth.provider.mode: "expect_jwt"
       com.openexchange.oauth.provider.userLookupNamePart: "full"
-      com.openexchange.oauth.provider.userLookupClaim: "phoenixusername"
+      com.openexchange.oauth.provider.userLookupClaim: "opendesk_username"
-      com.openexchange.authentication.oauth.clientId: "as8oidc"
+      com.openexchange.authentication.oauth.clientId: "opendesk-oxappsuite"
       # MAIL
       com.openexchange.mail.authType: "xoauth2"
       com.openexchange.mail.loginSource: "mail"

helmfile/apps/openproject-bootstrap/helmfile.yaml

@@ -8,10 +8,10 @@ repositories:
   # openDesk OpenProject Bootstrap
   # Source: Set when repo is managed on Open CoDE
   - name: "openproject-bootstrap-repo"
-    oci: true
+    oci: {{ .Values.charts.openprojectBootstrap.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.openprojectBootstrap.verify }}
-    username: "{{ .Values.charts.openprojectBootstrap.username }}"
+    username: {{ .Values.charts.openprojectBootstrap.username | quote }}
     password: {{ .Values.charts.openprojectBootstrap.password | quote }}
     url: "{{ .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
 

helmfile/apps/openproject-bootstrap/values.gotmpl

@@ -4,18 +4,18 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
-  domain: "{{ .Values.global.domain }}"
+  domain: {{ .Values.global.domain | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
-  registry: "{{ .Values.global.imageRegistry }}"
+  registry: {{ .Values.global.imageRegistry | quote }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
   registry: {{ .Values.global.imageRegistry }}
-  repository: "{{ .Values.images.openprojectBootstrap.repository }}"
+  repository: {{ .Values.images.openprojectBootstrap.repository | quote }}
-  tag: "{{ .Values.images.openprojectBootstrap.tag }}"
+  tag: {{ .Values.images.openprojectBootstrap.tag | quote }}
-  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
+  imagePullPolicy: {{ .Values.global.imagePullPolicy |quote }}
 
 cleanup:
   deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}

helmfile/apps/openproject/helmfile.yaml

@@ -8,10 +8,10 @@ repositories:
   # OpenProject
   # Source: https://github.com/opf/helm-charts
   - name: "openproject-repo"
-    oci: true
+    oci: {{ .Values.charts.openproject.oci }}
     keyring: "../../files/gpg-pubkeys/openproject-com.gpg"
     verify: {{ .Values.charts.openproject.verify }}
-    username: "{{ .Values.charts.openproject.username }}"
+    username: {{ .Values.charts.openproject.username | quote }}
     password: {{ .Values.charts.openproject.password | quote }}
     url: "{{ .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
 

helmfile/apps/openproject/values.gotmpl

@@ -46,7 +46,10 @@ openproject:
     mail: "openproject-admin@swp-domain.internal"
     password_reset: "false"
     password: {{ .Values.secrets.openproject.adminPassword | quote }}
-
+  oidc:
+    authorizationEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/auth"
+    tokenEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
+    userinfoEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/userinfo"
 ingress:
   host: "{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
   enabled: {{ .Values.ingress.enabled }}
@@ -56,18 +59,18 @@ ingress:
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
 environment:
-  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_SECRET: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
   OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_USER: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
   OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
-  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap"
+  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_SECRET: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
+  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
   OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
   OPENPROJECT_OPENID__CONNECT_KEYCLOAK_HOST: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_END__SESSION__ENDPOINT: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/logout"
+  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_END__SESSION__ENDPOINT: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
   # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
   OPENPROJECT_SEED_LDAP_OPENDESK_HOST: {{ .Values.ldap.host | quote }}
   OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
   OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
+  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
   OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.domain | quote }}
   OPENPROJECT_SMTP__USER__NAME: {{ .Values.smtp.username | quote }}
   OPENPROJECT_SMTP__PASSWORD: {{ .Values.smtp.password | quote }}
@@ -76,7 +79,7 @@ environment:
   OPENPROJECT_SMTP__ADDRESS: {{ .Values.smtp.host | quote }}
   OPENPROJECT_MAIL__FROM: "do-not-reply@{{ .Values.global.domain }}"
   # Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
-  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.univentionCorporateServer.ldapSearch.openproject | quote }}
+  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.univentionManagementStack.ldapSearch.openproject | quote }}
   {{ if ne .Values.objectstores.openproject.backend "aws" }}
   OPENPROJECT_FOG_CREDENTIALS_ENDPOINT: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
   OPENPROJECT_FOG_CREDENTIALS_PATH__STYLE: "true"

helmfile/apps/openproject/values.yaml

@@ -22,11 +22,8 @@ openproject:
   oidc:
     enabled: true
     provider: "keycloak"
-    identifier: "openproject"
+    identifier: "opendesk-openproject"
-    authorizationEndpoint: "/realms/souvap/protocol/openid-connect/auth"
+    scope: "[openid,opendesk]"
-    tokenEndpoint: "/realms/souvap/protocol/openid-connect/token"
-    userinfoEndpoint: "/realms/souvap/protocol/openid-connect/userinfo"
-    scope: "[openid,phoenix]"
   # seed will only be executed on initial installation
   seed_locale: "de"
 
@@ -53,7 +50,7 @@ s3:
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
 environment:
   OPENPROJECT_LOG__LEVEL: "info"
-  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ATTRIBUTE__MAP_LOGIN: "phoenixusername"
+  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ATTRIBUTE__MAP_LOGIN: "opendesk_username"
   OPENPROJECT_LOGIN__REQUIRED: "true"
   OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
   OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"

helmfile/apps/provisioning/helmfile.yaml

@@ -7,7 +7,8 @@ bases:
 repositories:
   # OX Connector
   - name: "ox-connector-repo"
-    username: "{{ .Values.charts.oxConnector.username }}"
+    oci: {{ .Values.charts.oxConnector.oci }}
+    username: {{ .Values.charts.oxConnector.username | quote }}
     password: {{ .Values.charts.oxConnector.password | quote }}
     url: "{{ .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
 

helmfile/apps/provisioning/values-oxconnector.gotmpl

@@ -26,7 +26,7 @@ oxConnector:
   oxMasterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
   oxSoapServer: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
   oxDefaultContext: "1"
-  ldapPassword: {{ if eq .Values.ldap.host "univention-corporate-container" }} "ucctempldapstring" {{ else }} {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }} {{ end }}
+  ldapPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
 
 resources:
   {{ .Values.resources.oxConnector | toYaml | nindent 2 }}

helmfile/apps/services/helmfile.yaml

@@ -8,101 +8,101 @@ repositories:
   # openDesk Otterize
   # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-otterize
   - name: "otterize-repo"
-    oci: true
+    oci: {{ .Values.charts.otterize.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.otterize.verify }}
-    username: "{{ .Values.charts.otterize.username }}"
+    username: {{ .Values.charts.otterize.username | quote }}
     password: {{ .Values.charts.otterize.password | quote }}
     url: "{{ .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
 
   # openDesk Certificates
   # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-certificates
   - name: "certificates-repo"
-    oci: true
+    oci: {{ .Values.charts.certificates.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.certificates.verify }}
-    username: "{{ .Values.charts.certificates.username }}"
+    username: {{ .Values.charts.certificates.username | quote }}
     password: {{ .Values.charts.certificates.password | quote }}
     url: "{{ .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
 
   # openDesk PostgreSQL
   # Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-postgresql
   - name: "postgresql-repo"
-    oci: true
+    oci: {{ .Values.charts.postgresql.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.postgresql.verify }}
-    username: "{{ .Values.charts.postgresql.username }}"
+    username: {{ .Values.charts.postgresql.username | quote }}
     password: {{ .Values.charts.postgresql.password | quote }}
     url: "{{ .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
 
   # openDesk MariaDB
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-mariadb
   - name: "mariadb-repo"
-    oci: true
+    oci: {{ .Values.charts.mariadb.oci }}
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.mariadb.verify }}
-    username: "{{ .Values.charts.mariadb.username }}"
+    username: {{ .Values.charts.mariadb.username | quote }}
     password: {{ .Values.charts.mariadb.password | quote }}
     url: "{{ .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
 
   # openDesk Postfix
   # https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-postfix
   - name: "postfix-repo"
-    oci: true
+    oci: {{ .Values.charts.postfix.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.postfix.verify }}
-    username: "{{ .Values.charts.postfix.username }}"
+    username: {{ .Values.charts.postfix.username | quote }}
     password: {{ .Values.charts.postfix.password | quote }}
     url: "{{ .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
 
   # openDesk Istio Resources
   # https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-istio-resources
   - name: "istio-resources-repo"
-    oci: true
+    oci: {{ .Values.charts.istioResources.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.istioResources.verify }}
-    username: "{{ .Values.charts.istioResources.username }}"
+    username: {{ .Values.charts.istioResources.username | quote }}
     password: {{ .Values.charts.istioResources.password | quote }}
     url: "{{ .Values.charts.istioResources.registry }}/{{ .Values.charts.istioResources.repository }}"
 
