feat(otterize): Update and add values

# [1.10.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.9.0...v1.10.0) (2025-11-24)

### Bug Fixes

* **collabora:** Update Controller to 1.1.6 incl. Helm chart update to 1.1.10 ([d25c95f](d25c95f06b))
* **collabora:** Update from 25.04.5 to 25.04.6 ([8de0f5d](8de0f5de72))
* **external-services:** Create `nubus_authsession` database ([ec72602](ec72602cdd))
* **helmfile:** Enable verification for XWiki Helm chart ([5104793](51047936de))
* **helmfile:** Streamline annotations ([7aa717c](7aa717c050))
* **nubus:** Remove legacy `UMC` Keycloak client that was used for SAML connection with the Nubus portal ([152221f](152221fa79))
* **open-xchange:** Only enable `smtpSASLAuthEnable` when `relayHost` is set ([70bbbf3](70bbbf311f))
* **open-xchange:** Optimize Dovecot Pro full-text search caches; review `migrations.md` for required upgrade steps ([f3f707c](f3f707c9ee))
* **open-xchange:** Template SASL security options ([684c6d4](684c6d4f29))
* **open-xchange:** Update Dovecot configuration based on supplier's best practise review ([850761e](850761e047))
* **opendesk-static-files:** [[#260](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/260)] Fix doublette creation of configmap `data` keys when the same file is referenced multiple times for a component ([b5a76be](b5a76bea57))
* **openproject:** Update from 16.1.0 to 16.1.1 ([62fae99](62fae9976a))
* **xwiki:** Update XWiki from 17.4.4 to 17.4.7 ([02a3b77](02a3b77114))

### Features

* **jitsi:** Update from 2.0.10431 to 2.0.10590 ([f5aad1f](f5aad1fa47))
* **nubus:** Update from v1.14.0 to v1.15.2 ([12379d6](12379d67e0))
* **open-xchange:** Support for LDAP group based mailing lists ([cc94f0c](cc94f0c66d))
* **openproject:** Update OpenProject from 16.5.1 to 16.6.0 ([19438c0](19438c0281))

.gitignore

@@ -5,9 +5,26 @@
 .yamllint
 
 # Ignore changes to sample environments
-helmfile/environments/dev/values.yaml.gotmpl
-helmfile/environments/prod/values.yaml.gotmpl
+helmfile/environments/dev/*.yaml.gotmpl
+helmfile/environments/test/*.yaml.gotmpl
+helmfile/environments/prod/*.yaml.gotmpl
+helmfile/environments/dev/*/
+helmfile/environments/test/*/
+helmfile/environments/prod/*/
+!helmfile/environments/dev/sample.yaml.gotmpl
+!helmfile/environments/test/sample.yaml.gotmpl
+!helmfile/environments/prod/sample.yaml.gotmpl
 
 # Ignore in CI generated files
 .kyverno/opendesk.yaml
 .kyverno/kyverno-test.yaml
+
+# Ignore editor backup files
+*~
+
+# Ignore ./log directory and *.log files
+logs
+*.log
+
+# Ignore backup files, e.g. created by the script that eases the local chart development
+*.bak

.gitlab/common/common.yml

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+variables:
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.2\
+    @sha256:e33a6327b9c8f89f6e86d13804d5d81e9fdf6974a2f280874d6901067c22fd83"
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.14\
+    @sha256:34d2a96e5fc25155abd48fef4d335b131c71d8cbc00ad531df0cae9918b9f2ab"
+
+.common:
+  cache: {}
+  needs: []
+  tags: []
+...

.gitlab/generate/generate-common.yml

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+include:
+  - local: "/.gitlab/common/common.yml"
+
+.generate-common:
+  extends: ".common"
+  stage: ".post"
+  tags: []
+...

.gitlab/generate/generate-docs.yml

@@ -0,0 +1,20 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+include:
+  - local: "/.gitlab/generate/generate-common.yml"
+
+generate-docs:
+  cache:
+    - key: "generate-docs-${CI_COMMIT_REF_SLUG}"
+      paths:
+        - "${CI_PROJECT_DIR}/docs"
+      policy: "push"
+  extends: ".generate-common"
+  image: "${OPENDESK_CI_CLI_IMAGE}"
+  rules:
+    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $RELEASE_BRANCH"
+      when: "on_success"
+  script:
+    - "node /app/src/index.js generate-docs -d ${CI_PROJECT_DIR}"
+...

.gitlab/issue_templates/Default.md

@@ -0,0 +1,59 @@
+## 🐛 Issue Report Template
+
+Thank you for reporting an issue!
+Please provide the details below to help us investigate and resolve it efficiently.
+If you have a feature request, please select the "Feature Request" template.
+
+### 📦 Deployment Details
+- **Release version deployed**:
+  _(e.g. v1.4.2, commit hash, or branch name)_
+
+- **Deployment type**:
+  - [ ] Fresh installation
+  - [ ] Upgrade (from version: ___ )
+
+### ☸️ Kubernetes Environment
+- **Kubernetes distribution** (select one):
+  - [ ] Rancher RKE / RKE2
+  - [ ] OpenShift
+  - [ ] k3s
+  - [ ] kind / minikube
+  - [ ] Other: ___________
+
+- **Kubernetes version**:
+  _(e.g. v1.27.3)_
+
+### 🌐 Ingress & Certificates
+- **Ingress controller in use**:
+  - [ ] Ingress NGINX Controller version: ___
+  - [ ] Other: Currently only Ingress NGINX is supported
+
+- **Certificate status**:
+  - [ ] Let’s Encrypt
+  - [ ] Other publicly verifiable certificate (issuer: ___ )
+  - [ ] Self-signed certificate (see [`self-signed-certificated.md`](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/enhanced-configuration/self-signed-certificates.md))
+    - [ ] Option 1
+    - [ ] Option 2a
+    - [ ] Option 2b
+
+### 🔧 Tooling Versions
+- **Helm version (`helm version`)**: ___________
+- **Helmfile version (`helmfile --version`)**: ___________
+
+### 🔍 Problem Description
+- **Expected behavior**:
+
+- **Observed behavior / error message**:
+
+- **Steps to reproduce**:
+  1.
+  2.
+  3.
+
+### 📄 Additional context
+
+- Relevant logs (please redact sensitive info):
+- Screenshots (if applicable):
+- Other notes that might help:
+
+## 🙌 Thank you for contributing to the project!

.gitlab/issue_templates/Feature_Request.md

@@ -0,0 +1,37 @@
+## 💡 Feature Request Template
+
+Thank you for suggesting an improvement!
+To help us understand and evaluate your idea, please provide the details below.
+
+### 📝 Summary
+
+- **Short description of the feature**:
+  _(One or two sentences that capture the core idea)_
+
+### 🎯 Use Case / Motivation
+
+- **Who would benefit from this feature?**
+  - [ ] Operators / Administrators
+  - [ ] Developers
+  - [ ] End users
+  - [ ] Other: ___________
+
+- **Why is this feature needed?**
+  _(Describe the problem, pain point, or gap this would address)_
+
+### 🔧 Proposed Solution
+
+- **How should it work?**
+  _(Describe the desired functionality. If relevant, provide examples, CLI flags, configuration snippets, or workflows.)_
+
+### 📊 Alternatives Considered
+
+- **Other approaches you’ve tried or thought of**:
+  _(What’s possible now, and why is it not sufficient?)_
+
+### 📄 Additional Context
+
+- Links to related issues, merge requests, or external references:
+- Screenshots, diagrams, or mockups (if available):
+
+## 🙌 Thank you for helping improve the project!

.gitlab/lint/lint-common.yml

@@ -1,17 +1,26 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
-variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.2.0\
-    @sha256:b36b1fc8a19605306dffef2c919c2a6bf5a3099e8a42ecb39a416394410b75d7"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.1\
-    @sha256:5b1bd85cc73ba0cede1f37d79fa7eeebffa653afa7944406eea9287c29a7769a"
+include:
+  - local: "/.gitlab/common/common.yml"
 
 .lint-common:
-  cache: {}
-  needs: []
+  extends: ".common"
   stage: "lint"
-  tags:
-    - "docker"
 
+common-yaml-linter:
+  rules:
+    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
+      when: "never"
+    - when: "always"
+
+conventional-commits-linter:
+  rules:
+    - if: >
+          $RUN_RENOVATE == "yes" ||
+          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
+          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
+      when: "never"
+    - when: "always"
 ...

.gitlab/lint/lint-kyverno.yml

@@ -1,11 +1,11 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 include:
   - local: "/.gitlab/lint/lint-common.yml"
 
 lint-kyverno:
-  allow_failure: true
+  allow_failure: false
   extends: ".lint-common"
   image: "${OPENDESK_LINT_IMAGE}"
   parallel:
@@ -14,22 +14,47 @@ lint-kyverno:
           - "collabora"
           - "cryptpad"
           - "element"
-          - "intercom-service"
           - "jitsi"
           - "nextcloud"
+          - "notes"
+          - "nubus"
           - "open-xchange"
+          - "opendesk-migrations-post"
+          - "opendesk-migrations-pre"
+          - "opendesk-openproject-bootstrap"
+          - "opendesk-services"
           - "openproject"
-          - "openproject-bootstrap"
-          - "provisioning"
-          - "services"
-          - "univention-management-stack"
+          - "services-external"
           - "xwiki"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${APP}"
-    - "helmfile template -e test --include-needs > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
-    - "node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests -d ${CI_PROJECT_DIR}/.kyverno -t required ${APP}"
-    - "node /app/opendesk-ci-cli/src/index.js filter-for-kinds -f ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-env
+      -d ${CI_PROJECT_DIR}/helmfile/environments
+      -x ${CI_PROJECT_DIR}/.kyverno/_overwrite.yaml
+    - "helmfile template -e test --include-needs --skip-tests > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
+    - >
+      node /app/opendesk-ci-cli/src/index.js remove-empty-keys
+      -f ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml
     - "cd ${CI_PROJECT_DIR}/.kyverno"
+    # Test optional
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
+      -d ${CI_PROJECT_DIR}/.kyverno
+      -t optional
+      -s manifest
+      -f opendesk.yaml
+      --skip-tests true
+      ${APP}
+    - "kyverno test . || true"
+    # Test required
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
+      -d ${CI_PROJECT_DIR}/.kyverno
+      -t required
+      -s manifest
+      -f opendesk.yaml
+      --skip-tests true
+      ${APP}
     - "kyverno test ."
-
 ...

.gitlab/lint/lint-opendesk.yml

@@ -7,6 +7,11 @@ include:
 lint-opendesk:
   extends: ".lint-common"
   image: "${OPENDESK_CI_CLI_IMAGE}"
+  rules:
+    - if: >
+        $RUN_RENOVATE == "yes"
+      when: "never"
+    - when: "always"
   script:
     - "node /app/src/index.js sort-all -d ${CI_PROJECT_DIR}/helmfile"
     - "git diff --exit-code"

.gitlab/lint/lint-reuse.yml

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+reuse-linter:
+  allow_failure: false
+  rules:
+    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
+      when: "never"
+    - when: "always"
+...

.gitlab/merge_request_templates/Bugfix.md

@@ -0,0 +1,61 @@
+# 🪲 Bugfix
+
+*Expected MR Title and git commit message*
+*`fix(<app-name>): <Short description of what has been fixed>`*
+
+
+## ✅ Changes
+
+Explain for the reviewer how the change addresses the issue, providing some insights on the underlaying cause of the bug.
+
+- ...
+
+## 🧪 How to reproduce & test
+
+Provida a link to the issue or document the required details below.
+In case it is a GitLab issue, reference it at the end of the commit message in square brackets, like `[#123]`
+Provide steps for QA or reviewers to test the fix and mention anything reviewers should be aware of.
+
+### Steps to reproduce
+
+1. ...
+
+### Actual behaviour
+
+*Based on the "Steps to reproduce" explain what the user sees while the bug isn't fixed.*
+
+### Expected behaviour
+
+*Based on the "Steps to reproduce" explain what the user gets to see with the bug fix merged.*
+
+## 🔄 Requirements for migrations
+
+- [ ] Describe manual steps required to update existing deployments. This especially applies if this MR introduces breaking changes:
+- [ ] Any other considerations in context of the update:
+
+# Checklist / Sign-offs
+
+## 🏷️ Labels
+
+Set labels:
+
+```
+/label ~"MR-Type::Bugfix"
+/label ~"PO::👀"
+/label ~"QA::👀"
+/label ~"Testautomation::👀"
+```
+
+ # 👷 Developer Checklist
+
+**Documentation:**
+
+Does this MR introduce changes (e.g., new secrets, configuration options) that require documentation?
+- [ ] No
+- [ ] Yes, and the documentation has been updated accordingly
+
+**Quality Assurance:**
+- [ ] Verified that the feature works as expected, including upgrade scenarios
+- [ ] Performed regression testing
+- Link to internal comment(s) with detailed QA results (to avoid exposing infrastructure details):
+  - ...

.gitlab/merge_request_templates/Default.md

@@ -0,0 +1,13 @@
+Thank you for your contribution!
+
+Please follow these simple guidelines to continue:
+
+- Select a MR template in case you contribution is covers more than simple documentation/non functional changes:
+  - `Update`: Major/minor updates of openDesk core applications, the ones listed on the [README.md](../../README.md). Main commit should be `feat(component): ...`
+  - `Bugfix`: For (bug)fixes in the platform or non-update/feature releases of the openDesk core applications. Main commit should be `fix(component): ...`
+  - `Feature`: An update in the platform providing support for a specific feature. Main commit should be `feat(component): ...`
+  - `Other`: All other changes.
+  - In case you just do a `chore`/`docs` commit, you can skip the templates from above.
+- Create MRs early and use the "draft" state to show that this MR isn't ready for review and merge.
+- Always assign the MR to yourself and set somebody from the development team as reviewer. If you do not know whom to chose leave the reviewer empty.
+- Flag the MR "ready" as soon as it can be reviewed and QA'd.

.gitlab/merge_request_templates/Feature.md

@@ -0,0 +1,48 @@
+# ⬆️ Feature
+
+*Expected MR Title and git commit message*
+*`feat(<app-name>): <Short description of the new feature>`*
+
+## ✅ Changes
+
+List the key changes made in this MR:
+
+- ...
+
+## 🧪 Tests
+
+Provide steps for QA or reviewers to test the feature and mention anything reviewers should be aware of:
+
+- ...
+
+## 🔄 Requirements for migrations
+
+- [ ] Describe manual steps required to update existing deployments. This especially applies if this MR introduces breaking changes:
+- [ ] Any other considerations in context of the update:
+
+# Checklist / Sign-offs
+
+## 🏷️ Labels
+
+Set labels:
+
+```
+/label ~"MR-Type::Feature"
+/label ~"PO::👀"
+/label ~"QA::👀"
+/label ~"Testautomation::👀"
+```
+
+# 👷 Developer Checklist
+
+**Documentation:**
+
+Does this MR introduce changes (e.g., new secrets, configuration options) that require documentation?
+- [ ] No
+- [ ] Yes, and the documentation has been updated accordingly
+
+**Quality Assurance:**
+- [ ] Verified that the feature works as expected, including upgrade scenarios
+- [ ] Performed regression testing
+- Link to internal comment(s) with detailed QA results (to avoid exposing infrastructure details):
+  - ...

.gitlab/merge_request_templates/Other.md

@@ -0,0 +1,42 @@
+# 🎉 Other
+
+*Expected MR Title and git commit message*
+*`fix(<component>): <Short description of what has been changed>`*
+
+## ✅ Changes
+
+Explain for the reviewer and QA the reason for the MR and what changes are included.
+
+- ...
+
+## 🔄 Requirements for migrations
+
+- [ ] Describe manual steps required to update existing deployments. This especially applies if this MR introduces breaking changes:
+- [ ] Any other considerations in context of the update:
+
+# Checklist / Sign-offs
+
+## 🏷️ Labels
+
+Set labels:
+
+```
+/label ~"MR-Type::Other"
+/label ~"PO::👀"
+/label ~"QA::👀"
+/label ~"Testautomation::👀"
+```
+
+# 👷 Developer Checklist
+
+**Documentation:**
+
+Does this MR introduce changes (e.g., new secrets, configuration options) that require documentation?
+- [ ] No
+- [ ] Yes, and the documentation has been updated accordingly
+
+**Quality Assurance:**
+- [ ] Verified that the feature works as expected, including upgrade scenarios
+- [ ] Performed regression testing
+- Link to internal comment(s) with detailed QA results (to avoid exposing infrastructure details):
+  - ...

.gitlab/merge_request_templates/Update.md

@@ -0,0 +1,42 @@
+# ⬆️ Application Update
+
+*Expected MR Title and git commit message*
+*`feat/fix(<app-name>): Update from <old-version> to <new-version>`*
+
+## 📋 Changelog/Release Notes
+
+- [ ] [README.md](../../README.md) component table updated including the link to the related release notes of the updated application.
+- [ ] Provide significant improvements you would like to see in the [openDesk release notes](https://www.opendesk.eu/en/blog/opendesk-1-6). If you have a lot of details to provide or someone else is providing the details, you can use a comment on this MR and provide a link here.
+
+## 🔄 Requirements for migrations
+
+- [ ] Minimum version of the application required in existing deployments to update/upgrade:
+- [ ] Describe manual steps required to update existing deployments. This especially applies if the upgrade includes any breaking changes:
+- [ ] Any other considerations in context of the update:
+
+# Checklist / Sign-offs
+
+## 🏷️ Labels
+
+Set labels:
+
+```
+/label ~"MR-Type::AppUpdate"
+/label ~"PO::👀"
+/label ~"QA::👀"
+/label ~"Testautomation::👀"
+```
+
+# 👷 Developer Checklist
+
+**Documentation:**
+
+Does this MR introduce changes (e.g., new secrets, configuration options) that require documentation?
+- [ ] No
+- [ ] Yes, and the documentation has been updated accordingly
+
+**Quality Assurance:**
+- [ ] Verified that the feature works as expected, including upgrade scenarios
+- [ ] Performed regression testing
+- Link to internal comment(s) with detailed QA results (to avoid exposing infrastructure details):
+  - ...

.gitlab/release/release-common.yml

@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# Overwrite shared settings
+.common-semantic-release:
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
+  tags: []
+...

.gitlab/release/release-generate-version.yml

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+generate-release-version:
+  rules:
+    - if: >
+        $JOB_RELEASE_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
+      when: "on_success"
+...

.gitlab/release/release-semantic.yml

@@ -0,0 +1,63 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+release:
+  cache:
+    - key: "generate-docs-${CI_COMMIT_REF_SLUG}"
+      paths:
+        - "${CI_PROJECT_DIR}/docs"
+      policy: "pull"
+  rules:
+    - if: >
+        $JOB_AVSCAN_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
+      when: "on_success"
+  script:
+    - >
+      export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
+      "@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
+      grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
+    - |
+      if [ -z "${RELEASE_VERSION}" ]; then
+        echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
+      else
+        echo "RELEASE_VERSION=${RELEASE_VERSION}"
+      fi
+    - |
+      echo -e "\n[INFO] Writing data to helm value file..."
+      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
+      # SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+      # SPDX-License-Identifier: Apache-2.0
+      ---
+      global:
+        systemInformation:
+          releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
+      ...
+      EOF
+    - |
+      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
+      {
+        "branches": ["main"],
+        "plugins": [
+          "@semantic-release/gitlab",
+          "@semantic-release/release-notes-generator",
+          "@semantic-release/changelog",
+          ["@semantic-release/git", {
+            "assets": [
+              "charts/**/Chart.yaml",
+              "CHANGELOG.md",
+              "charts/**/README.md",
+              "helmfile/environments/default/global.generated.yaml.gotmpl",
+              ".kyverno/kyverno-test.yaml",
+              "docs"
+            ],
+            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+          }]
+        ]
+      }
+      EOF
+    - "semantic-release"
+  needs:
+    - "generate-docs"
+...

.gitlab/renovate/renovate.yml

@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+renovate:
+  rules:
+    - if: >
+        $RUN_RENOVATE == "yes"
+      when: "on_success"
+  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
+  variables:
+    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
+    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
+    # Increase the renovatebot log level on stdout
+    LOG_LEVEL: "DEBUG"
+  script:
+    - "renovate ${RENOVATE_EXTRA_FLAGS}"
+  stage: "renovate"
+...

.kyverno/_apps.yaml

@@ -1,279 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-pod:
-  - resource: "mariadb"
-    kind: "StatefulSet"
-    app: "services"
-  - resource: "postgresql"
-    kind: "StatefulSet"
-    app: "services"
-  - resource: "clamav-simple"
-    kind: "StatefulSet"
-    app: "services"
-  - resource: "redis-master"
-    kind: "StatefulSet"
-    app: "services"
-  - resource: "ums-store-dav"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-ldap-server"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-ldap-notifier"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-portal-listener"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-selfservice-listener"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-provisioning-nats"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-guardian-management-api"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-guardian-management-ui"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-guardian-authorization-api"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "ums-open-policy-agent"
-    kind: "StatefulSet"
-    app: "univention-management-stack"
-  - resource: "open-xchange-core-mw-default"
-    kind: "StatefulSet"
-    app: "open-xchange"
-  - resource: "jitsi-prosody"
-    kind: "StatefulSet"
-    app: "jitsi"
-  - resource: "opendesk-synapse"
-    kind: "StatefulSet"
-    app: "element"
-  - resource: "xwiki"
-    kind: "StatefulSet"
-    app: "xwiki"
-  - resource: "ox-connector"
-    kind: "StatefulSet"
-    app: "provisioning"
-  - resource: "minio"
-    kind: "Deployment"
-    app: "services"
-  - resource: "cryptpad"
-    kind: "Deployment"
-    app: "cryptpad"
-  - resource: "memcached"
-    kind: "Deployment"
-    app: "services"
-  - resource: "postfix"
-    kind: "Deployment"
-    app: "services"
-  - resource: "ums-keycloak"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-stack-gateway"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-udm-rest-api"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-portal-server"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-notifications-api"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-portal-frontend"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-umc-gateway"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-umc-server"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-provisioning-nats-box"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-keycloak-extensions-handler"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "ums-keycloak-extensions-proxy"
-    kind: "Deployment"
-    app: "univention-management-stack"
-  - resource: "intercom-service"
-    kind: "Deployment"
-    app: "intercom-service"
-  - resource: "dovecot"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-documentconverter"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-guidedtours"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-imageconverter"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-gotenberg"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-ui-middleware"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-ui-middleware-updater"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-ui"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-core-user-guide"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-guard-ui"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-nextcloud-integration-ui"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "open-xchange-public-sector-ui"
-    kind: "Deployment"
-    app: "open-xchange"
-  - resource: "opendesk-nextcloud-apache2"
-    kind: "Deployment"
-    app: "nextcloud"
-  - resource: "opendesk-nextcloud-exporter"
-    kind: "Deployment"
-    app: "nextcloud"
-  - resource: "opendesk-nextcloud-php"
-    kind: "Deployment"
-    app: "nextcloud"
-  - resource: "collabora"
-    kind: "Deployment"
-    app: "collabora"
-  - resource: "jitsi-jibri"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "jitsi-jicofo"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "jitsi-jvb"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "jitsi-web"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "jitsi-opendesk-jitsi-keycloak-adapter"
-    kind: "Deployment"
-    app: "jitsi"
-  - resource: "opendesk-element"
-    kind: "Deployment"
-    app: "element"
-  - resource: "opendesk-well-known"
-    kind: "Deployment"
-    app: "element"
-  - resource: "opendesk-synapse-web"
-    kind: "Deployment"
-    app: "element"
-  - resource: "opendesk-matrix-user-verification-service"
-    kind: "Deployment"
-    app: "element"
-  - resource: "matrix-neoboard-widget"
-    kind: "Deployment"
-    app: "element"
-  - resource: "matrix-neochoice-widget"
-    kind: "Deployment"
-    app: "element"
-  - resource: "matrix-neodatefix-widget"
-    kind: "Deployment"
-    app: "element"
-  - resource: "matrix-neodatefix-bot"
-    kind: "Deployment"
-    app: "element"
-  - resource: "openproject-web"
-    kind: "Deployment"
-    app: "openproject"
-  - resource: "openproject-worker"
-    kind: "Deployment"
-    app: "openproject"
-  - resource: "mariadb-bootstrap"
-    kind: "Job"
-    app: "services"
-  - resource: "postgresql-bootstrap"
-    kind: "Job"
-    app: "services"
-  - resource: "minio-provisioning"
-    kind: "Job"
-    app: "services"
-  - resource: "ums-stack-data-ums-1"
-    kind: "Job"
-    app: "univention-management-stack"
-  - resource: "ums-stack-data-swp-1"
-    kind: "Job"
-    app: "univention-management-stack"
-  - resource: "ums-keycloak-bootstrap-bootstrap-1"
-    kind: "Job"
-    app: "univention-management-stack"
-  - resource: "opendesk-keycloak-bootstrap-bootstrap-1"
-    kind: "Job"
-    app: "univention-management-stack"
-  - resource: "opendesk-open-xchange-bootstrap"
-    kind: "Job"
-    app: "open-xchange"
-  - resource: "opendesk-nextcloud-management-1"
-    kind: "Job"
-    app: "nextcloud"
-  - resource: "jitsi-opendesk-jitsi"
-    kind: "Job"
-    app: "jitsi"
-  - resource: "opendesk-matrix-user-verification-service-bootstrap"
-    kind: "Job"
-    app: "element"
-  - resource: "matrix-neodatefix-bot-bootstrap"
-    kind: "Job"
-    app: "element"
-  - resource: "opendesk-openproject-bootstrap-bootstrap-1"
-    kind: "Job"
-    app: "openproject-bootstrap"
-#  # Has timestamp in resource name - not supported yet.
-#  - resource: "openproject-seeder-*"
-#    kind: "Job"
-#  - resource: "ums-store-dav-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-udm-rest-api-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-portal-server-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-notifications-api-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-portal-frontend-test-connection"
-#    kind: "Pod"
-#  - resource: "ums-provisioning-nats-test-request-reply"
-#    kind: "Pod"
-#  - resource: "ums-provisioning-provisioning-api-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-core-guidedtours-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-gotenberg-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-core-ui-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-core-user-guide-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-guard-ui-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-nextcloud-integration-ui-test-connection"
-#    kind: "Pod"
-#  - resource: "open-xchange-public-sector-ui-test-connection"
-#    kind: "Pod"
-#  - resource: "jitsi-prosody-test-connection"
-#    kind: "Pod"
-#  - resource: "jitsi-web-test-connection"
-#    kind: "Pod"
-#  - resource: "openproject-test-connection"
-#    kind: "Pod"
-...

.kyverno/_overwrite.yaml

@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+replicas:
+  umsLdapServerPrimary: 2
+...

.kyverno/policies/_policies.yaml

@@ -1,55 +1,292 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 pod:
   - name: "require-tag-and-digest"
     rule: "require-tag-and-digest"
     type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "disallow-default-serviceaccount"
-    rule: "require-sa"
-    type: "required"
-  - name: "require-imagepullsecrets"
-    rule: "require-imagepullsecrets"
+    rule: "disallow-default-serviceAccountName"
+    type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "template-imagepullsecrets"
+    rule: "template-imagePullSecrets"
     type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "disallow-latest-tag"
-    rule: "validate-image-tag"
+    rule: "disallow-latest-tag"
     type: "required"
-  - name: "require-imagepullpolicy-always"
-    rule: "require-imagepullpolicy-always"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-latest-tag"
+    rule: "require-image-tag-or-digest"
     type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-imagepullpolicy"
+    rule: "require-imagePullPolicy"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-health-and-liveness-check"
     rule: "require-health-and-liveness-check"
+    type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Pod"
+      - "DaemonSet"
+  - name: "template-storage"
+    rule: "template-storageClassName-pod"
     type: "required"
-    excludeKinds:
-      - "Job"
+    kinds:
+      - "PersistentVolumeClaim"
+  - name: "template-storage"
+    rule: "template-storageClassName-pvc"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+  - name: "template-storage"
+    rule: "template-requests-storage-pod"
+    type: "required"
+    kinds:
+      - "PersistentVolumeClaim"
+  - name: "template-storage"
+    rule: "template-requests-storage-pvc"
+    type: "required"
+    kinds:
+      - "StatefulSet"
   - name: "require-requests-limits"
     rule: "validate-resources"
     type: "required"
-  - name: "restrict-image-registries"
-    rule: "validate-registries"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "template-image-registries"
+    rule: "template-image-registries"
     type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-ro-rootfs"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-no-privilege-escalation"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-all-capabilities-dropped"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-no-privileged"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-run-as-user"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-run-as-group"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-seccomp-profile"
-    type: "required"
+    type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-run-as-non-root"
     type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-containersecuritycontext"
+    rule: "require-empty-seLinuxOptions"
+    type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-containersecuritycontext"
+    rule: "require-default-procMount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-containersecuritycontext"
+    rule: "restrict-sysctls"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-docker-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-containerd-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-crio-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-dockerd-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-namespaces"
+    rule: "disallow-host-namespaces"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-path"
+    rule: "disallow-host-path"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-ports"
+    rule: "disallow-host-ports"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-process"
+    rule: "disallow-host-process"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "template-ingress"
+    rule: "template-ingressClassName"
+    type: "required"
+    kinds:
+      - "Ingress"
+  - name: "template-ingress"
+    rule: "template-tls-secretName"
+    type: "required"
+    kinds:
+      - "Ingress"
+  - name: "template-replicas"
+    rule: "template-replicas"
+    type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
 ...

.kyverno/policies/disallow-container-sock-mounts.yaml

@@ -0,0 +1,80 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-container-sock-mounts"
+  annotations:
+    policies.kyverno.io/title: "Disallow CRI socket mounts"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Container daemon socket bind mounts allow access to the container engine on the node.
+      This access can be used for privilege escalation and to manage containers outside of Kubernetes, and hence should
+      not be allowed.
+      This policy validates that the sockets used for CRI engines Docker, Containerd, and CRI-O are not used.
+      In addition to or replacement of this policy, preventing users from mounting the parent directories
+      (/var/run and /var) may be necessary to completely prevent socket bind mounts.
+spec:
+  background: true
+  rules:
+    - name: "validate-docker-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the Docker Unix socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/docker.sock"
+          - spec:
+              =(volumes):
+    - name: "validate-containerd-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the Containerd Unix socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/containerd/containerd.sock"
+          - spec:
+              =(volumes):
+    - name: "validate-crio-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the CRI-O Unix socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/crio/crio.sock"
+          - spec:
+              =(volumes):
+    - name: "validate-dockerd-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the Docker CRI socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/cri-dockerd.sock"
+          - spec:
+              =(volumes):

.kyverno/policies/disallow-default-serviceaccount.yaml

@@ -1,10 +1,20 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "disallow-default-serviceaccount"
+  annotations:
+    policies.kyverno.io/title: "Prevent default ServiceAccount privilege escalation"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Kubernetes automatically creates a ServiceAccount object named default for every namespace in your cluster.
+      These default service accounts get no permissions by default.
+      Accidental or intended assignment of permissions on the default service account results in elevated permissions
+      for all pods with default service account assigned.
+      This risk can be mitigated by creating a custom ServiceAccount for each application or reduce the risk by disable
+      auto mounting the default service account into the pod.
 spec:
   background: true
   rules:
@@ -12,11 +22,15 @@ spec:
         resources:
           kinds:
             - "Pod"
-      name: "require-sa"
+      name: "disallow-default-serviceAccountName"
       validate:
-        message: "serviceAccountName must be set to anything other than 'default'."
-        pattern:
-          spec:
-            serviceAccountName: "!default"
+        message: >-
+          Field serviceAccountName must be set to anything other than 'default'.
+          When serviceAccountName is 'default' then automountServiceAccountToken must set to 'false' .
+        anyPattern:
+          - spec:
+              serviceAccountName: "!default"
+          - spec:
+              automountServiceAccountToken: "false"
   validationFailureAction: "audit"
 ...

.kyverno/policies/disallow-host-namespaces.yaml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-namespaces"
+  annotations:
+    policies.kyverno.io/title: "Disallow Host Namespaces"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Host namespaces (Process ID namespace, Inter-Process Communication namespace, and network namespace) allow access
+      to shared information and can be used to elevate privileges.
+      Pods should not be allowed access to host namespaces.
+      This policy ensures fields which make use of these host namespaces are unset or set to `false`.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-namespaces"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
+          spec.hostIPC, and spec.hostPID must be unset or set to `false`.
+        pattern:
+          spec:
+            =(hostPID): "false"
+            =(hostIPC): "false"
+            =(hostNetwork): "false"

.kyverno/policies/disallow-host-path.yaml

@@ -0,0 +1,32 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-path"
+  annotations:
+    policies.kyverno.io/title: "Disallow hostPath"
+    policies.kyverno.io/subject: "Pod,Volume"
+    policies.kyverno.io/description: >-
+      HostPath volumes let Pods use host directories and volumes in containers.
+      Using host resources can be used to access shared data or escalate privileges and should not be allowed.
+      This policy ensures no hostPath volumes are in use.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-path"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.
+        anyPattern:
+          - spec:
+              =(volumes):
+                - X(hostPath): "null"
+          - spec:
+              =(volumes):

.kyverno/policies/disallow-host-ports.yaml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-ports"
+  annotations:
+    policies.kyverno.io/title: "Disallow hostPorts"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Access to host ports allows potential snooping of network traffic and should not be allowed, or at minimum
+      restricted to a known list. This policy ensures the `hostPort` field is unset or set to `0`.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-ports"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort
+          , spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
+          must either be unset or set to `0`.
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(ports):
+                  - =(hostPort): 0
+            =(initContainers):
+              - =(ports):
+                  - =(hostPort): 0
+            containers:
+              - =(ports):
+                  - =(hostPort): 0

.kyverno/policies/disallow-host-process.yaml

@@ -0,0 +1,45 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-process"
+  annotations:
+    policies.kyverno.io/title: "Disallow hostProcess"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Windows pods offer the ability to run HostProcess containers which enables privileged access to the Windows node.
+      Privileged access to the host is disallowed in the baseline policy.
+      HostProcess pods are an alpha feature as of Kubernetes v1.22.
+      This policy ensures the `hostProcess` field, if present, is set to `false`.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-process"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess,
+          spec.containers[*].securityContext.windowsOptions.hostProcess,
+          spec.initContainers[*].securityContext.windowsOptions.hostProcess, and
+          spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess must either be undefined or set to
+          `false`.
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(securityContext):
+                  =(windowsOptions):
+                    =(hostProcess): "false"
+            =(initContainers):
+              - =(securityContext):
+                  =(windowsOptions):
+                    =(hostProcess): "false"
+            containers:
+              - =(securityContext):
+                  =(windowsOptions):
+                    =(hostProcess): "false"

.kyverno/policies/disallow-latest-tag.yaml

@@ -1,10 +1,18 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "disallow-latest-tag"
+  annotations:
+    policies.kyverno.io/title: "Disallow usage of latest tag"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      The ':latest' tag is mutable and can lead to unexpected errors if the image changes.
+      A best practice is to use an immutable tag that maps to a specific version of an application Pod.
+      This policy validates that the image specifies a tag and that it is not called `latest`.
+      Defining no image tag or digest result in the container engine retrieving the latest tag.
 spec:
   background: true
   rules:
@@ -12,7 +20,7 @@ spec:
         resources:
           kinds:
             - "Pod"
-      name: "validate-image-tag"
+      name: "disallow-latest-tag"
       validate:
         message: "Using a mutable image tag e.g. 'latest' is not allowed."
         pattern:
@@ -23,5 +31,27 @@ spec:
               - image: "!*:latest"
             containers:
               - image: "!*:latest"
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "require-image-tag-or-digest"
+      validate:
+        message: "A image tag or a digest is required, otherwise latest tag is chosen."
+        anyPattern:
+          - spec:
+              =(ephemeralContainers):
+                - image: "*:*"
+              =(initContainers):
+                - image: "*:*"
+              containers:
+                - image: "*:*"
+          - spec:
+              =(ephemeralContainers):
+                - image: "*@*"
+              =(initContainers):
+                - image: "*@*"
+              containers:
+                - image: "*@*"
   validationFailureAction: "audit"
 ...