   # openDesk ClamAV
   # https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/opendesk-clamav
   - name: "clamav-repo"
-    oci: true
+    oci: {{ .Values.charts.clamav.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.clamav.verify }}
-    username: "{{ .Values.charts.clamav.username }}"
+    username: {{ .Values.charts.clamav.username | quote }}
     password: {{ .Values.charts.clamav.password | quote }}
     url: "{{ .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
   - name: "clamav-simple-repo"
-    oci: true
+    oci: {{ .Values.charts.clamavSimple.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.clamavSimple.verify }}
-    username: "{{ .Values.charts.clamavSimple.username }}"
+    username: {{ .Values.charts.clamavSimple.username | quote }}
     password: {{ .Values.charts.clamavSimple.password | quote }}
     url: "{{ .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
 
   # VMWare Bitnami
   # Source: https://github.com/bitnami/charts/
   - name: "memcached-repo"
-    oci: true
+    oci: {{ .Values.charts.memcached.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.memcached.verify }}
-    username: "{{ .Values.charts.memcached.username }}"
+    username: {{ .Values.charts.memcached.username | quote }}
     password: {{ .Values.charts.memcached.password | quote }}
     url: "{{ .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
   - name: "redis-repo"
-    oci: true
+    oci: {{ .Values.charts.redis.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.redis.verify }}
-    username: "{{ .Values.charts.redis.username }}"
+    username: {{ .Values.charts.redis.username | quote }}
     password: {{ .Values.charts.redis.password | quote }}
     url: "{{ .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
   - name: "minio-repo"
-    oci: true
+    oci: {{ .Values.charts.minio.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.minio.verify }}
-    username: "{{ .Values.charts.minio.username }}"
+    username: {{ .Values.charts.minio.username | quote }}
     password: {{ .Values.charts.minio.password | quote }}
     url: "{{ .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
 

helmfile/apps/services/values-otterize.gotmpl

@@ -42,8 +42,6 @@ apps:
     enabled: {{ .Values.postgresql.enabled }}
   redis:
     enabled: {{ .Values.redis.enabled }}
-  univentionCorporateServer:
-    enabled: {{ .Values.univentionCorporateServer.enabled }}
   univentionManagementStack:
     enabled: {{ .Values.univentionManagementStack.enabled }}
   xwiki:

helmfile/apps/univention-corporate-container/helmfile.yaml

@@ -1,30 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-repositories:
-  # openDesk Univention Corporate Server (as eval Container)
-  - name: "univention-corporate-container-repo"
-    oci: true
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.univentionCorporateServer.verify }}
-    username: "{{ .Values.charts.univentionCorporateServer.username }}"
-    password: {{ .Values.charts.univentionCorporateServer.password | quote }}
-    url: "{{ .Values.charts.univentionCorporateServer.registry }}/\
-      {{ .Values.charts.univentionCorporateServer.repository }}"
-
-releases:
-  - name: "univention-corporate-container"
-    chart: "univention-corporate-container-repo/{{ .Values.charts.univentionCorporateServer.name }}"
-    version: "{{ .Values.charts.univentionCorporateServer.version }}"
-    values:
-      - "values.yaml"
-      - "values.gotmpl"
-    installed: {{ .Values.univentionCorporateServer.enabled }}
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "univention-corporate-container"
-...

helmfile/apps/univention-corporate-container/values.gotmpl

@@ -1,68 +0,0 @@
-{{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  registry: {{ .Values.global.imageRegistry | quote }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-image:
-  registry: {{ .Values.global.imageRegistry | quote }}
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  repository: {{ .Values.images.univentionCorporateServer.repository | quote }}
-  tag: {{ .Values.images.univentionCorporateServer.tag | quote }}
-
-ingress:
-  host: "{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
-  enabled: {{ .Values.ingress.enabled }}
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
-  tls:
-    enabled: {{ .Values.ingress.tls.enabled }}
-    secretName: {{ .Values.ingress.tls.secretName | quote }}
-
-persistence:
-  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-  size: {{ .Values.persistence.size.univentionCorporateServer | quote }}
-
-extraEnvVars:
-  - name: ISTIO_DOMAIN
-    value: {{ .Values.istio.domain | quote }}
-  - name: CENTRALNAVIGATION_API_SECRET
-    value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-  - name: LDAPSEARCH_OX_USERNAME
-    value: "ldapsearch_ox"
-  - name: LDAPSEARCH_OX_PASSWORD
-    value: {{ .Values.secrets.univentionCorporateServer.ldapSearch.ox | quote }}
-  - name: LDAPSEARCH_DOVECOT_USERNAME
-    value: "ldapsearch_dovecot"
-  - name: LDAPSEARCH_DOVECOT_PASSWORD
-    value: {{ .Values.secrets.univentionCorporateServer.ldapSearch.dovecot | quote }}
-  - name: LDAPSEARCH_KEYCLOAK_USERNAME
-    value: "ldapsearch_keycloak"
-  - name: LDAPSEARCH_KEYCLOAK_PASSWORD
-    value: {{ .Values.secrets.univentionCorporateServer.ldapSearch.keycloak | quote }}
-  - name: LDAPSEARCH_NEXTCLOUD_USERNAME
-    value: "ldapsearch_nextcloud"
-  - name: LDAPSEARCH_NEXTCLOUD_PASSWORD
-    value: {{ .Values.secrets.univentionCorporateServer.ldapSearch.nextcloud | quote }}
-  - name: LDAPSEARCH_OPENPROJECT_USERNAME
-    value: "ldapsearch_openproject"
-  - name: LDAPSEARCH_OPENPROJECT_PASSWORD
-    value: {{ .Values.secrets.univentionCorporateServer.ldapSearch.openproject | quote }}
-  - name: LDAPSEARCH_XWIKI_USERNAME
-    value: "ldapsearch_xwiki"
-  - name: LDAPSEARCH_XWIKI_PASSWORD
-    value: {{ .Values.secrets.univentionCorporateServer.ldapSearch.xwiki | quote }}
-  - name: DEFAULT_ACCOUNT_USER_PASSWORD
-    value: {{ .Values.secrets.univentionCorporateServer.defaultAccounts.userPassword | quote }}
-  - name: DEFAULT_ACCOUNT_ADMIN_PASSWORD
-    value: {{ .Values.secrets.univentionCorporateServer.defaultAccounts.adminPassword | quote }}
-
-resources:
-  {{ .Values.resources.univentionCorporateServer | toYaml | nindent 2 }}
-...

helmfile/apps/univention-corporate-container/values.yaml

@@ -1,7 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-service:
-  nodePort:
-    enabled: false
-...

helmfile/apps/univention-management-stack/helmfile.yaml

@@ -6,21 +6,146 @@ bases:
 ---
 repositories:
   # Univention Management Stack
-  - name: "ums-repo"
+  - name: "ums-store-dav-repo"
-    url: >-
+    oci: {{ .Values.charts.umsStoreDav.oci }}
-      {{ env "PRIVATE_CHART_REPOSITORY_URL" |
+    username: {{ .Values.charts.umsStoreDav.username | quote }}
-         default "https://gitlab.souvap-univention.de/api/v4/projects/155/packages/helm/stable" }}
+    password: {{ .Values.charts.umsStoreDav.password | quote }}
+    url: "{{ .Values.charts.umsStoreDav.registry }}/{{ .Values.charts.umsStoreDav.repository }}"
+  - name: "ums-ldap-server-repo"
+    oci: {{ .Values.charts.umsLdapServer.oci }}
+    username: {{ .Values.charts.umsLdapServer.username | quote }}
+    password: {{ .Values.charts.umsLdapServer.password | quote }}
+    url: "{{ .Values.charts.umsLdapServer.registry }}/{{ .Values.charts.umsLdapServer.repository }}"
+  - name: "ums-ldap-notifier-repo"
+    oci: {{ .Values.charts.umsLdapNotifier.oci }}
+    username: {{ .Values.charts.umsLdapNotifier.username | quote }}
+    password: {{ .Values.charts.umsLdapNotifier.password | quote }}
+    url: "{{ .Values.charts.umsLdapNotifier.registry }}/{{ .Values.charts.umsLdapNotifier.repository }}"
+  - name: "ums-udm-rest-api-repo"
+    oci: {{ .Values.charts.umsUdmRestApi.oci }}
+    username: {{ .Values.charts.umsUdmRestApi.username | quote }}
+    password: {{ .Values.charts.umsUdmRestApi.password | quote }}
+    url: "{{ .Values.charts.umsUdmRestApi.registry }}/{{ .Values.charts.umsUdmRestApi.repository }}"
+  - name: "ums-stack-data-ums-repo"
+    oci: {{ .Values.charts.umsStackDataUms.oci }}
+    username: {{ .Values.charts.umsStackDataUms.username | quote }}
+    password: {{ .Values.charts.umsStackDataUms.password | quote }}
+    url: "{{ .Values.charts.umsStackDataUms.registry }}/{{ .Values.charts.umsStackDataUms.repository }}"
+  - name: "ums-stack-data-swp-repo"
+    oci: {{ .Values.charts.umsStackDataSwp.oci }}
+    username: {{ .Values.charts.umsStackDataSwp.username | quote }}
+    password: {{ .Values.charts.umsStackDataSwp.password | quote }}
+    url: "{{ .Values.charts.umsStackDataSwp.registry }}/{{ .Values.charts.umsStackDataSwp.repository }}"
+  - name: "ums-portal-server-repo"
+    oci: {{ .Values.charts.umsPortalServer.oci }}
+    username: {{ .Values.charts.umsPortalServer.username | quote }}
+    password: {{ .Values.charts.umsPortalServer.password | quote }}
+    url: "{{ .Values.charts.umsPortalServer.registry }}/{{ .Values.charts.umsPortalServer.repository }}"
+  - name: "ums-notifications-api-repo"
+    oci: {{ .Values.charts.umsNotificationsApi.oci }}
+    username: {{ .Values.charts.umsNotificationsApi.username | quote }}
+    password: {{ .Values.charts.umsNotificationsApi.password | quote }}
+    url: "{{ .Values.charts.umsNotificationsApi.registry }}/{{ .Values.charts.umsNotificationsApi.repository }}"
+  - name: "ums-portal-listener-repo"
+    oci: {{ .Values.charts.umsPortalListener.oci }}
+    username: {{ .Values.charts.umsPortalListener.username | quote }}
+    password: {{ .Values.charts.umsPortalListener.password | quote }}
+    url: "{{ .Values.charts.umsPortalListener.registry }}/{{ .Values.charts.umsPortalListener.repository }}"
+  - name: "ums-portal-frontend-repo"
+    oci: {{ .Values.charts.umsPortalFrontend.oci }}
+    username: {{ .Values.charts.umsPortalFrontend.username | quote }}
+    password: {{ .Values.charts.umsPortalFrontend.password | quote }}
+    url: "{{ .Values.charts.umsPortalFrontend.registry }}/{{ .Values.charts.umsPortalFrontend.repository }}"
+  - name: "ums-umc-gateway-repo"
+    oci: {{ .Values.charts.umsUmcGateway.oci }}
+    username: {{ .Values.charts.umsUmcGateway.username | quote }}
+    password: {{ .Values.charts.umsUmcGateway.password | quote }}
+    url: "{{ .Values.charts.umsUmcGateway.registry }}/{{ .Values.charts.umsUmcGateway.repository }}"
+  - name: "ums-umc-server-repo"
+    oci: {{ .Values.charts.umsUmcServer.oci }}
+    username: {{ .Values.charts.umsUmcServer.username | quote }}
+    password: {{ .Values.charts.umsUmcServer.password | quote }}
+    url: "{{ .Values.charts.umsUmcServer.registry }}/{{ .Values.charts.umsUmcServer.repository }}"
+  - name: "ums-selfservice-listener-repo"
+    oci: {{ .Values.charts.umsSelfserviceListener.oci }}
+    username: {{ .Values.charts.umsSelfserviceListener.username | quote }}
+    password: {{ .Values.charts.umsSelfserviceListener.password | quote }}
+    url: "{{ .Values.charts.umsSelfserviceListener.registry }}/{{ .Values.charts.umsSelfserviceListener.repository }}"
+
+  # Univention Keycloak Extensions
+  - name: "ums-keycloak-extensions-repo"
+    oci: {{ .Values.charts.umsKeycloakExtensions.oci }}
+    username: {{ .Values.charts.umsKeycloakExtensions.username | quote }}
+    password: {{ .Values.charts.umsKeycloakExtensions.password | quote }}
+    url: "{{ .Values.charts.umsKeycloakExtensions.registry }}/{{ .Values.charts.umsKeycloakExtensions.repository }}"
+  # Univention Keycloak
+  - name: "ums-keycloak-repo"
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.umsKeycloak.verify }}
+    oci: {{ .Values.charts.umsKeycloak.oci }}
+    username: {{ .Values.charts.umsKeycloak.username | quote }}
+    password: {{ .Values.charts.umsKeycloak.password | quote }}
+    url: "{{ .Values.charts.umsKeycloak.registry }}/{{ .Values.charts.umsKeycloak.repository }}"
+  - name: "ums-keycloak-bootstrap-repo"
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.umsKeycloakBootstrap.verify }}
+    oci: {{ .Values.charts.umsKeycloakBootstrap.oci }}
+    username: {{ .Values.charts.umsKeycloakBootstrap.username | quote }}
+    password: {{ .Values.charts.umsKeycloakBootstrap.password | quote }}
+    url: "{{ .Values.charts.umsKeycloakBootstrap.registry }}/{{ .Values.charts.umsKeycloakBootstrap.repository }}"
+  - name: "opendesk-keycloak-bootstrap-repo"
+    oci: {{ .Values.charts.opendeskKeycloakBootstrap.oci }}
+    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
+    verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
+    username: {{ .Values.charts.opendeskKeycloakBootstrap.username | quote }}
+    password: {{ .Values.charts.opendeskKeycloakBootstrap.password | quote }}
+    url: "{{ .Values.charts.opendeskKeycloakBootstrap.registry }}/\
+      {{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
   # VMWare Bitnami
   # Source: https://github.com/bitnami/charts/
   - name: "nginx-repo"
-    oci: true
+    oci: {{ .Values.charts.nginx.oci }}
     keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
     verify: {{ .Values.charts.nginx.verify }}
-    username: "{{ .Values.charts.nginx.username }}"
+    username: {{ .Values.charts.nginx.username | quote }}
     password: {{ .Values.charts.nginx.password | quote }}
     url: "{{ .Values.charts.nginx.registry }}/{{ .Values.charts.nginx.repository }}"
 
 releases:
+  - name: "ums-keycloak"
+    chart: "ums-keycloak-repo/{{ .Values.charts.umsKeycloak.name }}"
+    version: "{{ .Values.charts.umsKeycloak.version }}"
+    values:
+      - "values-ums-keycloak.yaml.gotmpl"
+    installed: {{ .Values.univentionManagementStack.enabled }}
+
+  - name: "ums-keycloak-extensions"
+    chart: "ums-keycloak-extensions-repo/{{ .Values.charts.umsKeycloakExtensions.name }}"
+    version: "{{ .Values.charts.umsKeycloakExtensions.version }}"
+    values:
+      - "values-ums-keycloak-extensions.yaml.gotmpl"
+    needs:
+      - "ums-keycloak"
+    installed: {{ .Values.univentionManagementStack.enabled }}
+
+  - name: "ums-keycloak-bootstrap"
+    chart: "ums-keycloak-bootstrap-repo/{{ .Values.charts.umsKeycloakBootstrap.name }}"
+    version: "{{ .Values.charts.umsKeycloakBootstrap.version }}"
+    values:
+      - "values-ums-keycloak-bootstrap.yaml.gotmpl"
+    needs:
+      - "ums-keycloak"
+    installed: {{ .Values.univentionManagementStack.enabled }}
+
+  - name: "opendesk-keycloak-bootstrap"
+    chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.opendeskKeycloakBootstrap.name }}"
+    version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
+    values:
+      - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
+    needs:
+      - "ums-keycloak-bootstrap"
+    installed: {{ .Values.univentionManagementStack.enabled }}
+
   - name: "ums-stack-gateway"
     chart: "nginx-repo/{{ .Values.charts.nginx.name }}"
     version: "{{ .Values.charts.nginx.version }}"
@@ -30,16 +155,17 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-store-dav"
-    chart: "ums-repo/{{ .Values.charts.umsStoreDav.name }}"
+    chart: "ums-store-dav-repo/{{ .Values.charts.umsStoreDav.name }}"
     version: "{{ .Values.charts.umsStoreDav.version }}"
     values:
       - "values-common.gotmpl"
       - "values-common.yaml"
       - "values-store-dav.gotmpl"
+      - "values-store-dav.yaml"
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-ldap-server"
-    chart: "ums-repo/{{ .Values.charts.umsLdapServer.name }}"
+    chart: "ums-ldap-server-repo/{{ .Values.charts.umsLdapServer.name }}"
     version: "{{ .Values.charts.umsLdapServer.version }}"
     values:
       - "values-common.gotmpl"
@@ -49,7 +175,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-ldap-notifier"
-    chart: "ums-repo/{{ .Values.charts.umsLdapNotifier.name }}"
+    chart: "ums-ldap-notifier-repo/{{ .Values.charts.umsLdapNotifier.name }}"
     version: "{{ .Values.charts.umsLdapNotifier.version }}"
     values:
       - "values-common.gotmpl"
@@ -59,7 +185,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-udm-rest-api"
-    chart: "ums-repo/{{ .Values.charts.umsUdmRestApi.name }}"
+    chart: "ums-udm-rest-api-repo/{{ .Values.charts.umsUdmRestApi.name }}"
     version: "{{ .Values.charts.umsUdmRestApi.version }}"
     values:
       - "values-common.gotmpl"
@@ -69,7 +195,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-stack-data-ums"
-    chart: "ums-repo/{{ .Values.charts.umsStackDataUms.name }}"
+    chart: "ums-stack-data-ums-repo/{{ .Values.charts.umsStackDataUms.name }}"
     version: "{{ .Values.charts.umsStackDataUms.version }}"
     values:
       - "values-common.gotmpl"
@@ -79,7 +205,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-stack-data-swp"
-    chart: "ums-repo/{{ .Values.charts.umsStackDataSwp.name }}"
+    chart: "ums-stack-data-swp-repo/{{ .Values.charts.umsStackDataSwp.name }}"
     version: "{{ .Values.charts.umsStackDataSwp.version }}"
     values:
       - "values-common.gotmpl"
@@ -89,7 +215,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-portal-server"
-    chart: "ums-repo/{{ .Values.charts.umsPortalServer.name }}"
+    chart: "ums-portal-server-repo/{{ .Values.charts.umsPortalServer.name }}"
     version: "{{ .Values.charts.umsPortalServer.version }}"
     values:
       - "values-common.gotmpl"
@@ -99,7 +225,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-notifications-api"
-    chart: "ums-repo/{{ .Values.charts.umsNotificationsApi.name }}"
+    chart: "ums-notifications-api-repo/{{ .Values.charts.umsNotificationsApi.name }}"
     version: "{{ .Values.charts.umsNotificationsApi.version }}"
     values:
       - "values-common.gotmpl"
@@ -109,7 +235,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-portal-listener"
-    chart: "ums-repo/{{ .Values.charts.umsPortalListener.name }}"
+    chart: "ums-portal-listener-repo/{{ .Values.charts.umsPortalListener.name }}"
     version: "{{ .Values.charts.umsPortalListener.version }}"
     values:
       - "values-common.gotmpl"
@@ -119,7 +245,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-portal-frontend"
-    chart: "ums-repo/{{ .Values.charts.umsPortalFrontend.name }}"
+    chart: "ums-portal-frontend-repo/{{ .Values.charts.umsPortalFrontend.name }}"
     version: "{{ .Values.charts.umsPortalFrontend.version }}"
     values:
       - "values-common.gotmpl"
@@ -129,7 +255,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-umc-gateway"
-    chart: "ums-repo/{{ .Values.charts.umsUmcGateway.name }}"
+    chart: "ums-umc-gateway-repo/{{ .Values.charts.umsUmcGateway.name }}"
     version: "{{ .Values.charts.umsUmcGateway.version }}"
     values:
       - "values-common.gotmpl"
@@ -139,7 +265,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-umc-server"
-    chart: "ums-repo/{{ .Values.charts.umsUmcServer.name }}"
+    chart: "ums-umc-server-repo/{{ .Values.charts.umsUmcServer.name }}"
     version: "{{ .Values.charts.umsUmcServer.version }}"
     values:
       - "values-common.gotmpl"
@@ -149,7 +275,7 @@ releases:
     installed: {{ .Values.univentionManagementStack.enabled }}
 