.kyverno/policies/require-containersecuritycontext.yaml

@@ -1,10 +1,16 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-containersecuritycontext"
+  annotations:
+    policies.kyverno.io/title: "ContainerSecurityContext best practices are set."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      The containerSecurityContext is the most important security-related section because it has the highest precedence
+      and restricts the container to its minimal privileges.
 spec:
   background: true
   rules:
@@ -169,5 +175,70 @@ spec:
               - securityContext:
                   runAsNonRoot: true
 
+    - name: "require-empty-seLinuxOptions"
+      match:
+        resources:
+          kinds:
+            - "Pod"
+      validate:
+        message: "SELinux options have to be unset."
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - securityContext:
+                  seLinuxOptions:
+            =(initContainers):
+              - securityContext:
+                  seLinuxOptions:
+            containers:
+              - securityContext:
+                  seLinuxOptions:
+
+    - name: "require-default-procMount"
+      match:
+        resources:
+          kinds:
+            - "Pod"
+      validate:
+        message: >-
+          Changing the proc mount from the default is not allowed. The fields
+          spec.containers[*].securityContext.procMount, spec.initContainers[*].securityContext.procMount,
+          and spec.ephemeralContainers[*].securityContext.procMount must be unset or
+          set to `Default`.
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(securityContext):
+                  =(procMount): "Default"
+            =(initContainers):
+              - =(securityContext):
+                  =(procMount): "Default"
+            containers:
+              - =(securityContext):
+                  =(procMount): "Default"
+
+    - name: "restrict-sysctls"
+      match:
+        resources:
+          kinds:
+            - "Pod"
+      validate:
+        message: >-
+          Setting additional sysctls above the allowed type is not allowed.
+          The field spec.securityContext.sysctls must be unset or not use any other names
+          than kernel.shm_rmid_forced, net.ipv4.ip_local_port_range,
+          net.ipv4.ip_unprivileged_port_start, net.ipv4.tcp_syncookies and
+          net.ipv4.ping_group_range.
+        pattern:
+          spec:
+            =(securityContext):
+              =(sysctls):
+                - =(name): >-
+                    kernel.shm_rmid_forced |
+                    net.ipv4.ip_local_port_range |
+                    net.ipv4.ip_unprivileged_port_start |
+                    net.ipv4.tcp_syncookies |
+                    net.ipv4.ping_group_range
+
   validationFailureAction: "audit"
 ...

.kyverno/policies/require-health-and-liveness-check.yaml

@@ -1,10 +1,20 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-health-and-liveness-check"
+  annotations:
+    policies.kyverno.io/title: "Disallow usage of latest tag"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Liveness and readiness probes need to be configured to correctly manage a Pod's lifecycle during deployments,
+      restarts, and upgrades.
+      For each Pod, a periodic `livenessProbe` is performed by the kubelet to determine if the Pod's containers are
+      running or need to be restarted.
+      A `readinessProbe` is used by Services and Pods to determine if the Pod is ready to receive network traffic.
+      This policy validates that all containers have livenessProbe and readinessProbe defined.
 spec:
   background: true
   rules:
@@ -14,8 +24,9 @@ spec:
             - "Pod"
       name: "require-health-and-liveness-check"
       validate:
-        message: "Liveness and readiness probes are required. spec.containers[*].livenessProbe.periodSeconds
-          must be set to a value greater than 0."
+        message: >-
+          Liveness and readiness probes are required. spec.containers[*].livenessProbe.periodSeconds must be set to a
+          value greater than 0.
         pattern:
           spec:
             containers:

.kyverno/policies/require-imagepullpolicy-always.yaml

@@ -1,40 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-apiVersion: "kyverno.io/v1"
-kind: "ClusterPolicy"
-metadata:
-  name: "require-imagepullpolicy-always"
-spec:
-  background: true
-  rules:
-    - match:
-        resources:
-          kinds:
-            - "Pod"
-      name: "require-imagepullpolicy-always"
-      validate:
-        message: "The imagePullPolicy must be set to `Always` when the tag `latest` is used."
-        anyPattern:
-          - spec:
-              =(ephemeralContainers):
-                - (image): "*:latest"
-                  imagePullPolicy: "Always"
-              =(initContainers):
-                - (image): "*:latest"
-                  imagePullPolicy: "Always"
-              containers:
-                - (image): "*:latest"
-                  imagePullPolicy: "Always"
-          - spec:
-              =(ephemeralContainers):
-                - (image): "!*:latest"
-                  imagePullPolicy: "IfNotPresent"
-              =(initContainers):
-                - (image): "!*:latest"
-                  imagePullPolicy: "IfNotPresent"
-              containers:
-                - (image): "!*:latest"
-                  imagePullPolicy: "IfNotPresent"
-  validationFailureAction: "audit"
-...

.kyverno/policies/require-imagepullpolicy.yaml

@@ -0,0 +1,51 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "require-imagepullpolicy"
+  annotations:
+    policies.kyverno.io/title: "Disallow usage of latest tag"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      If the `latest` tag is allowed for images, it is a good idea to have the imagePullPolicy field set to `Always` to
+      ensure later pulls get an updated image in case the latest tag gets updated.
+      This policy validates the imagePullPolicy is set to `Always` when the `latest` tag is specified explicitly or
+      where a tag is not defined at all.
+      Additionally this policy checks if the variable `.Values.global.imagePullPolicy` is used in templates.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "require-imagePullPolicy"
+      validate:
+        message: >-
+          The imagePullPolicy must be set to `Always` when the `latest` tag is used, otherwise the value from
+          `.Values.global.imagePullPolicy` has to be used.
+        anyPattern:
+          - spec:
+              =(ephemeralContainers):
+                - (image): "*:latest | !*:*"
+                  imagePullPolicy: "Always"
+              =(initContainers):
+                - (image): "*:latest | !*:*"
+                  imagePullPolicy: "Always"
+              containers:
+                - (image): "*:latest | !*:*"
+                  imagePullPolicy: "Always"
+          - spec:
+              =(ephemeralContainers):
+                - (image): "!*:latest"
+                  imagePullPolicy: "kyverno"
+              =(initContainers):
+                - (image): "!*:latest"
+                  imagePullPolicy: "kyverno"
+              containers:
+                - (image): "!*:latest"
+                  imagePullPolicy: "kyverno"
+  validationFailureAction: "audit"
+...

.kyverno/policies/require-imagepullsecets.yaml

@@ -1,23 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-apiVersion: "kyverno.io/v1"
-kind: "ClusterPolicy"
-metadata:
-  name: "require-imagepullsecrets"
-spec:
-  background: true
-  rules:
-    - match:
-        resources:
-          kinds:
-            - "Pod"
-      name: "require-imagepullsecrets"
-      validate:
-        message: "ImagePullSecrets are required."
-        pattern:
-          spec:
-            imagePullSecrets:
-              - name: "*"
-  validationFailureAction: "audit"
-...

.kyverno/policies/require-requests-limits.yaml

@@ -1,10 +1,20 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-requests-limits"
+  annotations:
+    policies.kyverno.io/title: "Require resources cpu/memory request and limits."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      As application workloads share cluster resources, it is important to limit resources requested and consumed by
+      each Pod.
+      It is recommended to require resource requests and limits per Pod, especially for memory and CPU.
+      If a Namespace level request or limit is specified, defaults will automatically be applied to each Pod based on
+      the LimitRange configuration.
+      This policy validates that all containers have specified requests for memory and CPU and a limit for memory.
 spec:
   background: true
   rules:
@@ -17,6 +27,20 @@ spec:
         message: "CPU and memory resource requests and limits are required."
         pattern:
           spec:
+            =(ephemeralContainers):
+              - resources:
+                  limits:
+                    memory: "?*"
+                  requests:
+                    cpu: "?*"
+                    memory: "?*"
+            =(initContainers):
+              - resources:
+                  limits:
+                    memory: "?*"
+                  requests:
+                    cpu: "?*"
+                    memory: "?*"
             containers:
               - resources:
                   limits:

.kyverno/policies/require-tag-and-digest.yaml

@@ -1,10 +1,18 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-tag-and-digest"
+  annotations:
+    policies.kyverno.io/title: "Require tag and digest for image."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      To ensure that containers are not compromised in container registry by pushing malicious code to the same tag, it
+      is required to reference images by setting a sha256 hashed digest.
+      Setting only the digest is complicated for humans to compare software versions, therefore in openDesk it is
+      required to reference container images by tag and digest.
 spec:
   background: true
   rules:

.kyverno/policies/restrict-image-registries.yaml

@@ -1,27 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-apiVersion: "kyverno.io/v1"
-kind: "ClusterPolicy"
-metadata:
-  name: "restrict-image-registries"
-spec:
-  background: true
-  rules:
-    - match:
-        resources:
-          kinds:
-            - "Pod"
-      name: "validate-registries"
-      validate:
-        message: "Unknown image registry."
-        pattern:
-          spec:
-            =(ephemeralContainers):
-              - image: "external-registry.souvap-univention.de/*"
-            =(initContainers):
-              - image: "external-registry.souvap-univention.de/*"
-            containers:
-              - image: "external-registry.souvap-univention.de/*"
-  validationFailureAction: "audit"
-...

.kyverno/policies/template-image-registries.yaml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-image-registries"
+  annotations:
+    policies.kyverno.io/title: "Check image registry template"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy verifies that a custom external registry can be template to allow downloads from a private registry or
+      cache.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "template-image-registries"
+      validate:
+        message: "Unknown image registry."
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - image: "my_private_registry.domain.tld/*"
+            =(initContainers):
+              - image: "my_private_registry.domain.tld/*"
+            containers:
+              - image: "my_private_registry.domain.tld/*"
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-ingress.yaml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-ingress"
+  annotations:
+    policies.kyverno.io/title: "Validate openDesk Ingress templating"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy verifies that ingress variables are templated.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Ingress"
+      name: "template-ingressClassName"
+      validate:
+        message: "Verifies that ingressClassName can be customized by `.Values.ingress.ingressClassName` variable."
+        pattern:
+          spec:
+            ingressClassName: "kyverno"
+    - match:
+        resources:
+          kinds:
+            - "Ingress"
+      name: "template-tls-secretName"
+      validate:
+        message: "Verifies that tls.secretName can be customized by `.Values.ingress.tls.secretName` variable."
+        pattern:
+          spec:
+            tls:
+              - secretName: "kyverno-tls"
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-replicas.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-replicas"
+  annotations:
+    policies.kyverno.io/title: "Validate openDesk Pod replicas templating"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy verifies that `.Values.replicas.<app>` variables are templated.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Deployment"
+            - "StatefulSet"
+      name: "template-replicas"
+      validate:
+        message: "Verifies that replica count can be customized by `.Values.replicas.<app>` variable."
+        pattern:
+          spec:
+            replicas: 42
+
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-require-imagepullsecets.yaml

@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-imagepullsecrets"
+  annotations:
+    policies.kyverno.io/title: "ImagePullSecrets template variable have to be implemented."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      It is recommended to cache images to ensure continuous image availability during network partitions, rate limiting
+      or registry outages.
+      These caches as well as a company proxy may require authentication which will be provided as ImagePullSecrets.
+      This is a openDesk test to ensure that environment variables are templated in Helmfile deployment.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "template-imagePullSecrets"
+      validate:
+        message: "ImagePullSecrets are required."
+        pattern:
+          spec:
+            imagePullSecrets:
+              - name: "kyverno-test"
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-storage.yaml

@@ -0,0 +1,67 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-storage"
+  annotations:
+    policies.kyverno.io/title: "Validate storageClass and size templates."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy validates if `.Values.persistence.storageClassNames` variables are used in templates and if the size
+      of volumes can be customized by `.Values.persistence.storages.<COMPONENT>.size` variable.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "StatefulSet"
+      name: "template-storageClassName-pod"
+      validate:
+        message: "VolumeClaims inside pods needs to have storageClass set when templated."
+        pattern:
+          spec:
+            (volumeClaimTemplates):
+              - spec:
+                  storageClassName: "kyverno-test"
+    - match:
+        resources:
+          kinds:
+            - "PersistentVolumeClaim"
+      name: "template-storageClassName-pvc"
+      validate:
+        message: "PersistentVolumeClaim needs to have storageClassName set when templated."
+        pattern:
+          spec:
+            storageClassName: "kyverno-test"
+
+    - match:
+        resources:
+          kinds:
+            - "StatefulSet"
+      name: "template-requests-storage-pod"
+      validate:
+        message: "VolumeClaims inside pods needs to have storageClass set when templated."
+        pattern:
+          spec:
+            (volumeClaimTemplates):
+              - spec:
+                  resources:
+                    requests:
+                      storage: "42Gi"
+    - match:
+        resources:
+          kinds:
+            - "PersistentVolumeClaim"
+      name: "template-requests-storage-pvc"
+      validate:
+        message: "PersistentVolumeClaim needs to have storageClassName set when templated."
+        pattern:
+          spec:
+            resources:
+              requests:
+                storage: "42Gi"
+  validationFailureAction: "audit"
+...

.opencode/openDesk-logo-rgb-color.svg

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Ebene_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 693.25 214.02">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: #571efa;
+      }
+
+      .cls-2 {
+        fill: #927afa;
+      }
+    </style>
+  </defs>
+  <g>
+    <path class="cls-2" d="M126.14,140.32v2.13c0,8.99-7.31,16.3-16.3,16.3h-38.26c-8.99,0-16.3-7.31-16.3-16.3v-38.26c0-8.99,7.31-16.3,16.3-16.3h2.13v52.44h52.44Z"/>
+    <path class="cls-1" d="M126.85,127.56h-40.39v-44.65c0-15.24,12.4-27.64,27.64-27.64h12.76c17.58,0,31.89,14.31,31.89,31.89v8.5c0,17.58-14.31,31.89-31.89,31.89ZM104.88,109.13h21.97c7.42,0,13.46-6.04,13.46-13.46v-8.5c0-7.42-6.04-13.46-13.46-13.46h-12.76c-5.08,0-9.21,4.13-9.21,9.21v26.22Z"/>
+  </g>
+  <g>
+    <path d="M210.82,90.76c14.85,0,24.34,10.9,24.34,24.25s-9.49,24.25-24.34,24.25-24.44-10.9-24.44-24.25,9.49-24.25,24.44-24.25ZM210.82,133.34c11.37,0,17.39-8.46,17.39-18.33s-6.02-18.33-17.39-18.33-17.48,8.46-17.48,18.33,6.01,18.33,17.48,18.33Z"/>
+    <path d="M244.19,91.7h6.96v11.84c3.29-7.8,10.25-12.78,20.4-12.78,13.07,0,21.9,9.87,21.9,24.34s-8.83,24.16-21.9,24.16c-10.34,0-17.2-5.17-20.4-12.78v28.95h-6.96v-63.73ZM269.38,133.34c9.4,0,17.11-5.83,17.11-18.24s-7.71-18.42-17.11-18.42-17.95,6.11-17.95,18.42,8.65,18.24,17.95,18.24Z"/>
+    <path d="M322.96,90.76c13.35,0,22.28,8.37,22.28,22.65v2.82h-37.5c.28,9.78,5.26,17.29,15.6,17.29,8.55,0,13.54-4.51,15.23-11.47h6.86c-1.97,8.27-7.61,17.2-21.9,17.2-15.13,0-22.46-11.28-22.46-24.91,0-15.04,8.74-23.59,21.9-23.59ZM338.37,110.78c-.66-9.12-6.77-14.29-15.51-14.29-8.18,0-14.29,5.26-15.04,14.29h30.55Z"/>
+    <path d="M355.01,91.7h6.96v12.97c2.54-8.65,9.12-13.91,19.36-13.91s16.73,6.77,16.73,18.99v28.57h-7.05v-28.01c0-9.68-3.76-13.63-12.03-13.63-10.53,0-17.01,8.84-17.01,21.34v20.3h-6.96v-46.62Z"/>
+    <path d="M409.81,72.05h24.35c6.89,0,12.97.85,18.24,2.54,5.26,1.69,9.57,4.98,12.92,9.87,3.35,4.89,5.03,11.78,5.03,20.68s-1.68,15.89-5.03,20.77c-3.35,4.89-7.66,8.18-12.92,9.87-5.27,1.69-11.34,2.54-18.24,2.54h-24.35v-66.27ZM434.16,125.07c4.76,0,8.57-.38,11.42-1.13s5.17-2.55,6.96-5.41c1.79-2.85,2.68-7.32,2.68-13.39s-.91-10.46-2.72-13.35c-1.82-2.88-4.14-4.7-6.96-5.45s-6.61-1.13-11.37-1.13h-9.31v39.86h9.31Z"/>
+    <path d="M480.17,101.33c2.1-3.67,5.01-6.47,8.74-8.41s8.01-2.91,12.83-2.91c7.9,0,14.07,2.1,18.52,6.3,4.45,4.2,6.67,10,6.67,17.39v3.95h-35.53c.25,3.38,1.32,6.03,3.2,7.94,1.88,1.91,4.45,2.87,7.71,2.87,2.82,0,5.15-.59,7-1.79,1.85-1.19,3.02-2.88,3.53-5.08h14.19c-.75,5.26-3.28,9.53-7.57,12.78-4.29,3.26-9.98,4.89-17.06,4.89-5.2,0-9.71-1.05-13.54-3.15-3.82-2.1-6.75-5.03-8.79-8.79-2.04-3.76-3.05-8.08-3.05-12.97s1.05-9.35,3.15-13.02ZM513.02,109.93c-.25-3.01-1.36-5.33-3.34-6.96-1.97-1.63-4.53-2.44-7.66-2.44s-5.56.82-7.47,2.44c-1.91,1.63-2.99,3.95-3.24,6.96h21.71Z"/>
+    <path d="M539.62,134.65c-4.14-3.07-6.21-7.58-6.21-13.54h14.29c0,2.7.85,4.69,2.54,5.97,1.69,1.29,4.29,1.93,7.8,1.93,2.57,0,4.43-.33,5.59-.99,1.16-.66,1.74-1.71,1.74-3.15,0-1-.34-1.82-1.03-2.44-.69-.63-1.79-1.16-3.29-1.6l-14.48-3.95c-3.2-.81-5.95-2.27-8.27-4.37-2.32-2.1-3.48-5-3.48-8.7,0-4.45,1.83-7.86,5.5-10.25,3.67-2.38,8.79-3.57,15.37-3.57,7.27,0,12.94,1.46,17.01,4.37s6.11,7.13,6.11,12.64h-14.29c0-4.57-2.91-6.86-8.74-6.86-2.07,0-3.7.35-4.89,1.03-1.19.69-1.79,1.6-1.79,2.73,0,1.94,1.72,3.35,5.17,4.23l11.09,2.73c4.32,1.07,7.79,2.71,10.39,4.94,2.6,2.22,3.9,5.34,3.9,9.35,0,4.58-1.83,8.07-5.5,10.48-3.67,2.41-9.1,3.62-16.31,3.62-8.02,0-14.1-1.54-18.24-4.61Z"/>
+    <path d="M587.56,69.23h14.29v40.04l18.89-18.33h17.48l-23.59,23.03,23.5,24.35h-17.39l-18.89-19.93v19.93h-14.29v-69.09Z"/>
+  </g>
+</svg>

.renovate/config.yaml

@@ -0,0 +1,109 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# Platform type of repository
+platform: "gitlab"
+
+# Enable onboarding merge request
+onboarding: false
+
+# If set to true: keep repository data between runs instead of deleting the data
+persistRepoData: false
+
+# Controls Renovate's behavior regarding repository config files such as renovate.json
+requireConfig: "ignored"
+
+# List of Repositories
+# See: https://docs.renovatebot.com/configuration-options/
+repositories:
+  - repository: "bmi/opendesk/deployment/opendesk"
+    # Set the branch to read current dependency state from, this is especially useful during
+    # renovate setup when looking into your feature branch or when your default branch is
+    # not the one you want to check on.
+    baseBranches: [ "develop" ]
+    # Set a limit for the maximum number of parallel MRs (default 10)
+    prConcurrentLimit: 50
+    # Prefix to use for all branch names created by renovate bot (default: "renovate/")
+    branchPrefix: "renovate/"
+    # Lowercase merge request and commit titles ("never" = leave titles untouched )
+    commitMessageLowerCase: "never"
+    # Commit scope to use if Semantic Commits are enabled (fix(<scope>)...)
+    semanticCommitScope: "renovate"
+    # Commit type to use if Semantic Commits are enabled (default: "chore")
+    semanticCommitType: "chore"
+    # Enable dependency dashboard
+    dependencyDashboard: false
+    # Include package files only within these defined paths
+    includePaths:
+      - "helmfile/environments/default/images.yaml.gotmpl"
+      - "helmfile/environments/default/charts.yaml.gotmpl"
+    customManagers:
+      - customType: "regex"
+        fileMatch:
+          - "helmfile/environments/default/images.yaml.gotmpl"
+        datasourceTemplate: "docker"
+        matchStrings:
+          # yamllint disable rule:line-length rule:quoted-strings
+          - ' providerResponsible: "(?<depType>.+?)"[\s\S]+? upstreamRegistry: "(?<registryUrl>.+?)"[\s\S]+? upstreamRepository: "(?<depName>.+?)"[\s\S]+? tag: "(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)"'
+          # yamllint enable rule:line-length rule:quoted-strings
+      - customType: "regex"
+        fileMatch:
+          - "helmfile/environments/default/charts.yaml.gotmpl"
+        datasourceTemplate: "docker"
+        matchStrings:
+          # yamllint disable rule:line-length rule:quoted-strings
+          - ' providerResponsible: "(?<depType>.+?)"[\s\S]+? upstreamRegistry: "(?<registryUrl>.+?)"[\s\S]+? upstreamRepository: "(?<depName>.+?)"[\s\S]+? version: "(?<currentValue>.+?)"'
+          # yamllint enable rule:line-length rule:quoted-strings
+    # Rules for matching packages
+    packageRules:
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "openDesk" ]
+        groupName: "Platform"
+        groupSlug: "platform"
+        branchTopic: "platform"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Collabora" ]
+        groupName: "Collabora"
+        groupSlug: "collabora"
+        branchTopic: "collabora"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Element" ]
+        groupName: "Element"
+        groupSlug: "element"
+        branchTopic: "element"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Nordeck" ]
+        groupName: "Nordeck"
+        groupSlug: "nordeck"
+        branchTopic: "nordeck"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Open-Xchange" ]
+        groupName: "Open-Xchange"
+        groupSlug: "openxchange"
+        branchTopic: "openxchang"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "OpenProject" ]
+        groupName: "OpenProject"
+        groupSlug: "openproject"
+        branchTopic: "openproject"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Nextcloud" ]
+        groupName: "nextcloud"
+        branchTopic: "nextcloud"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Univention" ]
+        groupName: "Univention"
+        groupSlug: "univention"
+        branchTopic: "univention"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "XWiki" ]
+        groupName: "XWiki"
+        groupSlug: "xwiki"
+        branchTopic: "xwiki"
+    # Add merge request labels
+    labels:
+      - "renovate"
+    # Enable custom regex manager only
+    enabledManagers:
+      - "custom.regex"
+...

.reuse/dep5

@@ -1,12 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: openDesk
-Upstream-Contact: <git+bmi-souveraener-arbeitsplatz-cla-1339-29pr0g9pj4or9yi6wfly6pbhg-issue@opencode.de>
-Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace
-
-Files: helmfile/environments/default/theme/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: Apache-2.0
-
-Files: helmfile/files/gpg-pubkeys/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: CC0-1.0

CHANGELOG.md

@@ -1,3 +1,854 @@
+# [1.10.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.9.0...v1.10.0) (2025-11-24)
+
+
+### Bug Fixes
+
+* **collabora:** Update Controller to 1.1.6 incl. Helm chart update to 1.1.10 ([d25c95f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d25c95f06bc199d09aa6ea4dc09c10e95153de38))
+* **collabora:** Update from 25.04.5 to 25.04.6 ([8de0f5d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8de0f5de7277ad726588d7de2d06cb3e9376c993))
+* **external-services:** Create `nubus_authsession` database ([ec72602](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ec72602cdd3207f73ff806a26bfe7b9fd32b8634))
+* **helmfile:** Enable verification for XWiki Helm chart ([5104793](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/51047936de102c610adc00f4dff12d2eb8e945b0))
+* **helmfile:** Streamline annotations ([7aa717c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7aa717c0509a731c060c58a1b5877e1d9899406f))
+* **nubus:** Remove legacy `UMC` Keycloak client that was used for SAML connection with the Nubus portal ([152221f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/152221fa7976bfa942d5e9e9b8f78cc8e65765c0))
+* **open-xchange:** Only enable `smtpSASLAuthEnable` when `relayHost` is set ([70bbbf3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/70bbbf311fcba57c31f535be7d0d453f4a945cee))
+* **open-xchange:** Optimize Dovecot Pro full-text search caches; review `migrations.md` for required upgrade steps ([f3f707c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f3f707c9eee8edf3ad61834d87b5c059f31b0e26))
+* **open-xchange:** Template SASL security options ([684c6d4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/684c6d4f29dd447872ebe582eef43c04034896f7))
+* **open-xchange:** Update Dovecot configuration based on supplier's best practise review ([850761e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/850761e0475b2f281fb23f6972d5c74fbdaa3a61))
+* **opendesk-static-files:** [[#260](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/260)] Fix doublette creation of configmap `data` keys when the same file is referenced multiple times for a component ([b5a76be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b5a76bea57ef7b136c54d1bc95c40f0a0c3f9716))
+* **openproject:** Update from 16.1.0 to 16.1.1 ([62fae99](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/62fae9976a731c00700d56ce8fab198bb2531d20))
+* **xwiki:** Update XWiki from 17.4.4 to 17.4.7 ([02a3b77](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02a3b7711490394690df70ca92bab58b253e34f5))
+
+
+### Features
+
+* **jitsi:** Update from 2.0.10431 to 2.0.10590 ([f5aad1f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f5aad1fa47559f0d3941c233c7d40029a9e83281))
+* **nubus:** Update from v1.14.0 to v1.15.2 ([12379d6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/12379d67e07936496fe31276b2052406e0137db6))
+* **open-xchange:** Support for LDAP group based mailing lists ([cc94f0c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cc94f0c66df098d0a20f7f0d4a6af5e791557981))
+* **openproject:** Update OpenProject from 16.5.1 to 16.6.0 ([19438c0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/19438c02817875bd408c5d6cf423d7bfb61f907f))
+
+# [1.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.8.0...v1.9.0) (2025-11-07)
+
+
+### Bug Fixes
+
+* **collabora:** Update from 25.04.4.3.1 to 25.04.5.3.1 ([e0128e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e0128e6ccf02eaaa68fe53f5629150f0e0863ba0))
+* **element:** Increase message and media rate limits ([13968a8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13968a8133174024dc97c5cf73e6b1e7883ce0a0))
+* **element:** Update favicon to use PNG version ([f8104f6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f8104f635862ce6c80b66c6d7fa82df7cde9d446))
+* **element:** Update Synapse from v1.137.0 to v1.141.0; fixes https://github.com/element-hq/synapse/security/advisories/GHSA-fh66-fcv5-jjfr which applies to all openDesk deployments using Element/Matrix with federation enabled ([02d3021](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02d3021c4ba97f81165e286d1ee53b7c199f5dbb))
+* **element:** Update widgets primary color theme settings ([94394a1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/94394a1e3e3da304138263de73121a62aabbee11))
+* **gitlab:** Add issue templates ([26da7e3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/26da7e366709b3888f6786b574e3b3b11f1a6fab))
+* **helmfile:** Support setting the `defaultLanguage` - relevant for OX App Suite and XWiki - in `functional.yaml.gotmpl` ([24065db](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/24065dbc7043d09dbad0d272128cfe2f33f22e48))
+* **helmfile:** Use passwords defined in `database.yaml.gotmpl` for Cassandra when available ([0268219](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/026821996a4e42ac9ef25dd62c34d1697547962c))
+* **notes:** Fix python path for self signed certs ([c4279d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c4279d11bb46c9fe65b2ccd54dc0789d11c0d0d8))
+* **notes:** Fix repeated redirects on expired session; Remove fetching of external assets ([c1012f4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c1012f4e656222750dda0668d8f81e5d1fbe02fd))
+* **open-xchange:** Don't enable sasl auth when no relay host is set ([ff3b221](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ff3b2218706a98b854c072de62105aa8352e3949))
+* **open-xchange:** Enable and configure defaults for ContactCollector, remove legacy config artifacts ([465f60d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/465f60d4a28ead7d7a715db71dad9d9992e8b89a))
+* **open-xchange:** Use masterpassword for mailfilter in migration Pods; use PLAIN instead of OAuth for SASL ([484dfaf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/484dfafe643e04a717e6bc3a8e6e6e6f5011c1c1))
+* **ox-connector:** Use FQDN for internal service URLs ([8593d5f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8593d5f2bdea685a836edc9d9034ce1976cf2e96))
+
+
+### Features
+
+* **helmfile:** Add toggle for external mail client onboarding and allow non-default FQDNs for IMAP and SMTP endpoints ([25a97ab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/25a97abba69b34c6b65a08ca7af979f3897d218b))
+* **open-xchange:** Enable XRechnung in Viewer ([08e6ec5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/08e6ec59d2abac36a8f6e5ab10fec6a5643de282))
+* **openproject:** Update from 16.4.1 to 16.5.1 ([74cf2ee](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/74cf2ee0d818b5e017b3c97f6fbedb05ab764d67))
+
+# [1.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.7.1...v1.8.0) (2025-09-25)
+
+
+### Bug Fixes
+
+* **clamav:** [bmi/opendesk/deployment/opendesk[#234](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/234)] Update Helm chart to support conditional proxy credentials ([dee7525](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dee75256492577c7b2ab6bafd741e06f98acfccd))
+* **element:** Let Synapse create room `v12` by default; review `migrations.md` for details ([af9d4cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/af9d4cda6cf641e65fe49054e1397159272f3bd1))
+* **helmfile:** Add more detailed descriptions on `functional.authentication.realmSettings` and provide two `accessCodeLifespan*` options ([0314a70](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0314a7076ae7d377d86c3ff3acda691966a36635))
+* **helmfile:** Do not set portal "Support" link by default ([776fe92](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/776fe92ae18963b11503d4d7e20bbf298902ad9b))
+* **intercom-service:** Update from v2.19.0 to v2.19.5 ([3305dfa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3305dfa5fb4a22bd5354dec1f65eb0e95eed678d))
+* **jitsi:** [bmi/opendesk/deployment/opendesk[#228](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/228)] Turn off Gravatar option, by default this still keeps the input field in the Jitsi UI, but does not longer issue requests to gravatar.com; check `migrations.md` in case the option should be enabled ([083fa98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/083fa9842d6bd9c27eabac28f49668e5bee02a42))
+* **nextcloud:** App "Spreed" and core app "Comments" not enabled by default; review `migrations.md` for potential upgrade steps ([31d35b2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31d35b25c6cf0e4a18cf6f33b01a6dd0fd10545e))
+* **nextcloud:** Update from 31.0.6 to 31.0.7 including the latest app versions ([f848b9a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f848b9a0f4d6f65babb983b6527bfc63776b455a))
+* **open-xchange:** Add client onboarding for mail ([d8fc3e0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d8fc3e04f584da23bfd0590676f26cbac65bf4cf))
+* **open-xchange:** Set guest mode to inherit theming and set theme for notification mail button ([f2ce251](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f2ce25193a78eee3f103aabb368bf8457900fa1c))
+* **open-xchange:** Switch off Element integration when `apps.element.enabled: [secure]` ([7a2dbc5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7a2dbc5f8cca5981ffc171f2be1b72c40877ac2c))
+* **open-xchange:** Update Dovecot charts with improved auth cache defaults ([836d8a4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/836d8a494dcd2e8ab8ea95684742cd143cac6074))
+* **opendesk-certificates:** [bmi/opendesk/deployment/opendesk[#236](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/236)] Update Helm chart to add `commonName` to certificate ([2e708a7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2e708a75b6abdb987925333714c99d1e09bbc5a2))
+* **openproject:** [bmi/opendesk/deployment/opendesk[#228](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/228)] Turn off Gravatar option by default; check `migrations.md` in case the option should be enabled ([628e914](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/628e91435c37a615a421a48c2a9a0639840d9a78))
+* **ox-connector:** Update from v0.27.7 to v0.27.9 ([ba77f2b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ba77f2b11c0eb649891a5375258e6649686333fb))
+* **postfix:** Relax TLS settings to `TLSv1.2`/`medium` for broader SMTP relay compatibility ([31cbd9a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31cbd9af1a9afb177b70bccd329829f75bceab03))
+* **xwiki:** Update image to set new default for user self-registration; review migrations.md for required actions on existing deployments ([c75abaf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c75abaf1e660fe8daeeb09ee3d41e14ea67e9a25))
+
+
+### Features
+
+* **collabora:** Support for macro execution controlled by `functional.weboffice.macros.enabled` (default: `[secure]`) ([38f2bdd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/38f2bdd2b98e4248972363db73c03373db71f433))
+* **cryptpad:** Update from 2024.6.1 to 2025.6.0 ([23dfe0a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/23dfe0aaa6012f5695fc026d06920bd4b0a63f66))
+* **element:** Update Element-Web from 1.11.89 or 1.12.0 and Synapse from 1.129.0 to 1.137.0 ([f895bcc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f895bcc2b8a7d4010b19c7ffb6712c4813231f9d))
+* **element:** Update NeoBoard widget to v2.3.1, NeoChoice widget to v1.6.0, NeoDateFix widget to v1.7.2 and NeoDateFix bot to 2.8.5 ([b377a5e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b377a5e0e25e317c64c2d30b44370beb211e23fd))
+* **jitsi:** Upgrade from stable-9955 to stable-10431 ([e138610](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e138610d2941f6c3a93eef3764f252bd4eab9987))
+* **nextcloud:** Expose `forbiddenChars` in `functional.yaml.gotmpl`; review `migrations.md` for required upgrade steps ([5a2c1fc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5a2c1fcf98d3773deef8292773962d5f70832a0f))
+* **notes:** Update from 3.2.1 to 3.4.0 ([c636650](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c63665040cf3c985dc9878992785a893d261c420))
+* **nubus:** Update from 1.12.0 to 1.13.1 ([35424b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/35424b88d652a1e8a4c37fee4355636badba22b6))
+* **nubus:** Update from v1.13.1 to v1.14.0 using OIDC instead of SAML for portal SSO; review `migrations.md` for required upgrade steps ([d3b1f57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d3b1f575cc2deab70ca262ab301c6b67f9c1b393))
+* **open-xchange:** Add options to `functional.groupware`; review `migrations.md` for details on new defaults/required upgrade steps ([8a7cc3b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8a7cc3b8c7199f8c15f01e1b2d55d630431ddf9c))
+* **open-xchange:** Enable mail categories ([4da1c5d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4da1c5d9e3b1f66419a5e19ba683cff5681315bd))
+* **open-xchange:** Update from 8.39 to 8.40 ([c70a0bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c70a0bdc4c1564032982a2967788e0b78db74c00))
+* **open-xchange:** Update from 8.40 to 8.41 ([c50b817](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c50b81779539186f3885d6bdb64d348fbe7bda67))
+* **openproject:** Update OpenProject from 16.2.1 to 16.3.2 ([f77f329](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f77f3291caf778274c23f89bde3661e586447f5a))
+* **openproject:** Update OpenProject from 16.3.2 to 16.4.1 ([f5483d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f5483d1a3b4cb8fddff38bb9fc29439cd6c4fc40))
+* **xwiki:** Update from 16.10.5 to 17.4.4 and configure openDesk's Collabora for `.odt`, `.rtf` and `.docx` export of wiki pages ([813e92c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/813e92c1b05f806bff8022d71d8cd25f475b0b8f))
+
+## [1.7.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.7.0...v1.7.1) (2025-08-26)
+
+
+### Bug Fixes
+
+* **collabora:** Update from 25.04.3 to 25.04.4 ([84d6b50](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/84d6b504d21e687de3fb4cdabafc9cff6fe1f1d7))
+* **helmfile:** When optional mail domain is set, use it as sender domain for system generated (noreply) mails ([bd4c997](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bd4c997950750e36168434e82daf48f20d0a42df))
+* **jitsi:** Increase `patchJVB` job `backoffLimit` to avoid deployment failures on infrastructure where LoadBalancer services take longer to become available ([eb2a181](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/eb2a1811fb1d11b0dd0ea0e9987f96846a855ac7))
+* **nextcloud:** Fetch central navigation from cluster internal service ([dd0e516](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd0e516778104c47ef990d95d01bdec6b33d9bab))
+* **nextcloud:** Stop browser from caching server-generated files ([410a1ad](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/410a1ade6907f676d3c4cbc68b33754e0e41e9fb))
+* **nextcloud:** Work around a bug that breaks the `nextcloud-management` job in case the theming `primary_color` was set in Nextcloud's web UI ([4aebe22](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4aebe22f22dc9e679563a46687ebdc8793c281e8))
+* **notes:** Explicitly template security contexts; add missing ingress classes and pull secrets ([834c847](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/834c84768a3a6537990e27377acb170b6269dfb0))
+* **nubus:** Remove temporary `nubusUdmListener` `livenessProbe` as recommended by supplier ([688a505](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/688a505ef780e7c81006a73db6465ef75dea1404))
+* **open-xchange:** Click on top bar logo to point to portal instead of mail inbox ([9f762a7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9f762a7c2ea3f8e4d3207d8d2aae44597a366ee0))
+* **open-xchange:** Configure correct autoreply addresses and enable FTS in Dovecot EE ([997c083](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/997c083335b79aa7446894b6ebbb6ed1d5950a3d))
+* **open-xchange:** Explicitly deactivate DAV support if not enabled in `functional.yaml.gotmpl` ([62ba5ab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/62ba5aba496af40208a13abeb6c8f1de62e98e35))
+* **open-xchange:** Fix FTS bulk delete in Dovecot EE ([cd2a356](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cd2a356b89249b8a163f2becc57832164bc6c8e5))
+* **open-xchange:** Set mail quota using `functional.groupware.quota.default` ([67fe50e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/67fe50e53c7477016efe3b3d90c63214928f165c))
+* **opendesk-static-files:** Serve missing `.png` favicons for Notes and the Nextcloud topbar logo ([42b1105](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/42b11059d29d6445e1e4e3309ad7a9a026b56c92))
+* **ox-connector:** Update OX Connector and OX Extension to v0.27.7 ([57c96af](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/57c96af5a545a6a6851926b85bca0dc24263b55e))
+* **xwiki:** Templating of `imagePullSecrets` ([bbbcd68](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bbbcd6807e972c6120d90df52b8ffe9da03ebce3))
+
+# [1.7.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.6.0...v1.7.0) (2025-08-11)
+
+
+### Bug Fixes
+
+* **collabora:** Connect to Collabora Controller websocket via service ([5d01f60](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5d01f6023d6d300e106cc86dfca09a4ae388f4ca))
+* **collabora:** Update from 25.04.2 to 25.04.3 ([3507c62](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3507c62f832556c5d76e7a5b206acbdbcaca37a8))
+* **helmfile:** Adds default-enterprise-overrides to default values in helmfile-generic ([672e649](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/672e649b608fa03f04834837f13c360a08e8eb6c))
+* **nextcloud:** Block filesystem-unsafe characters in file and folder names ([0df6212](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0df6212ca9399d39bedc30c064cbae80c2684e44))
+* **nextcloud:** Include latest Helm chart version with supports `configuration.sharing.restrictUserEnumerationToGroup` ([c3dfa2a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c3dfa2a6075ae388764acbb20bd8282a64183ed3))
+* **notes:** Set Pod Disruption Budget (PDB) labels ([e35dac0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e35dac087aac54f545d361dee881196b264af906))
+* **nubus:** Add `livenessProbe` for `nubusUdmListener` to mitigate cases where the listener becomes uninitialized and stops forwarding provisioning data to NATS. Temporary until upstream provides a probe ([ef8d67f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ef8d67f3c1525de6f958ac7a8893b4b30ea3f7dc))
+* **open-xchange:** Disable documents role ([573e11f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/573e11f5c5103ee5906b0168317054a7e5a22e87))
+* **open-xchange:** Postfix to support submissions and external secrets ([13ab665](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13ab6659001abf5b6c683bf6a9309972ef7412b3))
+* **open-xchange:** Support application specific passwords in groupware when CalDAV/CardDAV support is enabled, see `functional.groupware.davSupport.enabled` for reference ([90b2290](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/90b22904dab0195f505021beb785317f8969ff7d))
+* **open-xchange:** Use dedicated pod for migration ([6fd52b1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6fd52b167eeed5c7e9eda2a21b209680131380ee))
+* **opendesk-certificates:** Update Helm chart to remove default host for `webmail` being set even if OX App Suite is not enabled ([09a0aac](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/09a0aace45227b60e9b39671e747958bd339c8c9))
+* **opendesk-services:** Update opendesk-alerts from 1.1.1 to 1.1.2, update opendesk-dashboards from 1.1.1 to 1.1.2 ([174d4fc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/174d4fc61cbb718818015779012fa65353987f3c))
+* **openproject:** Update from 16.2.0 to 16.2.1 ([bba9b71](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bba9b716a3fdf915bfc2925f1c27fe91494edcb0))
+* **ox-connector:** Update OX Connector and OX Extension to v0.27.2; review `migrations.md` for required upgrade steps ([9d51e40](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d51e40063d73226fc8a25365cbfa92ff09f0910))
+
+
+### Features
+
+* **nextcloud:** Enhance theming options for Nextcloud ([bdc7331](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bdc7331cb59da96941c3250625af3cb5f9b12e15))
+* **notes:** Switch to new Helm chart with support for self-signed deployments; review `migrations.md` for required upgrade steps ([3106ca7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3106ca793ee1e0021f7c03e620873c49adb54199))
+* **nubus:** Allow configuration of limits for password reset requests via `security.passwordResetLimits` ([09f54b4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/09f54b41347ff5c90064c8d4c2c6a9db7f05d54c))
+* **nubus:** Update from 1.11.2 to 1.12.0 ([5537dbb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5537dbbd7cb93dcb2aeafe9017c68a89d2e19293))
+* **open-xchange:** Update from 8.38 to 8.39 ([489986e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/489986e906e828f3877e7a9087541f10c5bbfe8c))
+* **open-xchange:** Use internal endpoint for provisioning and support for optionally spinning up a dedicated internal Pod just for provisioning (see `technial.oxAppSuite.provisioning.dedicatedCoreMwPod` for details) ([31b7ec7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31b7ec78274e5a901b51aaaeed01e6ac82298b73))
+* **openproject:** Update from 16.1.1 to 16.2.0 ([e273abb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e273abbecf58b098e76c49e1763b4c3074bf5cec))
+
+# [1.6.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.5.0...v1.6.0) (2025-07-14)
+
+
+### Bug Fixes
+
+* **dovecot-pro:** Use of `requiredEnv` instead of `env` and update `README-EE.md` ([a79e40f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a79e40f44af68a16f0944265cc447ec9b0d84922))
+* **helmfile:** Prefix NATS passwords as workaround for upstream issue and add documentation to `gettings-started.md` [[#185](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/185), [#202](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/202)] ([7f478bf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7f478bffd60bdf3af536bc593ef397d823a22e88))
+* **helmfile:** Remove default setting from `repositories.helm.registryOpencodeDeEnterprise` for better support of `PRIVATE_HELM_REGISTRY_URL` ([c5dd881](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c5dd8814ae7576eaaf7cfcdd1cb4aa101f164c62))
+* **helmfile:** Set `nubusKeycloakBootstrap` debug mode when openDesk is running in debug mode ([4e0ffee](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4e0ffeea1f9d0420c404d78c5188ff6bdb0f81ea))
+* **helmfile:** Streamline license header comment style [[#192](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/192)] ([20cbad3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/20cbad31e75d9ae27081675072561650fa168935))
+* **nubus:** Explicitly template `nubusStackDataUms.stackDataContext.portalFqdn` to fix custom hostname support [[#193](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/193)] ([6aa6d3a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6aa6d3af2fed1be99b4f4eb5de2e2703ca00578a))
+* **nubus:** Replace openDesk portal fork with upstream `portal-frontend` image ([e4f1afc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e4f1afca0fdf4af184f4e287f1317ed57d229013))
+* **nubus:** Update from 1.11.1 to 1.11.2 ([237c9af](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/237c9af3c16885b51dcd1d7c793bf7fd23dbcefb))
+* **open-xchange:** Add missing `imagePullSecrets` for `core-imageconverter` and `core-documentconverter` ([9b7f439](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9b7f439d83c9cd5a60b70f8d3ba7d36bb35ebd5c))
+* **open-xchange:** Enable `com.openexchange.smime.test` only when openDesk is running with `debug.enabled: true` ([51ff7a5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/51ff7a5fdb7b7f3bdef02a32e44e6204df9db6ea))
+* **open-xchange:** Enable searching by LDAP `mailAlternativeAddress` when resolving global contacts. Note: OX App Suite evaluates all `mailAlternativeAddress` values of a user when searching, but only the first address is returned, which might differ from the one that matched the search criteria. ([9014324](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/90143241564d7e66bf1b864c704e13c677dcbc93))
+* **open-xchange:** Use `objectstore.dovecot.secretKey` when defined ([5c33226](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5c332264edfcbb3343bcfd39352db6ddefd0a85c))
+* **opendesk-services:** Add missing certificates ([acbabdb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/acbabdb80662bf0599a157b24d3f8461e1f98cad))
+* **openproject:** Update from 16.1.0 to 16.1.1 ([e30d4f1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e30d4f126dda29183cffc078307d41d3dce6f4fa))
+
+
+### Features
+
+* **collabora:** Update from 24.04.13 to 25.04.2 ([c56f564](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c56f564025531d25a1966792f8c161aedf644c99))
+* **element:** Update NeoBoard from 2.1.0 to 2.2.1, NeoChoice from 1.5.1. to 1.5.2, NeoDateFix from 1.7.0 to 1.7.1 widgets and NeoDateFixBot from 2.8.2 to 2.8.3 latest releases ([98d31f8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/98d31f811bdb007e40c4b3436ff65cdcf610db7e))
+* **helmfile:** Add options in `functional.yaml.gotmpl` for setting the portal's corner links, toggling the welcome message and the newsfeed ([1a6f438](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1a6f438724cc442ca7b9c423a326c67690510301))
+* **nextcloud:** Update from 30.0.10 to 31.0.6 and support for notify-push ([a4c8be6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a4c8be60f335af98270e40478e53e6fa34c23d38))
+* **nubus:** Update from 1.9.1 to 1.11.1; required minimum openDesk version for this upgrade is 1.5.0, see `migrations.md` for details ([ccd5ab8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ccd5ab84e3f5bb67eb879a3683c299d7a61ddba0))
+* **open-xchange:** Store attachments for calendar, contact and task objects in object storage; review `migrations.md` for required upgrade steps ([4eb6570](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4eb6570b0a69931f09042bdc40edfad23e6f28c1))
+* **open-xchange:** Updated OX App Suite from 8.37 to 8.38 ([2b31751](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2b317514c61eba4ebc4cc9e7041aac606d8c16b8))
+
+# [1.5.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.4.1...v1.5.0) (2025-06-16)
+
+
+### Bug Fixes
+
+* **dovecot:** Enable Dovecot ACL for CE (file) & EE (cassandra) ([9354ee7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9354ee719628c876c26e91e1b57a4a0cfafedca1))
+* **notes:** Support templating of Ingress annotations `bodyTimeout` and `bodySize` to allow application defined upload limits to be reached ([69faf77](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/69faf77d15d1df441eb62c58374620f8035f2596))
+* **nubus:** Create required LDAP objects for `global.additionalMailDomains` ([4dcb683](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4dcb6831189fc9cedb244c3fd7997d57e8a78c5a))
+* **nubus:** Explicitly template security context for Keycloak proxy ([e959438](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e9594382ed7a2469240d62134b34bcf3e5d06a59))
+* **nubus:** Update CSS for login screen to show login button for federated IdP ([0d4e1b0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0d4e1b01e3e82ace7f7438a754235a009036b90d))
+* **nubus:** Use read-only root filesystem for Keycloak bootstrap ([1edd7c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1edd7c3f062ec411b8b38f45be9ef22a200b4bea))
+* **open-xchange:** Enabled mail login resolver ([7547f49](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7547f4948ea13357c4cbc3ae69ae4e7210fdf4a2))
+* **open-xchange:** Update App Suite 8.37 to latest patch level (8.37.69) ([bc436b2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc436b248525bf76584dd21f735694065bcb67a5))
+* **open-xchange:** Update Dovecot CE chart to support ACLs (mailbox sharing) and usernames different from local part of mail address ([87c30ab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/87c30ab8e32c1b405f6aff8eda5eed5f74d5df0a))
+* **open-xchange:** Use login name instead of email between OX and Dovecot ([8e9ef08](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8e9ef0867beb8381ad4a5f55f2e9d12bd7dbbba2))
+* **openproject:** Update from 16.0.0 to 16.0.1 ([b60f9c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b60f9c7576deca327ad36c48ad0b1a7e3e9d3c9c))
+
+
+### Features
+
+* **ci:** Update Helm to 3.18.1 and Helmfile to 1.1.1 ([59a4086](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/59a40864edbdf9775e0d6003425c3b05b7b7cb15))
+* **notes:** Update from 2.4.0 to 3.2.1 ([9f4e3c8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9f4e3c86c74ef6c6f618150a7a9d0935fb5ed437))
+* **open-xchange:** Support for `mailAlternativAddress`(es) for sending and receiving emails ([6d6b1a6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6d6b1a6dd754dcb283fd23f08f9df937f8e08c59))
+* **openproject:** Update from 15.5.1 to 16.0.0 including Helm chart update ([add7266](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/add72669aedfcd57b41fe8680f14940ab77f6aef))
+
+## [1.4.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.4.0...v1.4.1) (2025-06-02)
+
+
+### Bug Fixes
+
+* **nextcloud:** Update NC CE to 30.0.10 ([785be8b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/785be8b6621305e79acca62250720028b9ca7a30))
+* **nextcloud:** Update Nextcloud incl. apps to 30.0.10 ([559fbf6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/559fbf6801fc785f26f9e6287e0730f86b459a01))
+* **nubus:** Use `.Values.theme.texts.productName` for Keycloak's `loginTitle` instead of static product name string ([d1a1e5d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d1a1e5dc29ca21fd822abd127406f6859603b9c7))
+* **open-xchange:** Re-adding `com.openexchange.oauth.provider.*` to fix central contacts feature ([561e44f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/561e44fd4cc42089954868da60edbd210b9a2608))
+* **open-xchange:** Set `com.openexchange.hostname` to get working links in outgoing system mails (e.g. task assignments) ([0d61687](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0d616871e3f5114ec429714658500c09af842fe6))
+* **postfix:** Require TLSv1.3 ([3b3d8ac](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3b3d8aca54bdaea055289c993e3f158d93864223))
+* **requirements.md:** Helm 3.18.x is not supported due to upstream bug ([1ea9cae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1ea9cae1ce46f864dc03d94c1a72956c5f5ba9a9))
+
+# [1.4.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.2...v1.4.0) (2025-05-20)
+
+
+### Bug Fixes
+
+* **docs:** Update requirements, bump helmfile to v1.0.0 ([88b29c5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/88b29c57e8197f072b9c80019255ee0b7d1188e1))
+* **dovecot:** Encode object storage password and add more template values ([c40de73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c40de73ccf02bf77df0c3a17c2fccf2e113c4b35))
+* **nubus:** [[#182](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/182)] Add `KC_TRUSTSTORE_PATHS` to Keycloak when using self-signed certificates ([006aed7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/006aed791e5cf58850712e468a15c8abe1ee0973))
+* **nubus:** [[#183](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/183)] Do not override `nubusPortalConsumer.waitForDependency.image` when using self-signed certificates ([b45a0bf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b45a0bf832506fb60488cd01c9c883b58e1d60b6))
+* **nubus:** Update ArgoCD hook annotations ([f2b1384](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f2b13846700d8a49a066b3343b043dac89d326f5))
+* **open-xchange:** Update Open-Xchange to v8.36 ([b40b863](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b40b8630c1a5ba7452d0461d38b1175fa647226d))
+* **open-xchange:** Update Open-Xchange to v8.37 ([174c73c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/174c73c012e911342644bdcb89d22b35be9baa36))
+* **openproject:** Update to 15.5.1 ([e91efa8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e91efa8ecc1be9b444092e1a291747bb9f0c00ea))
+* **openxchange:** Add proper dav URLs in client onboarding and disable unnecessary oauth section ([bba2af0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bba2af0f06942bd2063cc7b79f3e39fdb07838f0))
+* **openxchange:** Disable redundant o-x-authentication-oauth package ([1d2b17b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1d2b17b4951581e1f60d8a7f2402512dc1c1c568))
+* **openxchange:** Enable DAV support ([709e50f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/709e50ff7c020347dad953be7380d08438d3ab69))
+
+
+### Features
+
+* **collabora:** Update enterprise image to 24.04.13.4.1 ([b590810](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b5908100ddbd7497f7f858e874bcbf7979480d1b))
+* **helmfile:** Define `global.additionalMailDomains` as list; if you use the setting already, check `migrations.md` for details ([4b30576](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4b305768c444c166e28829ee05631451ba997126))
+* **helmfile:** Option to select default file format for weboffice using; see `functional.weboffice.defaultFormat` in `functional.yaml.gotmpl` for details ([5f58a85](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5f58a857acab38fa7f56e1e14ef0a6f805c7622e))
+* **nubus:** Update nubus to v1.9.1 ([3d694a8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d694a8248d5e983ab3e05753326088b375f2d82))
+
+## [1.3.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.1...v1.3.2) (2025-05-06)
+
+
+### Bug Fixes
+
+* **dovecot:** Update Helm chart to fix migration mode ([7ba84b9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ba84b99caf61e5a4a35b71d875e9ede0f71423e))
+* **helmfile:** Explicitly template auth-modules in OX App Suite; Streamline name of OX App Suite EE image ([6cbb6b6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6cbb6b6922864467ca365bcc9b1cfa49182df050))
+
+## [1.3.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.0...v1.3.1) (2025-04-24)
+
+
+### Bug Fixes
+
+* **ci:** Update Helm to v3.17.3 ([9446faa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9446faaa597777e9fb15d33953e02fdbfef646b2))
+* **ci:** Update Helm to v3.17.3 ([d794a20](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d794a2036ed6543bf89a0b661cc8a4c8a383a5f0))
+* **docs:** Update "Ingress controller" section and add footnote on volume provisioner in `requirements.md` ([17efbd7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/17efbd79f177f635885735823696a6e50b919d3e))
+* **helmfile:** Conditional templating of additional annotations in selected components to unblock openDesk deployment despite a bug in Helm 3.17 (https://github.com/helm/helm/issues/30587) ([861b84b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/861b84b14de9fb42c483f3ddb9e083305750d137))
+* **postfix:** Disable unauthenticated relaying of mails in `postfix-ox` ([7414f05](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7414f05005e019f2121e8458fe63e795819fe92c))
+
+# [1.3.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.2.1...v1.3.0) (2025-04-22)
+
+
+### Bug Fixes
+
+* **helmfile:** Fix Kyverno lint issues for EE components ([46b3834](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/46b38342d3cb6789e1734cd6eba412bc726c834b))
+* **helmfile:** Remove no longer used `secrets.nubus.defaultAccounts.*` ([6e6d155](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6e6d15552e87a77870755db3b48f2af686916c1f))
+* **helmfile:** Support for Keycloak session settings via `functional.authentication.realmSettings.*` ([3fcfa00](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3fcfa00503854f752a3885321b16b3f3597cb09a))
+* **migrations:** Optional delete of `ums-minio-rewrites` Ingress, as it is non-existing in deployments with external object storage ([6932953](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/693295391bb02892b537a48513c9e0c2824ed466))
+* **ox-connector:** Update to v0.19.0 ([fe664a7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fe664a7f8d696fea53b6abadec5a0cb5db751f43))
+* **xwiki:** Update Helm chart to v1.4.4 to fix the problem with XWiki not starting when secrets contained specific (XML interpreted) characters ([67a1df0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/67a1df0f80dc598287174a8dd6bda3f477227f0d))
+
+
+### Features
+
+* **collabora:** Update to 24.04.13 ([8f12208](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8f12208074b2947ec65ebc3c21920d4f775e0c6e))
+* **helmfile:** Add template support for annotations ([9cde57d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9cde57d74b8cfdd09e4f6b82cf45f1b1a686e035))
+* **helmfile:** Support for SSO federation; see `ssoFederation` section in `functional.yaml.gotmpl` for details ([79975a5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/79975a58e3a4f50e59d1d790045c22a32ab49372))
+* **nubus:** Show openDesk version to all users (instead of admin users only) ([393ee31](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/393ee311630630fd1aae8354ead90bcaaf5e4dba))
+* **nubus:** Update to 1.8.0 ([90c49f6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/90c49f6f83df0b34b86c17164eaa4e137d0cd9be))
+* **openproject:** Update to 15.5.0 ([7f1cfc5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7f1cfc55551f608603e0401dfef24bbb9cc334e5))
+
+## [1.2.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.2.0...v1.2.1) (2025-03-28)
+
+
+### Bug Fixes
+
+* **dovecot:** Support external secrets ([f758685](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f758685a2eb4c04bad6bce103cc5ba273c80606d))
+* **element:** Update Synapse to 1.127.1; Fixes https://www.cve.org/CVERecord?id=CVE-2025-30355 which applies to Synapse installations with unrestricted (no allow list) federation enabled ([5cd12b9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5cd12b91c78269b84749280e71aee0fcb195da17))
+* **openproject:** Update to 15.4.2 ([aa8e30b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/aa8e30b34f24302c756b2297b05e138d15ed0d2d))
+
+# [1.2.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.2...v1.2.0) (2025-03-25)
+
+
+### Bug Fixes
+
+* **collabora:** Set proper theming for Collabora Online (openDesk EE) ([896b3c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/896b3c102cd59a9c4d0ae28457261a4749b37a6d))
+* **collabora:** Update to 24.04.12 ([4296db7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4296db7c90c93c3c268a7642ae920d412cb70429))
+* **dev-tooling:** Fix path names when refencing local Helm chart copies in `helmfile-child.yaml.gotmpl` files ([60f5e36](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/60f5e36b7cf183ac9f15b0e56b486e642c54ac4d))
+* **docs:** Add `functional.md` and reference it in `getting-started.md` ([0efc0af](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0efc0af761703a63392034df3f34acf569174e0c))
+* **docs:** Add testing.md ([c4e4258](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c4e425816272951082fa15f1ab4ff4aee4a4598d))
+* **dovecot:** Update EE Helm chart to resolve issue with mandatory set `PriorityClass` ([696f2da](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/696f2daa9c3df6b0db744d81bd6e159b3f9be440))
+* **element:** Run UVS container as a non-root user ([f262507](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f26250774e4bdb157181c3c8fe5c51f7429771ed))
+* **element:** Update NeoChoice and NeoBoard widget to latest releases ([7456543](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7456543d81625599372f781f963fe5902f969627))
+* **helmfile:** Add missing `deletePodsOnSuccessTimeout` statements ([87144b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/87144b8fd3268ad8196673999241ed1a1bf234fa))
+* **helmfile:** Support for `functional.externalServices.matrix.federation.domainAllowList` ([817af98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/817af98fcdf9bca0028365796fb17a8cd5d9f4f9))
+* **intercom:** Allow transient session cookies and rolling session duration configuration ([4d59d12](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4d59d12a9703e05cb6bc47fe413ebcaafdcb4c8b))
+* **intercom:** Update to Intercom Service v2.10.3 ([7b05213](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7b05213d6eaa96717e368bc68b79af44c9b3d921))
+* **jitsi:** Update chart to v3.1.0 incl. a fix in room history toggle ([1480253](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1480253a52e5a9848b626f60b7fb75ad7c43c4a5))
+* **migrations:** Explicit scoping of role required for access to the migration's ConfigMap ([02488fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02488fe2dd84046735bdb9351e47d4508eaf191f))
+* **nextcloud:** Disable integration with OX App Suite if groupware it is not available ([fdfe76c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fdfe76c37e597534b2a8b4bf609e28628aabff3e))
+* **nextcloud:** Update apps and support branding of the HTML title ([bc55f6a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc55f6a366398aae497bde8d81b9663b04f992de))
+* **nextcloud:** Update images for improved log output ([f1147f0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f1147f0fdf12271c47225f81069013afdf8bd5f3))
+* **nextcloud:** Update images to allow logging in environments where inotify cannot be used ([0110675](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01106757da8d8d5a60629126a794c1d61d850f0b))
+* **nextcloud:** Update to 30.0.6 including latest apps ([52b0b13](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/52b0b13e6bf4be738bd29029d1f2940e93a99045))
+* **nubus:** Add imagePullSecrets to nginx-s3-gateway ([466b70a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/466b70a9bb9bbbaf25c920fcca965388eb4d0350))
+* **nubus:** Add migrations for Nubus 1.7.0; See migrations.md for details ([7d7e9e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7d7e9e65b32e6445b45edcb8bf15f64f79d63a2f))
+* **nubus:** Always use S3 gateway for assets ([1e62a0d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1e62a0dfe14ccd840e910d6aea79fb7beabb8da5))
+* **nubus:** Change logo URLs for apps referencing the openDesk logo provided by Nubus ([5d398f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5d398f5d64fd03ad9e9a3898424f485fef8888b1))
+* **nubus:** Cleanup of unnecessary LDAP groups; customization option to show the OX App Suite context selection in the IAM's admin UI ([4c42ed7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4c42ed76e82fc0cd517a7409e21cadb757fdac8a))
+* **nubus:** Delete now legacy Ingress `ums-minio-rewrites` ([1c50aa5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1c50aa5ce2ffef4446b28504c461faf84ef856c8))
+* **nubus:** Fix mixed up links for legal and privacy statement ([dbcc785](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dbcc785134a79ebe500724739338702c5e6772a3))
+* **nubus:** Indent `nubusPortalConsumer.persistence.groupMembershipCache` causing `persistence.storages.nubusPortalConsumer.*` to be ignored; See migrations.md for details ([baa5b14](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/baa5b14551f405a5e17ddfc62733c98868a1f205))
+* **nubus:** Register OX provisioning consumer only when OX is enabled; See migrations.md for details ([adb3fa1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/adb3fa18eb36de91927c8118493038b400ff77d5))
+* **nubus:** Remove unnecessary inactive portal tiles and folders ([1724fa1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1724fa14a3fcab9473da06f7702eb248eef334c6))
+* **nubus:** Update openDesk customizing: Preset openDesk specific attributes on `Administrator` account; Remove unused portal categories ([6edfe72](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6edfe7239fd3916be71f830543c01084100b8aba))
+* **opendesk-services:** Add notes to certificate resource ([d18abb0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d18abb0d0a2e011065a6c40f80f56bbdb5a48a90))
+* **openproject:** Update `opendesk-openproject-bootstrap` to support external secrets ([41e0aae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/41e0aaeffec3e0b4f83662b4381713d2480533fc))
+* **openproject:** Update to 15.3.0 including update for seeding relevant environment variables ([a6de1fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a6de1fe694e7cbee88db5a0688b60e7c8d8e4cff))
+* **openproject:** Update to 15.3.1 ([f34a4a3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f34a4a360178f3a54cfe45198c4717241a9c5289))
+* **openproject:** Update to 15.3.2 ([6723a34](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6723a34c229fb683d5adb1c8c900afb0c3f24087))
+* **openproject:** Update to 15.4.0 ([2a0f2a3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2a0f2a33330e149f8b4b26a3b3c5273274b2c0ca))
+* **openproject:** Update to 15.4.1 ([747cae5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/747cae545abf186b8ec19b5203cdf47c67667601))
+* **openxchange:** Template HTML title from `.Values.theme.texts.productName` ([2e992fc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2e992fc23606a497d770e44fb3afeada1f5d54dd))
+* **openxchange:** Update to latest 8.35 patch level ([44c2081](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/44c2081bd860bd66204d2648f287fc6c5b928faa))
+* **ox-connector:** Update to v0.14.7 ([dd3b35b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd3b35b626d860389fad4fc0541dc962fe51c060))
+* **postfix:** Add internal authentication ([2389d59](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2389d597358f53e43be5982e29125eabda94bf6c))
+* **postfix:** Add recipient delimiter support ([f92b76b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f92b76b2b28c7955123f83881d23f719ea8dfd5c))
+* **requirements.md:** Set Ingress NGINX 1.11.5 as requirement ([2bf8e1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2bf8e1de9873e15501b282d8e0d16350559e54dd))
+* **synapse:** Use synapse-guest-module by Element (supplier) ([2730b03](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2730b03e701922c3b14fdd5f8e8dfb64223b3edc))
+
+
+### Features
+
+* **helmfile:** Use PostgreSQL as default database for Nextcloud and XWiki;  follow `migrations.md` when upgrading an existing environment ([2f584bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2f584bd8e82ab7262659d6b24613f214f6e9ad25))
+* **nextcloud:** Support external secrets for metrics token ([dbec2ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dbec2ec36f5019bc0f5e9769ab02701ebac4aa2c))
+* **notes:** Update to v2.4.0 ([3d35440](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d35440dc76c703872488ec468649ed274099fd5))
+* **nubus:** Support of external secrets in opendesk-keycloak-bootstrap ([3d2f751](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d2f75165a571a67d08f7e9588297c70fc808179))
+* **nubus:** Update to v1.7.0 ([d018385](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d018385473df1f5154e15ca8c55145d10e713797))
+* **openxchange:** Update to OX App Suite 8.35 ([037537b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/037537b394b2e07aa05590c8bcf7c1145df7d7e9))
+* **xwiki:** Update to 16.10.5 ([bfd27f3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bfd27f3c396d6f05ed3e6dd4cd9f2ff424250da8))
+
+## [1.1.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.1...v1.1.2) (2025-02-19)
+
+
+### Bug Fixes
+
+* **dovecot:** Add Dovecot Pro [EE] ([6e343c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6e343c76a32a5bf4b431bdad6be1f7d107caa4f5))
+* **element:** Add Element EE components ([61d94a8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/61d94a8de655d1289aaf59c42f0dbf30b0156e1f))
+* **helmfile:** Add missing customizing option for Matrix widgets ([9c79c44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9c79c44453af7b0c68f4ee2a5e40f1f9fb298570))
+* **helmfile:** Add SSL option for Keycloak Extensions Proxy's PostgreSQL connection ([91d0f98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/91d0f9868226b08128af518be741c8614342581e))
+* **helmfile:** Fine-grained service types ([de8b560](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/de8b560fe7e2294229a959398be60bec9b6a7790))
+* **helmfile:** Integrate oD EE ([03ec704](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/03ec70435c365eca9f555a195b7ab92cc9eee907))
+* **helmfile:** Introduce `apps` as top level in `opendesk_main.yaml.gotmpl`; Please check migrations.md for upgrades of existing installations ([2fcf014](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2fcf014894ac3356ef8c6e57dda30c5176172e5e))
+* **helmfile:** Make openDesk IAM attributes optional with enabled as default ([b32996d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b32996da347c7ec24fb53afe72fee8c07631bebe))
+* **helmfile:** Provide toggle in `functional.yaml.gotmpl` for "new device notification" mails ([284c9fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/284c9fe0c7e217e3f92ec70eaad6ccf593ff2a87))
+* **helmfile:** Remove reference to no longer required `elementWeb` chart ([cd9c54b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cd9c54b17733f9e334c558ccd86e69677264970a))
+* **helmfile:** Set default for domain to `opendesk.internal` to avoid enforcing DOMAIN environment variable for deployments using YAML overrides ([930ae9d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/930ae9d3e71bcd3f4034aa4dae5eabb3ae04d11b))
+* **helmfile:** Update/streamline theming ([8eeaa23](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8eeaa23c2f68e8e0cbda5b3763ab15ba8262c48d))
+* **jitsi:** Support for phone dial-in into Jitsi conferences ([1323ef1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1323ef142e789820acb05cb4991d10502a35498b))
+* **nextcloud:** Update `groupfolders` app to fix group selection in admin mode ([ab49bf9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ab49bf9f6bb945cdce3950e46382b7361c48e6e4))
+* **nextcloud:** Update Nextcloud to 29.0.11 and support for Cron-Job specific resource definitions ([09f4829](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/09f482981b96774b3fe0948b7bb120be90157148))
+* **nubus:** Disable unused notification feature ([955f17e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/955f17ef8bb72459beb536cdcf6b502b16eabbff))
+* **nubus:** Fix Keycloak dialogue background length on small screens ([4662709](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/466270967310fab9333b892c904efa86d21f7d17))
+* **nubus:** Only configure apps that are deployed to show up in IAM admin UI and Keycloak ([1f051e7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1f051e777905668297c98dfa507875c08158bfda))
+* **nubus:** Re-implement toggle for UDM-REST-API based on `functional.externalServices.nubus.udmRestApi.enabled` ([777e7d2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/777e7d2fc6afa9c53a4ff1c6853c9960b9a22d5f))
+* **nubus:** Remove doublet `resources` key in `udm-listener` StatefulSet ([10e0b0a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/10e0b0ad6cbd89bd88b119f17b6cba6ec698f698))
+* **nubus:** Support for custom UDM commands ([aff8edb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/aff8edbde2150763d6a36f97b9403c8c67e51fab))
+* **nubus:** Update Keycloak Extensions Proxy ([601e649](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/601e6499132c3adaaaea374033511eab09132cb2))
+* **open-xchange:** Parameters to split read and write queries to MariaDB ([370247b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/370247b95197792a65b84b2d01b9c1806f8b059a))
+* **open-xchange:** Update OX App Suite to 8.33 ([581c8ae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/581c8aed1f86bad251141ecb105e59d0054d5a1a))
+* **openproject:** Update OpenProject to 15.2.1 ([83c311b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/83c311b101a6fa551d9c25ea4e9a7ef6673137ca))
+* **oxconnector:** Update to strict `securityContext` from upstream defaults ([32df165](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/32df1657d29a2d73495d52b62bb77521cb8b8e86))
+
+## [1.1.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.0...v1.1.1) (2025-01-27)
+
+
+### Bug Fixes
+
+* **docs:** Add permissions.md ([04ab28c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/04ab28c029bb60575c1936ca5acdd2f829b26c06))
+* **element:** MatrixID for Element "Welcome User" to support deployments where matrix domain differs from homeserver FQDN ([ccb51a0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ccb51a0de32525a93fd982d52dc8e6a35db8f09a))
+* **element:** Update Element to 1.11.90 ([335806a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/335806a53e51c3fc6a03440316e909aa51af5be8))
+* **element:** Update Helm chart to v6.0.2 for a fix when using non generated secrets in `opendesk-synapse` ([d5e73fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d5e73feb880c33e8127f284fcc685ffdc15874a8))
+* **element:** Update Synapse to 1.121.1 ([33ff922](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/33ff9227b745f99e3abdde6dbbe6b00042fca655))
+* **helmfile:** Move the access restriction configuration for Keycloak client scopes into helmfile templating, instead of hardcoded Helm chart values ([3662b5c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3662b5cd255b37321d3a3625f78feff07b7e633c))
+* **helmfile:** Remove duplicate entries from `secrets.yaml.gotmpl` ([a13cf63](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a13cf630242343dc8f759cfeb423ff626480b086))
+* **helmfile:** Support component specific storageClassNames. **Note:** Please check the migration.md if you upgrade a deployment that has set custom PVC sizes using `persistence.size` settings. ([bacf51e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bacf51efb1b042b80f13f5cf3f50557006f32374))
+* **helmfile:** Support PostgreSQL as alternative database backend for Nextcloud and XWiki. **Note:** PostgreSQL is likely to become the preferred option/default in the future and MariaDB might be deprecated at a later point. ([a0f52ee](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a0f52ee7d4f6a9b82c9d4e288bc4c6cc96018985))
+* **helmfile:** Update `opendesk-alerts` and `opendesk-dashboards` to get predictable sort order, improving GitOps deployments ([0c91117](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0c91117575a3b56ff9f0b4ae72a501b9f3b4384c))
+* **helmfile:** Update upstream images for k8s/kubectl to v1.32.0 ([b71c2e5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b71c2e57eec10093d96804e249fbaf81c51fb22e))
+* **intercom:** Remove legacy OIDC claims ([6796f32](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6796f320f72db02d67b73685aa6356cda9ac86d1))
+* **nextcloud:** Update image and Helm chart to support app toggles during deployment ([1cdfcf2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1cdfcf2784271f2b8ea61d2e8e534db2aa386f4b))
+* **nextcloud:** Update to Nextcloud 29.0.10 ([d096fb1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d096fb1154dbcd092e105d4450e7996dfda0388e))
+* **nubus:** Fix `pullPolicy` setting for `ldapServer.leaderElector` to satisfy Kyverno linter ([6f2f7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6f2f7cd5db6708c1fc523e3cf3160f39f1dba2bb))
+* **nubus:** Merge yaml files for better maintainability ([6c67eca](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6c67eca7aa68c3f597cc5790ba1046ca0855c329))
+* **nubus:** Pre-create groups in Keycloak to avoid race condition on group sync when initial users login parallel ([5496317](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5496317fee1ca47a80d0798b9048a1474ca8e2a6))
+* **nubus:** Remove `extra` settings from ldapServer needed for openDesk 1.0.0 LDAP migration ([fab862e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fab862eec689bf8ef547c4bd06244313f24f6d0b))
+* **nubus:** Remove b64 encoded files from CSS, instead use `opendesk-static-files` ([2926e2c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2926e2c93a2b4be24abd1e6dd4ce02071a629cb4))
+* **nubus:** Template `secrets.nubus.masterpassword`. **Note:** Please check migrations.md for details. ([5aae75a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5aae75a1521f73e497859fe3d3b89a8752bb47a1))
+* **nubus:** Update customizations for group cleanup ([0b230fa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0b230fa2cc841edfde99f5d94dc9c8054bfbb5ec))
+* **open-xchange:** Add missing `registryOpencodeDe` to OX-Connector's `waitForDependency` image ([a16d907](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a16d9071c96ef7fde87e6579c328e1e05509824b))
+* **openproject:** Update to 15.1.1 ([b4b714f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4b714ff41a8f01d4b44c6d5ced3f036f7d90699))
+* **openproject:** Update to 15.2.0 ([9d8e9c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d8e9c3ade9917fb8044331ebdea8d7bca4066b0))
+* **static-files:** Update Helm chart to use more generic `assets` over `theme.imagery.assets` ([63562c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63562c1aae6b2c33ea39b93c11e842c2ab1e2c25))
+* **static-files:** Update Helm chart to v4.0.1 to support longer domain names ([b0e665b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b0e665b031baf36c59eea85b3d575f1a49290bf1))
+* **xwiki:** Update Helm chart to v1.4.1 to fix support for custom `ingressClassName` values. Ref [#144](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/144) ([033cb55](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/033cb558ddc0b47d17b006cdc75c593c5c356147))
+
+# [1.1.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.0.0...v1.1.0) (2024-12-24)
+
+
+### Bug Fixes
+
+* **cassandra:** Prepare cassandra for openDesk Enterprise. ([508e286](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/508e28623258542a4082e79ed75ce1e5758ae2e0))
+* **cassandra:** Remove values in charts.yaml for enterprise components. ([c0cbb76](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c0cbb76921b5108d084640baf3e607e9fc6557c7))
+* **ci:** Explicitly set RELEASE_BRANCH (to `main`) for scan and release steps ([e5ad0bb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e5ad0bb2e028dafab0ba29fb2e9b0d207b8795fd))
+* **ci:** Reduce Kyverno linting issues ([e4d9106](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e4d9106c457e018922dcc730df0570d41f3ec2aa))
+* **collabora:** Add/update Helmfile for Collabora Controller to be used in EE deployments ([a63d7cb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a63d7cb8614bfa7d26d997ffdf3ea807ae187664))
+* **collabora:** Update to 24.04.9.2. ([407f2be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/407f2be2ad2d40813bb37e0ba302ef14e3a06bd9))
+* **docs:** Add `architecture.md` and `apis.md` ([7710858](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/77108587c71dee16ecf539608838c8c9064a66f8))