   - name: "ums-selfservice-listener"
-    chart: "ums-repo/{{ .Values.charts.umsSelfserviceListener.name }}"
+    chart: "ums-selfservice-listener-repo/{{ .Values.charts.umsSelfserviceListener.name }}"
     version: "{{ .Values.charts.umsSelfserviceListener.version }}"
     values:
       - "values-common.gotmpl"

helmfile/apps/univention-management-stack/values-ldap-notifier.yaml

@@ -7,4 +7,12 @@ volumes:
     shared-data: "shared-data-ums-ldap-server-0"
     shared-run: "shared-run-ums-ldap-server-0"
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-ldap-server.yaml

@@ -30,4 +30,25 @@ extraVolumeMounts:
     mountPath: "/var/lib/univention-ldap-local/local-schema/opendeskProjectmanagement.schema"
     subPath: "opendeskProjectmanagement.schema"
 
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-notifications-api.yaml

@@ -9,4 +9,12 @@ notificationsapi:
   sql_echo: "False"
   api_prefix: "/univention/portal/notifications-api"
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-opendesk-keycloak-bootstrap.yaml.gotmpl

@@ -0,0 +1,320 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: "{{ .Values.global.domain }}"
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  registry: "{{ .Values.global.imageRegistry }}"
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: "{{ .Values.global.imageRegistry }}"
+  repository: "{{ .Values.images.opendeskKeycloakBootstrap.repository }}"
+  tag: "{{ .Values.images.opendeskKeycloakBootstrap.tag }}"
+  imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
+
+cleanup:
+  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+
+config:
+  keycloak:
+    adminUser: "kcadmin"
+    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
+    realm: {{ .Values.platform.realm | quote }}
+    intraCluster:
+      enabled: true
+      internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
+  custom:
+    clientScopes:
+      - name: "read_contacts"
+        protocol: "openid-connect"
+      - name: "write_contacts"
+        protocol: "openid-connect"
+      - name: "opendesk"
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+    clients:
+      - name: "opendesk-dovecot"
+        clientId: "opendesk-dovecot"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        attributes:
+          backchannel.logout.session.required: false
+        defaultClientScopes:
+          - "opendesk"
+      - name: "opendesk-intercom"
+        clientId: "opendesk-intercom"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
+        redirectUris:
+          - "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/callback"
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        attributes:
+          backchannel.logout.session.required: true
+          backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
+        protocolMappers:
+          - name: "intercom-audience"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-audience-mapper"
+            consentRequired: false
+            config:
+              included.client.audience: "opendesk-intercom"
+              id.token.claim: false
+              access.token.claim: true
+          # temporary additional claim while entryuuid is a hardcoded attribute in IntercomService and we cannot set
+          # it to `opendesk_useruuid` standard claim. For reference:
+          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/app.js#L89
+          - name: "entryuuid_temp"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "entryuuid"
+              jsonType.label: "String"
+          # temporary additional claim while phoenixusername is a hardcoded attribute in IntercomService and we cannot
+          # set it to `opendesk_username` standard claim. For reference:
+          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/routes/navigation.js#L27
+          - name: "phoenixusername_temp"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "phoenixusername"
+              jsonType.label: "String"
+        defaultClientScopes:
+          - "opendesk"
+          - "offline_access"
+      - name: "opendesk-jitsi"
+        clientId: "opendesk-jitsi"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        redirectUris:
+          - "https://{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}/*"
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: true
+        fullScopeAllowed: true
+        defaultClientScopes:
+          - "opendesk"
+          - "profile"
+      - name: "opendesk-matrix"
+        clientId: "opendesk-matrix"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
+        redirectUris:
+          - "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        standardFlowEnabled: true
+        directAccessGrantsEnabled: true
+        serviceAccountsEnabled: true
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        attributes:
+          backchannel.logout.session.required: true
+          backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        defaultClientScopes:
+          - "opendesk"
+        optionalClientScopes:
+          - "email"
+          - "profile"
+        # This is a temporary OIDC client for matrix, as the OIDC logout still uses "matrix" as client ID. Unless that
+        # is solved and also is able to use "opendesk-matrix" we keep that dummy client that
+      - name: "matrix"
+        clientId: "matrix"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        standardFlowEnabled: true
+        directAccessGrantsEnabled: true
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        attributes:
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+      - name: "opendesk-nextcloud"
+        clientId: "opendesk-nextcloud"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
+        redirectUris:
+          - "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        attributes:
+          backchannel.logout.session.required: true
+          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/user_oidc/backchannel-logout/ncoidc"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        protocolMappers:
+          - name: "context"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "oxContextIDNum"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "context"
+              jsonType.label: "String"
+        defaultClientScopes:
+          - "opendesk"
+          - "email"
+          - "read_contacts"
+          - "write_contacts"
+      - name: "opendesk-openproject"
+        clientId: "opendesk-openproject"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
+        redirectUris:
+          - "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        serviceAccountsEnabled: true
+        attributes:
+          backchannel.logout.session.required: true
+          backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        protocolMappers:
+          - name: "opendeskProjectmanagementAdmin"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "opendeskProjectmanagementAdmin"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "openproject_admin"
+              jsonType.label: "String"
+        defaultClientScopes:
+          - "opendesk"
+          - "email"
+          - "profile"
+      - name: "opendesk-oxappsuite"
+        clientId: "opendesk-oxappsuite"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
+        redirectUris:
+          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        attributes:
+          backchannel.logout.session.required: true
+          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/ajax/oidc/backchannel_logout"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        protocolMappers:
+          - name: "context"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "oxContextIDNum"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "context"
+              jsonType.label: "String"
+        defaultClientScopes:
+          - "opendesk"
+          - "read_contacts"
+          - "write_contacts"
+      - name: "opendesk-xwiki"
+        clientId: "opendesk-xwiki"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
+        redirectUris:
+          - "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        attributes:
+          backchannel.logout.session.required: false
+          backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/NOT_YET_IMPLEMENTED_DONT_FORGET_TO_DISABLE_FCL_WHEN_BCL_IS_ACTIVATED/backchannel-logout"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+        defaultClientScopes:
+          - "opendesk"
+          - "address"
+          - "email"
+          - "profile"
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  enabled: true
+  privileged: false
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+
+podAnnotations:
+  intents.otterize.com/service-name: "ums-keycloak-bootstrap"
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+
+resources:
+  {{ .Values.resources.opendeskKeycloakBootstrap | toYaml | nindent 2 }}
+
+...

helmfile/apps/univention-management-stack/values-portal-frontend.yaml

@@ -70,4 +70,24 @@ extraVolumeMounts:
     mountPath: "/var/www/html/custom/portal_background_image.svg"
     subPath: "portal_background_image.svg"
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-portal-listener.yaml

@@ -13,4 +13,24 @@ portalListener:
 store-dav:
   bundled: false
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-portal-server.yaml

@@ -11,4 +11,24 @@ portalServer:
   centralNavigation:
     enabled: true
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-selfservice-listener.yaml

@@ -8,4 +8,24 @@ selfserviceListener:
   umcServerUrl: "http://ums-umc-server"
   umcAdminUser: "default.admin"
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-stack-data-swp.gotmpl