+* **docs:** Add GitOps / Argo CD documentation ([bbe7550](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bbe7550c4617b4799190192b5316ac04295e9e88))
+* **docs:** Update and streamline README.md and migrations.md. ([a86c0af](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a86c0afdbb7fa1230aa90cf210323969fd580431))
+* **element:** Add extensive database options ([9e102e2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9e102e2d1b9d6621b9c5d6ed0643432e8879f663))
+* **element:** Prepare element for openDesk Enterprise. ([00a1a93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/00a1a9394ee3544b1a0d7b3e975c36830ba8b13c))
+* **element:** Rename release opendesk-element to opendesk-element-web ([1213ecc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1213ecc425041ac4adba99a0ae2d8188932a7d9f))
+* **element:** Switch `element-web` base image to Alpine ([47ce294](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/47ce29440388370f7d63e373eeda90d067830ebd))
+* **element:** Toggle IPv4-only mode depending on cluster.networking.ipFamilies ([627b9c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/627b9c1e8464fd9529ddf50f171031053710323c))
+* **element:** Update Matrix Meetings Bot to 2.8.2 ([4403dfe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4403dfe720982a8339043951a4dfc88bfb0af57c))
+* **element:** Update Synapse to 1.120.2 and Element to 1.11.87 update also related containers ([9d7644d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d7644dc04c9ef97449680e5197f2129d62d56f8))
+* **helmfile:** Add `opendesk-static-files` to `opendesk-services` to serve favicons ([6438284](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6438284090f3e552843679c1ea62b5538be5dff9))
+* **helmfile:** Add Redis username and tls option ([564fb2d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/564fb2d7c7190a91446293ce21950701503ecbb7))
+* **helmfile:** Allow usage of pre-defined CA certificates. ([0738fa0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0738fa080d61f0e6c084dd8fd5e09635469b1dca))
+* **helmfile:** Auto-redirect user to login dialogue, please read migrations.md for more details ([a9c8dfe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a9c8dfeab125510a7d9a137e16b14685155aa441))
+* **helmfile:** Remove `default.user` and `default.admin` for new deployments. ([54f9e4c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/54f9e4c3f8fd425bde1272e3eec490efa30461f7))
+* **helmfile:** Remove `theme` subtree from the migration's `.Values` secret to avoid a bloated secret hitting limits in certain clusters setups and GitOps tools. ([b6725dd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b6725dddc19f22e142a214c02aef5139b2921d5a))
+* **helmfile:** Splitting the directory `./helmfile/apps/services` into `-external` and `opendesk-` services, please read migrations.md for more details ([277a1f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/277a1f5a65e340180feeb84cce2097be5a2157e1))
+* **helmfile:** Streamline `commonLabels.deployStage`. ([f969425](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f96942536f931e8f8eb714ce0503716b873b593b))
+* **helmfile:** Streamline `requests.cpu` in `resources.yaml` ([43f427e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/43f427e06a83aea8979e1b54f7ea7f2d24ab28cf))
+* **helmfile:** Streamline file extensions in `/helmfile/environments/default` to ([0e3b661](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0e3b6615653d7bbe30b09e57428b1f5c19f171f8))
+* **helmfile:** Unify templating name for Open-Xchange to `openxchange` and for OX App Suite to `oxAppSuite`. ([6ff1fcd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6ff1fcd438103534e78a5898f25fcea1080dfb86))
+* **helmfile:** Use dictionaries for defining `customization.yaml`, please read migrations.md for more details ([86ef0be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/86ef0be542b0e34d76a85cb226e223a3e7dbc76e))
+* **jitsi:** Update Jitsi Helm chart and images. ([5c691e4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5c691e450821c81b363040b68ffba96e38d1712b))
+* **jitsi:** Update to 2.0.9823 and chart to 2.1.1 ([56ce335](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/56ce3355fcedf60595f33609848f6c8bd8644914))
+* **jitsi:** Update to switch the colors of `Hang up` and `End meeting for all` buttons. ([9dbb2b7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9dbb2b755caa8e6bda80bed691c54e66b1a63eb9))
+* **migrations:** Cleanup of jobs ([539a302](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/539a30263c9ce25ab7c6aa6607fd41cd1099315b))
+* **migrations:** Update to support Nubus 1.5.1 ([7f60ab3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7f60ab3b7a155c8f95bfcf139fa896cbc41ca767))
+* **nextcloud:** Add Redis TLS option ([1402593](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1402593556af9cf039878a1261b656424fc45c88))
+* **nextcloud:** Fix templating for nextcloud database name ([7f1f6cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7f1f6cdcd4385d24cf13cdf9425b615337a131de))
+* **nextcloud:** Fix templating for nextcloud database user ([c8c12a2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c8c12a278e8d00f04c1c7b6dd7fbdf3826c89a19))
+* **nextcloud:** Support IPv4 only clusters ([b25ada1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b25ada1f603659cd551be23d62992e8fa6a0603d))
+* **nextcloud:** Trusted Proxy setting. ([bc0ca8b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc0ca8b4c1dfdcd046c9b4ddd1f63a28e6a5531a))
+* **nextcloud:** Update Chart to 3.6.1 and Image to 2.3.3 (including rollback to 29.0.8). Introducing setting for `functional.filestore.sharing.external.sendPasswordMail` ([18fcaa0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/18fcaa0331c9c94bb2f260f97fbadad44b019bb6))
+* **nextcloud:** Update to 29.0.9 incl. latest apps. ([c63cca7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c63cca72a35cdeb35b8ea48d98a5c5d55982d145))
+* **notes:** Add `favicon.ico` via `opendesk-static-files` ([669995b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/669995bb95235a56f7b2387c4c582d6e7250e4a9))
+* **notes:** Add https to all endpoints ([174951c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/174951cd5145e83d776a9b4bda4f091d5b827402))
+* **nubus:** Add nginx s3 proxy when minio disabled ([b3b6ab5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b3b6ab5a61dc5bca13c8b1f4e6b716bbcad64e8c))
+* **nubus:** Enable Keycloak debug mode logging; add Keycloak specific section to debugging.md ([3b3679b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3b3679bab150ece327ce1e132933820b1e3afa88))
+* **nubus:** Fix selfsigned certificate mounts ([b90bff3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b90bff30b35b91fff792f2d5d617de4cdba30f23))
+* **nubus:** Leader election on re-deployments ([b965677](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b9656772a9c743c9119a850e0b48cb39d68f48fa))
+* **nubus:** Start ums keycloak bootstrap already during Sync phase ([16dfd25](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/16dfd255c621b1da311fd6fee775f7397e5f6792))
+* **nubus:** Update external portal links and login screen background. ([901b1f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/901b1f529e7d16a8164511bebac1e7f9a475d111))
+* **nubus:** Update to 1.4.0 ([2a94f2d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2a94f2dd4bdfa039b4459b3711e171ee46172583))
+* **nubus:** Update to v1.5.1 ([4c7422a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4c7422a411a4fa1ddc36430d363ae06226efb31d))
+* **nubus:** Use favicon with transparent background for portal ([1b13c3e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1b13c3ea658786420d960c8e67aed81f40067c0a))
+* **open-xchange:** Extend Dovecot LDAP filter to also match OX-Resources ([31ea6e0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31ea6e0e08226afb8d9cba4370033fd6f742459b))
+* **open-xchange:** Fix truststore decrypt error on self-signed deployments ([8611d95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8611d95e5a4ab7b158ed8322676589c3d196b548))
+* **open-xchange:** Update AppSuite to 8.30, update Helm chart to 2.12.85 ([0c88699](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0c886999174f87030af268c7fdd0beee11f01346))
+* **opendesk-services:** Update minio to 2024.12.13 ([4cda827](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4cda827f5554ed7ff92a85fc62f6908183181f9b))
+* **opendesk-services:** Update otterize Network Policies ([4602396](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4602396583c454a23b3458c54cb40e259f245163))
+* **openproject:** Bump Helm chart to 9.2 ([718eb45](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/718eb45e9c9961f1f792b59e232fd7da66916c7d))
+* **openproject:** Bump version to 15.0.2 ([c06e0bb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c06e0bb8d4d04c8794dafddecc189d5f376d661e))
+* **openproject:** Update 15.1.0 image ([6d329e1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6d329e18cff8c6ebbbf1b0965801827079904f88))
+* **openproject:** Update branding and Helm chart to 9.0.1 ([d3b1916](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d3b191644b0bf20cac1cd9f85ed4b4dc7c6b549d))
+* **openproject:** Update to 14.6.3 incl. latest Helm chart (8.3.2). ([4c82adf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4c82adf668c7f90489bc4ae46426cf607e3425d8))
+* **postfix:** Added service type definition analogous to dovecot ([31ec100](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31ec1003c0874a2920132c61d48a1a88e5569cb8))
+* **services:** Add template for certificate issuerRef.kind ([df144fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/df144fe3d3ffd70ca0b7e5aa4c2894b96d0138f1))
+* **services:** Update MariaDB chart to v3.0.3 in preparation for the use of external secrets. ([08feab1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/08feab1cfcc099d9b8caed2c4db9a97d4542a5ac))
+* **services:** Update Redis to 7.4.1 as required by OX Appsuite, please read migrations.md for more details ([5e0b2e2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5e0b2e26fc33d7befcb3f94d748e8e9d6f93f383))
+* **xwiki:** Fix templating for xwiki database port ([de15071](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/de15071ae9d6194d93f9a5fbb0033650b266eaf9))
+* **xwiki:** Set superadmin password account only when debug is enabled ([e2b3bd5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e2b3bd543fab7be512cef58382c4d62c48cd79b4))
+
+
+### Features
+
+* **helmfile:** Add grafana dashboards ([1441c57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1441c5734f42b995505e6aa97f59bdb1eae32b1b))
+* **helmfile:** Add openDesk specific alerts ([f630a36](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f630a369da12ef7f19d5553c6dbd5955e414868f))
+* **helmfile:** Add template support for antivirus icap/milter ([83da87e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/83da87e9623be294753302686a8d8270c28bcc58))
+* **helmfile:** Allow custom/self-signed ca-certificates ([c71faf5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c71faf5e8011c42b02fd5025a9b1629300a4f1e3))
+* **jitsi:** Enable Jitsi room history by default. ([45add79](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/45add7981c3a50045caeadb7f2b0bc11254ae562))
+* Newsfeed in Portal based on XWiki blog feature ([3ad285a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3ad285a8695a32607c4bf0faea0747c7e685dcd6))
+* **notes:** Integrate Preview of Notes app ([96f1819](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/96f18196c53267dbd72cd28e6fbadf06448db93a))
+
+# [1.0.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.9.0...v1.0.0) (2024-10-14)
+
+
+### Bug Fixes
+
+* **ci:** Add TESTS_GRACE_PERIOD variable for run-tests job. ([1023f3d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1023f3d081a980a794850399f133cf817448c431))
+* **ci:** Re-enable e2e test trigger. ([603b102](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/603b102f41b8a7e3bfab1c7d45cd05da96c455f6))
+* **ci:** Remove K8s secret creation for `EXTERNAL_REGISTRY_USERNAME` / `EXTERNAL_REGISTRY_PASSWORD`. ([cbe6b1a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cbe6b1ae6c01beb68ae3bcc0d2444f4b48c8e2ea))
+* **ci:** Trigger e2e tests for multiple languages. ([9d7d89f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d7d89f74f49c384e9632b74cbe20a641725caa7))
+* **collabora:** Add ipFamilies cluster.networking option ([add2ab1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/add2ab1a41e422295ccd58c09aa9fab9b45f18cb))
+* **collabora:** Reduce Collabora's securityContext capabilities. ([a7ea701](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7ea701cc65ab230d269e4f6b91b39a03c126fad))
+* **collabora:** Set Nextcloud URL for custom font support. ([370c7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/370c7cd836b46fb31c79b59d76297abd8748a711))
+* **collabora:** Update to 24.04.6.1.1. ([97f7a1c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/97f7a1cafd743c5e91f9cce6d028c54281afda81))
+* **collabora:** Update to 24.04.6.2.1. ([3d44193](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d441933ca1c28911218ebc073e7b1d39e402325))
+* **collabora:** Update to 24.04.7.1.2. ([11ebb80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11ebb80494d181b8ef4793e3e59f3e6ac225b072))
+* **collabora:** Update to 24.04.7.2. ([5f72da4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5f72da4e579aeb749c045bb7f25355b3e12b411a))
+* **docs:** Update `replicas.yaml` and  `docs/scaling.md`. ([45715a2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/45715a20594dafe833041d5843c857bc0e23dcbc))
+* **docs:** Various updates. ([8aa1a7f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8aa1a7fa7d106d2e70b1e31b6bda5febb3afec66))
+* **element:** Feature toggle for user controlled updates of their Element display name; new default for generating MatrixID, check docs/migrations.md for details. ([efc41cb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/efc41cb3aa0294d79f6cad3d9e879380745fef57))
+* **element:** Set Synapse rate limit. ([4ff720d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4ff720d36fa30f5f3a7328edd3bfc7edf89cf48f))
+* **element:** Update 'capabilities_approved' for NeoBoard Widget ([ade8535](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ade8535c4456ef9db8c8ef7915bcc4c5ae215f6a))
+* **element:** Update NeoBoard to 1.20.0 and `synapse-guest-module` to 2.0.0. ([11b0d44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11b0d441e0c886b5360690d23bf266a4ccb57a10))
+* **element:** Update NeoDateFix translations. ([71f21dc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/71f21dc4333765f4bdaf7cfd8910b9b6982b0340))
+* **element:** Update Synapse to v0.1150. ([12680e5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/12680e5c1ae40a7722db0417751b014229bdd559))
+* **element:** Use Element upstream without widgets. ([bdc6ad2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bdc6ad286425e429c8195014251046ac0cfe6424))
+* **helmfile:** Add `cluster.networking.proxies`. Deployments need to set this if their load balancer or reverse proxy IPs are not part of the `cluster.networking.cidr`. ([a395759](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a3957595516e6864c762fbeedb9fdc50c02920cb))
+* **helmfile:** Add `sample.yaml.gotmpl` to `dev` and `prod` env directories. ([dd80abe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd80abe622fd824b8af358a8923d6fb47715825d))
+* **helmfile:** Add new settings to `functional.yaml` for fileshare expiry dates. ([6b88f73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6b88f731eb2b6c8ceebc9a7a0c96e63d13743b24))
+* **helmfile:** Check imagePullSecrets templates for all resources ([13e0bb8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13e0bb8d68df12b8451b7318059d35f7eaa018b8))
+* **helmfile:** Move Intercom-Service to Nubus component. ([ef1dad7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ef1dad7433bbf64b9d021bd581d9016ffc68e610))
+* **helmfile:** Move OX-Connector to Open-Xchange component. ([751f578](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/751f5783d05ec4577e563d135c04d2925a14da47))
+* **helmfile:** Remove NET_RAW capabilities ([e512486](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e512486e74545449a0e3dca5254ffb44f2d1790f))
+* **helmfile:** Remove some YAML linter warnings. ([d641359](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d641359c29c81c774880196febaf4e979b98e5d6))
+* **helmfile:** Remove toggle `functional.email.systemGenerated.useComponentInSenderdomain`. Mails will no longer use a component subdomain in their sender address. ([b60fe39](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b60fe39b5c7f6479180495eb76a52b77385fb92d))
+* **helmfile:** Switch fom dep5 to REUSE.toml. ([592f031](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/592f03135f226a18038dff534c5b8f8dfc327670))
+* **helmfile:** Update portal and branding. ([6ba6923](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6ba69236129e2176afd14d05060f6db1671df863))
+* **helmfile:** Update replicas.yaml. ([8ef69ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8ef69ecaf22a8cee51ea4029173d30ff5f1213a0))
+* **helmfile:** Update to support Helmfile 1.0.0-rc5. ([f4b9395](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f4b9395b4134b28eb969e71bc2321eae3054da00))
+* **intercom-service:** Customizable user mapper. ([a7e5f64](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7e5f64b50f102855bd15568ff698160f2b616e3))
+* **jitsi:** Improve handling of non authorized users. ([8bca56d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8bca56d4acb1e8baf1d9bd6e640080b15aac35df))
+* **jitsi:** Update chart for improved openDesk look & feel. ([f297d8c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f297d8c0b70bd923670a6107471dafe750d8a352))
+* **jitsi:** Update Helm chart and Keycloak Adapter image. ([3ad81e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3ad81e6b92ac652fbf20f56f2cc85e6d8eb5d0d4))
+* **jitsi:** Update images to `9646-stable`. ([49ad36e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/49ad36ef4e04640493373e0ba9f4d596968e5412))
+* **jitsi:** Updated branding and new option `functional.dataProtection.jitsiRoomHistory.enabled` defaulting to `[secure]`. ([67d52c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/67d52c771ef596e444d021886cf5554e12fc1a65))
+* **nextcloud:** Add support for secret keys for administrator and ldap credentials ([7aee88e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7aee88ec94be75f096c31bbb08246c563736b5bc))
+* **nextcloud:** Bump image to incorporate latest PHP fixes. ([c9ae039](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c9ae0391b07e18f22c91f4eb6ac746f43210a3f3))
+* **nextcloud:** Remove `/index.php`. ([3baf37c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3baf37c5097e763069ad66163362e19a90bd5d4e))
+* **nextcloud:** Update to 29.0.5 and support for new functional settings regarding sharing of files. See the options related to `functional.filestore.sharing` in `functional.yaml` and also `migrations.md` regarding their defaults that differ from the previous standard behaviour of openDesk. ([ac148d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ac148d0c28cf8382c8b96dbedddeccdd0fcd762b))
+* **nextcloud:** Update to 29.0.6 including latest app updates. ([9950b73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9950b73ae3789fbae31e98a6ad9845822797cb78))
+* **nubus:** Add interim ingress configuration fixing UMC in German ([6a60c6d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6a60c6dd43a31e6e972d7149977638d077cbe77b))
+* **nubus:** Only use one LDAP Primary and make replica count of Secondary and Proxy others configurable ([31753ff](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31753ffb19dcd4a82766ed39e7584cbba46b57b0))
+* **nubus:** Reduce lint failures, especially take care of pullSecrets ([e923468](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e923468cd6070615c5ba776bb223759988283ecd))
+* **nubus:** Remove duplicated "nubusPortalFrontend" ([8cd2f3a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8cd2f3a993af673eba3c931a2a9e5a9756943a5d))
+* **nubus:** Remove superfluous variables ([a7d3d25](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7d3d2585ca73543902d5240f3629bc4e1bc4fe8))
+* **nubus:** Update "openDesk Standard" OX profile. ([fdb37c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fdb37c3943b08a49badf15da93f4d07abf8f7706))
+* **nubus:** Update customization for improved UX. ([b9db81f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b9db81f69d19985571486aaa4cc11077e0a2abc2))
+* **nubus:** Update LDAP openDesk schemas and add related openDesk config options to user. ([e3238f9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e3238f96f74bfea0b52125d0b5c384aacb75287c))
+* **nubus:** Update LDAP to openLDAP 2.5. ([c63e725](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c63e7255254db140d622b658603b99dee5af9879))
+* **nubus:** Update opendesk-nubus to set default OXContext and improved OXProfile, update migrations to (optionally) ldap-patch OXContext for `Administrator`/`default.admin` as well as patch the OXProfile to 1.0 default state. ([e619db6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e619db6da20710a9c1f3df6d8777a370be90c697))
+* **nubus:** Update to 0.63.2 ([28dd762](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/28dd762db397f47f0741087fd376be9e3e194dbe))
+* **nubus:** Update to 0.64.2. ([fc7099a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fc7099a8a6d71f10be1e9ac92279cfdb5f0ebb7d))
+* **nubus:** Update to Nubus 0.62.2. ([8229949](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8229949b47b15933fd4bcc198ec8b27302e2ea32))
+* **nubus:** Update to version 0.57.3. ([11f750e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11f750e1d603c44fdcbc9711fbe66cbf15ff0c10))
+* **open-xchange:** DisplayName settings for OX-Connector. ([b7faa24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b7faa24d76d6078336d222b195fb83f0860e7e35))
+* **open-xchange:** Update cluster internal Nextcloud URL. ([b1946d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b1946d0c1df6a8825bb5ba6ce61bb8d51d8eefa5))
+* **open-xchange:** Update Migrations for OX-Connector. ([6325b69](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6325b69a9145d90328237c359315d057bb187fc5))
+* **open-xchange:** Update OpenXchange Appsuite Bootstrap to v2.1.0 ([fb8f7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fb8f7cd28a82025be5bdc1f9eb92cb2497e22e16))
+* **open-xchange:** Update OX AppSuite to 8.26 and improve configuration including server-side Element integration. ([61d7496](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/61d74966d0427ed9214858af2126f250117a8962))
+* **openproject:** Bump OpenProject to 14.5.1. ([deacbc9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/deacbc9db5f30a492e77eb1516182a40427b0c02))
+* **openproject:** Remove `OPENPROJECT_PER__PAGE__OPTIONS` to enable functional administration of the setting. ([df9380b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/df9380b92445b992dc3917c63f1d3ce02f9c6633))
+* **openproject:** Update Helm chart to v8.0.0 and explicitly template resources. ([91e34aa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/91e34aabaae8e72b0edb6afe466d4de028dc6a38))
+* **openproject:** Update to 14.6.0. ([560aa30](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/560aa30cba2e528094231cb41474a2554f535438))
+* **openproject:** Update to 14.6.1. ([cc4b359](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cc4b35912428b6f4f5541500020f7a4aaff1674e))
+* **openproject:** Updated bootstrap image does not fail on rerun. ([7d0d6ea](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7d0d6ea8d15a226d34a0605daf6d635f6c1caae9))
+* **services:** Bump Postfix Helm chart to 2.2.0. ([f194f24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f194f248459ac0bd39246c72f937672ed24e5f14))
+* **services:** Support application based connection limits and password updates for PostgreSQL and MariaDB. ([c03566d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c03566dd63afd0c66de4627880b33ae359cba54f))
+* **xwiki:** Disable check for local Office component. ([a91f181](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a91f181c463a5feaa3ac04b4b39fcd27a55fe4a1))
+* **xwiki:** Enable IAM controlled functional admin role. ([fa8572f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fa8572f785e59b0797c0e5fee12776d0fdc66361))
+* **xwiki:** Update to 16.4.4 - updated. ([6347966](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6347966765c3a1caeec0840d2132c8c41a5d1237))
+* **xwiki:** Update to 16.4.4. ([d693ff9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d693ff94f4f79ee26df661f738c843bd4d887716))
+
+
+### Features
+
+* **element:** Add feature flag `functional.dataProtection.matrixPresence.enabled` that defaults to `[secure]` to avoid that openDesk provides presence information on users unintended. We include the hardcoded configuration in openDesk Synapse that users cannot change their displayname. ([4b99357](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4b99357b21176f57b75b745a9e3fa04d3cba9d9a))
+* **helmfile:** Add customization.yaml to define custom files for helmfile releases ([180ccdd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/180ccddfaa71e6dcf5f0383bbf1175e6568fc7ee))
+* **helmfile:** Add fine-granular registry overwrites ([7348547](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7348547d9602edb2f52c73d26749c4a4d8aadd91))
+* **helmfile:** Add support for argocd git-ops deployment ([9f081d8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9f081d856724c06928dbb3d6119fd7a090bb4048))
+* **helmfile:** Change default subdomain names. Attention, consult docs/migrations.md for upgrade deployments. ([3d84e80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d84e804c2e93d758e42a477888faf681aa56e7e))
+* **helmfile:** Full ArgoCD support ([7bf8e69](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7bf8e6976a14a1bb3d1a06135c17211d6530a1c3))
+* **helmfile:** Support feature toggle `email.systemGenerated.useComponentInSenderdomain`. ([a46a632](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a46a6326164e2462cd95a7421c7785e7d529e9c0))
+* **nextcloud:** Use nextcloud image with bundled nginx ([81f5969](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/81f5969653388b6ce4ef4d15f4fe1cbd61a17e10))
+* **nubus:** Update IAM components. ([ce03400](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ce03400043414ce0d13e2a0f90909d65d7b6eb99))
+* **nubus:** Update to Nubus 0.39.2 chart ([7345563](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/73455630fdfada47d0f4895d3f2969c7e80b8847))
+* **open-xchange:** Support for email migration feature toggle enabling masterpassword authentication in Dovecot and AppSuite. Requires openDesk Enterprise. ([356d8df](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/356d8dfbfd3825f30fc6c0786551d239e1c5e02e))
+* **services:** [bmi/opendesk/deployment/opendesk[#66](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/66)] Add dkimpy-milter to sign outgoing emails with DKIM and use local postfix as mail relay in all components. ([fbe4909](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fbe4909a8e4c78fd541facea4bd052d10100ea71))
+
+
+### BREAKING CHANGES
+
+* **helmfile:** Upgrading from previous releases requires manual steps, read `./docs/migrations.md` carefully.
+
+# [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24)
+
+
+### Bug Fixes
+
+* **collabora:** Update to 24.04.5.1.1. ([8a2d951](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8a2d951c3b59c3f8ddb508ad8f95798774b7c4b0))
+* **collabora:** Update to 24.04.5.1.2. ([74d444e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/74d444e2d6065082be3ca90373a4d3b1836ea7a8))
+* **docs:** Update workflow.md. ([fd3df7d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fd3df7df6740d8e54b433c039d294843582e8947))
+* **docu:** Update documentation on integration uses cases ([#95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/95)). ([382af1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/382af1dfb966b5d10da4790212d6422a4a8c5618))
+* **helmfile:** Add S3 bucket for migrations. ([972020f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/972020f946d8238e65b1c1e2942682c797306e1a))
+* **helmfile:** Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details. ([26a7641](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/26a7641a5ab764196af6bbe26d97907de86f541e))
+* **jitsi:** Raise memory limit for jicofo and jvb as required by upstream product. ([fe923bb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fe923bb9cd58873957adb018c1410d33bb4d8f3a))
+* **keycloak:** Support for custom OIDC Clients and ClientScopes. ([46412d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/46412d1a9e4547dea8d0da3e322400ea148edf19))
+* **nextcloud:** Support templating of default quota and `*_retention_obligation` settings ([#93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/93)). ([23ef1d5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/23ef1d557bc0fdf6faac59f7a287f1ef1b302404))
+* **nextcloud:** Update to 28.0.7 including latest apps for 28. ([671f57a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/671f57a809eb4bb791698cda39f7711ac4833334))
+* **nextcloud:** Update to 28.0.7 including the apps, fix admin panel warnings ([#94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/94)). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details. ([63f8394](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63f8394e044670a89a642e933600b68ff740a102))
+* **openproject:** Bump to 14.3.0 and update Helm chart to 7.0.0. ([6b609ed](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6b609edc4a60601ca45372b4fc691f0ac7c9ed93))
+* **openproject:** Support for adding token to enable OpenProject Premium. ([dfaf4be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dfaf4be640209f5908815cceaf29db591212ddaa))
+* **xwiki:** Add email address mapping to LDAP sync; Fix hostname `null` value in notification links. ([1067e72](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1067e725b3dabce4ddfeb60b4cbe9e5b4d0db0e5))
+* **xwiki:** Remove .rtf and .odt export options as they are currently non functional. ([b806d51](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b806d51311c6d406ea3c93842601ddf5dbd13bb3))
+* **xwiki:** Update to 16.4. ([db7f5d6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/db7f5d60bdae437cebe58ab10f928a4a348e1ee3))
+* **xwiki:** Update to 16.4.1. ([e54aaab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e54aaab072f31713b5172e4bab9ba7e9ca9c5c26))
+
+
+### Features
+
+* **authentication:** Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage. ([b4570a9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4570a9a873efa6c896fe543ab0ba3b94fd086c0))
+
+## [0.8.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.0...v0.8.1) (2024-07-01)
+
+
+### Bug Fixes
+
+* **collabora:** Bump image to 24.04.4.1.1. ([368fe13](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/368fe13ddb080f0c8f42cbd3612a29f818308708))
+* **collabora:** Bump image to 24.04.4.2.1. ([01767d3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01767d38061259853e4bd8b2eba31d3b04c4e672))
+* **docs:** Add Ports section to getting started. ([c07b25c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c07b25c4b9a702e214373fe08d95827286ebd866))
+* **docs:** Correction regarding the currently supported ingress controller. ([8514908](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/85149086ae70cb85a1718715747985a3da2a7b64))
+* **docs:** Update regarding the currently supported ingress controller. ([064a5ad](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/064a5ad246ea7217c2fb107787228d7aca9b5028))
+* **element:** Provide the internal cluster domain to `synapse-web`. ([a8692d5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a8692d5506dc65895a562423d8ddb7da9078fc3a))
+* **helmfile:** Add script to ease local development of platform charts. ([d8f3e05](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d8f3e05e584116f6196d43e0ea9bb8946ab2e5ab))
+* **helmfile:** Enable SMTP for XWiki and Element/Synapse; Streamline mail sender addresses within platform based on `<localpart>@<component>.<domain>` and allow configuration of `<localpart>`. ([01c5e6b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01c5e6b359dd5eb42c98e818da301871bea79264))
+* **helmfile:** Include all `.yaml.gotmpl` files for the envs in `environments.yaml`. ([e523434](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e52343440d81c0596177399058b4711cc0d5da67))
+* **helmfile:** Streamline `functional.yaml`. *Upgrade notice:* If you set a non default value for `.Values.portal.enableDeploymentInformation` please change it to `.Values.admin.portal.deploymentInformation.enabled` with this version. ([e89b16a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e89b16a747f95be7661b1fd4f5c90acce638542e))
+* **jitsi:** Update PatchJVB bitnami/kubectl image to 1.30.2. ([6ef3641](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6ef3641d82d88d6fed80652b239bc63115abbf2d))
+* **nubus:** Enable Keycloak's user account console. ([c03e4a5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c03e4a534090dde46363a7cfab718bb307e22621))
+* **nubus:** Remove doublette ingress annotations. ([890b36e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/890b36ecbb8c9311b5048d8d6d50ee5acf00ea61))
+* **open-xchange:** Fixing YAML indentation of updater resources ([0ce346b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0ce346b162feb0bc6fee7f18caee84917117abe1))
+* **openproject:** Bump image to 14.2.0. ([1ad35f1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1ad35f1e12e236607e3830da6d08010eb465b501))
+* **openproject:** Switch DBInit container image to Alpine based version to reduce footprint. ([c90f7c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c90f7c1742d415d5a787ff5832959e2974b77b83))
+* **openproject:** Update PostgreSQL image for DB init to 16.3. ([45e5699](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/45e569955d09c584490e6826651f7564567c1f9b))
+* **services:** Allow Postfix "relayHost" to be empty. ([7268f60](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7268f607a5839c6e940ce07fa15c1ffec9610d19))
+
+# [0.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.7.1...v0.8.0) (2024-06-10)
+
+
+### Bug Fixes
+
+* **ci:** Allow CI to be triggered by API authorized personal access token. ([b95fd11](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b95fd1152a2122de0fbc2b31cacb8a1b1c5917b7))
+* **collabora:** Semi-disable update checker. ([d7a127f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d7a127fe269ddf0347adce692f138eb1a6359508))
+* **collabora:** Update to 24.04.3.1.1. ([5869316](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/58693162e6c2f72ba6254dd0168dea48539b7d43))
+* **docs:** Spell check and streamline. ([4d99bf3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4d99bf3bf085a6f8d4dbdef442fa969150dfff4d))
+* **element:** Bump container images (widgets, community artifacts). ([f856205](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f856205afce914ea62a9e309b9400714f4c4d040))
+* **element:** Bump to v1.11.67. ([a4ff89b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a4ff89b213afef9fd35dd6ab3c54bf0e8e8b20c9))
+* **element:** Update Synapse. ([9fa8ace](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9fa8ace80f9af5d5c96073fe836cf606956c4f43))
+* **helmfile:** Remove unused ox-provisioning hostname. ([e31a0a2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e31a0a258e274274e20aab41c4c757d891bff639))
+* **jitsi:** Update jitsi-keycloak-adapter image to Docker tag v20240314. ([6202bc4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6202bc4719e96c537c67a65a9419aa183edc6d55))
+* **nubus:** Change to new Univention upstream registry. ([d7fbc57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d7fbc572ca5b3ee4eca31bf50f4e00f257a72b83))
+* **nubus:** Disable UDM REST API routing by default and always disable UMC local login. ([e1e8a7f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e1e8a7f121c41c3f23db4541211d255dfb06591a))
+* **nubus:** Guardian version bump and refactoring. ([2f88752](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2f88752ae6a9df7ff3cb9a3c2d158589f7defb33))
+* **nubus:** Re-add selfservice-listener image configuration. ([af711b0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/af711b0edb05bb96fe2ad7e51d5862ed97043178))
+* **open-xchange:** Set Nubus LDAP attribute to render manager_name in address book. See https://forge.univention.org/bugzilla/show_bug.cgi?id=53741 for reference. ([4f92001](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4f92001d688416133fcfd3415afb5f4bbceb7356))
+* **openproject:** Bump library/postgres image to v16. ([742c293](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/742c293243e5c8165e065b5b53af7bac6647fad1))
+* **openproject:** Bump to 14.1.0, set default timezone on deployment to `Europe/Berlin` and raise default memory limit to 2Gi. ([6e49721](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6e4972107e8eac498ace98217488f4e07fabb6b1))
+* **openproject:** Update Helm chart to v5.1.4. ([75cd077](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/75cd077351c0a892afcd57c835b77206ea90da66))
+* **openproject:** Update to 14.1.1 and bump PostgreSQL 13 image for InitDB. ([bd2d7cf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bd2d7cf748f8cb6b1693056c4a5fc4a60b598acd))
+* **services:** Update `opendesk-home` to v1.0.2 to fix issue with Element `.well-known` ingress collision. ([b0eb28b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b0eb28bc3f577a46021444832e0cc132f6e4b0e1))
+* **univention-management-stack:** Add functional switch to disable deployment information. ([a31c5f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a31c5f59a68e90ba9e80350ebd5827e7b05d4ef5))
+
+
+### Features
+
+* **element:** Enable Matrix federation via https. ([ecb566f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ecb566f61e9818ff204501730576af360e4e90d0))
+* **helmfile:** Add support for Ingress parameter configuration (proxy-body-size, proxy-read-timeout, proxy-send-timeout). ([dc39b94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dc39b94e8824683e54e0f2902e8b4bfe1c43442a))
+* **helmfile:** Create child helmfile for GitOps approach. ([a899699](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a899699e21b1d8da9886a93a2e74442799e23e96))
+* **nubus:** Cleanup Keycloak values. ([f3d8cf0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f3d8cf08efbba1b1dd5969821c3af7603202e67f))
+
+## [0.7.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.7.0...v0.7.1) (2024-05-21)
+
+
+### Bug Fixes
+
+* **ci:** Add Renovate dependency update automation. ([650c41c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/650c41c3f04b6c7c04a1d5eca76aba7f75e14b96))
+* **cryptpad:** Update Helm chart v0.0.19 and include CryptPad app in Helmfile deployment. ([931ed95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/931ed95ce16d5be6bde7ea1c1140406f00fef060))
+* **docu:** Add IdP federation documentation. ([7167055](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7167055303bdbe9ad677b16635089c0328a849ff))
+* **docu:** Rename SYNAPSE_DOMAIN to MATRIX_DOMAIN. If you use SYNAPSE_DOMAIN in your deployment, ensure you set the MATRIX_DOMAIN accordingly before upgrading. ([96baa6c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/96baa6cc15bac8d3ce315132699e301093d5d6d8))
+* **element:** Provide certificate for alternative Synapse domain. ([88ac239](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/88ac2396e6888e0f28a80ceebaa0f51d2ba436ee))
+* **helmfile:** Use Open CoDE as default registry for Univention helm chart ([#71](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/71)). ([4e56ce4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4e56ce4073105003dffbcaa91af473c1f707cd13))
+* **jitsi:** Bump images to stable-9457-2. ([1d47fa6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1d47fa681adf29e4b4ca432a9d5390972098d2e0))
+* **jitsi:** Raise Jibri memory limits to fullfil Jibri's 2Gi /dev/shm requirement and update Helm chart; To update an existing installation you need to manually delete the `jitsi-prosody` stateful set before the update e.g. `kubectl -n <your_namespace> delete --cascade=orphan statefulsets jitsi-prosody`. Ensure you use the `--cascade=orphan` part, otherwise you have to remove and reinstall the complete deployment. ([6570c13](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6570c13f3a3ad5864de5afe6afb4c60483cd489f))
+* **nextcloud:** Bump to 28.0.5 incl. latest app versions. ([04d9372](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/04d9372cfccc80145962faf4c2387949a43c8f2c))
+* **nubus:** Bump Keycloak to 24.0.3. ([923533d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/923533d7b7527de728f73813397ed0c2a0427da5))
+* **nubus:** Enable 2FA for group "Domain Admins" by default. ([1179669](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11796699bb551f8b83badd13204654c880b65efe))
+* **nubus:** Update keycloak-bootstap and keycloak-extensions. ([1c6666f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1c6666fe45fb7acd83c26b5f2b808fce3fb9e20b))
+* **open-xchange:** Support change of username. ([b2cfa8b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b2cfa8b9965ce50f593295c80c363bad7ef0454e))
+* **openproject:** Bump version to 14.0.1, update Helm chart to 4.5.0. ([e085211](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e0852119e8e248431f51a86e3bd5177cef0b1e93))
+
+# [0.7.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.6.0...v0.7.0) (2024-05-06)
+
+
+### Bug Fixes
+
+* **ci:** Add debug option. Has to be supported by stage specific configuration containing: `debug.enabled: {{ env "DEBUG_ENABLED" | default false }}` ([3dc6484](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3dc648421b80d4e170a11792604be127a3960c0e))
+* **element:** Provide the internal cluster domain to synapse web ([b9ac5ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b9ac5ecf2def57bba0070f1c2f4a01449808f106))
+* **univention-management-stack:** Add the image configuration for NATS ([e9ec2f3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e9ec2f3a6e51975ccdbd6d3575b5fc6a909502aa))
+* **univention-management-stack:** Fix [#55](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/55), [#35](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/35) by updating chart "ums" to 0.11.2 and image "portal-listener" to 0.20.6; To update an existing installation you need to manually delete the `ums-portal-listener` stateful set before the update: `kubectl -n <your_namespace> delete statefulsets ums-portal-listener` ([2ad0270](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2ad027082f4cb958d68d7728d8db05f786dba0f0))
+* **univention-management-stack:** Migrate UDM-REST-API image to new Univention registry ([9be3b78](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9be3b78761610db0274572d5a7c526aa34d0615f))
+* **univention-management-stack:** Objectstore credentials ([d1bd43f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d1bd43fa957accdb70f0cda69983e0490ac6cfa0))
+* **univention-management-stack:** Update Helm chart to 0.12.0 including required changes to openDesk Helmfile deployment. ([fefd2f6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fefd2f6cae3617ba1f00ef0c5fa3a80cde1d6ba1))
+* **univention-management-stack:** Use the NATS related image configuration ([cd22570](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cd225703ebe67bc78faa878080639dd7cc1845a9))
+
+
+### Features
+
+* **element:** Add support for Matrix federation ([36139b4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/36139b42f1df9785b8414059bf70dc3e37616e8a))
+* **helmfile:** Introduce additional variables for mailDomain and synapseDomain ([e6fe2a7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e6fe2a7c18581f637d6bd4d0553d558f753dadd2))
+* **services:** Add opendesk-home service, which redirects on domain to portal ([c7e2172](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c7e217208c4cb812cc23f9aa5ea42fcb77ea7c3a))
+
+# [0.6.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.81...v0.6.0) (2024-04-11)
+
+
+### Bug Fixes
+
+* **helmfile:** Improve support for external Objectstore, and fix issue with DoveCot storageClassName ([1b748b6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1b748b6bf63d75fc5232c90407a3fa885c2dd3c8)), closes [#57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/57) [#60](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/60) [#56](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/56)
+* **nextcloud:** Bump to 28.0.4 ([cb33a92](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cb33a929ef7c13a9a578e56a631951292d14d0e4))
+* **univention-management-stack:** add Guardian provisioning job image ([79c52d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/79c52d014cec188d010a2827bb63b2635abafb2c))
+* **univention-management-stack:** Update UMC to 0.11.8 ([5e3f4fa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5e3f4faade2ea02e51f260d1d614296a6a484848))
+* **univention-management-stack:** Use umbrella helm chart ([10ecb44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/10ecb44aa675d2f139aaec6fe8d4246fa1d3dd40))
+* **xwiki:** Bump to 15.10.8 and enable OIDC backchannel logout ([c395d35](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c395d35dd77bbec5e6b7d01768533f87af843560))
+
+
+### Features
+
+* **open-xchange:** Bump to 8.23 and remove Istio prerequisite ([3be3564](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3be3564ec7168a1a2d72b58f11da84e89e81911d))
+
+## [0.5.81](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.80...v0.5.81) (2024-03-28)
+
+
+### Bug Fixes
+
+* **docs:** Various updates ([50e2638](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/50e263866be8b51ef295ebf8025c3117821a2b6c))
+* **element:** Update Element Web to v1.11.59 with widget sync fix and NeoBoard v1.14.0 ([0fd4a26](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0fd4a26c711fb345b79cdff1c775d7ef20335768))
+* **helmfile:** Fix OpenAPI validations for Kubernetes v1.28 ([0aa4cfb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0aa4cfb46f793369a472a736b28eea834a545439))
+* **nextcloud:** Bump to 28.0.3 ([34d2c05](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/34d2c059596466f8f7d6d09c2855c595391a7e0d))
+* **nextcloud:** Rename default shared folder to `__Shared_with_me__` ([5f9d015](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5f9d015f0b98579d652fd4172e74835ed67ccf11))
+* **open-xchange:** Bump to 8.22 ([5ebf291](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5ebf291a4dbe88a09c0afe2befa6140ad33bf30b))
+* **openproject:** Bump OpenProject to 13.4.0 ([d565c05](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d565c057ddb7b348f7a829e0f931b1ea448b454b))
+* **openproject:** Bump version to 13.4.1 ([7cc3964](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7cc39647d89538630bac9caa158c47b5cb8d2c45))
+* **services:** Update Otterize Policies ([42f63e3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/42f63e399230495c83f934e07beb9fc950ef5e29))
+* **univention-management-stack:** Add missing authenticator secret mount to portal-server ([5a39e87](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5a39e8725b6454591f552f87f12535201e52df7c))
+* **univention-management-stack:** Update LDAP server for BSI base security compliance ([8e889db](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8e889db63eaf05b24cc23838545f63d969232c65))
+* **univention-management-stack:** Update ldap-notifier and ldap-server ([a41ddd5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a41ddd5451a9fbd3c6319827fee3eaffbd931271))
+* **univention-management-stack:** Update provisioning charts, images and helm value to add authentication ([8c97bcf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8c97bcf994487281ae94e6d66c73f4a11c08a0be))
+
+## [0.5.80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.79...v0.5.80) (2024-03-11)
+
+
+### Bug Fixes
+
+* **ci:** Remove creation of release artefacts, use the `images.yaml` and `charts.yaml` in `./helmfile/environments/default` for information about the artefacts instead. ([ee99eef](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ee99eefb72d3207866ffd1b3bd21a36bd55ad288))
+* **collabora:** Bump image to 23.05.9.4.1 ([9c32058](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9c32058fcc21a14e9e66a46064ea044402638920))
+* **docs:** Add development.md and refactor `images.yaml` and `charts.yaml` ([a2b333b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a2b333b46277a4bb86b75ca04edb64e69efff916))
+* **helmfile:** YAML handling of seLinuxOptions and align overall `toYaml` syntax ([011ad2c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/011ad2cd6bfe552e04a598452e8814d4d1029152))
+* **nextcloud:** Update images digests ([bc18724](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc18724d70ffff749d5192487944e62233cf4376))
+* **openproject:** Bump to 13.3.1 ([7ee9e47](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ee9e47e8269334294c80093a359b247d86f5d62))
+
+## [0.5.79](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.78...v0.5.79) (2024-02-29)
+
+
+### Bug Fixes
+
+* **collabora:** Bump image to 23.05.9.2.1 ([f4b8226](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f4b8226ea13971a38d61145ea9ac3821bc35f6b3))
+* **collabora:** Fix aliasgroups configuration whitelisting the Nextcloud host ([8b065fd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8b065fd9d789cdd597a584937fefaae40f42bba2))
+* **docs:** Update version numbers of functional components for release in README.md ([31e5cf3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31e5cf317ca7cd84a94cf42d57d0964152904471))
+* **element:** Provide end-to-end encryption as user controlled option ([3d31127](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d31127a6ab0fa1d3af02695b521db5918932279))
+* **helmfile:** Enhance objectore environment variables to allow external Object Store ([d444226](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d4442261aa141e21222dc13407023b96570d055f))
+* **helmfile:** Set debuglevel to WARN instead of INFO when debug is not enabled. ([2efceef](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2efceef076beb06a3719859d7f4e2f0d03b99f44))
+* **nextcloud:** Bump images to enable password_policy and fix email with groupware ([8807b24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8807b24ce09e59aaea39c349e9e12ee2a44a117a))
+* **univention-management-stack:** Bump Keycloak Extensions chart and configure the `/univention/meta.json` to be retrieved from `ums-stack-gateway` to avoid the inline 404 during Keycloak login. ([2023d5b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2023d5bce4642f794831670713b1a2520a0419d6))
+* **univention-management-stack:** Provisioning version bump ([410a023](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/410a0237149a5e41434c09795959bc53e57fb4ca))
+* **univention-management-stack:** Template more Keycloak Extension values incl. logLevel ([7ec123b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ec123b9a174c8dade1fe9f6679796979749efab))
+
+## [0.5.78](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.77...v0.5.78) (2024-02-23)
+
+
+### Bug Fixes
+
+* **ci:** Move main development repo OpenCoDE ([43718b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/43718b8da2966b87fab8e206df449c923f6615e7))
+* **ci:** Run release pipeline only on pushes to main ([13dcb00](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13dcb004419b4efd8ded8c25e7afa41d10156be8))
+* **ci:** Update kyverno rules ([d9263c9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d9263c90110df241adaef8d1a5df8e8d8ceda11b))
+* **docs:** Add missing footnote regarding Nubus ([bc6e4f8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc6e4f8e5dcc32cc476de579fd56dbade79b7c31))
+* **nextcloud:** Set admin priviledges for users in central IAM ([a3e415d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a3e415d575ba24b99e741994fb29d0f0cfd11d8a))
+* **univention-management-stack:** Scaling udm-rest-api ([57d0f61](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/57d0f61b2c3e789b72a0098907817c97fee69268))
+* **univention-management-stack:** Set Keycloak CSP header to allow session continuation in admin portal. ([a398e5a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a398e5aaf131c1f00b09e1776d6daf10f2c343ad))
+* **univention-management-stack:** UMS portal-server scalability ([b1b4c28](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b1b4c28618e0eca31b59719e9e1f2db8ecff7f5c))
+* **univention-management-stack:** Univention Portal upstream codefixes version bump ([c2f62f7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c2f62f7c9487b2119b0d3efd98b40c92efb97c5d))
+* **univention-management-stack:** Update provisioning to fix high CPU usage when in idle ([d9c23bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d9c23bdf0b955c0b5e4c82dd1ee785b75ce18a3b))
+
+## [0.5.77](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.76...v0.5.77) (2024-02-16)
+
+
+### Bug Fixes
+
+* **ci:** Complete CI var usage for external registry ([3bcdcd0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3bcdcd06b7c4829686f11b8f065ec38829b5a5a6))
+* **ci:** Update openDesk CI Lint to v2.3.1 ([250ef2b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/250ef2bc3fe9047b49b236b606ec3e3fa28e13ce))
+* **collabora:** Add chart validation ([0159902](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01599022f14d447dfdadf390ca9e8e29668dfb07))
+* **collabora:** Bump to 23.05.9.1.1 ([b525a81](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b525a814fc25867c068579d5cbd8d1a993144519))
+* **cryptpad:** Update chart to v0.0.18 ([6f0b1f3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6f0b1f37fc06c40bf537dbaed60f314341211e41))
+* **docs:** Add functional component table referencing the component versions to README.md ([bc7eeb8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc7eeb8c9d3dd19f625d6f7ba94b15eb4b782d20))
+* **docs:** Add generated security-context.md ([d9e07ff](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d9e07ff7bd0e8be090f4fe2c370fa9978c22dfd5))
+* **element:** Change name of neodatefix bot job ([dd535da](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd535daac0bb0e602eefa45e8dc448fd07fbdd33))
+* **element:** Disable e2ee ([ba0824b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ba0824bac30ae1fc43458bdc8c09a143076e874c))
+* **helmfile:** Add additional provisioning components and configuration ([110ff56](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/110ff56f7487e7ac89b1b75c8c63d04e1c2a41c0))
+* **helmfile:** Add seLinuxOptions for all applications ([02d04fa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/02d04faa2a8d8a0b3bfc179cc8efb3fec086bc70))
+* **helmfile:** Annotations in image.yaml ([7ebbd03](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ebbd03bdcb11abf4e459035c459b74adf8cfcda))
+* **helmfile:** Bump Collabora Chart to 1.11.1 and Image to 23.05.8.4.1 ([d2b1f0b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d2b1f0b07b5ebe4b98b2dc29b916857e28ce5706))
+* **helmfile:** Fix annotations in images.yaml ([acaec3b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/acaec3b8ac6e0ecd58167fca874cd56caa15fa98))
+* **helmfile:** Fix umsPortalFrontend image annotation ([8f83261](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8f832619864504eaa04945a9a79d6790d2ab8a48))
+* **helmfile:** Improve debugging ([56f5e35](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/56f5e35895c712440c1a7d249be672c86fc34eeb))
+* **nextcloud:** Bump openincryptpad to 0.3.3 and disable circles app ([f2b8acf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f2b8acfba85d384ed425779fa52133935e553e86))
+* **nextcloud:** Set backchannel logout url ([c0fc225](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c0fc225349794034feea1d0c05b29068b9a455af))
+* **nextcloud:** Update image, nextcloud apps and chart ([fd2a66f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fd2a66f8f2a987aa71872122267f29aee3d5f22a))
+* **nextcloud:** Update nextcloud image and chart to support upgrades ([5d95e7a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5d95e7ab2a71097d8c6231bff8c3a6aa3b6f163a))
+* **nextcloud:** Update to Nextcloud to v28 ([7c9f38f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7c9f38f06e1f0d000992ecdfd77921d6fc28015c))
+* **open-xchange:** Bump Gotenberg image ([49f126d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/49f126d169759b3e9dd130101e64892822750d7b))
+* **open-xchange:** Dovecot image on OpenCoDE without mirror ([1396071](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/139607186549f7a9a129023f1f72aff82cf36460))
+* **openproject:** Bump version to 13.3.0 ([c2087ef](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c2087efcf95bf2eef19556ba1a1d26b7807021c4))
+* **univention-management-stack:** New device login notifications on first login with 2FA ([ee1a337](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ee1a337ab5dea7001045860eb6a5bee1dfc84219))
+* **univention-management-stack:** Patches not applied to uldap ([2909e1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2909e1d821397797244d7c11c0935a3bbc902bb1))
+* **univention-management-stack:** Support for object-storage icons and portal files ([83ac645](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/83ac645faec748e773dd7940ca0ca1102bd6dff3))
+* **univention-management-stack:** Update NGINX Helm chart to 15.9.3 ([c16c0ac](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c16c0ac7955e64254214d7129ae70d5dd8808743))
+* **univention-management-stack:** Update otterize to allow umc-server communication with memcached ([6c15dc1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6c15dc1d668623ddd95090e321d1bb268e681db5))
+* **xwiki:** Add bottom border to top nav bar to be aligned with the other components ([affa92c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/affa92cde2caa175707f8ae0e8d4adedbdceb608))
+* **xwiki:** Bump XWiki chart to 1.3.0 ([cabee0c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cabee0c9da3a32e180931b3bd490ba8f83aadb79))
+
 ## [0.5.76](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.75...v0.5.76) (2024-01-24)
 
 

CONTRIBUTING.md

@@ -5,19 +5,19 @@ SPDX-License-Identifier: Apache-2.0
 
 # Read me first
 
-Please read the [project's overall CONTRIBUTING.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md) first.
+Please read the [project's entire CONTRIBUTING.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md) first.
 
 # How to contribute?
 
-Please also read the [project's workflow documentation](./docs/workflow.md) for more details on standards like commit
-messages and branching.
+Please also read the [project's workflow documentation](./docs/developer/workflow.md) for more details on standards like commit
+messages and branching convention.
 
 ## Helm vs. Operators vs. Manifests
 
 Due to DVS requirements:
 
 - we have to use [Helm charts](https://helm.sh/) (that can consist of Manifests).
-- we should avoid stand alone Manifests.
+- we should avoid stand-alone Manifests.
 - we do not use Operators and CRDs.
 
 In order to align the Helm files from various sources into the unified deployment of openDesk we make use of
@@ -25,13 +25,12 @@ In order to align the Helm files from various sources into the unified deploymen
 
 ## Tooling
 
-We should not introduce a new tool without sharing the purpose with the team and let the team decide if the tool should
-be used.
+New tools should not be introduced without first discussing it with the team. A proposal is fine, but let the team decide if the tool should
+be used or not.
 
 We should avoid adding unnecessary complexity.
 
 ## In doubt? Ask!
 
-We are always happy about contributions, but also like to discuss technical approaches to solve a problem to ensure
-a contribution fits the openDesk platform strategy or clarify that specific topics might be must ahead on our own
-roadmap. So when in doubt please [open an issue](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues/new) and start a discussion.
+We are always happy to receive contributions, but we also like to discuss technical approaches in order to solve a problem. This helps to ensure
+a contribution fits the openDesk platform strategy and roadmap, and potentially avoids otherwise wasted time. So when in doubt please [open an issue](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues/new) and start a discussion.

LICENSES/CC-BY-SA-4.0.txt

@@ -0,0 +1,170 @@
+Creative Commons Attribution-ShareAlike 4.0 International
+
+ Creative Commons Corporation (“Creative Commons”) is not a law firm and does not provide legal services or legal advice. Distribution of Creative Commons public licenses does not create a lawyer-client or other relationship. Creative Commons makes its licenses and related information available on an “as-is” basis. Creative Commons gives no warranties regarding its licenses, any material licensed under their terms and conditions, or any related information. Creative Commons disclaims all liability for damages resulting from their use to the fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and conditions that creators and other rights holders may use to share original works of authorship and other material subject to copyright and certain other rights specified in the public license below. The following considerations are for informational purposes only, are not exhaustive, and do not form part of our licenses.
+
+Considerations for licensors: Our public licenses are intended for use by those authorized to give the public permission to use material in ways otherwise restricted by copyright and certain other rights. Our licenses are irrevocable. Licensors should read and understand the terms and conditions of the license they choose before applying it. Licensors should also secure all rights necessary before applying our licenses so that the public can reuse the material as expected. Licensors should clearly mark any material not subject to the license. This includes other CC-licensed material, or material used under an exception or limitation to copyright. More considerations for licensors.
+
+Considerations for the public: By using one of our public licenses, a licensor grants the public permission to use the licensed material under specified terms and conditions. If the licensor’s permission is not necessary for any reason–for example, because of any applicable exception or limitation to copyright–then that use is not regulated by the license. Our licenses grant only permissions under copyright and certain other rights that a licensor has authority to grant. Use of the licensed material may still be restricted for other reasons, including because others have copyright or other rights in the material. A licensor may make special requests, such as asking that all changes be marked or described.
+
+Although not required by our licenses, you are encouraged to respect those requests where reasonable. More considerations for the public.
+
+Creative Commons Attribution-ShareAlike 4.0 International Public License
+
+By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-ShareAlike 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions.
+
+Section 1 – Definitions.
+
+     a.	Adapted Material means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image.
+
+     b.	Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.
+
+     c.	BY-SA Compatible License means a license listed at creativecommons.org/compatiblelicenses, approved by Creative Commons as essentially the equivalent of this Public License.
+
+     d.	Copyright and Similar Rights means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights.
+
+     e.	Effective Technological Measures means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements.
+
+     f.	Exceptions and Limitations means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material.
+
+     g.	License Elements means the license attributes listed in the name of a Creative Commons Public License. The License Elements of this Public License are Attribution and ShareAlike.
+
+     h.	Licensed Material means the artistic or literary work, database, or other material to which the Licensor applied this Public License.
+
+     i.	Licensed Rights means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license.
+
+     j.	Licensor means the individual(s) or entity(ies) granting rights under this Public License.
+
+     k.	Share means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them.
+
+     l.	Sui Generis Database Rights means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world.
+
+     m.	You means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning.
+
+Section 2 – Scope.
+
+     a.	License grant.
+
+          1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to:
+
+               A. reproduce and Share the Licensed Material, in whole or in part; and
+
+               B. produce, reproduce, and Share Adapted Material.
+
+          2. Exceptions and Limitations. For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions.
+
+          3. Term. The term of this Public License is specified in Section 6(a).
+
+          4. Media and formats; technical modifications allowed. The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material.
+
+          5. Downstream recipients.
+
+               A. Offer from the Licensor – Licensed Material. Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License.
+
+               B. Additional offer from the Licensor – Adapted Material. Every recipient of Adapted Material from You automatically receives an offer from the Licensor to exercise the Licensed Rights in the Adapted Material under the conditions of the Adapter’s License You apply.
+
+               C. No downstream restrictions. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material.
+
+          6. No endorsement. Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i).
+
+     b.	Other rights.
+
+          1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise.
+
+          2. Patent and trademark rights are not licensed under this Public License.
+
+          3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties.
+
+Section 3 – License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the following conditions.
+
+     a.	Attribution.
+
+          1. If You Share the Licensed Material (including in modified form), You must:
+
+               A. retain the following if it is supplied by the Licensor with the Licensed Material:
+
+                    i.	identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated);
+
+                    ii.	a copyright notice;
+
+                    iii. a notice that refers to this Public License;
+
+                    iv.	a notice that refers to the disclaimer of warranties;
+
+                    v.	a URI or hyperlink to the Licensed Material to the extent reasonably practicable;
+
+               B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and
+
+               C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License.
+
+          2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information.
+
+          3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable.
+
+     b.	ShareAlike.In addition to the conditions in Section 3(a), if You Share Adapted Material You produce, the following conditions also apply.
+
+          1. The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License.
+
+          2. You must include the text of, or the URI or hyperlink to, the Adapter's License You apply. You may satisfy this condition in any reasonable manner based on the medium, means, and context in which You Share Adapted Material.
+
+          3. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply.
+
+Section 4 – Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material:
+
+     a.	for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database;
+
+     b.	if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material, including for purposes of Section 3(b); and
+
+     c.	You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database.
+For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights.
+
+Section 5 – Disclaimer of Warranties and Limitation of Liability.
+
+     a.	Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You.
+
+     b.	To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You.
+
+     c.	The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability.
+
+Section 6 – Term and Termination.
+
+     a.	This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically.
+
+     b.	Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates:
+
+          1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or
+
+          2. upon express reinstatement by the Licensor.
+
+     c.	For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License.
+
+     d.	For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License.
+
+     e.	Sections 1, 5, 6, 7, and 8 survive termination of this Public License.
+
+Section 7 – Other Terms and Conditions.
+
+     a.	The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed.
+
+     b.	Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License.
+
+Section 8 – Interpretation.
+
+     a.	For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License.
+
+     b.	To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions.
+
+     c.	No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor.
+
+     d.	Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority.
+
+Creative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the “Licensor.” Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at creativecommons.org/policies, Creative Commons does not authorize the use of the trademark “Creative Commons” or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses.
+
+Creative Commons may be contacted at creativecommons.org.