@@ -8,7 +8,7 @@ stackDataSwp:
 
 stackDataContext:
   ldapSearchUsers:
-    {{- range $username, $password := .Values.secrets.univentionCorporateServer.ldapSearch }}
+    {{- range $username, $password := .Values.secrets.univentionManagementStack.ldapSearch }}
     - username: {{ printf "ldapsearch_%s" $username | quote }}
       password: {{ $password | quote }}
       lastname: "LDAP-Search-User"
@@ -23,6 +23,8 @@ stackDataContext:
   portalRealtimeVideoconferenceLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.jitsi .Values.global.domain | quote }}
   portalManagementProjectLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openproject .Values.global.domain | quote }}
   portalManagementKnowledgeLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.xwiki .Values.global.domain | quote }}
+  portalTitleDE: "{{ .Values.theme.texts.productName }} Portal"
+  portalTitleEN: "{{ .Values.theme.texts.productName }} Portal"
 
   smtpHost: {{ .Values.smtp.host | quote }}
   smtpPort: {{ .Values.smtp.port | quote }}

helmfile/apps/univention-management-stack/values-stack-data-swp.yaml

@@ -8,9 +8,18 @@ stackDataSwp:
 
 stackDataContext:
   ldapBase: "dc=swp-ldap,dc=internal"
-  oxDefaultContext: "10"
+  oxDefaultContext: "1"
   smtpStartTls: true
 
 additionalAnnotations:
   intents.otterize.com/service-name: "ums-stack-data-swp"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-stack-data-ums.gotmpl

@@ -14,7 +14,7 @@ stackDataContext:
   ldapBase: {{ .Values.ldap.baseDn | quote }}
   ldapHostDn: {{ printf "%s,%s" "cn=admin" .Values.ldap.baseDn | quote }}
 
-  idpSamlMetadataUrl: {{ printf "https://%s.%s%s" .Values.global.hosts.keycloak .Values.global.domain "/realms/souvap/protocol/saml/descriptor" | quote }}
+  idpSamlMetadataUrl: {{ printf "https://%s.%s/%s/%s/%s" .Values.global.hosts.keycloak .Values.global.domain "realms" .Values.platform.realm "protocol/saml/descriptor" | quote }}
   umcSamlSpFqdn: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
   idpFqdn: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
   ldapSamlSpUrls: {{ printf "https://%s.%s%s" .Values.global.hosts.univentionManagementStack .Values.global.domain "/univention/saml/metadata" | quote }}

helmfile/apps/univention-management-stack/values-stack-data-ums.yaml

@@ -14,4 +14,13 @@ stackDataContext:
 
 additionalAnnotations:
   intents.otterize.com/service-name: "ums-stack-data-ums"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-store-dav.yaml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
+...

helmfile/apps/univention-management-stack/values-udm-rest-api.yaml

@@ -18,4 +18,24 @@ extraVolumeMounts:
     mountPath: "/usr/share/attribute-to-group-mapper/flag_to_group_mapping.json"
     subPath: "flag_to_group_mapping.json"
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-umc-gateway.yaml

@@ -20,4 +20,25 @@ extraVolumeMounts:
       "/usr/share/univention-management-console-frontend/js/dijit/themes\
       /umc/icons/16x16/udm-portals-announcement.png"
     subPath: "udm-portals-announcement.png"
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-umc-server.yaml

@@ -51,4 +51,25 @@ memcached:
   auth:
     username: null
     password: null
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+    add:
+      - "CHOWN"
+      - "DAC_OVERRIDE"
+      - "FOWNER"
+      - "FSETID"
+      - "KILL"
+      - "SETGID"
+      - "SETUID"
+      - "SETPCAP"
+      - "NET_BIND_SERVICE"
+      - "NET_RAW"
+      - "SYS_CHROOT"
+  privileged: false
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/univention-management-stack/values-ums-keycloak-bootstrap.yaml.gotmpl

@@ -0,0 +1,80 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  registry: {{ .Values.global.imageRegistry | quote }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: {{ .Values.global.imageRegistry | quote }}
+  repository: {{ .Values.images.umsKeycloakBootstrap.repository | quote }}
+  tag: {{ .Values.images.umsKeycloakBootstrap.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+
+cleanup:
+  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+
+config:
+  keycloak:
+    adminUser: "kcadmin"
+    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
+    realm: {{ .Values.platform.realm | quote }}
+    intraCluster:
+      enabled: true
+      internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
+    loginLinks:
+      - link_number: 1
+        language: "de"
+        description: "Passwort vergessen?"
+        href: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/#/selfservice/passwordforgotten"
+      - link_number: 1
+        language: "en"
+        description: "Forgot password?"
+        href: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/#/selfservice/passwordforgotten"
+  ums:
+    ldap:
+      internalHostname: {{ .Values.ldap.host | quote }}
+      baseDN: {{ .Values.ldap.baseDn | quote }}
+      readUserDN: "uid=ldapsearch_keycloak,cn=users,dc=swp-ldap,dc=internal"
+      readUserPassword: {{ .Values.secrets.univentionManagementStack.ldapSearch.keycloak | quote }}
+      mappers:
+        - ldapAndUserModelAttributeName: "opendeskProjectmanagementAdmin"
+        - ldapAndUserModelAttributeName: "oxContextIDNum"
+    saml:
+      serviceProviderHostname: "{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+  twoFactorAuthentication:
+    enabled: true
+    group: "2fa-users"
+
+containerSecurityContext:
+  enabled: true
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  readOnlyRootFilesystem: false
+  runAsGroup: 1000
+  runAsNonRoot: true
+  runAsUser: 1000
+  seccompProfile:
+    type: "RuntimeDefault"
+
+podAnnotations:
+  intents.otterize.com/service-name: "ums-keycloak-bootstrap"
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 1000
+  fsGroupChangePolicy: "Always"
+
+resources:
+  {{ .Values.resources.umsKeycloakBootstrap | toYaml | nindent 2 }}
+
+...

helmfile/apps/univention-management-stack/values-ums-keycloak-extensions.yaml.gotmpl

@@ -5,7 +5,11 @@ SPDX-License-Identifier: Apache-2.0
 ---
 global:
   keycloak:
+    host: "ums-keycloak:8080"
+    adminUsername: "kcadmin"
     adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
+    adminRealm: "master"
+    realm: {{ .Values.platform.realm | quote }}
   postgresql:
     connection:
       host: {{ .Values.databases.keycloakExtension.host | quote }}
@@ -17,30 +21,65 @@ global:
 handler:
   image:
     registry: {{ .Values.global.imageRegistry | quote }}
-    repository: {{ .Values.images.keycloakExtensionHandler.repository | quote }}
+    repository: {{ .Values.images.umsKeycloakExtensionHandler.repository | quote }}
-    tag: {{ .Values.images.keycloakExtensionHandler.tag | quote }}
+    tag: {{ .Values.images.umsKeycloakExtensionHandler.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   appConfig:
+    captchaProtectionEnable: false
     smtpPassword: {{ .Values.smtp.password | quote }}
     smtpHost: {{ .Values.smtp.host | quote }}
     smtpPort: {{ .Values.smtp.port | quote }}
     smtpUsername: {{ .Values.smtp.username | quote }}
     mailFrom: "noreply@{{ .Values.global.domain }}"
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    runAsNonRoot: true
   resources:
-    {{ .Values.resources.keycloakExtension | toYaml | nindent 4 }}
+    {{ .Values.resources.umsKeycloakExtensionHandler | toYaml | nindent 4 }}
+postgresql:
+  enabled: false
 proxy:
   image:
     registry: {{ .Values.global.imageRegistry | quote }}
-    repository: {{ .Values.images.keycloakExtensionProxy.repository | quote }}
+    repository: {{ .Values.images.umsKeycloakExtensionProxy.repository | quote }}
-    tag: {{ .Values.images.keycloakExtensionProxy.tag | quote }}
+    tag: {{ .Values.images.umsKeycloakExtensionProxy.tag | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
   ingress:
+    annotations:
+      nginx.org/proxy-buffer-size: "8k"
+      nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
+    paths:
+      - pathType: "Prefix"
+        path: "/realms"
+      - pathType: "Prefix"
+        path: "/resources"
+      - pathType: "Prefix"
+        path: "/fingerprintjs"
     enabled: {{ .Values.ingress.enabled }}
     ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
     host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
     tls:
       enabled: {{ .Values.ingress.tls.enabled }}
       secretName: {{ .Values.ingress.tls.secretName | quote }}
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    runAsNonRoot: true
   resources:
-    {{ .Values.resources.keycloakProxy | toYaml | nindent 4 }}
+    {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 4 }}
 ...

helmfile/apps/univention-management-stack/values-ums-keycloak.yaml.gotmpl

@@ -0,0 +1,56 @@
+{{/*
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imageRegistry: {{ .Values.global.imageRegistry | quote }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: {{ .Values.global.imageRegistry | quote }}
+  repository: {{ .Values.images.umsKeycloak.repository | quote }}
+  tag: {{ .Values.images.umsKeycloak.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+config:
+  admin:
+    password: {{ .Values.secrets.keycloak.adminPassword | quote }}
+  database:
+    host: {{ .Values.databases.keycloak.host | quote }}
+    port: {{ .Values.databases.keycloak.port }}
+    user: {{ .Values.databases.keycloak.username | quote }}
+    database: {{ .Values.databases.keycloak.name | quote }}
+    password: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: false
+  runAsUser: 1000
+  runAsGroup: 1000
+  runAsNonRoot: true
+
+podSecurityContext:
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+
+theme:
+  univentionTheme: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/theme.css"
+  univentionCustomTheme: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/css/custom.css"
+  favIcon: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/favicon.ico"
+
+replicaCount: {{ .Values.replicas.keycloak }}
+
+resources:
+  {{ .Values.resources.umsKeycloak | toYaml | nindent 2 }}
+
+...