README-EE.md

@@ -0,0 +1,198 @@
+<!--
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>openDesk Enterprise Edition</h1>
+
+<!-- TOC -->
+* [Overview](#overview)
+* [Enterprise Features](#enterprise-features)
+* [CE vs. EE](#ce-vs-ee)
+  * [CE Components](#ce-components)
+  * [EE Components](#ee-components)
+    * [Collabora](#collabora)
+    * [Element](#element)
+    * [Nextcloud](#nextcloud)
+    * [Open-Xchange](#open-xchange)
+      * [OX App Suite](#ox-app-suite)
+      * [OX Dovecot](#ox-dovecot)
+* [Enabling the Enterprise deployment](#enabling-the-enterprise-deployment)
+* [Configuring the oD EE deployment for self-hosted installations](#configuring-the-od-ee-deployment-for-self-hosted-installations)
+  * [Registry access](#registry-access)
+  * [License keys](#license-keys)
+<!-- TOC -->
+
+# Overview
+
+openDesk Enterprise Edition is recommended for production use. It receives support and patches from ZenDiS and the suppliers of the components due to the product subscriptions included.
+
+This document refers to the openDesk Community Edition as "oD CE" and the openDesk Enterprise Edition as "oD EE".
+
+Please contact [ZenDiS](mailto:opendesk@zendis.de) to get openDesk Enterprise, either as a SaaS offering or for your on-premises installation.
+
+# Enterprise Features
+
+oD EE ships the following features for Enterprise use that are not available in oD CE.
+
+| Component            | Enterprise-only Features                                                                                          |
+| -------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| **Collabora**        | Branding                       |
+|                      | [Automatic load scaling](https://www.collaboraonline.com/collabora-online-controller/)                       |
+| **Element**          | [AdminBot](https://ems-docs.element.io/books/element-cloud-documentation/page/admin-bot) |
+|                      | [GroupSync](https://ems-docs.element.io/books/element-server-suite-classic-documentation-lts-2504/page/setting-up-group-sync-with-the-installer#bkmrk-what-is-group-sync?) |
+|                      | [Admin Console](https://ems-docs.element.io/books/element-server-suite-classic-documentation-lts-2504/page/using-the-admin-console)                                   |
+| **Nextcloud**        | Enterprise security patches |
+|                      | [Guard app](https://nextcloud.com/features/#guard)                                           |
+| **Open‑Xchange**     | S3 storage                |
+|                      | Central orchestration of cluster topology, health checks, and configuration |
+|                      | Advanced Full-Text Search (FTS) functionality for mailboxes                |
+| **OpenProject**.     | [Enterprise addons](https://www.openproject.org/docs/enterprise-guide/) (*Corporate Plan*) |
+| **XWiki**            | [XWiki Pro apps](https://xwiki.com/en/offerings/products/xwiki-pro)                                                   |
+
+# CE vs. EE
+
+The following table summarizes the differences between oD CE and oD EE.
+
+| Aspect                           | Community Edition (CE)                  | Enterprise Edition (EE)                                                    |
+| -------------------------------- | --------------------------------------- | -------------------------------------------------------------------------- |
+| **Licensing of core components** | OSS (Apache‑2.0 / GPL, etc.)            | Same OSS licenses                                                          |
+| **Closed‑source modules**        | None                                    | Collabora (branding), Element (admin tools), Nextcloud (guard app), OX Pro, Dovecot Pro |
+| **Technical enablement**         | Fully public images/charts via openCode | EE‑only registry, license file (`enterprise.yaml`)                         |
+| **Support & updates**            | Community via openCode, no SLA          | SLA‑backed support, patches, 2nd/3rd level                                 |
+| **Access to source code**        | All CE code on openCode                 | Proprietary modules NOT on openCode                                        |
+
+
+## CE Components
+
+The following components are using the same codebase and artifacts for their Community and Enterprise offering:
+
+- Cryptpad
+- Jitsi
+- Notes
+- Nubus
+- OpenProject
+- XWiki
+
+## EE Components
+
+This section provides information about the components that have - at least partially - Enterprise-specific artifacts.
+
+If you want to check in detail which artifacts are specific to openDesk Enterprise and thereby may contain proprietary code, please check the `repository:`
+values in the image ([1](./helmfile/environments/default/images.yaml.gotmpl) / [2](./helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl))
+and chart ([1](./helmfile/environments/default/charts.yaml.gotmpl) / [2](./helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl)) definitions.
+When a repository path starts with `/zendis`, the artifact is only available in an openDesk Enterprise deployment.
+
+###  Collabora
+
+- Collabora Online (COOL) container image: Is build from the same public source code as Collabora Development Edition (CODE), only the build configurations might differ. COOL includes a brand package that is not public and its license is not open source.
+- [COOL Controller](https://www.collaboraonline.com/cool-controller-release-notes/) container image and Helm chart: Source code and chart are using Mozilla Public License Version 2.0, but the source code is not public. It is provided to customers upon request.
+
+openDesk updates Collabora once a COOL image based on the version pattern `<major>.<minor>.<patch>.3+.<build>` was made available. This happens usually at the same time the CODE image with `<major>.<minor>.<patch>.2+.<build>` is made available.
+
+### Element
+
+- AdminBot and GroupSync container image: 100% closed source
+- Admin Console container image: 100% closed source, though ~65% of the total runtime code is from the [matrix-bot-sdk](https://github.com/turt2live/matrix-bot-sdk/)
+
+### Nextcloud
+
+- Nextcloud Enterprise: openDesk uses the Nextcloud Enterprise to the build Nextcloud container image for oD EE. The Nextcloud EE codebase might contain EE exclusive (longterm support) security patches, plus the Guard app, that is not publicly available, while it is AGPL-3.0 licensed.
+
+openDesk updates the Nextcloud images for openDesk CE and EE in parallel, therefore we will not upgrade to a new major Nextcloud release before the related Nextcloud Enterprise release is available. When patches are released exclusively for Nextcloud Enterprise, they are made available also exclusively in oD EE.
+
+### Open-Xchange
+
+#### OX App Suite
+
+- OX App Suite Core Middleware container image: The amount of code, that is not open source and has a proprietary license, is <10%.
+- OX App Suite Pro Helm chart: It is not publicly available, though it is "just" an umbrella chart re-using the publicly available charts referencing the EE images, so it has <10% prorietary content.
+
+openDesk updates OX App Suite in oD CE and EE always to the same release version. Only the App Suíte Pro Helm chart has the same versioning as the actual App Suite release, the chart used in oD CE has a different versioning scheme.
+
+#### OX Dovecot
+
+- Dovecot Pro container image: Dovecot Pro is based on the open source components Dovecot and Pigeonhole but extended by modules providing additional functionality like obox2, cluster, cluster controller and dovecot fts. The additional modules make up about 15% of the overall Dovecot Pro code and are subject to a closed source license.
+
+openDesk aims to keep Dovecot's shared codebases in sync between oD CE and EE, though the versioning between the releases differs (CE: 2.x, EE: 3.y).
+
+Dovecot Pro requires two additional environment variables:
+
+- `DOVECOT_CRYPT_PRIVATE_KEY`
+- `DOVECOT_CRYPT_PUBLIC_KEY`
+
+These variables must contain the base64 encoded strings of the private and public
+key. These keys can be generated with the following commands:
+
+- Private Key: `openssl genpkey -algorithm X25519 -out private.pem && cat private.pem | base64 -w0`
+- Public Key: `openssl pkey -in private.pem -out public.pem -pubout && cat public.pem | base64 -w0`
+
+
+# Enabling the Enterprise deployment
+
+To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value that does not evaluate to boolean *false* for [Helm flow control](https://helm.sh/docs/chart_template_guide/control_structures/#ifelse), e.g. `"true"`, `"yes"` or `"1"`:
+
+```shell
+OPENDESK_ENTERPRISE=true
+```
+
+> **Note**
+> Upgrading from oD CE to EE is currently not supported, especially due to the fact it requires a migration
+> from Dovecot 2.x (standard storage) to Dovecot Pro 3.x (S3).
+
+# Configuring the oD EE deployment for self-hosted installations
+
+## Registry access
+
+With openDesk EE you get access to the related artifact registry owned by ZenDiS.
+
+Three steps are required to access the registry - for step 1 and 2 you can set some variables. Below, you can define `<your_name_for_the_secret>` freely, like `enterprise-secret`, as long as it consistent in step 1 and 3.
+
+```shell
+NAMESPACE=<your_namespace>
+NAME_FOR_THE_SECRET=<your_name_for_the_secret>
+YOUR_ENTERPRISE_REGISTRY_USERNAME=<your_registry_credential_username>
+YOUR_ENTERPRISE_REGISTRY_PASSWORD=<your_registry_credential_password>
+```
+
+1. Add your registry credentials as a secret to the namespace you want to deploy openDesk to. Do not forget to create the namespace if it does not exist yet (`kubectl create namespace ${NAMESPACE}`).
+
+```shell
+kubectl create secret --namespace "${NAMESPACE}" \
+  docker-registry "${NAME_FOR_THE_SECRET}" \
+  --docker-server "registry.opencode.de" \
+  --docker-username "${YOUR_ENTERPRISE_REGISTRY_USERNAME}" \
+  --docker-password "${YOUR_ENTERPRISE_REGISTRY_PASSWORD}" \
+  --dry-run=client -o yaml | kubectl apply -f -
+```
+
+2. Docker login to the registry to access Helm charts for local deployments:
+
+```shell
+docker login registry.opencode.de -u ${YOUR_ENTERPRISE_REGISTRY_USERNAME} -p ${YOUR_ENTERPRISE_REGISTRY_PASSWORD}
+```
+
+3. Reference the secret from step #1 in the deployment as well as the registry itself for `images` and `helm` charts:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "<your_name_for_the_secret>"
+repositories:
+  image:
+    registryOpencodeDeEnterprise: "registry.opencode.de"
+  helm:
+    registryOpencodeDeEnterprise: "registry.opencode.de"
+```
+
+## License keys
+
+Some applications require license information for their Enterprise features to be enabled. With the aforementioned registry credentials you will also receive a file called [`enterprise.yaml`](./helmfile/environments/default/enterprise_keys.yaml.gotmpl) containing the relevant license keys.
+
+Please place the file next your other `.yaml.gotmpl` file(s) that configure your deployment.
+
+Details regarding the scope/limitation of the component's licenses:
+
+- Nextcloud: Enterprise license to enable [Nextcloud Enterprise](https://nextcloud.com/de/enterprise/) specific features, can be used across multiple installations until the licensed number of users is reached.
+- OpenProject: Domain specific enterprise license to enable [OpenProject's Enterprise feature set](https://www.openproject.org/enterprise-edition/), domain matching can use regular expressions.
+- XWiki: Deployment specific enterprise license (key pair) to activate the [XWiki Pro](https://xwiki.com/en/offerings/products/xwiki-pro) apps. *Caution! XWiki needs these license keys as one-line strings. Multi-line strings result in installation failure*

README.md

@@ -1,108 +1,136 @@
 <!--
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
 
 <h1>openDesk Deployment Automation</h1>
 
-openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the "Projektgruppe für
-Aufbau ZenDiS" of Germany's Federal Ministry of the Interior.
-
-It features:
-- Fully integrated Identity Management (Univention)
-- File storage (Nextcloud)
-- Weboffice (Collabora)
-- Videoconference (Nordeck w/ Jitsi)
-- Chat and Collaboration (Element w/ Nordeck)
-- Groupware (OX Appsuite)
-- Wiki (XWiki)
-- Project Management (OpenProject)
-- Notes and Diagrams (Cryptpad)
-
-openDesk integrates these components and is working towards a seamless user experience.
-
-While not all components are perfectly shaped for the execution inside containers, one of the project objectives is to
-align the applications with the best practises regarding container design and operations.
-
-This documentation aims to give you all that is needed to set up your own instance of the openDesk.
-Basic knowledge of Kubernetes and Devops is required though.
-
 <!-- TOC -->
-* [Active development notice](#active-development-notice)
-* [Feedback](#feedback)
+* [Overview](#overview)
+* [Upgrades](#upgrades)
 * [Requirements](#requirements)
 * [Getting started](#getting-started)
 * [Advanced customization](#advanced-customization)
+* [Architecture](#architecture)
+* [Testing](#testing)
+* [Permissions](#permissions)
 * [Releases](#releases)
-* [Components](#components)
+* [Data storage](#data-storage)
+* [Feedback](#feedback)
+* [Development](#development)
 * [License](#license)
 * [Copyright](#copyright)
 <!-- TOC -->
 
-# Active development notice
-openDesk will face breaking changes in the near future without upgrade paths before
-[technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
-v1.0.0 is reached.
+# Overview
 
-While most components support upgrades, major configuration or component changes may occur, therefore we recommend
-at the moment always installing from scratch.
+openDesk is a Kubernetes-based, open-source and cloud-native digital workplace suite provided by the
+*Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH*.
 
-Components that are going to be replaced soon are:
-- the Nextcloud community container is going to be replaced by an openDesk specific Nextcloud distroless container and
-- Dovecot Community is going to be replaced by a Dovecot container tailored for the needs of the public sector.
+For production use, the [openDesk Enterprise Edition](./README-EE.md) is recommended.
 
-In the next months, we not only expect upstream updates of the functional components within their feature scope, but we
-are also going to address operational issues like monitoring and network policies.
+openDesk currently features the following functional main components:
 
-Of course, further development also includes enhancing the documentation.
+| Function             | Functional component        | License                                                                                | Component<br/>version                                                                         | Upstream documentation                                                                                                                |
+|----------------------|-----------------------------|----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
+| Chat & collaboration | Element ft. Nordeck widgets | AGPL-3.0-or-later (Element Web), AGPL-3.0-only (Synapse), Apache-2.0 (Nordeck widgets) | [1.12.0](https://github.com/element-hq/element-web/releases/tag/v1.12.0)                      | [For the most recent release](https://element.io/user-guide)                                                                          |
+| Collaborative notes  | Notes (aka Docs)            | MIT                                                                                    | [3.4.0](https://github.com/suitenumerique/docs/releases/tag/v3.4.0)                           | Online documentation/welcome document available in installed application                                                              |
+| Diagram editor       | CryptPad ft. diagrams.net   | AGPL-3.0-only                                                                          | [2025.6.0](https://github.com/cryptpad/cryptpad/releases/tag/2025.6.0)                        | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
+| File management      | Nextcloud                   | AGPL-3.0-or-later                                                                      | [31.0.7](https://nextcloud.com/de/changelog/#31-0-7)                                          | [Nextcloud 31](https://docs.nextcloud.com/)                                                                                           |
+| Groupware            | OX App Suite                | GPL-2.0-only (backend), AGPL-3.0-or-later (frontend)                                   | [8.41](https://documentation.open-xchange.com/appsuite/releases/8.41/)                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Knowledge management | XWiki                       | LGPL-2.1-or-later                                                                      | [17.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/17.4.4/)                | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
+| Portal & IAM         | Nubus                       | AGPL-3.0-or-later                                                                      | [1.15.2](https://docs.software-univention.de/nubus-kubernetes-release-notes/1.x/en/1.15.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
+| Project management   | OpenProject                 | GPL-3.0-only                                                                           | [16.6.1](https://www.openproject.org/docs/release-notes/16-6-1/)                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Videoconferencing    | Jitsi                       | Apache-2.0                                                                             | [2.0.10590](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_10590)       | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
+| Weboffice            | Collabora                   | MPL-2.0                                                                                | [25.04.6](https://www.collaboraoffice.com/code-25-04-release-notes/)                          | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
 
-# Feedback
+While not all components are perfectly designed for the execution inside containers, one of the project's objectives is to
+align the applications with best practices regarding container design and operations.
 
-We love to get feedback from you!
-Related to the deployment / contents of this repository,
-please use the [issues within this project](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues).
+This documentation aims to give you all that is needed to set up your own instance of the openDesk.
 
-If you want to address other topics, please check the section
-["Rückmeldungen und Beteiligung" of the Infos' project OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung).
+Basic knowledge of Kubernetes and DevOps processes is required though.
+
+# Upgrades
+
+You want to upgrade an existing openDesk installation?
+
+⟶ Visit our detailed documentation about [Updates & Upgrades](./docs/migrations.md).
 
 # Requirements
 
-⟶ Visit our detailed [Requirements](./docs/requirements.md) overview.
+You want to understand what is required to install openDesk yourself?
+
+⟶ Visit our [Requirements](./docs/requirements.md) overview.
 
 # Getting started
 
-⟶ Visit our detailed [Getting started](./docs/getting-started.md) guide.
+You would like to install openDesk in your own infrastructure?
+
+⟶ Visit our detailed [Getting started guide](./docs/getting-started.md).
 
 # Advanced customization
 
+- [Enhanced Configuration](./docs/enhanced-configuration.md)
 - [External services](./docs/external-services.md)
 - [Security](./docs/security.md)
 - [Scaling](./docs/scaling.md)
 - [Monitoring](./docs/monitoring.md)
 - [Theming](./docs/theming.md)
 
+# Architecture
+
+More information on openDesk's architecture can be found in our [architecture documentation](./docs/architecture.md).
+
+# Testing
+
+openDesk is continuously tested to ensure it meets high quality standards. Read how we test in openDesk in our [testing concept](./docs/testing.md).
+
+# Permissions
+
+Find out more about the permission system in the [roles & permissions concept](./docs/permissions.md)
+
 # Releases
 
-All technical releases are created using [Semantic Versioning](https://semver.org/lang/de/).
+openDesk implements a defined [release and patch management process](./docs/releases.md) to ensure stability and security.
+
+All technical releases are created using [Semantic Versioning](https://semver.org/).
 
 Gitlab provides an
-[overview on the releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
+[overview on the releases](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases)
 of this project.
 
-The following release artefacts are provided beside the default source code assets:
-- `chart-index.json`: An overview of all Helm charts used by the release.
-- `image-index.json`: An overview of all container images used by the release.
+Please find a list of the artifacts related to the release either in the source code archive attached to the release or
+in the files from the release's git-tag:
+- `./helmfile/environments/default/images.yaml.gotmpl`
+- `./helmfile/environments/default/charts.yaml.gotmpl`
 
-⟶ Visit out detailed [Workflow](./docs/workflow.md) docs.
+Find more information in our [Workflow documentation](./docs/developer/workflow.md).
 
-# Components
+# Data storage
 
-⟶ Visit our detailed [Component](./docs/components.md) docs.
+More information about different data storages used within openDesk are described in the
+[Data Storage documentation](./docs/data-storage.md).
 
+# Feedback
+
+We love to get feedback from you!
+
+For feedback related to the deployment / contents of this repository,
+please use the [issues within this project](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues).
+
+If you want to address other topics, please check the section
+["Rückmeldungen und Beteiligung" in the OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung) of the [openDesk Info Repository](https://gitlab.opencode.de/bmi/opendesk/info).
+
+# Development
+
+If you want to join or contribute to the development of openDesk please read the [Development guide](./docs/developer/development.md).
 
 # License
 
 This project uses the following license: Apache-2.0
 
 # Copyright
-Copyright (C) 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+
+Copyright (C) 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH

REUSE.toml

@@ -0,0 +1,44 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+
+version = 1
+
+[[annotations]]
+path = "cspell.json"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/gpg-pubkeys/*"
+SPDX-FileCopyrightText = "2023 Bundesministerium des Innern und für Heimat, PG ZenDiS \"Projektgruppe für Aufbau ZenDiS\""
+SPDX-License-Identifier = "CC0-1.0"
+
+[[annotations]]
+path = "helmfile/files/theme/**"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "docs/architecture/apis_images/*"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = ".opencode/openDesk-logo-rgb-color.svg"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "CC-BY-SA-4.0"
+
+[[annotations]]
+path = ".opencode/screenshots/*"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "CC-BY-SA-4.0"
+
+[[annotations]]
+path = ".gitlab/merge_request_templates/*.md"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = ".gitlab/issue_templates/*.md"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"

cspell.json

@@ -0,0 +1,86 @@
+{
+    "version": "0.2",
+    "ignorePaths": [],
+    "dictionaryDefinitions": [],
+    "dictionaries": [],
+    "words": [
+        "Addressbooks",
+        "AppSuite",
+        "Arbeitsplatz",
+        "Aufbau",
+        "bootstrap",
+        "Bundesministerium",
+        "Ceph",
+        "clamav",
+        "CNCF",
+        "Collabora",
+        "commandline",
+        "configurability",
+        "containerd",
+        "Coturn",
+        "cryptpad",
+        "databasename",
+        "Digitale",
+        "DMARC",
+        "explorative",
+        "Filepicker",
+        "filestore",
+        "Gitflow",
+        "gotmpl",
+        "Grundschutz",
+        "hadolint",
+        "Heimat",
+        "helmfile",
+        "helmfiles",
+        "homeserver",
+        "IBAC",
+        "ICAP",
+        "IMAPS",
+        "Innern",
+        "Jitsi",
+        "kcadmin",
+        "Keycloak",
+        "Kubescape",
+        "kubespray",
+        "Kyverno",
+        "letsencrypt",
+        "localpart",
+        "Minio",
+        "NATS",
+        "Nextcloud",
+        "nindent",
+        "Nordeck",
+        "Nubus",
+        "Öffentlichen",
+        "OIDC",
+        "opencode",
+        "openDesk",
+        "OpenProject",
+        "Otterize",
+        "Projektgruppe",
+        "psql",
+        "pubkeys",
+        "RDBMS",
+        "seccomp",
+        "selfsigned",
+        "slapadd",
+        "slapcat",
+        "SMTPS",
+        "Souveräne",
+        "Souveränität",
+        "templating",
+        "trashbin",
+        "truststore",
+        "Univention",
+        "Velero",
+        "Verwaltung",
+        "Videokonferenz",
+        "Weboffice",
+        "Xchange",
+        "xwiki",
+        "Zentrum",
+        "analysed"
+    ],
+    "ignoreWords": [],
+    "import": []
+}

dev/README.md

@@ -0,0 +1,46 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Tools for local development</h1>
+
+* [charts-local.py](#charts-localpy)
+  * [Commandline parameter](#commandline-parameter)
+    * [`--match <your_string>`](#--match-your_string)
+    * [`--revert`](#--revert)
+    * [`--branch` (deprecated)](#--branch-deprecated)
+
+# charts-local.py
+
+This script helps you with cloning/pulling Helm charts and referencing them directly in the openDesk
+Helmfile deployment for comfortable local test and development. The charts will be cloned/pulled into a directory
+created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
+
+The name of the directory containing the charts is based on the (currently) selected branch of the openDesk
+repo prefixed with `charts-`.
+
+The script will create `.bak` copies of the helmfiles that have been touched that can easily be reverted to
+using the `--revert` option.
+
+Run the script with `-h` to get information about the script's parameter on commandline.
+
+## Commandline parameter
+
+### `--match <your_string>`
+
+Will only fetch repos or pull images for charts which name matches `<your_string>`.
+
+### `--revert`
+
+Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
+scripts itself back to their original location.
+
+### `--branch` (deprecated)
+
+Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
+does not exist yet. Otherwise it will switch to defined branch.
+
+If parameter is omitted the current branch of the `opendesk` repo will be used.
+
+As this parameter was used rarely, we might remove the support in a later version.

dev/charts-local.py

@@ -0,0 +1,198 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+
+import os.path
+import logging
+import yaml
+import sys
+import shutil
+import subprocess
+import configargparse
+
+from pathlib import Path
+from git import Repo
+
+p = configargparse.ArgParser()
+p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work with. Will be created by the script if it does not exist yet.')
+p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
+p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
+p.add('--match', default='', help="Clone/pull only charts that contain the given string in their name.")
+p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
+options = p.parse_args()
+
+script_path = os.path.dirname(os.path.realpath(__file__))
+# some static definitions
+log_path = script_path+'/../logs'
+charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml.gotmpl'
+base_repo_path = script_path+'/..'
+base_helmfile = base_repo_path+'/helmfile_generic.yaml.gotmpl'
+helmfile_backup_extension = '.bak'
+
+Path(log_path).mkdir(parents=True, exist_ok=True)
+
+logFormatter = logging.Formatter("%(asctime)s %(levelname)-5.5s %(message)s")
+rootLogger = logging.getLogger()
+rootLogger.setLevel(options.loglevel)
+
+fileHandler = logging.FileHandler("{0}/{1}.log".format(log_path, os.path.basename(__file__)))
+fileHandler.setFormatter(logFormatter)
+rootLogger.addHandler(fileHandler)
+
+consoleHandler = logging.StreamHandler()
+consoleHandler.setFormatter(logFormatter)
+rootLogger.addHandler(consoleHandler)
+
+logging.debug(f"Working with relative paths from script location: {script_path}")
+logging.debug(f"Log directory:      {log_path}")
+logging.debug(f"charts.yaml.gotmpl: {charts_yaml}")
+
+
+def create_or_switch_branch_base_repo():
+    base_repo = Repo(path=base_repo_path)
+    current_branch = base_repo.active_branch.name
+    if not options.branch:
+        branch = current_branch
+        logging.debug(f"No branch specified on commandline, working with current branch: {current_branch}")
+    else:
+        branch = options.branch
+        if branch in base_repo.branches:
+            if branch != current_branch:
+                logging.debug(f"Selected {branch} already exists, switching.")
+                # ToDo: Graceful handle: "Please commit your changes or stash them before you switch branches."
+                base_repo.git.switch(branch)
+            else:
+                logging.debug(f"Already on selected brach {branch}")
+        else:
+            logging.debug(f"Creating branch {branch} and switching")
+            base_repo.git.branch(branch)
+            base_repo.git.switch(branch)
+    return branch
+
+def create_path_if_not_exists(path):
+    if os.path.isdir(path):
+        logging.warning(f"Path {path} already exists.")
+    else:
+        logging.debug(f"creating directory {path}.")
+        Path(path).mkdir(parents=True, exist_ok=True)
+
+def clone_charts_locally(branch, charts):
+    charts_path = script_path+'/../../charts-'+branch.replace('/', '_')
+    charts_dict = {}
+    doublette_dict = {}
+    create_path_if_not_exists(charts_path)
+
+    for chart in charts['charts']:
+        tag = charts['charts'][chart]['version']
+        repository = charts['charts'][chart]['repository']
+        registry = charts['charts'][chart]['registry']
+        name = charts['charts'][chart]['name']
+        logging.debug(f"Working on {chart} / tag {tag} / repo {repository}")
+        chart_local_path = charts_path+'/'+name
+        if not options.match in name:
+            logging.info(f"Chart name {name} does not match {options.match} - skipping...")
+            continue
+        elif registry == '':
+            logging.info("Empty registry definition - skipping...")
+            continue
+        if os.path.isdir(chart_local_path):
+            logging.debug(f"Found pre-existing {chart_local_path} skipping clone/pull, but will still reference chart in Helmfile...")
+            charts_dict[chart] = chart_local_path
+            git_url = options.git_hostname+':'+repository
+            doublette_dict[git_url] = chart_local_path
+            continue
+        elif 'opendesk/components/platform-development/charts' in repository:
+            logging.info("Cloning the charts repo")
+            git_url = options.git_hostname+':'+repository
+            if git_url in doublette_dict:
+                logging.debug(f"{chart} located at {git_url} is already checked out to {doublette_dict[git_url]}")
+                charts_dict[chart] = doublette_dict[git_url]
+            else:
+                logging.debug(f"Cloning into {chart_local_path}")
+                Repo.clone_from(git_url, chart_local_path)
+                chart_repo = Repo(path=chart_local_path)
+                chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
+                doublette_dict[git_url] = chart_local_path
+                charts_dict[chart] = chart_local_path
+        else:
+            logging.info("Pulling the chart")
+            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_path}"
+            logging.debug(f"CLI command: {helm_command}")
+            try:
+                subprocess.check_output(helm_command, shell = True)
+            except subprocess.CalledProcessError:
+                sys.exit(f"! CLI command '{helm_command}' failed")
+            charts_dict[chart] = chart_local_path
+    return charts_dict
+
+def grep_yaml(file):
+    with open(file, 'r') as file:
+        content = ''
+        for line in file.readlines():
+            if not '{{' in line:
+                content += line
+    return yaml.safe_load(content)
+
+
+def get_child_helmfiles():
+    child_helmfiles = []
+    root_helmfile = grep_yaml(base_helmfile)
+    for entry in root_helmfile['helmfiles']:
+        child_helmfiles.append(base_repo_path+'/'+entry['path'])
+    return child_helmfiles
+
+
+def process_the_helmfiles(charts_dict, charts):
+    chart_def_prefix = '    chart: "'
+    child_helmfiles = get_child_helmfiles()
+    for child_helmfile in child_helmfiles:
+        child_helmfile_updated = False
+        output = []
+        with open(child_helmfile, 'r') as file:
+            for line in file:
+                if chart_def_prefix in line:
+                    for chart_ident in charts_dict:
+                        if '.Values.charts.'+chart_ident+'.name' in line:
+                            logging.debug(f"found match with {chart_ident} in {line.strip()}")
+                            line = charts_dict[chart_ident]
+                            if os.path.isdir(line+'/charts/'+charts['charts'][chart_ident]['name']):
+                                line += '/charts/'+charts['charts'][chart_ident]['name']
+                            elif not os.path.isdir(line):
+                                sys.exit(f"! Did not find directory to reference in Helmfile: '{line}'")
+                            line = chart_def_prefix+line+'" # replaced by local-dev script'+"\n"
+                            child_helmfile_updated = True
+                            break
+                output.append(line)
+        if child_helmfile_updated:
+            child_helmfile_backup = child_helmfile+helmfile_backup_extension
+            if os.path.isfile(child_helmfile_backup):
+                logging.debug("backup {child_helmfile_backup} already exists, will not create a new one.")
+            else:
+                logging.debug(f"creating backup {child_helmfile_backup}.")
+                shutil.copy2(child_helmfile, child_helmfile_backup)
+            logging.debug(f"Updating {child_helmfile}")
+            with open(child_helmfile, 'w') as file:
+                file.writelines(output)
+
+
+def revert_the_helmfiles():
+    child_helmfiles = get_child_helmfiles()
+    for child_helmfile in child_helmfiles:
+        child_helmfile_backup = child_helmfile+helmfile_backup_extension
+        if os.path.isfile(child_helmfile_backup):
+            logging.debug(f"Reverting {child_helmfile} from backup {child_helmfile_backup}")
+            os.rename(child_helmfile_backup, child_helmfile)
+        else:
+            logging.debug(f"Did not found the backup file {child_helmfile_backup}")
+
+##
+## Main program
+##
+if options.revert:
+    revert_the_helmfiles()
+else:
+    branch = create_or_switch_branch_base_repo()
+    with open(charts_yaml, 'r') as file:
+        charts = yaml.safe_load(file)
+    charts_dict = clone_charts_locally(branch, charts)
+    process_the_helmfiles(charts_dict, charts)

dev/requirements.txt

@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+
+configargparse
+pyyaml
+GitPython