helmfile/apps/univention-management-stack/values-ums-stack-gateway.yaml

@@ -238,4 +238,21 @@ serverBlock: |
     }
 
   }
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 1001
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  enabled: true
+  privileged: false
+  readOnlyRootFilesystem: false
+  runAsUser: 1001
+  runAsNonRoot: true
+  seccompProfile:
+    type: "RuntimeDefault"
 ...

helmfile/apps/xwiki/helmfile.yaml

@@ -8,7 +8,8 @@ repositories:
   # XWiki
   # Source: https://github.com/xwiki-contrib/xwiki-helm
   - name: "xwiki-repo"
-    username: "{{ .Values.charts.xwiki.username }}"
+    oci: {{ .Values.charts.xwiki.oci }}
+    username: {{ .Values.charts.xwiki.username | quote }}
     password: {{ .Values.charts.xwiki.password | quote }}
     url: "{{ .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
 

helmfile/apps/xwiki/values.gotmpl

@@ -22,21 +22,21 @@ customConfigs:
     xwiki.authentication.ldap.port: 389
     ## Authentication to the LDAP server
     xwiki.authentication.ldap.bind_DN: "uid=ldapsearch_xwiki,cn=users,dc=swp-ldap,dc=internal"
-    xwiki.authentication.ldap.bind_pass: {{ .Values.secrets.univentionCorporateServer.ldapSearch.xwiki | quote }}
+    xwiki.authentication.ldap.bind_pass: {{ .Values.secrets.univentionManagementStack.ldapSearch.xwiki | quote }}
     ## Base DN used for searching for users
     xwiki.authentication.ldap.base_DN: "dc=swp-ldap,dc=internal"
     ## Allow short update cycles of the LDAP group cache
     xwiki.authentication.ldap.groupcache_expiration: 300
 
   "xwiki.properties":
-    "oidc.endpoint.authorization": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/auth"
+    "oidc.endpoint.authorization": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/auth"
-    "oidc.endpoint.token": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/token"
+    "oidc.endpoint.token": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
-    "oidc.endpoint.userinfo": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/userinfo"
+    "oidc.endpoint.userinfo": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/userinfo"
-    "oidc.endpoint.logout": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap/protocol/openid-connect/logout"
+    "oidc.endpoint.logout": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
     "oidc.secret": {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
     "url.trustedDomains": "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-    "workplaceServices.navigationEndpoint": "https://{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}/univention/portal/navigation.json"
+    "workplaceServices.navigationEndpoint": "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json"
-    "workplaceServices.base": "https://{{ .Values.global.hosts.univentionCorporateServer }}.{{ .Values.global.domain }}"
+    "workplaceServices.base": "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
     "workplaceServices.portalSecret": {{ .Values.secrets.centralnavigation.apiKey | quote }}
 
 properties:
@@ -46,7 +46,7 @@ properties:
   "property:xwiki:FlamingoThemes.Iceberg^FlamingoThemesCode.ThemeClass.navbar-default-link-hover-bg": {{ .Values.theme.colors.secondaryGreyLight | quote }}
   ## Link LDAP users and users authenticated through OIDC
   "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.addOIDCObject": 1
-  "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.OIDCIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/souvap"
+  "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.OIDCIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
 
 ingress:
   enabled: {{ .Values.ingress.enabled }}

helmfile/apps/xwiki/values.yaml

@@ -22,13 +22,13 @@ customConfigs:
     xwiki.authentication.ldap.update_photo: 1
 
   xwiki.properties:
-    oidc.scope: "openid,profile,email,address,phoenix"
+    oidc.scope: "openid,profile,email,address,opendesk"
     oidc.endpoint.userinfo.method: "GET"
-    oidc.user.nameFormater: "${oidc.user.phoenixusername._clean._lowerCase}"
+    oidc.user.nameFormater: "${oidc.user.opendesk_username._clean._lowerCase}"
-    oidc.user.subjectFormater: "${oidc.user.phoenixusername._lowerCase}"
+    oidc.user.subjectFormater: "${oidc.user.opendesk_username._lowerCase}"
     # yamllint disable-line rule:line-length
     oidc.userinfoclaims: "xwiki_user_accessibility,xwiki_user_company,xwiki_user_displayHiddenDocuments,xwiki_user_editor,xwiki_user_usertype"
-    oidc.clientid: "xwiki"
+    oidc.clientid: "opendesk-xwiki"
     oidc.endpoint.token.auth_method: "client_secret_basic"
     oidc.skipped: false
     oidc.logoutMechanism: "rpInitiated"

helmfile/environments/default/_helper.gotmpl

@@ -1,11 +0,0 @@
-{{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
-*/}}
----
-## Define LDAP service (supports "ums_eval" from the CI pipeline)
-ldap:
-  host: {{ if eq (env "DEPLOY_UCS") "ums-eval" }} "ums-ldap-server" {{ else }} "univention-corporate-container" {{ end }}
-  notifierHost: {{ if eq (env "DEPLOY_UCS") "ums-eval" }} "ums-ldap-notifier" {{ else }} "univention-corporate-container" {{ end }}
-  baseDn: "dc=swp-ldap,dc=internal"
-...

helmfile/environments/default/_helper.yaml

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+ldap:
+  host: "ums-ldap-server"
+  notifierHost: "ums-ldap-notifier"
+  baseDn: "dc=swp-ldap,dc=internal"
+## Define Keycloak realmname for openDesk
+platform:
+  realm: "opendesk"
+...

helmfile/environments/default/charts.yaml

@@ -11,6 +11,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-certificates"
     name: "opendesk-certificates"
+    oci: true
     version: "2.1.0"
     verify: true
     username: ~
@@ -25,6 +26,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/clamav"
     name: "opendesk-clamav"
+    oci: true
     version: "4.0.0"
     verify: true
     username: ~
@@ -40,6 +42,7 @@ charts:
     repository: "sovereign-workplace/souvap/tooling/charts/clamav"
     name: "clamav-simple"
     version: "4.0.0"
+    oci: true
     verify: true
     username: ~
     password: ~
@@ -53,6 +56,7 @@ charts:
     registry: "https://collaboraonline.github.io"
     repository: "online"
     name: "collabora-online"
+    oci: false
     version: "1.0.2"
     username: ~
     password: ~
@@ -66,6 +70,7 @@ charts:
     registry: "https://cryptpad.github.io"
     repository: "helm"
     name: "cryptpad"
+    oci: false
     version: "0.0.14"
     username: ~
     password: ~
@@ -79,7 +84,8 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/dovecot"
     name: "dovecot"
-    version: "1.3.6"
+    oci: true
+    version: "1.3.7"
     verify: true
     username: ~
     password: ~
@@ -93,6 +99,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
     name: "opendesk-element"
+    oci: true
     version: "2.6.0"
     verify: true
     username: ~
@@ -107,6 +114,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
     name: "opendesk-well-known"
+    oci: true
     version: "2.6.0"
     verify: true
     username: ~
@@ -121,6 +129,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/intercom-service"
     name: "intercom-service"
+    oci: true
     version: "2.0.1"
     verify: true
     username: ~
@@ -135,6 +144,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/istio-ressources"
     name: "istio-gateway"
+    oci: true
     version: "2.0.0"
     verify: true
     username: ~
@@ -149,40 +159,58 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-jitsi"
     name: "sovereign-workplace-jitsi"
+    oci: true
     version: "1.7.2"
     verify: true
     username: ~
     password: ~
 
-  keycloak:
+  umsKeycloak:
-    # renovate:
-    # registryUrl=https://registry-1.docker.io
-    # packageName=bitnamicharts/keycloak
-    # dataSource=docker
-    # dependencyType=service
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
-    name: "keycloak"
-    version: "12.1.5"
-    verify: true
-    username: ~
-    password: ~
-
-  keycloakBootstrap:
     # renovate:
     # registryUrl=https://registry.souvap-univention.de
-    # packageName=souvap/tooling/charts/sovereign-workplace-keycloak-bootstrap/sovereign-workplace-keycloak-bootstrap
+    # packageName=souvap/tooling/charts/univention-keycloak/ums-keycloak
     # dataSource=docker
     # dependencyType=vendor
     registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-keycloak-bootstrap"
+    repository: "sovereign-workplace/souvap/tooling/charts/univention-keycloak"
-    name: "sovereign-workplace-keycloak-bootstrap"
+    name: "ums-keycloak"
-    version: "1.1.12"
+    oci: true
+    version: "1.0.1"
     verify: true
     username: ~
     password: ~
 
-  keycloakExtensions:
+  umsKeycloakBootstrap:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/univention-keycloak-bootstrap/ums-keycloak-bootstrap
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/univention-keycloak-bootstrap"
+    name: "ums-keycloak-bootstrap"
+    oci: true
+    version: "1.0.1"
+    verify: true
+    username: ~
+    password: ~
+
+  opendeskKeycloakBootstrap:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # packageName=souvap/tooling/charts/opendesk-keycloak-bootstrap/opendesk-keycloak-bootstrap
+    # dataSource=docker
+    # dependencyType=vendor
+    registry: "external-registry.souvap-univention.de"
+    repository: "sovereign-workplace/souvap/tooling/charts/opendesk-keycloak-bootstrap"
+    name: "opendesk-keycloak-bootstrap"
+    oci: true
+    version: "1.0.3"
+    verify: true
+    username: ~
+    password: ~
+
+  umsKeycloakExtensions:
     # renovate:
     # registryUrl=https://gitlab.souvap-univention.de/api/v4/projects/77/packages/helm/stable
     # packageName=keycloak-extensions
@@ -191,24 +219,11 @@ charts:
     registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/77/packages/helm/stable"
     name: "keycloak-extensions"
+    oci: false
     version: "0.1.0"
     username: ~
     password: ~
 
-  keycloakTheme:
-    # renovate:
-    # registryUrl=https://registry.souvap-univention.de
-    # packageName=souvap/tooling/charts/keycloak-theme/opendesk-keycloak-theme
-    # dataSource=docker
-    # dependencyType=vendor
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/keycloak-theme"
-    name: "opendesk-keycloak-theme"
-    version: "2.0.0"
-    verify: true
-    username: ~
-    password: ~
-
   mariadb:
     # renovate:
     # registryUrl=https://registry.opencode.de
@@ -218,6 +233,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/charts/opendesk-mariadb"
     name: "mariadb"
+    oci: true
     version: "2.2.0"
     verify: true
     username: ~
@@ -232,6 +248,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/opendesk-matrix-widgets"
     name: "matrix-neoboard-widget"
+    oci: true
     version: "3.3.0"
     verify: true
     username: ~
@@ -246,6 +263,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/opendesk-matrix-widgets"
     name: "matrix-neochoice-widget"
+    oci: true
     version: "3.3.0"
     verify: true
     username: ~
@@ -260,6 +278,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/opendesk-matrix-widgets"
     name: "matrix-neodatefix-bot"
+    oci: true
     version: "3.3.0"
     verify: true
     username: ~
@@ -274,6 +293,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/opendesk-matrix-widgets"
     name: "matrix-neodatefix-widget"
+    oci: true
     version: "3.3.0"
     verify: true
     username: ~
@@ -288,6 +308,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
     name: "opendesk-matrix-user-verification-service"
+    oci: true
     version: "2.6.0"
     verify: true
     username: ~
@@ -302,6 +323,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
     name: "memcached"
+    oci: true
     version: "6.6.2"
     verify: true
     username: ~
@@ -316,6 +338,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
     name: "minio"
+    oci: true
     version: "12.8.19"
     verify: true
     username: ~
@@ -329,6 +352,7 @@ charts:
     # dependencyType=vendor
     registry: "https://nextcloud.github.io"
     repository: "helm"
+    oci: false
     name: "nextcloud"
     version: "3.5.19"
     username: ~
@@ -343,6 +367,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-nextcloud-bootstrap"
     name: "opendesk-nextcloud-bootstrap"
+    oci: true
     version: "3.2.6"
     verify: true
     username: ~
@@ -357,6 +382,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
     name: "nginx"
+    oci: true
     version: "15.3.5"
     verify: true
     username: ~
@@ -371,6 +397,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/opf/helm-charts"
     name: "openproject"
+    oci: true
     version: "3.0.2"
     verify: true
     username: ~
@@ -385,6 +412,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/opendesk-openproject-bootstrap"
     name: "opendesk-openproject-bootstrap"
+    oci: true
     version: "1.2.1"
     verify: true
     username: ~
@@ -399,7 +427,8 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/appsuite-public-sector/charts"
     name: "appsuite-public-sector"
-    version: "2.2.34"
+    oci: true
+    version: "2.2.37"
     username: ~
     password: ~
 
@@ -412,6 +441,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-open-xchange-bootstrap"
     name: "sovereign-workplace-open-xchange-bootstrap"
+    oci: true
     version: "1.3.1"
     verify: true
     username: ~
@@ -426,7 +456,8 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/opendesk-otterize"
     name: "opendesk-otterize"
-    version: "1.1.5"
+    oci: true
+    version: "1.2.0"
     verify: true
     username: ~
     password: ~
@@ -440,6 +471,7 @@ charts:
     registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/128/packages/helm/stable"
     name: "ox-connector"
+    oci: false
     version: "0.1.0-pre-jconde-listener-entrypoint-chaining"
     username: ~
     password: ~
@@ -453,6 +485,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/postfix"
     name: "postfix"
+    oci: true
     version: "2.0.4"
     verify: true
     username: ~
@@ -467,6 +500,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/postgresql"
     name: "postgresql"
+    oci: true
     version: "2.0.3"
     verify: true
     username: ~
@@ -481,6 +515,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/bitnami-charts"
     name: "redis"
+    oci: true
     version: "18.1.2"
     verify: true
     username: ~
@@ -495,7 +530,8 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
     name: "opendesk-synapse"
-    version: "2.6.0"
+    oci: true
+    version: "2.6.2"
     verify: true
     username: ~
     password: ~
@@ -509,6 +545,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
     name: "opendesk-synapse-create-account"
+    oci: true
     version: "2.6.0"
     verify: true
     username: ~
@@ -523,6 +560,7 @@ charts:
     registry: "external-registry.souvap-univention.de"
     repository: "sovereign-workplace/souvap/tooling/charts/sovereign-workplace-element"
     name: "opendesk-synapse-web"
+    oci: true
     version: "2.6.0"
     verify: true
     username: ~
@@ -534,9 +572,10 @@ charts:
     # packageName=ldap-notifier
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "ldap-notifier"
+    oci: false
     version: "0.7.0"
     username: ~
     password: ~
@@ -547,9 +586,10 @@ charts:
     # packageName=ldap-server
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "ldap-server"
+    oci: false
     version: "0.7.0"
     username: ~
     password: ~
@@ -560,9 +600,10 @@ charts:
     # packageName=notifications-api
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "notifications-api"
+    oci: false
     version: "0.9.1"
     username: ~
     password: ~
@@ -573,9 +614,10 @@ charts:
     # packageName=portal-frontend
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "portal-frontend"
+    oci: false
     version: "0.9.1"
     username: ~
     password: ~
@@ -586,9 +628,10 @@ charts:
     # packageName=portal-listener
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "portal-listener"
+    oci: false
     version: "0.9.1"
     username: ~
     password: ~
@@ -599,9 +642,10 @@ charts:
     # packageName=portal-server
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "portal-server"
+    oci: false
     version: "0.9.1"
     username: ~
     password: ~
@@ -612,9 +656,10 @@ charts:
     # packageName=umc-server
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "selfservice-listener"
+    oci: false
     version: "0.2.0"
     username: ~
     password: ~
@@ -625,10 +670,11 @@ charts:
     # packageName=stack-data-swp
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "stack-data-swp"
-    version: "0.39.3"
+    oci: false
+    version: "0.39.4"
     username: ~
     password: ~
 
@@ -638,9 +684,10 @@ charts:
     # packageName=stack-data-ums
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "stack-data-ums"
+    oci: false
     version: "0.39.3"
     username: ~
     password: ~
@@ -651,9 +698,10 @@ charts:
     # packageName=store-dav
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "store-dav"
+    oci: false
     version: "0.9.1"
     username: ~
     password: ~
@@ -664,9 +712,10 @@ charts:
     # packageName=udm-rest-api
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "udm-rest-api"
+    oci: false
     version: "0.4.1"
     username: ~
     password: ~
@@ -677,9 +726,10 @@ charts:
     # packageName=umc-gateway
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "umc-gateway"
+    oci: false
     version: "0.6.2"
     username: ~
     password: ~
@@ -690,27 +740,14 @@ charts:
     # packageName=umc-server
     # dataSource=helm
     # dependencyType=vendor
-    registry: "gitlab.souvap-univention.de"
+    registry: "https://gitlab.souvap-univention.de"
     repository: "api/v4/projects/155/packages/helm/stable"
     name: "umc-server"
+    oci: false
     version: "0.6.2"
     username: ~
     password: ~
 
-  univentionCorporateServer:
-    # renovate:
-    # registryUrl=https://registry.souvap-univention.de
-    # packageName=souvap/tooling/charts/univention-corporate-container/univention-corporate-container
-    # dataSource=docker
-    # dependencyType=vendor
-    registry: "external-registry.souvap-univention.de"
-    repository: "sovereign-workplace/souvap/tooling/charts/univention-corporate-container"
-    name: "univention-corporate-container"
-    version: "1.0.10"
-    verify: true
-    username: ~
-    password: ~
-
   xwiki:
     # renovate:
     # registryUrl=https://xwiki-contrib.github.io/xwiki-helm
@@ -719,9 +756,9 @@ charts:
     # dependencyType=vendor
     registry: "https://xwiki-contrib.github.io"
     repository: "xwiki-helm"
+    oci: false
     name: "xwiki"
     version: "1.2.3"
-    verify: true
     username: ~
     password: ~
 ...