docs/architecture.md

@@ -0,0 +1,449 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Architecture</h1>
+
+<!-- TOC -->
+* [Overview](#overview)
+* [Nubus (IAM)](#nubus-iam)
+* [Authentication](#authentication)
+  * [Identity data flows](#identity-data-flows)
+  * [OpenID Connect (OIDC)](#openid-connect-oidc)
+  * [Keycloak](#keycloak)
+  * [Keycloak Extensions](#keycloak-extensions)
+  * [OpenLDAP](#openldap)
+* [Authorization](#authorization)
+  * [LDAP group synchronization](#ldap-group-synchronization)
+* [Provisioning](#provisioning)
+  * [OX Connector](#ox-connector)
+  * [SCIM](#scim)
+* [Component integration](#component-integration)
+  * [Intercom Service / Silent login](#intercom-service--silent-login)
+  * [Central contacts](#central-contacts)
+  * [Central navigation](#central-navigation)
+  * [Filepicker](#filepicker)
+  * [Newsfeed](#newsfeed)
+  * [(OpenProject) File store](#openproject-file-store)
+* [Applications vs. services](#applications-vs-services)
+  * [Collabora (weboffice)](#collabora-weboffice)
+  * [CryptPad Online (diagrams)](#cryptpad-online-diagrams)
+  * [Element/Synapse (chat \& call)](#elementsynapse-chat--call)
+  * [Jitsi (video conferencing)](#jitsi-video-conferencing)
+  * [Nextcloud (files)](#nextcloud-files)
+  * [Nubus (identity and access management / portal)](#nubus-identity-and-access-management--portal)
+  * [OpenProject (project management)](#openproject-project-management)
+  * [OX App Suite (groupware) with OX Dovecot (mail backend)](#ox-app-suite-groupware-with-ox-dovecot-mail-backend)
+  * [XWiki (knowledge management)](#xwiki-knowledge-management)
+* [Application specific user accounts](#application-specific-user-accounts)
+* [Footnotes](#footnotes)
+<!-- TOC -->
+
+openDesk is designed as a [Kubernetes](https://kubernetes.io) deployment.
+
+It consists of a set of [Helm charts](https://helm.sh/) orchestrated by [Helmfile](https://github.com/helmfile/helmfile).
+
+openDesk includes functional applications, like file management, chat, and email. Other services such
+as databases and object storage are included for evaluation purposes only. In production, you must provide
+these services yourself.
+
+# Overview
+
+The following diagram shows a high-level overview of openDesk.
+
+```mermaid
+flowchart TD
+    A(User) -->|Log In| B[Keycloak]
+    subgraph Nubus
+        B -->C[Portal]
+        B -->|User Directory| OpenLDAP
+    end
+    C -->|Manage Files| NC[fa:fa-file Nextcloud]
+    C -->|Chat & Call| EL[fa:fa-comments Element]
+    C -->|Send/Receive E-Mails| OXE[fa:fa-envelope OX App Suite]
+    C -->|Manage Appointments| OXC[fa:fa-calendar OX App Suite]
+    NC -->|Edit Office Documents| CO[fa:fa-file-word Collabora Online]
+    NC -->|Edit diagram.net Documents| CP[fa:fa-chart-diagram CryptPad]
+    C -->|Manage Tasks| OP[fa:fa-diagram-project OpenProject]
+    C -->|Store Knowledge| XW[fa:fa-book XWiki]
+    C -->|Meet People| JI[fa:fa-video Jitsi]
+```
+
+openDesk includes a portal that allows navigation to the respective application. The portal is part of the
+Identity and Access Management (IAM) application shipped with openDesk: *Nubus*. Nubus includes OpenLDAP
+for storing users, groups, and permissions, and Keycloak for single sign-on with LDAP user federation
+configured to use the aforementioned OpenLDAP.
+
+When the user is authenticated by Keycloak, the portal shows the applications the user is permitted to access.
+
+The user can now access applications and use the corresponding functionality without the need to authenticate
+again. This is implemented using the OpenID Connect (OIDC) protocol.
+
+# Nubus (IAM)
+
+[Nubus](https://www.univention.de/products/nubus/) is a specialized IAM platform developed by Univention GmbH
+to centralize and simplify identity management in IT environments. It is typically used in contexts where
+user authentication, role-based access control, and integration with multiple systems are essential.
+
+In openDesk, Nubus serves the following purposes:
+
+1. Identity Provider (IdP)
+
+    Nubus acts as the central IdP in a federated authentication system, issuing and managing authentication tokens for applications.
+
+2. Access Control Layer
+
+    As a gateway, Nubus ensures that only authorized users can access specific systems, services, or APIs, enforcing RBAC policies.
+
+3. Integration Hub
+
+    Links applications by synchronizing identity and access data across them, ensuring consistency.
+
+4. User Provisioning
+
+    Automates the process of creating, updating, and deactivating user accounts across integrated systems based on organizational workflows.
+
+5. IAM Administration
+
+    The user, group and permission information which is stored in Nubus' OpenLDAP service is managed by IAM Admin(s)
+    using a stripped down version of the [UMC (Univention Management Console)](https://docs.software-univention.de/manual/5.0/de/central-management-umc/umc.html).
+
+6. Frontend Integration Authentication
+
+    A specialized component - the Intercom Service - acts according to the Backend-for-Frontend pattern when it comes to certain integration use cases, for example, ones that require the frontend of one application to call the API of another service, that also has the need for user authentication. See [Component integration](#component-integration) for more details.
+
+7. Portal
+
+   Nubus provides a Portal component for users to access the connected applications. This component also includes self-service possibilities  e.g. for password resetting.
+
+For additional information, refer to the [Nubus for Kubernetes Architecture Manual](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/index.html).
+
+# Authentication
+
+openDesk uses the OpenID Connect (OIDC) protocol for authentication and authorization.
+
+## Identity data flows
+
+An overview of
+- components that consume the LDAP service.
+  - The components access the LDAP using a component-specific LDAP search account.
+- components using Univention Keycloak as an identity provider (IdP).
+  - All components use OAuth2 / OIDC flows.
+  - All components have a client configured in Keycloak.
+
+Some components trust others to handle authentication for them.
+
+```mermaid
+flowchart TD
+ K[IdP]-->L[LDAP]
+ N[Nextcloud]-->L
+ O[OpenProject] --> L
+ A[OX AppSuite]-->L
+ D[OX Dovecot]-->L
+ P[Portal/Admin]-->L
+ X[XWiki]-->L
+ A-->K
+ N-->K
+ D-->K
+ O-->K
+ X-->K
+ P-->K
+ E[Element]-->K
+ J[Jitsi]-->K
+ I[IntercomService]-->K
+ C[Collabora]-->N
+ R[CryptPad]-->N
+ F[Postfix]-->D
+```
+
+## OpenID Connect (OIDC)
+
+[OIDC](https://openid.net/developers/how-connect-works/) is an identity layer on top of the OAuth 2.0 protocol, allowing clients (Relying Party (RP)) to verify the identity of end-users based on the authentication performed by an authorization server (OpenID Provider (OP)). In openDesk, Keycloak serves as the OIDC provider, managing user authentication and issuing tokens for secure access to applications.
+
+The following sequence diagram shows an OIDC flow of a user logging into openDesk's project management application. In openDesk, applications such as OpenProject take the role of the OIDC Relying Party, whereas Keycloak acts as the OIDC provider and OpenLDAP as the IdP.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant Browser as Browser
+    participant OpenProject as OpenProject<br/>OIDC Relying Party
+    participant Keycloak as Keycloak<br>OIDC Provider
+    participant LDAP as OpenLDAP<br>IdP
+    Browser->>OpenProject: GET https://projects.domain.tld
+    OpenProject-->>Browser: Redirect to OIDC provider authentication form (with request)
+    Browser->>Keycloak: Authenticate with username/password, optionally 2FA
+    Keycloak->>LDAP: Retrieve/update user information
+    LDAP->>Keycloak: Return user info
+    Keycloak-->>Browser: 302 Redirect https://projects.domain.tld/callback?[...]
+    Browser->>OpenProject: GET https://projects.domain.tld/callback?[...]
+    OpenProject->>Keycloak: POST https://id.domain.tld/oauth/token
+    Keycloak-->>OpenProject: Return JSON with token, signature
+    OpenProject->>OpenProject: Verify token signature valid, signed by Provider
+    OpenProject-->>Browser: 302 Redirect https://projects.domain.tld
+    Note over Browser: User is authenticated
+```
+
+## Keycloak
+
+[Keycloak](https://www.keycloak.org/) is an open-source identity and access management solution for web based applications and services. It provides features such as single sign-on, multi-factor authentication, user federation, and centralized user management.
+
+In openDesk, Keycloak serves as the [OIDC provider](#openid-connect-oidc), handling user authentication and issuing tokens for secure access to applications.
+
+For more information, see the [Keycloak Documentation](https://www.keycloak.org/documentation).
+
+## Keycloak Extensions
+
+Part of Nubus are the [Keycloak Extensions](https://docs.software-univention.de/nubus-kubernetes-operation/1.0/en/configuration/keycloak-extensions.html) which are used for:
+
+- Login brute force protection: Blocking authentication requests upon too many failed attempts from a device or IP. _The available [CAPTCHA](https://en.wikipedia.org/wiki/CAPTCHA) option is deactivated in openDesk._
+- New device notification: Sending the user an email after successful login from a new device.
+
+To address these use cases, the Keycloak Extensions act as a proxy to Keycloak.
+
+## OpenLDAP
+
+[OpenLDAP](https://www.openldap.org) is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a central repository for user and group information. In openDesk, OpenLDAP is used as the user directory to store user and group data, and also manages access control policies across the applications.
+
+# Authorization
+
+## LDAP group synchronization
+
+LDAP group synchronization ensures that user group memberships are consistent across the applications in openDesk that make use of the IAM group information. Nubus uses OpenLDAP to store and manage user groups, which are synchronized with integrated applications to enforce access control policies.
+
+Keycloak LDAP groups are available to the following applications, however, none of the applications support nested groups. This means that users must be direct members of a group, as members of subgroups will be ignored.
+- Files / Nextcloud: Reads all groups that are enabled for Nextcloud, twice a day. Determined by the setting `background_sync_interval` in the `user_ldap` app.
+- Knowledge Management / XWiki: Reads all groups that are enabled for XWiki use, once daily during the night. Based on the jobs `LDAP Group Import Job` and `Mapped groups daily updater` that are accessible to admin users in `/bin/view/Scheduler`.
+- Project Management / OpenProject: Reads all groups that are enabled for OpenProject, [hourly](https://www.openproject.org/docs/system-admin-guide/authentication/ldap-connections/ldap-group-synchronization/#create-a-synchronized-group).
+- Webmail / OX AppSuite: Requires a webmail user to be a part of a group before the group is actively provisioned to OX AppSuite.
+
+# Provisioning
+
+Part of the already mentioned Nubus IAM is a [provisioning service](https://docs.software-univention.de/nubus-kubernetes-architecture/0.5/en/components/provisioning-service.html).
+
+Besides the Nubus internal user of the provisioning service, the OX AppSuite is currently the only openDesk application that is getting data actively provisioned to it. This is in contrast to the norm, where applications fetch the required information from the LDAP themselves.
+
+## OX Connector
+
+As the OX AppSuite is using an application specific format to get e.g. users provisioned, there is also a specific connector component that links the provisioning service to the OX AppSuite, it is called the [OX Connector](https://docs.software-univention.de/manual/5.0/de/mail/ox-connector.html).
+
+The [OX SOAP API](https://oxpedia.org/wiki/index.php?title=Open-Xchange_Provisioning_using_SOAP) is used by the OX Connector to synchronize information about the follow OX AppSuite objects:
+- Contexts
+- Functional Mailboxes
+- Groups
+- (Managed) Resources
+- Users
+
+To find out more, see [Roles & Permissions](./docs/permissions.md).
+
+## SCIM
+
+[System for Cross-domain Identity Management](https://scim.cloud) (SCIM) is an open standard for automating the exchange of user identity information between identity domains or IT systems. SCIM is designed to make user provisioning and management easier by providing a standardized way to manage user identities in cloud-based applications and services.
+
+In openDesk, SCIM will be used in the future to automate the process of creating, updating, and deactivating user accounts across the applications. This ensures that user data is consistent across all applications, reducing the administrative overhead and potential for errors.
+
+> [!note]
+> SCIM support is planned in openDesk for 2025.
+
+# Component integration
+
+Important, especially from the end user perspective, are the functional integrations between the different openDesk applications.
+
+```mermaid
+flowchart TD
+ OX-AppSuite_Frontend-->|Silent Login, Filepicker, Central Navigation|Intercom_Service
+ Element-->|Silent Login, Central Navigation|Intercom_Service
+ Intercom_Service-->|Silent Login, Token Exchange|IdP
+ Intercom_Service-->|Filepicker|Nextcloud
+ Intercom_Service-->|Central Navigations|Portal
+ Intercom_Service-->|Newsfeed|XWiki
+ OX-AppSuite_Backend-->|Filepicker|Nextcloud
+ OX-AppSuite_Backend-->|Videoconferences|Element
+ Nextcloud-->|Central Navigation|Portal
+ OpenProject-->|Central Navigation|Portal
+ OpenProject-->|File Store|Nextcloud
+ XWiki-->|Central Navigation|Portal
+ Nextcloud-->|Central Contacts|OX-AppSuite_Backend
+ OX-AppSuite_Frontend-->|Filepicker|OX-AppSuite_Backend
+ Portal-->|Newsfeed|Intercom_Service
+```
+
+Details can be found in the upstream documentation that is linked in the respective sections.
+
+## Intercom Service / Silent login
+
+The Intercom Service is deployed in the context of Nubus. Its role is to enable cross-application integration
+based on the user's browser interaction, as handling authentication when the frontend of an application has to call
+the API from another application is often challenging.
+
+To establish a session with the Intercom Service, applications can use the silent login feature within an iframe.
+
+Currently, only OX AppSuite and Element are using the frontend-based integration.
+
+**Links:**
+- [Intercom Service upstream documentation](https://docs.software-univention.de/intercom-service/latest/index.html).
+
+## Central contacts
+
+OX App Suite is responsible for managing contacts in openDesk. Therefore, Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
+- create a new contact in the user's contacts folder when a file is shared with an unknown email address.
+- retrieve contacts from the user's contacts folder to support search-as-you-type when starting to share a file.
+
+**Links:**
+- Currently used [OX Contacts API (deprecated)](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Contacts).
+- New [OX Addressbooks API](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Addressbooks) the Central Contacts integration will switch to.
+
+## Central navigation
+
+Central navigation is based on an API endpoint in the Nubus portal that returns a JSON containing the portal's contents for
+a given user. The response from the API endpoint is used in the openDesk applications to render the central navigation.
+
+The API can be called by
+- frontend services through the Intercom Service's `/navigation.json` endpoint.
+- backend services directly at the portal's `/univention/portal/navigation.json` endpoint.
+
+The central navigation expects the API caller to present a shared secret for authentication and the username for whom the portal
+contents should be returned for.
+
+A `curl` based request returning the navigation contents looks like this:
+
+```
+curl 'https://portal.<DOMAIN>/univention/portal/navigation.json?base=https%3A//portal.<DOMAIN>&language=de-DE' -u "<USERNAME>:<SHARED_SECRET>"
+```
+
+## Filepicker
+
+The Nextcloud Filepicker is integrated into the OX AppSuite, supporting the following use cases within the respective openDesk instance's Nextcloud:
+- Attach files from Nextcloud to emails.
+- Create and add links to Nextcloud files into emails.
+- Save attachments from emails into Nextcloud.
+- Attach files from Nextcloud to calendar entries.
+
+The Filepicker uses frontend and backend-based integration:
+- For frontend-based integration, the OX AppSuite frontend uses the Intercom Service.
+- Backend-based integration is coming from the OX AppSuite middleware. The middleware communicates directly with Nextcloud
+when attaching a file to an email or storing a file in Nextcloud to avoid passing these files through the user's browser.
+
+**Links:**
+- [OX AppSuite Nextcloud Integration upstream documentation](https://gitlab.open-xchange.com/extensions/nextcloud-integration/-/tree/main/documentation).
+
+## Newsfeed
+
+The portal renders a newsfeed based on entries of a predefined openDesk blog in XWiki. It accesses the required XWiki
+service through the Intercom Service's `/wiki` endpoint, in combination with the previously described silent login.
+
+**Links:**
+- [XWiki Blog feature](https://extensions.xwiki.org/xwiki/bin/view/Extension/Blog%20Application)
+
+## (OpenProject) File store
+
+While OpenProject allows you to attach files to work packages directly, it is often preferred that the files are
+stored within Nextcloud or to link an existing file from your openDesk Nextcloud to a work package.
+
+Therefore, openDesk pre-configures the trust between the openDesk instance's OpenProject and Nextcloud during the `openproject-boostrap` deployment step. As a prerequisite for that, openDesk's Nextcloud contains the `integration_openproject` app.
+
+The file store must still be enabled per project in OpenProject's project admin section.
+
+**Links:**
+- [OpenProject's documentation on Nextcloud integration](https://www.openproject.org/docs/system-admin-guide/integrations/nextcloud/)
+- [OpenProject Integration Nextcloud app](https://apps.nextcloud.com/apps/integration_openproject)
+
+# Applications vs. services
+
+openDesk consists of a variety of open-source projects, please find an overview below:
+
+| Name                  | Description                      | Type        |
+| --------------------- | -------------------------------- | ----------- |
+| Certificates          | TLS certificates                 | Service     |
+| ClamAV (Distributed)  | Antivirus engine                 | Service     |
+| ClamAV (Simple)       | Antivirus engine                 | Service     |
+| Collabora             | Weboffice                        | Application |
+| CryptPad              | diagrams.net editor              | Application |
+| dkimpy-milter         | DKIM milter for Postfix          | Service     |
+| Element               | Secure communications platform   | Application |
+| Jitsi                 | Videoconferencing                | Application |
+| MariaDB               | Database                         | Service     |
+| Memcached             | Cache database                   | Service     |
+| MinIO                 | Object storage                   | Service     |
+| Nextcloud             | File share                       | Application |
+| Nubus (UMS)           | Identity management & portal     | Application |
+| OpenProject           | Project management               | Application |
+| OX Appsuite & Dovecot | Groupware with IMAP mail backend | Application |
+| Postfix               | MTA                              | Service     |
+| PostgreSQL            | Database                         | Service     |
+| Redis                 | Cache database                   | Service     |
+| XWiki                 | Knowledge management             | Application |
+
+The end user focussed components are called applications and provide the functional scope of openDesk, please find separate paragraphs on each of the applications below.
+
+Other components are of type "Service", these are used for development and evaluation purposes only, they need to be replaced in production deployments.
+
+For the APIs / Protocols supported by the applications, please read the [apis.md](./docs/architecture/apis.md).
+
+## Collabora (weboffice)
+
+[Collabora](https://www.collaboraonline.com) is a powerful online document editing suite.
+
+In openDesk, Collabora is used for editing Office documents such as rich texts, spreadsheets and presentations.
+
+## CryptPad Online (diagrams)
+
+[CryptPad](https://cryptpad.org/) is a collaborative editor framework supporting end-to-end encryption.
+
+In openDesk, CryptPad is for editing diagrams.net documents.
+
+## Element/Synapse (chat & call)
+
+[Element Web](https://github.com/element-hq/element-web) is the web frontend for [Synapse](https://github.com/element-hq/synapse), the reference implementation of the sovereign and secure [Matrix protocol](https://matrix.org).
+
+In openDesk, Element is used for chat and direct audio & video calling.
+
+## Jitsi (video conferencing)
+
+[Jitsi](https://jitsi.org) is an open-source video conferencing solution that allows users to hold secure video meetings.
+
+In openDesk, Jitsi is used for video conferencing and online meetings. It integrates with other applications to provide seamless communication capabilities.
+
+[Jigasi](https://github.com/jitsi/jigasi) (Jitsi's SIP component) also allows joining the meeting via phone call if an external SIP server and SIP trunk are provided.
+
+## Nextcloud (files)
+
+[Nextcloud](https://nextcloud.com) is a file storage and sync platform with powerful collaboration capabilities with desktop, mobile and web interfaces.
+
+## Nubus (identity and access management / portal)
+
+[Nubus](https://www.univention.com/products/nubus/) is a unified Identity & Access Management, providing you with full control and digital sovereignty over your IAM processes and data.
+
+In openDesk, Nubus provides the management required for users, groups and other IAM objects, as well as the portal, the Identity provider for Single Sign-On and federation scenarios.
+
+## OpenProject (project management)
+
+[OpenProject](https://www.openproject.org) is a project management tool that supports agile project management, team collaboration, issue tracking, and more.
+
+## OX App Suite (groupware) with OX Dovecot (mail backend)
+
+[OX App Suite](https://www.open-xchange.com/products/ox-app-suite) is a groupware application using [OX Dovecot](https://www.dovecot.org/) as its backend mail store.
+
+In openDesk, OX App Suite is used for email, calendar, address book and personal task management.
+
+## XWiki (knowledge management)
+
+[XWiki](https://www.xwiki.org) is an open-source wiki platform for knowledge management and collaboration.
+
+# Application specific user accounts
+
+While the IAM manages users centrally, some applications come with local accounts for administrative purposes:
+
+| Application  | Account name                                  | Purpose                                                                                                                 | Password                                         |
+| ------------ | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
+| Collabora    | `collabora-internal-admin`                    | To access the Collabora admin dashboard                                                                                 | `secrets.collabora.adminPassword`                |
+| Element      | `uvs`                                         | The account for the "User Verification Service". It is used by Jitsi integrated into Element.                           | `secrets.matrixUserVerificationService.password` |
+|              | `meeting-bot`                                 | Used by the Nordeck Meeting-Bot to manage meeting rooms in Synapse.                                                     | `secrets.matrixNeoDateFixBot.password`           |
+| Nextcloud    | `nextcloud`                                   | Bootstrap the Nextcloud fileshare for OpenProject with `opendesk-openproject-bootstrap` job[^1].                        | `secrets.nextcloud.adminPassword`                |
+| OX App Suite | `admin`                                       | OX Connector to provision context, users, groups etc.                                                                   | `secrets.oxAppsuite.adminPassword`               |
+| OpenProject  | set in `secrets.openproject.apiAdminUsername` | Bootstrap the Nextcloud fileshare for OpenProject with `opendesk-openproject-bootstrap` job[^1].                        | `secrets.openproject.apiAdminPassword`           |
+| XWiki        | `superadmin`                                  | Only available with `debug.enabled: true`, can be used for interactive login using `/bin/view/Main/?oidc.skipped=true`. | `secrets.xwiki.superadminpassword`               |
+
+# Footnotes
+
+[^1]: We are working on a new approach to provision the OpenProject filestore, therefore the accounts are planned to be deactivated/removed in the future.