helmfile/environments/default/global.yaml

@@ -26,7 +26,6 @@ global:
     openxchange: "webmail"
     openxchangeProvisioning: "ox-provisioning"
     synapse: "matrix"
-    univentionCorporateServer: "portal"
     univentionManagementStack: "portal"
     whiteboard: "whiteboard"
     xwiki: "wiki"

helmfile/environments/default/images.yaml

@@ -14,7 +14,7 @@ images:
     # registryUrl=https://registry.souvap-univention.de
     # dependencyType=vendor
     repository: "souvap/tooling/images/collabora"
-    tag: "23.05.5.4.1@sha256:ff48ec379f0d63e50b7714d1fa0f8f8de4247595dfa78754c44786a79c4968e4"
+    tag: "23.05.6.3.1@sha256:cebcb5287df58f6f12bb95882f18e99f970552ce161be8fc51a541d96de53d0e"
     # @supplier: "Collabora"
   cryptpad:
     # renovate:
@@ -100,36 +100,35 @@ images:
     repository: "jitsi/jvb"
     tag: "stable-8922@sha256:75dd613807e19cbbd440d071b60609fa9e4ee50a1396b14deb0ed779d882a554"
     # @supplier: "Nordeck"
-  keycloak:
+  umsKeycloak:
     # renovate:
-    # registryUrl=https://docker.io
+    # registryUrl=https://docker.software-univention.de
     # dependencyType=vendor
-    repository: "bitnami/keycloak"
+    repository: "keycloak-keycloak"
-    tag: "19.0.3-debian-11-r22@sha256:4ac04104d20d4861ecca24ff2d07d71b34a98ee1148c6e6b6e7969a6b2ad085e"
+    tag: "22.0.3-ucs1@sha256:6b17a63d4c6bc60f9c645902f8dbb7ad094a867065e40c43cc81c867c1b8ba00"
     # @supplier: "Univention"
-  keycloakUnivention:
+  umsKeycloakBootstrap:
-    # renovate:
-    # registryUrl=https://registry.souvap-univention.de
-    # dependencyType=vendor
-    # This is a preview and not part of the standard deployment.
-    repository: "souvap/tooling/images/univention/keycloak-app-on-use-base-manpub-tr"
-    tag: "latest"
-    # @supplier: "Univention"
-  keycloakBootstrap:
     # renovate:
     # registryUrl=https://registry.souvap-univention.de
     # dependencyType=service
-    repository: "souvap/tooling/images/ansible"
+    repository: "souvap/tooling/images/univention-keycloak-bootstrap"
-    tag: "4.10.0@sha256:89d8212c20e03b0fd079e08afaf3247c1b96b380c4db1b572d68d0b4a6abc0ac"
+    tag: "1.0.5@sha256:81ccf77e5af77385e4d0c4ff6a7df2cec11691ea76c6c23c36eb1ef0d51ad687"
+    # @supplier: "Univention"
+  opendeskKeycloakBootstrap:
+    # renovate:
+    # registryUrl=https://registry.souvap-univention.de
+    # dependencyType=service
+    repository: "souvap/tooling/images/opendesk-keycloak-bootstrap"
+    tag: "1.0.3@sha256:b9c18294bdf5b3b79caa789e899403bbf1b485f05a0be3e09895e5161506d4a8"
     # @supplier: "openDesk DevSecOps"
-  keycloakExtensionHandler:
+  umsKeycloakExtensionHandler:
     # renovate:
     # registryUrl=https://registry.souvap-univention.de
     # dependencyType=vendor
     repository: "souvap/tooling/images/keycloak-extensions/keycloak-handler"
     tag: "latest@sha256:e67bdfc655e43b7fb83b025e13f949b04fdd98e089b33401275d03e340e03e2e"
     # @supplier: "Univention"
-  keycloakExtensionProxy:
+  umsKeycloakExtensionProxy:
     # renovate:
     # registryUrl=https://registry.souvap-univention.de
     # dependencyType=vendor
@@ -296,7 +295,7 @@ images:
     # registryUrl=https://registry.open-xchange.com
     # dependencyType=vendor
     repository: "appsuite-public-sector/guard-ui"
-    tag: "4.0.7@sha256:8c9fa5d6aed055c0e84042ab28b3f0e9add94390362266ad440da4f90b8c93a8"
+    tag: "4.2.2@sha256:c2ff375fa3dc359c555570f5216a5451966d9b7165934980acb1bf60363b59c8"
     # @supplier: "Open-Xchange"
   openxchangeImageConverter:
     # renovate:
@@ -317,7 +316,7 @@ images:
     # registryUrl=https://registry.open-xchange.com
     # dependencyType=vendor
     repository: "appsuite-public-sector/public-sector-ui"
-    tag: "2.2.0@sha256:3f8c62c139c27569e6b7d38321268e7cc291caa4ea1ea03180c8ce5499edd6d5"
+    tag: "2.2.1@sha256:cf5dc3754dfdf41844f619b0c3178d0406de3ce8dd51317ed706cb329d338fc8"
     # @supplier: "Open-Xchange"
   oxConnector:
     # renovate:
@@ -382,13 +381,6 @@ images:
     repository: "rapidfort/haproxy-official"
     tag: "2.6.6-bullseye@sha256:bf22cfb1301aae433213f5f8c687bc5d9ecc6b86daf1084be5f7a339bd27cadd"
     # @supplier: "Element"
-  univentionCorporateServer:
-    # renovate:
-    # registryUrl=https://registry.souvap-univention.de
-    # dependencyType=vendor
-    repository: "souvap/tooling/images/univention-corporate-server-swp/ucs"
-    tag: "20230829T094822@sha256:6415847851ee3b474cea756212698f4a110fbbde74882e22da92500a6358a4f8"
-    # @supplier: "Univention"
   umsConfigHtpasswd:
     # renovate:
     # registryUrl=https://registry.souvap-univention.de

helmfile/environments/default/persistence.yaml

@@ -19,7 +19,6 @@ persistence:
     prosody: "1Gi"
     redis: "1Gi"
     synapse: "1Gi"
-    univentionCorporateServer: "1Gi"
     univentionManagementStack:
       ldapServerData: "1Gi"
       ldapServerShared: "1Gi"

helmfile/environments/default/resources.yaml

@@ -95,28 +95,35 @@ resources:
     requests:
       cpu: 0.1
       memory: "384Mi"
-  keycloak:
+  opendeskKeycloakBootstrap:
+    limits:
+      cpu: 99
+      memory: "512Mi"
+    requests:
+      cpu: 0.1
+      memory: "256Mi"
+  umsKeycloak:
     limits:
       cpu: 99
       memory: "2Gi"
     requests:
       cpu: 0.1
       memory: "512Mi"
-  keycloakExtension:
+  umsKeycloakBootstrap:
-    limits:
-      cpu: 99
-      memory: "256Mi"
-    requests:
-      cpu: 0.1
-      memory: "48Mi"
-  keycloakBootstrap:
     limits:
       cpu: 99
       memory: "512Mi"
     requests:
       cpu: 0.1
       memory: "256Mi"
-  keycloakProxy:
+  umsKeycloakExtensionHandler:
+    limits:
+      cpu: 99
+      memory: "256Mi"
+    requests:
+      cpu: 0.1
+      memory: "48Mi"
+  umsKeycloakExtensionProxy:
     limits:
       cpu: 99
       memory: "256Mi"
@@ -340,13 +347,6 @@ resources:
     requests:
       cpu: 0.1
       memory: "64Mi"
-  univentionCorporateServer:
-    limits:
-      cpu: 99
-      memory: "4Gi"
-    requests:
-      cpu: 0.5
-      memory: "1Gi"
   umsLdapNotifier:
     limits:
       cpu: 99

helmfile/environments/default/secrets.gotmpl

@@ -11,11 +11,8 @@ secrets:
     shareCryptKey: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ox_appsuite" "share_cryptkey" | sha1sum | quote }}
     oxguardMC: {{ printf "MC%s" (randAlphaNum 20 | b64enc) | quote }}
     oxguardRC: {{ printf "RC%s" (randAlphaNum 20 | b64enc) | quote }}
-  univentionCorporateServer:
+  univentionManagementStack:
-    authSecret: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ucs" "auth_secret" | sha1sum | quote }}
+    ldapSecret: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "cn=admin" "ldap" | sha1sum | quote }}
-    defaultAccounts:
-      userPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ucs" "default_accounts_user_password" | sha1sum | quote }}
-      adminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ucs" "default_accounts_user_admin" | sha1sum | quote }}
     ldapSearch:
       keycloak: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ucs" "ldapsearch_keycloak" | sha1sum | quote }}
       nextcloud: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ucs" "ldapsearch_nextcloud" | sha1sum | quote }}
@@ -23,8 +20,6 @@ secrets:
       ox: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ucs" "ldapsearch_ox" | sha1sum | quote }}
       openproject: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ucs" "ldapsearch_openproject" | sha1sum | quote }}
       xwiki: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ucs" "ldapsearch_xwiki" | sha1sum | quote }}
-  univentionManagementStack:
-    ldapSecret: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "cn=admin" "ldap" | sha1sum | quote }}
     defaultAccounts:
       administratorPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "Administrator" "ums" | sha1sum | quote }}
       userPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "ucs" "default_accounts_user_password" | sha1sum | quote }}
@@ -54,6 +49,7 @@ secrets:
   keycloak:
     adminPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "adminPassword" | sha1sum | quote }}
     clientSecret:
+      dovecot: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "dovecot_client_secret" | sha1sum | quote }}
       intercom: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "intercom_client_secret" | sha1sum | quote }}
       matrix: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "matrix_client_secret" | sha1sum | quote }}
       jitsi: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "keycloak" "jitsi_plain_client_secret" | sha1sum | quote }}

helmfile/environments/default/workplace.yaml

@@ -41,10 +41,8 @@ postgresql:
   enabled: true
 redis:
   enabled: true
-univentionCorporateServer:
-  enabled: true
 univentionManagementStack:
-  enabled: false
+  enabled: true
 xwiki:
   enabled: true
 ...