docs/architecture/apis.md

@@ -0,0 +1,962 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>openDesk APIs</h1>
+
+This chapter presents APIs available in openDesk, grouped by application.
+
+<!-- TOC -->
+* [IAM - Nubus](#iam---nubus)
+  * [UMC Python API](#umc-python-api)
+  * [UMC store API](#umc-store-api)
+  * [IntercomService (ICS) API](#intercomservice-ics-api)
+  * [High-level Listener modules API](#high-level-listener-modules-api)
+  * [UDM Simple API](#udm-simple-api)
+  * [UDM REST API](#udm-rest-api)
+  * [UCR Python API](#ucr-python-api)
+  * [Identity Store and Directory Service (LDAP)](#identity-store-and-directory-service-ldap)
+  * [Nubus Provisioning Service](#nubus-provisioning-service)
+  * [Nubus Authorization Service](#nubus-authorization-service)
+* [Groupware - OX AppSuite / OX Dovecot](#groupware---ox-appsuite--ox-dovecot)
+  * [Usage of APIs within openDesk](#usage-of-apis-within-opendesk)
+  * [HTTP API](#http-api)
+  * [SOAP API](#soap-api)
+  * [REST API](#rest-api)
+  * [CardDAV](#carddav)
+  * [CalDAV](#caldav)
+  * [IMAP](#imap)
+  * [POP3](#pop3)
+* [Files - Nextcloud](#files---nextcloud)
+  * [Usage of APIs within openDesk](#usage-of-apis-within-opendesk-1)
+  * [OCS API](#ocs-api)
+  * [Notifications API](#notifications-api)
+  * [Activity API](#activity-api)
+  * [Remote wipe API](#remote-wipe-api)
+  * [WebDAV](#webdav)
+  * [CalDAV / CardDAV](#caldav--carddav)
+* [Weboffice - Collabora](#weboffice---collabora)
+  * [PostMessage API](#postmessage-api)
+  * [Conversion API](#conversion-api)
+* [Project management - OpenProject](#project-management---openproject)
+  * [HATEOAS API](#hateoas-api)
+  * [BCF API](#bcf-api)
+* [Video Conferencing - Jitsi](#video-conferencing---jitsi)
+  * [IFrame API](#iframe-api)
+  * [lib-jitsi-meet API](#lib-jitsi-meet-api)
+  * [Jitsi Meet React SDK](#jitsi-meet-react-sdk)
+* [Chat - Element](#chat---element)
+  * [Matrix Application Service API](#matrix-application-service-api)
+  * [Matrix Client-Server API](#matrix-client-server-api)
+  * [Matrix Server-Server API](#matrix-server-server-api)
+  * [Matrix Push Gateway API](#matrix-push-gateway-api)
+  * [Matrix Identity Service API](#matrix-identity-service-api)
+  * [Matrix React SDK Module API](#matrix-react-sdk-module-api)
+  * [Matrix Widget API](#matrix-widget-api)
+  * [NeoBoard Data Model API](#neoboard-data-model-api)
+  * [NeoDateFix REST API](#neodatefix-rest-api)
+* [Knowledge management - XWiki](#knowledge-management---xwiki)
+  * [REST API](#rest-api-1)
+  * [Scripting API](#scripting-api)
+  * [Java API](#java-api)
+  * [JavaScript API](#javascript-api)
+<!-- TOC -->
+
+# IAM - Nubus
+
+![Overview of functional components in Univention Nubus for Kubernetes](./apis_images/IAM-overview_functional_components_structured.svg)
+[Source](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/overview/components.html#overview-components-fig)
+
+## UMC Python API
+
+![Composition of UMC component with APIs highlighted](./apis_images/IAM-umc-architecture.png)
+[Source](https://docs.software-univention.de/developer-reference/latest/en/umc/architecture.html#umc-api)
+
+| Name                           | UMC Python API                                                                                                                                                                                                                                 |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        |                                                                                                                                                                                                                                                |
+| Versioning                     |                                                                                                                                                                                                                                                |
+| Authentication                 |                                                                                                                                                                                                                                                |
+| In openDesk provided by        | Nubus UMC                                                                                                                                                                                                                                      |
+| Transport protocol             |                                                                                                                                                                                                                                                |
+| Usage within component         |                                                                                                                                                                                                                                                |
+| Usage within openDesk          |                                                                                                                                                                                                                                                |
+| Usage for external integration |                                                                                                                                                                                                                                                |
+| Parallel access                | Allowed                                                                                                                                                                                                                                        |
+| Message protocol               | [Univention Management Console Protocol (UMCP)](https://docs.software-univention.de/ucs-python-api/univention.management.console.protocol.html). Format consisting of a single header line, one empty line and the body. The body can be JSON. |
+| Supported standards            |                                                                                                                                                                                                                                                |
+| Documentation                  | https://docs.software-univention.de/ucs-python-api/modules.html                                                                                                                                                                                |
+
+## UMC store API
+
+| Name                           | UMC store API (also named UMC JavaScript API or Dojo/UMC JavaScript API)                                     |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------   |
+| Purpose                        | Encapsulate and ease the access to JavaScript module data                                                    |
+| Versioning                     |                                                                                                              |
+| Authentication                 |                                                                                                              |
+| In openDesk provided by        | Nubus UMC                                                                                                    |
+| Transport protocol             |                                                                                                              |
+| Usage within component         |                                                                                                              |
+| Usage within openDesk          |                                                                                                              |
+| Usage for external integration |                                                                                                              |
+| Parallel access                | Allowed                                                                                                      |
+| Message protocol               |                                                                                                              |
+| Supported standards            |                                                                                                              |
+| Documentation                  | https://docs.software-univention.de/developer-reference/latest/en/umc/local-system-module.html#umc-store-api |
+
+## IntercomService (ICS) API
+
+| Name                           | IntercomService API                                                                                                                                                                                                                 |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Encapsulate and ease the access to module data from JavaScript                                                                                                                                                                      |
+| Versioning                     |                                                                                                                                                                                                                                     |
+| Authentication                 | IdP based SSO                                                                                                                                                                                                                       |
+| In openDesk provided by        | Nubus UMC                                                                                                                                                                                                                           |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                             |
+| Usage within component         |                                                                                                                                                                                                                                     |
+| Usage within openDesk          | The ICS implements the BFF pattern for various openDesk inter-component integrations, see [components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/components.md#component-integration)      |
+| Usage for external integration |                                                                                                                                                                                                                                     |
+| Parallel access                | Allowed                                                                                                                                                                                                                             |
+| Message protocol               | Depends on the integration use case.                                                                                                                                                                                                |
+| Supported standards            |                                                                                                                                                                                                                                     |
+| Documentation                  | https://docs.software-univention.de/intercom-service/latest/architecture.html                                                                                                                                                       |
+
+## High-level Listener modules API
+
+| Name                           | High-level Listener modules API                                                                                                                                                                                                     |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Dispatching of LDAP events.                                                                                                                                                                                                         |
+| Versioning                     |                                                                                                                                                                                                                                     |
+| Authentication                 |                                                                                                                                                                                                                                     |
+| In openDesk provided by        | Univention Event Processing                                                                                                                                                                                                         |
+| Transport protocol             |                                                                                                                                                                                                                                     |
+| Usage within component         | The listener mechanism is used to dispatch events from the LDAP to the Nubus provisioning service. It should be replaced with another approach in the future.                                                                       |
+| Usage within openDesk          | The ICS implements the BFF pattern for various openDesk inter-component integrations, see also [components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/components.md#component-integration) |
+| Usage for external integration |                                                                                                                                                                                                                                     |
+| Parallel access                | Allowed                                                                                                                                                                                                                             |
+| Message protocol               | Depends on the integration use case.                                                                                                                                                                                                |
+| Supported standards            |                                                                                                                                                                                                                                     |
+| Documentation                  | https://docs.software-univention.de/developer-reference/latest/en/listener/api.html                                                                                                                                                 |
+
+More details on the Nubus provisioning service can be found here: https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/provisioning-service.html
+
+## UDM Simple API
+
+![Architecture of UDM](./apis_images/IAM-udm-architecture.svg)
+[Source](https://docs.software-univention.de/architecture/latest/en/services/udm.html#architecture-model-udm)
+
+| Name                           | UDM Simple API                                                                                                                                    |
+| ------------------------------ | -------------------------------------------------------------------                                                                               |
+| Purpose                        | Allows use of capability and objects directly in Python programs.                                                                                 |
+| Versioning                     |                                                                                                                                                   |
+| Authentication                 |                                                                                                                                                   |
+| In openDesk provided by        | Univention Directory Manager                                                                                                                      |
+| Transport protocol             |                                                                                                                                                   |
+| Usage within component         | Allows to use UDM capability and objects directly in Python programs. UDM Simple API provides Python modules and classes below `univention.udm.*` |
+| Usage within openDesk          |                                                                                                                                                   |
+| Usage for external integration |                                                                                                                                                   |
+| Parallel access                | Allowed                                                                                                                                           |
+| Message protocol               | Depends on the integration use case.                                                                                                              |
+| Supported standards            |                                                                                                                                                   |
+| Documentation                  | https://docs.software-univention.de/ucs-python-api/univention.udm.html#module-univention.udm.                                                     |
+
+## UDM REST API
+
+| Name                           | UDM REST API                                                                                                                               |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| Purpose                        | Inspect, modify, create and delete objects through HTTP requests.                                                                          |
+| Versioning                     |                                                                                                                                            |
+| Authentication                 | Basic Auth                                                                                                                                 |
+| In openDesk provided by        | Univention Directory Manager                                                                                                               |
+| Transport protocol             | HTTP()                                                                                                                                     |
+| Usage within component         | The Nubus bootstrapping process makes use of the API.                                                                                      |
+| Usage within openDesk          |                                                                                                                                            |
+| Usage for external integration | The [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) utilizes the API. |
+| Parallel access                | Allowed                                                                                                                                    |
+| Message protocol               | Depends on the integration use case.                                                                                                       |
+| Supported standards            |                                                                                                                                            |
+| Documentation                  | https://docs.software-univention.de/nubus-kubernetes-customization/latest/en/api/udm-rest.html                                             |
+
+## UCR Python API
+
+![Architecture overview of UCR](./apis_images/IAM-ucr-architecture.svg)
+[Source](https://docs.software-univention.de/architecture/latest/en/services/ucr.html#services-ucr-architecture-model)
+
+| Name                           | UCR Python API                                                                                         |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------    |
+| Purpose                        | Offers a programming interface for components and other Python programs.                               |
+| Versioning                     |                                                                                                        |
+| Authentication                 |                                                                                                        |
+| In openDesk provided by        | Nubus                                                                                                  |
+| Transport protocol             |                                                                                                        |
+| Usage within component         | The Nubus bootstrapping process makes use of the API.                                                  |
+| Usage within openDesk          |                                                                                                        |
+| Usage for external integration |                                                                                                        |
+| Parallel access                | Allowed                                                                                                |
+| Message protocol               |                                                                                                        |
+| Supported standards            |                                                                                                        |
+| Documentation                  | https://docs.software-univention.de/developer-reference/latest/en/ucr/usage.html#using-ucr-from-python |
+
+## Identity Store and Directory Service (LDAP)
+
+![Overview of the Identity Store and Directory Service](./apis_images/IAM-functional_component_identity_store.svg)
+[Source](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/identity-store.html#component-identity-store-figure)
+
+| Name                           | Identity Store and Directory Service (LDAP)                                                                                                           |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------                             |
+| Purpose                        | Read access to Nubus LDAP                                                                                                                             |
+| Versioning                     | n/a                                                                                                                                                   |
+| Authentication                 | LDAP user auth                                                                                                                                        |
+| In openDesk provided by        | Nubus openLDAP                                                                                                                                        |
+| Transport protocol             | LDAP                                                                                                                                                  |
+| Usage within component         | Data backend for Nubus                                                                                                                                |
+| Usage within openDesk          | Used by multiple applications to access user/group data, e.g. Nextcloud Server, OpenProject, OX AppSuite backend, XWiki                               |
+| Usage for external integration | Not recommended                                                                                                                                       |
+| Parallel access                | Allowed                                                                                                                                               |
+| Message protocol               | LDAP                                                                                                                                                  |
+| Supported standards            | LDAP                                                                                                                                                  |
+| Documentation                  | https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/identity-store.html#component-identity-store-directory-service |
+
+## Nubus Provisioning Service
+
+![Overview of the Provisioning Service and its components](./apis_images/IAM-functional_component_provisioning_service_complete.svg)
+[Source](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/provisioning-service.html#component-provisioning-service-complete-figure)
+
+| Name          | Nubus Proisioning Service                                                                                        |
+| ------------- | ---------------------------------------------------------------------------------------------------              |
+| Documentation | https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/provisioning-service.html |
+
+## Nubus Authorization Service
+
+![ArchiMate view of the interfaces and protocols of the Authorization Service](./apis_images/IAM-interfaces_authorization_service.svg)
+[Source](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/overview/interfaces-protocols.html#authorization-service)
+
+| Name          | Nubus Authorization Service                                                                                                          |
+| ------------- | ---------------------------------------------------------------------------------------------------                                  |
+| Documentation | https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/overview/interfaces-protocols.html#authorization-service |
+
+# Groupware - OX AppSuite / OX Dovecot
+
+![OX AppSuite APIs overview](./apis_images/Groupware-api.png)
+
+![Use of OX AppSuite APIs by other components](./apis_images/Groupware-api-usage.png)
+
+## Usage of APIs within openDesk
+
+The following are the APIs used by the Groupware application:
+
+| Used by                        | Accessed component | Service            | Purpose                                                     | Message format                   |
+| ------------------------------ | ------------------ | ------------------ | ----------------------------------------------------------- | -------------------------------- |
+| AppSuite Middleware            | Keycloak           | Authentication     | Single sign-on / sign-out                                   | OIDC                             |
+| Dovecot                        | Keycloak           | Authentication     | Authenticate user                                           | OIDC                             |
+| AppSuite Frontend (in Browser) | Intercom Service   | Silent Login       | Establish Intercom Service session                          |                                  |
+| AppSuite Frontend (in Browser) | Intercom Service   | Central Navigation | Retrieve content for openDesk Navigation drop-down          | JSON                             |
+| AppSuite Frontend (in Browser) | Intercom Service   | Element Bot        | Manage (CUD) meetings in Element                            | Custom JSON (based on iCalender) |
+| AppSuite Frontend (in Browser) | Intercom Service   | Filepicker         | Read/write contents from/to Nextcloud or create share links | WebDAV & Nextcloud API           |
+| AppSuite Middleware            | Nextcloud          | Filepicker         | Read/write files from/to Nextcloud                          | WebDAV & Nextcloud API           |
+| AppSuite Middleware            | Element Bot        | Element Bot        | Update/delete meetings in Element                           | Custom JSON (based on iCalender) |
+| AppSuite Middleware            | LDAP               | Address book       | Search for global contacts and retrieve contact details     | LDAP                             |
+| Dovecot                        | LDAP               | Data retrieval     | Retrieve necessary user details to handle mailboxes         | LDAP                             |
+
+## HTTP API
+
+![Use of HTTP API in openDesk](./apis_images/Groupware-api-http-usage.png)
+
+| Name                           | HTTP API                                                                                                                                                                                                     |
+| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Login, accessing email, contacts, calendar, tasks, configs, email filtering, task automation, workflow automation, etc – most of the AppSuite's functionality that is available to the user through the Web-UI. |
+| Versioning                     | No API-specific versioning. The version can be considered identical to the OX App Suite version, which is contained in the URL of the online API documentation.                                                 |
+| Authentication                 |                                                                                                                                                                                                                 |
+| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                                                          |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                         |
+| Usage within component         | Used by OX Web-UI (Frontend)                                                                                                                                                                                    |
+| Usage within openDesk          | - Nextcloud uses the SearchAPI to synchronize contacts<br>- Nordeck Meeting bot synchronizes OX meeting changes applied in Element.                                                                             |
+| Usage for external integration | Not used at the moment, but is the recommended way to integrate with OX AppSuite.                                                                                                                               |
+| Parallel access                | Allowed                                                                                                                                                                                                         |
+| Message protocol               | JSON based, AppSuite specific format                                                                                                                                                                            |
+| Supported standards            | iCal, defined by RFC, fully implemented                                                                                                                                                                         |
+| Documentation                  | https://documentation.open-xchange.com/components/middleware/http/8/index.html                                                                                                                                  |
+
+## SOAP API
+
+| Name                           | SOAP API                                                                                  |
+| ------------------------------ | -------------------------------------------------------------------------------------------- |
+| Purpose                        | Management of users, groups, contexts, resources.                                            |
+| Versioning                     | n/a                                                                                          |
+| Authentication                 | Basic Auth                                                                                   |
+| In openDesk provided by        | OX AppSuite Middleware                                                                       |
+| Transport protocol             | HTTP(S)                                                                                      |
+| Usage within component         | none                                                                                         |
+| Usage within openDesk          | OX Connector synchronizes the state of the objects (users, groups etc.) managed in the LDAP. |
+| Usage for external integration | none                                                                                         |
+| Parallel access                | Allowed                                                                                      |
+| Message protocol               | XML based, exactly following the format of Java RMI.                                         |
+| Supported standards            | SOAP                                                                                         |
+| Documentation                  | https://software.open-xchange.com/products/appsuite/doc/SOAP/admin/OX-Admin-SOAP.html        |
+
+> [!note]
+> You will find a catalogue of the available services including links to the respective URLs at
+> `/webservices/` within the AppSuite host of your openDesk installation,
+> e.g. https://webmail.myopendesk.tld/webservices/
+
+## REST API
+
+| Name                           | REST API                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| ------------------------------ |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Delivers services in the following functional groups:<br>- *Admin*: Interface for provisioning and other administrative operations<br>- *Advertisement*: The advertisement module<br>- *Health*: The health-check module<br>- *InternetFreeBusy*: Servlet for requesting free busy data<br>- *Metrics*: The metrics module<br>- *Preliminary*: This module contains preliminary endpoints which may change in the future<br>- *Push*: The push module<br>- *Userfeedback*: The user feedback module |
+| Versioning                     | No API-specific versioning. The version can be considered identical to the OX App Suite version, which is contained in the URL of the online API documentation.                                                                                                                                                                                                                                                                                                                                     |
+| Authentication                 | Basic Auth                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Usage within component         | Push module is used by OX Frontend.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| Usage within openDesk          | none                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Usage for external integration | none                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Parallel access                | Allowed                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Message protocol               | - Email Body RFC 822 is used by Push<br>- Prometheus format is used by Metrics API<br>- API iCal format is used by InternetFreeBusy                                                                                                                                                                                                                                                                                                                                                                 |
+| Supported standards            | SOAP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Documentation                  | https://documentation.open-xchange.com/components/middleware/rest/8/index.html                                                                                                                                                                                                                                                                                                                                                                                                                      |
+## CardDAV
+
+| Name                           | CardDAV                                                                                                                                                                 |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Designed for rich clients. Synchronization of contact entries in both directions (i.e. as a server and as a client); vCard import and export are available via OX HTTP API |
+| Versioning                     | Yes, API version is specific to the version of the underlying protocol                                                                                                     |
+| Authentication                 |                                                                                                                                                                            |
+| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                     |
+| Transport protocol             | HTTP(S)                                                                                                                                                                    |
+| Usage within component         | none                                                                                                                                                                       |
+| Usage within openDesk          | none                                                                                                                                                                       |
+| Usage for external integration | none                                                                                                                                                                       |
+| Parallel access                | Allowed                                                                                                                                                                    |
+| Message protocol               | vCard, defined by RFC, fully implemented                                                                                                                                   |
+| Supported standards            |                                                                                                                                                                            |
+| Documentation                  | https://documentation.open-xchange.com/8/middleware/miscellaneous/caldav_carddav.html                                                                                      |
+
+## CalDAV
+
+| Name                           | CalDAV                                                                                                                                                                  |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Designed for rich clients. Synchronization of contact entries in both directions (i.e. as a server and as a client); vCard import and export are available via OX HTTP API |
+| Versioning                     | Yes, API version is specific to the version of the underlying protocol                                                                                                     |
+| Authentication                 |                                                                                                                                                                            |
+| In openDesk provided by        | OX AppSuite Middleware                                                                                                                                                     |
+| Transport protocol             | HTTP(S)                                                                                                                                                                    |
+| Usage within component         | none                                                                                                                                                                       |
+| Usage within openDesk          | none                                                                                                                                                                       |
+| Usage for external integration | none                                                                                                                                                                       |
+| Parallel access                | Allowed                                                                                                                                                                    |
+| Message protocol               | iCal, defined by RFC, fully implemented                                                                                                                                    |
+| Supported standards            | iTIP, iMIP                                                                                                                                                                 |
+| Documentation                  | https://documentation.open-xchange.com/8/middleware/miscellaneous/caldav_carddav.html                                                                                      |
+
+## IMAP
+
+| Name                           | IMAP                                                                                 |
+| ------------------------------ |--------------------------------------------------------------------------------------|
+| Purpose                        | Used for retrieval of emails, designed for rich clients                              |
+| Versioning                     | Yes, API version is specific to the version of the underlying protocol               |
+| Authentication                 |                                                                                      |
+| In openDesk provided by        | OX Dovecot                                                                           |
+| Transport protocol             | TCP                                                                                  |
+| Usage within component         | Used by OX AppSuite middleware to read/write mail and folders                        |
+| Usage within openDesk          | none                                                                                 |
+| Usage for external integration | Can be used by local IMAP clients (e.g. Thunderbird)                                 |
+| Parallel access                | Allowed                                                                              |
+| Message protocol               | RFC 9051                                                                             |
+| Supported standards            | IMAP                                                                                 |
+| Documentation                  | https://www.rfc-editor.org/rfc/rfc9051                                               |
+
+## POP3
+
+| Name                           | POP3                                                                   |
+| ------------------------------ |------------------------------------------------------------------------|
+| Purpose                        | Used for retrieval of emails, designed for rich clients                |
+| Versioning                     | Yes, API version is specific to the version of the underlying protocol |
+| Authentication                 |                                                                        |
+| In openDesk provided by        | OX Dovecot                                                             |
+| Transport protocol             | TCP                                                                    |
+| Usage within component         | none                                                                   |
+| Usage within openDesk          | none                                                                   |
+| Usage for external integration | Can be used by local POP3 clients (e.g. Thunderbird)                   |
+| Parallel access                | Allowed                                                                |
+| Message protocol               | RFC 1939                                                               |
+| Supported standards            | IMAP                                                                   |
+| Documentation                  | https://www.rfc-editor.org/rfc/rfc1939                                 |
+
+# Files - Nextcloud
+
+![Nextcloud APIs](./apis_images/Files-api.png)
+
+## Usage of APIs within openDesk
+
+The following are the APIs used by the Files application:
+
+| Used by          | Accessed component     | Service                | Purpose                                            | Message format |
+| ---------------- | ---------------------- | ---------------------- | -------------------------------------------------- | -------------- |
+| Nextcloud Server | Keycloak               | Authentication         | Single sign-on / sign-out                          | OIDC           |
+| Nextcloud Server | Nubus Portal           | Central Navigation     | Retrieve content for openDesk Navigation drop-down | JSON           |
+| Nextcloud Server | OX AppSuite Middleware | OX HTTP API (Contacts) | Reading/writing personal contacts                  | JSON           |
+| Nextcloud Server | Nubus                  | LDAP                   | Read users and groups data                         | LDAP           |
+
+## OCS API
+
+| Name                           | OCS API                                                                                                                                                                                                                                |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Obtain and/or manage user status, user preferences, shares, sharees, recommendations. API is likely to be extended to other use cases in the future. Nextcloud apps can extend the functionality of OCS API by providing new endpoints |
+| Versioning                     | Identical to component release version                                                                                                                                                                                                  |
+| Authentication                 | Basic Auth or by passing a set of valid session cookies                                                                                                                                                                                |
+| In openDesk provided by        | Nextcloud Server                                                                                                                                                                                                                       |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                |
+| Usage within component         | none                                                                                                                                                                                                                                   |
+| Usage within openDesk          | Filepicker uses the API to create share links.                                                                                                                                                                                         |
+| Usage for external integration | none                                                                                                                                                                                                                                   |
+| Parallel access                | Allowed                                                                                                                                                                                                                                |
+| Message protocol               | Requests in JSON, responses in JSON or XML                                                                                                                                                                                             |
+| Supported standards            |                                                                                                                                                                                                                                        |
+| Documentation                  | https://docs.nextcloud.com/server/latest/developer_manual/client_apis/OCS/index.html                                                                                                                                                   |
+
+## Notifications API
+
+| Name                           | Notifications API                                                                                                           |
+| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Fetch notifications                                                                                                         |
+| Versioning                     | See linked documentation (which also names the version), address via URL path, e.g. `/ocs/v2.php/apps/notifications/api/v2` |
+| Authentication                 |                                                                                                                             |
+| In openDesk provided by        | Nextcloud Server                                                                                                            |
+| Transport protocol             | HTTP(S)                                                                                                                     |
+| Usage within component         | none                                                                                                                        |
+| Usage within openDesk          | none                                                                                                                        |
+| Usage for external integration | none                                                                                                                        |
+| Parallel access                | Allowed                                                                                                                     |
+| Message protocol               | Requests in JSON, responses in JSON or XML                                                                                  |
+| Supported standards            |                                                                                                                             |
+| Documentation                  | https://github.com/nextcloud/notifications/blob/master/docs/ocs-endpoint-v2.md                                              |
+|                                |                                                                                                                             |
+
+## Activity API
+
+| Name                           | Activity API                                                                                                                                       |
+| ------------------------------ |----------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Obtaining the list of actions initiated by or involving a specific user (files created, shared, deleted etc and other activities reported by apps) |
+| Versioning                     | Identical to component release version                                                                                                           |
+| Authentication                 | See linked documentation (which also names the version), address via URL path, e.g. `/ocs/v2.php/apps/activity/api/v2`                             |
+| In openDesk provided by        | Nextcloud Server                                                                                                                                   |
+| Transport protocol             | HTTP(S)                                                                                                                                            |
+| Usage within component         | none                                                                                                                                               |
+| Usage within openDesk          | none                                                                                                                                               |
+| Usage for external integration | none                                                                                                                                               |
+| Parallel access                | Allowed                                                                                                                                            |
+| Message protocol               | Requests in JSON, responses in JSON or XML                                                                                                         |
+| Supported standards            |                                                                                                                                                    |
+| Documentation                  | https://github.com/nextcloud/activity/blob/master/docs/endpoint-v2.md                                                                              |
+
+## Remote wipe API
+
+| Name                           | Remote wipe API                                                                            |
+| ------------------------------ |--------------------------------------------------------------------------------------------|
+| Purpose                        | Used to wipe storage remotely (e.g. on a lost device)                                      |
+| Versioning                     | Identical to component release version                                                     |
+| Authentication                 | Login flow token                                                                           |
+| In openDesk provided by        | Nextcloud Server                                                                           |
+| Transport protocol             | HTTP(S)                                                                                    |
+| Usage within component         | none                                                                                       |
+| Usage within openDesk          | none                                                                                       |
+| Usage for external integration | none                                                                                       |
+| Parallel access                | Allowed                                                                                    |
+| Message protocol               | JSON                                                                                       |
+| Supported standards            |                                                                                            |
+| Documentation                  | https://docs.nextcloud.com/server/latest/developer_manual/client_apis/RemoteWipe/index.html |
+
+## WebDAV
+
+| Name                           | WebDAV                                                                                  |
+| ------------------------------ |-----------------------------------------------------------------------------------------|
+| Purpose                        | Accessing files and folders, conducting searches                                        |
+| Versioning                     | Identical to component release version                                                  |
+| Authentication                 | Basic Auth or by passing a set of valid session cookies                                 |
+| In openDesk provided by        | Nextcloud Server                                                                        |
+| Transport protocol             | HTTP(S)                                                                                 |
+| Usage within component         | none                                                                                    |
+| Usage within openDesk          | Used by OX AppSuite to get/put files (attachments)                                      |
+| Usage for external integration | none                                                                                    |
+| Parallel access                | Allowed                                                                                 |
+| Message protocol               | Requests in JSON, responses in JSON or XML                                              |
+| Supported standards            | RFC4918                                                                                 |
+| Documentation                  | https://docs.nextcloud.com/server/latest/developer_manual/client_apis/WebDAV/index.html |
+
+## CalDAV / CardDAV
+
+CalDAV and CardDAV APIs are available in Nextcloud, but as openDesk uses OX AppSuite for Calendar and Contacts these Nextcloud APIs do not provide relevant data in openDesk.
+
+# Weboffice - Collabora
+
+The following are the APIs used by the Weboffice application:
+
+| Used by   | Accessed component | Service           | Purpose                                     | Message format |
+| --------- | ------------------ | ----------------- | ------------------------------------------- | -------------- |
+| Collabora | Nextcloud          | Document handling | Retrieve, store and manage office documents | WOPI           |
+
+Collabora is integrated with Nextcloud to read/write Office documents from/to Nextcloud. The integration uses the Web
+Application Open Interface ([WOPI](https://learn.microsoft.com/en-us/openspecs/office_protocols/ms-wopi/6a8bb410-68ad-47e4-9dc3-6cf29c6b046b)) protocol.
+
+Nextcloud acts as the WOPI server whereas Collabora Online is the WOPI client.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    Browser->>Nextcloud: Open document "digital-strategy.odt"<br>(which is fileid=123456)
+    Nextcloud-->>Browser: "Use COOL server to open document online<br>URL is https://office.domain.tld/?open"
+    Browser->>Collabora: GET "https://office.domain.tld/?open&file=https://files.domain.tld/index.php/apps/richdocuments/wopi/files/123456"
+    Collabora-->>Nextcloud: GET https://files.domain.tld/index.php/apps/richdocuments/wopi/files
+    Nextcloud-->>Browser: Edit document "digital-strategy.odt" (fileid=123456)
+```
+
+
+## PostMessage API
+
+| Name                           | PostMessage API                                                                                                                                   |
+| ------------------------------ |---------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Interact with parent frame when Collabora browser part is enclosed in one, mostly based on WOPI specification with few extensions/modifications   |
+| Versioning                     | N/A                                                                                                                                               |
+| Authentication                 | CSP rules protect unauthorized communication. In practice, the editor is embedded in an iframe and can communicate only with the iframe's parent. |
+| In openDesk provided by        | Collabora                                                                                                                                         |
+| Transport protocol             | HTTP                                                                                                                                              |
+| Usage within component         | N/A                                                                                                                                               |
+| Usage within openDesk          | Query the number of users in a document, query supported export formats, manage sessions, manage actions like save, insert image, print etc.      |
+| Usage for external integration | In openDesk Collabora Online is integrated with Nextcloud but other integrations exist and are possible, see the documentation.                   |
+| Parallel access                | Allowed                                                                                                                                           |
+| Message protocol               | JSON                                                                                                                                              |
+| Supported standards            | [WOPI](https://learn.microsoft.com/en-us/openspecs/office_protocols/ms-wopi/6a8bb410-68ad-47e4-9dc3-6cf29c6b046b)                                 |
+| Documentation                  | https://sdk.collaboraonline.com/docs/postmessage_api.html                                                                                         |
+
+## Conversion API
+
+| Name                           | Conversion API                                                                                          |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Convert files between various file formats (e.g. to pdf, png, txt, or between OOXML and ODF etc.)       |
+| Versioning                     | N/A                                                                                                     |
+| Authentication                 | The `convert-to` endpoint is restricted to allowed host addresses that can be set in the configuration. |
+| In openDesk provided by        | Collabora                                                                                               |
+| Transport protocol             | HTTP (REST API)                                                                                         |
+| Usage within component         | N/A                                                                                                     |
+| Usage within openDesk          | To generate thumbnails in Nextcloud for supported document types.                                       |
+| Usage for external integration | It is possible to set up Collabora Online as a general document converter service.                      |
+| Parallel access                | Allowed                                                                                                 |
+| Message protocol               | Text based, see the documentation                                                                       |
+| Supported standards            | N/A                                                                                                     |
+| Documentation                  | https://sdk.collaboraonline.com/docs/conversion_api.html                                                |
+
+# Project management - OpenProject
+
+The following are the APIs used by the Project management application:
+
+| Used by         | Accessed component | Service            | Purpose                                            | Message format |
+| --------------- | ------------------ | ------------------ | -------------------------------------------------- | -------------- |
+| OpenProject-web | Keycloak           | Authentication     | Single sign-on / sign-out                          | OIDC           |
+| OpenProject-web | Nubus Portal       | Central Navigation | Retrieve content for openDesk Navigation drop-down | JSON           |
+| OpenProject-web | Nextcloud          | Various            | Integration of Nextcloud as OpenProject filestore  | JSON           |
+| OpenProject-web | Nubus              | LDAP               | Read users and groups data                         | LDAP           |
+
+## HATEOAS API
+
+| Name                           | HATEOAS (Hyperimages as the Engine of Application State) API                                                                                                                                                                                                                                                                                      |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Provides access for the frontend client of OpenProject and for third party use, i.e.:<br>- CRUD work packages, projects, time logging, users, queries (work package filters), and all related objects<br>- READ notifications, activities per work package<br>- READ capabilities (allowed actions of users throughout projects) does not address |
+| Versioning                     | URL based versioning scheme, e.g. `/api/v3/spec.json`                                                                                                                                                                                                                                                                                             |
+| Authentication                 | OAuth2, session based authentication, and basic auth                                                                                                                                                                                                                                                                                              |
+| In openDesk provided by        | OpenProject                                                                                                                                                                                                                                                                                                                                       |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                                                                                                                           |
+| Usage within component         | OpenProject Web-UI                                                                                                                                                                                                                                                                                                                                |
+| Usage within openDesk          | none                                                                                                                                                                                                                                                                                                                                              |
+| Usage for external integration | none                                                                                                                                                                                                                                                                                                                                              |
+| Parallel access                | Allowed                                                                                                                                                                                                                                                                                                                                           |
+| Message protocol               | [HAL](https://en.wikipedia.org/wiki/Hypertext_Application_Language) + JSON                                                                                                                                                                                                                                                                        |
+| Supported standards            | REST, [HATEOAS](https://en.wikipedia.org/wiki/HATEOAS)                                                                                                                                                                                                                                                                                            |
+| Documentation                  | https://www.openproject.org/docs/api/introduction/                                                                                                                                                                                                                                                                                                |
+
+**Additional Information:**
+
+*What does it not do that developers should know about?*
+- CRUD custom fields, time reports, wikis and wiki pages
+- Aggregated filterable activities/changes
+
+*What are the typical use cases?*
+- It powers all angular frontend components in OpenProject, mainly the work package table/view, boards, team planner etc., and supports all common use cases
+
+*How does it work? (What do users need to know about architecture an internal components?)*
+- HAL is a standard to define resources with embedding and links between them
+- HAL contains action links depending on the user’s permissions, allows permitted actions to be derived from object keys in json
+
+*What knowledge should the developer have before using the API?*
+- Knowledge of REST
+- (Optional) Knowledge of HAL standard
+
+*Are there any extensions or APIs in (or planned for) development that users should know about?*
+- Signaling to receive only selected attributes/nested resources from the API for performance improvements
+
+## BCF API
+
+| Name                           | BCF API                                                                                                                                                                              |
+| ------------------------------ |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Implementation of a subset of [BCF](https://en.wikipedia.org/wiki/BIM_Collaboration_Format) standard for [BIM](https://en.wikipedia.org/wiki/Building_information_modeling) projects |
+| Versioning                     | URL based versioning scheme, e.g. `/api/bcf/2.1`                                                                                                                                     |
+| Authentication                 | OAuth2                                                                                                                                                                               |
+| In openDesk provided by        | OpenProject                                                                                                                                                                          |
+| Transport protocol             | HTTP(S)                                                                                                                                                                              |
+| Usage within component         | none                                                                                                                                                                                 |
+| Usage within openDesk          | none                                                                                                                                                                                 |
+| Usage for external integration | none                                                                                                                                                                                 |
+| Parallel access                | Allowed                                                                                                                                                                              |
+| Message protocol               | JSON                                                                                                                                                                                 |
+| Supported standards            | [BCF 2.1](https://github.com/buildingSMART/BCF-API/blob/release_2_1/README.md)                                                                                                       |
+| Documentation                  | https://www.openproject.org/docs/api/bcf-rest-api/                                                                                                                                   |
+
+# Video Conferencing - Jitsi
+
+## IFrame API
+
+| Name                           | IFrame API                                                               |
+| ------------------------------ |--------------------------------------------------------------------------|
+| Purpose                        | Embed Jitsi video conferencing features into existing applications/sites |
+| Versioning                     | Identical to the Jitsi release version                                   |
+| Authentication                 | Optional (JWT-based authentication in openDesk context)                  |
+| In openDesk provided by        | Jitsi-Web                                                                |
+| Transport protocol             | HTTP(S)                                                                  |
+| Usage within component         | none                                                                     |
+| Usage within openDesk          | Used by Element (Chat Web-UI)                                            |
+| Usage for external integration | none                                                                     |
+| Parallel access                | Allowed                                                                  |
+| Message protocol               |                                                                          |
+| Supported standards            |                                                                          |
+| Documentation                  | https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-iframe/        |
+
+## lib-jitsi-meet API
+
+| Name                           | lib-jitsi-meet API                                                     |
+| ------------------------------ | ---------------------------------------------------------------------- |
+| Purpose                        | Create Jitsi video conferences with a custom GUI                       |
+| Versioning                     | Identical to the Jitsi release                                         |
+| Authentication                 | not required                                                           |
+| In openDesk provided by        | Jitsi-Web                                                              |
+| Transport protocol             | none (it works as a library)                                           |
+| Usage within component         | Used by Jitsi itself                                                   |
+| Usage within openDesk          | Used by Jitsi itself                                                   |
+| Usage for external integration | none                                                                   |
+| Parallel access                | Allowed                                                                |
+| Message protocol               |                                                                        |
+| Supported standards            |                                                                        |
+| Documentation                  | https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-ljm-api/     |
+
+## Jitsi Meet React SDK
+
+> [!note]
+> Additional SDKs can be found at https://jitsi.github.io/handbook/docs/category/sdks/
+
+| Name                           | Meet React SDK                                                      |
+| ------------------------------ | ------------------------------------------------------------------- |
+| Purpose                        | Embed Jitsi video conferencing into apps using React                |
+| Versioning                     | https://github.com/jitsi/jitsi-meet-react-sdk/releases              |
+| Authentication                 | not required                                                        |
+| In openDesk provided by        | Jitsi                                                               |
+| Transport protocol             | none (it works as a module)                                         |
+| Usage within component         | none                                                                |
+| Usage within openDesk          | none                                                                |
+| Usage for external integration | none                                                                |
+| Parallel access                | Allowed                                                             |
+| Message protocol               |                                                                     |
+| Supported standards            |                                                                     |
+| Documentation                  | https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-react-sdk |
+
+# Chat - Element
+
+While Jitsi is available as standalone videoconferencing in openDesk, it is also used in [Element as videoconferencing backend](https://github.com/element-hq/element-web/blob/develop/docs/jitsi.md).
+
+```mermaid
+---
+  config:
+    class:
+      hideEmptyMembersBox: true
+---
+classDiagram
+    class CommunicationService["Communication Service"] {
+        <<interface>>
+    }
+
+    class MxChat["Element Matrix Chat"] {
+        <<interface>>
+    }
+    class JitsiVideoConference["Jitsi Video Conference"] {
+        <<interface>>
+    }
+
+    CommunicationService <|.. MxChat
+    CommunicationService <|.. JitsiVideoConference
+    MxChat <-- JitsiVideoConference
+
+    class MxAppServiceApi["Matrix Application Service API"]
+    class MxClientServerApi["Matrix Client Server API"]
+    class MxServerServerApi["Matrix Server Server API"]
+    class MxPushGatewayApi["Matrix Push Gateway API"]
+    class MxIdentityServiceApi["Matrix Identity Service API"]
+    class MxRtc["Matrix RTC"]
+    class MxElementWebModuleApi["Matrix React SDK Module API"]
+    class MxWidgetApi["Matrix Widget API"]
+    class NeoBoardDataModelApi["NeoBoard Data Model API"]
+    class NeoDateFixRestApi["NeoDateFix REST API"]
+
+    MxChat *-- MxAppServiceApi
+    MxChat *-- MxClientServerApi
+    MxChat *-- MxServerServerApi
+    MxChat *-- MxPushGatewayApi
+    MxChat *-- MxIdentityServiceApi
+    MxChat *-- MxRtc
+    MxChat *-- MxElementWebModuleApi
+    MxChat *-- MxWidgetApi
+
+    class JitsiIframeApi["Jitsi iFrame API"]
+    class JitsiMeetApi["Jitsi Meet API"]
+    class JitsiMeetReactSdk["Jitsi Meet React SDK"]
+
+    JitsiVideoConference *-- JitsiIframeApi
+    JitsiVideoConference *-- JitsiMeetApi
+    JitsiVideoConference *-- JitsiMeetReactSdk
+```
+
+The following are the APIs used by the Chat application:
+
+| Used by         | Accessed component | Service            | Purpose                                            | Message format |
+| --------------- | ------------------ | ------------------ | -------------------------------------------------- | -------------- |
+| Element/Synapse | Keycloak           | Authentication     | Single sign-on / sign-out                          | OIDC           |
+| OpenProject-web | Intercom Service   | Central Navigation | Retrieve content for openDesk Navigation drop-down | JSON           |
+
+## Matrix Application Service API
+
+| Name                           | Matrix Application Service API                                                                                                               |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Implementation of custom server-side behavior in Matrix (e.g. gateways, filters, extensible hooks)                                           |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/app/v1`)                                                                    |
+| Authentication                 | HTTP-Authorization header with Bearer token                                                                                                  |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          | Nordeck Widgets                                                                                                                              |
+| Usage for external integration | none                                                                                                                                         |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/application-service-api/)                                                                            |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix Client-Server API
+
+| Name                           | Matrix Client-Server API                                                                                                                     |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Send messages, control rooms and synchronize conversation history, JSON objects over HTTP                                                    |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/client/v3`)                                                                 |
+| Authentication                 | HTTP-Authorization header with Bearer token                                                                                                  |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          | Used by Element (Chat Web-UI)                                                                                                                |
+| Usage for external integration | none                                                                                                                                         |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/client-server-api/)                                                                                  |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix Server-Server API
+
+| Name                           | Matrix Server-Server API                                                                                                                     |
+| ------------------------------ |----------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Communication between Matrix servers (also known as FederationAPIs)                                                                          |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/federation/v2`)                                                             |
+| Authentication                 | HTTP-Authorization header with Bearer token                                                                                                  |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          | none                                                                                                                                         |
+| Usage for external integration | Used when federation with other Matrix instances is enabled                                                                                  |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/client-server-api/)                                                                                  |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix Push Gateway API
+
+| Name                           | Matrix Push Gateway API                                                                                                                      |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Distribute notifications from the homeserver to clients (push)                                                                               |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/push/v2`)                                                                   |
+| Authentication                 |                                                                                                                                              |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          | Used by Element (Chat Web-UI)                                                                                                                |
+| Usage for external integration | none                                                                                                                                         |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/push-gateway-api/)                                                                                   |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix Identity Service API
+
+| Name                           | Matrix Identity Service API                                                                                                                  |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Validate, store, and answer questions about the identities of users                                                                          |
+| Versioning                     | URL based with version bumps on breaking changes (e.g. `/_matrix/identity/v2`)                                                               |
+| Authentication                 | HTTP-Authorization header with Bearer token                                                                                                  |
+| In openDesk provided by        | Synapse                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                      |
+| Usage within component         | none                                                                                                                                         |
+| Usage within openDesk          |                                                                                                                                              |
+| Usage for external integration | none                                                                                                                                         |
+| Parallel access                | Allowed                                                                                                                                      |
+| Message protocol               | JSON                                                                                                                                         |
+| Supported standards            | [Matrix](https://spec.matrix.org/latest/identity-service-api/)                                                                               |
+| Documentation                  | [Synapse](https://element-hq.github.io/synapse/latest/) is the reference implementation of the Matrix protocol, see standard for API details |
+
+## Matrix React SDK Module API
+
+| Name                           | Matrix React SDK Module API                                                                                                                                                                                                        |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | The module system in Element Web is a way to add or modify functionality of Element Web itself, bundled at compile time for the app.                                                                                               |
+| Versioning                     | [Releases in the Git repository](https://github.com/matrix-org/matrix-react-sdk-module-api/releases); [Dependency in `package.json` in Element (Chat Web-UI)](https://github.com/element-hq/element-web/blob/develop/package.json) |
+| Authentication                 | n/a - used as a library                                                                                                                                                                                                            |
+| In openDesk provided by        | Element (Chat Web-UI)                                                                                                                                                                                                              |
+| Transport protocol             | n/a - used as a library                                                                                                                                                                                                            |
+| Usage within component         | [Element (Chat-Web-UI) Modules](https://github.com/nordeck/element-web-modules/)                                                                                                                                                   |
+| Usage within openDesk          | none                                                                                                                                                                                                                               |
+| Usage for external integration | n/a - uses as a library                                                                                                                                                                                                            |
+| Parallel access                | Allowed                                                                                                                                                                                                                            |
+| Message protocol               | n/a - used as a library                                                                                                                                                                                                            |
+| Supported standards            | n/a - Element (Chat Web-UI) specific                                                                                                                                                                                               |
+| Documentation                  | [Element (Chat Web-UI) Documentation](https://github.com/element-hq/element-web/blob/develop/docs/modules.md); [matrix-react-sdk-module-api Git repository](https://github.com/matrix-org/matrix-react-sdk-module-api)             |
+
+## Matrix Widget API
+
+| Name                           | Matrix Widget API                                                                                                                                                                                                    |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Matrix Widgets are HTML and Javascript content / applications that can be embedded within, and communicate with Matrix clients.                                                                                      |
+| Versioning                     | n/a                                                                                                                                                                                                                  |
+| Authentication                 | Widgets request capabilities. They must be confirmed by a user or by the [Widget Lifecycle Module](https://github.com/nordeck/element-web-modules/blob/main/packages/element-web-widget-lifecycle-module/README.md). |
+| In openDesk provided by        | Element (Chat Web-UI)                                                                                                                                                                                                |
+| Transport protocol             | [HTML window.postMessage API](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage)                                                                                                                   |
+| Usage within component         | [NeoDateFix](https://github.com/nordeck/matrix-meetings/), [NeoBoard](https://github.com/nordeck/matrix-neoboard), [NeoChoice](https://github.com/nordeck/matrix-poll)                                                                                                    |
+| Usage within openDesk          | none                                                                                                                                                                                                                 |
+| Usage for external integration | none                                                                                                                                                                                                                 |
+| Parallel access                | Allowed                                                                                                                                                                                                              |
+| Message protocol               | JSON                                                                                                                                                                                                                 |
+| Supported standards            | [Matrix - MSC2764](https://github.com/matrix-org/matrix-spec-proposals/pull/2764)                                                                                                                                    |
+| Documentation                  | [Matrix - MSC2764](https://github.com/matrix-org/matrix-spec-proposals/pull/2764)                                                                                                                                    |
+
+## NeoBoard Data Model API
+
+| Name                           | NeoBoard Data Model API                                                                                                               |
+| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | The NeoBoard data model can be used to generate whiteboard documents.                                                                 |
+| Versioning                     | `version` field in the [NeoBoard data model](https://github.com/nordeck/matrix-neoboard/blob/main/docs/model/export-format.md#fields) |
+| Authentication                 | n/a                                                                                                                                   |
+| In openDesk provided by        | [NeoBoard](https://github.com/nordeck/matrix-neoboard)                                                                                |
+| Transport protocol             | n/a                                                                                                                                   |
+| Usage within component         | [NeoBoard](https://github.com/nordeck/matrix-neoboard)                                                                                |
+| Usage within openDesk          | none                                                                                                                                  |
+| Usage for external integration | none                                                                                                                                  |
+| Parallel access                | n/a                                                                                                                                   |
+| Message protocol               | JSON                                                                                                                                  |
+| Supported standards            | n/a                                                                                                                                   |
+| Documentation                  | [NeoBoard data model](https://github.com/nordeck/matrix-neoboard/tree/main/docs/model)                                                |
+
+## NeoDateFix REST API
+
+| Name                           | NeoDateFix REST API                                                                                                                                |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Can be used to query and set up NeoDateFix Matrix meetings.                                                                                        |
+| Versioning                     | Path segment in the [Meetings Bot API](https://github.com/nordeck/matrix-meetings/blob/main/docs/data-model.md#http-api)                           |
+| Authentication                 | n/a                                                                                                                                                |
+| In openDesk provided by        | [NeoDateFix](https://github.com/nordeck/matrix-meetings)                                                                                           |
+| Transport protocol             | HTTP(S)                                                                                                                                            |
+| Usage within component         | [NeoDateFix](https://github.com/nordeck/matrix-meetings)                                                                                           |
+| Usage within openDesk          | Used by OX to sync calendar entries to NeoDateFix                                                                                                  |
+| Usage for external integration | none                                                                                                                                               |
+| Parallel access                | n/a                                                                                                                                                |
+| Message protocol               | JSON                                                                                                                                               |
+| Supported standards            | n/a                                                                                                                                                |
+| Documentation                  | [NeoDateFix ADR001](https://github.com/nordeck/matrix-meetings/blob/main/docs/adrs/adr001-use-the-widget-api-to-interact-with-the-meetings-bot.md) |
+
+# Knowledge management - XWiki
+
+The following are the APIs used by the Knowledge management application:
+
+| Used by | Accessed component | Service            | Purpose                                            | Message format |
+| ------- | ------------------ | ------------------ | -------------------------------------------------- | -------------- |
+| Xwiki   | Keycloak           | Authentication     | Single sign-on / sign-out                          | OIDC           |
+| Xwiki   | Nubus Portal       | Central Navigation | Retrieve content for openDesk Navigation drop-down | JSON           |
+| Xwiki   | Nubus              | LDAP               | Read users and groups data                         | LDAP           |
+
+## REST API
+
+| Name                           | REST API                                                                                                                                                                                                                                                   |
+| ------------------------------ |------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Perform low-level actions, e.g. interact with XWiki stored data                                                                                                                                                                                            |
+| Versioning                     |                                                                                                                                                                                                                                                            |
+| Authentication                 | Anonymous or username/password on each request (stateless)                                                                                                                                                                                                 |
+| In openDesk provided by        | XWiki                                                                                                                                                                                                                                                      |
+| Transport protocol             | HTTP(S)                                                                                                                                                                                                                                                    |
+| Usage within component         |                                                                                                                                                                                                                                                            |
+| Usage within openDesk          | none                                                                                                                                                                                                                                                       |
+| Usage for external integration | none                                                                                                                                                                                                                                                       |
+| Parallel access                | Allowed                                                                                                                                                                                                                                                    |
+| Message protocol               | JSON/XML                                                                                                                                                                                                                                                   |
+| Supported standards            |                                                                                                                                                                                                                                                            |
+| Documentation                  | - https://www.xwiki.org/xwiki/bin/view/Documentation/UserGuide/Features/XWikiRESTfulAPI<br>- https://github.com/xwiki/xwiki-platform/blob/master/xwiki-platform-core/xwiki-platform-rest/xwiki-platform-rest-model/src/main/resources/xwiki.rest.model.xsd |
+
+## Scripting API
+
+| Name                           | Scripting API                                                                                                                                                                 |
+| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Feature-rich API to access any module, use any functionality, modify existing functionality; allows definition of new REST API endpoints - API scope is identical to Java API |
+| Versioning                     |                                                                                                                                                                               |
+| Authentication                 | Performed in the context of an (authenticated) user or anonymously - permissions (scripting rights, programming rights) of that context apply                                 |
+| In openDesk provided by        | XWiki                                                                                                                                                                         |
+| Transport protocol             |                                                                                                                                                                               |
+| Usage within component         |                                                                                                                                                                               |
+| Usage within openDesk          | none                                                                                                                                                                          |
+| Usage for external integration | Not supported                                                                                                                                                                 |
+| Parallel access                | Allowed                                                                                                                                                                       |
+| Message protocol               |                                                                                                                                                                               |
+| Supported standards            |                                                                                                                                                                               |
+| Documentation                  | https://extensions.xwiki.org/xwiki/bin/view/Extension/Scripting%20Documentation%20Application                                                                                 |
+
+## Java API
+
+| Name                           | Java API                                                                                                                                                                           |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Purpose                        | Feature-rich API to access any module, use any functionality, modify existing functionality; allows definition of new REST API endpoints - API scope is identical to Scripting API |
+| Versioning                     |                                                                                                                                                                                    |
+| Authentication                 | Performed in the context of an (authenticated) user or anonymously - but without the permission check (in contrast to the Scripting API)                                           |
+| In openDesk provided by        | XWiki                                                                                                                                                                              |
+| Transport protocol             |                                                                                                                                                                                    |
+| Usage within component         |                                                                                                                                                                                    |
+| Usage within openDesk          | none                                                                                                                                                                               |
+| Usage for external integration | none                                                                                                                                                                               |
+| Parallel access                | Allowed                                                                                                                                                                            |
+| Message protocol               |                                                                                                                                                                                    |
+| Supported standards            |                                                                                                                                                                                    |
+| Documentation                  | https://www.xwiki.org/xwiki/bin/view/Documentation/DevGuide/API/                                                                                                                   |
+
+## JavaScript API
+
+| Name                           | JavaScript API                                                                               |
+| ------------------------------ | -------------------------------------------------------------------------------------------- |
+| Purpose                        | Include dynamic components in XWiki/web pages                                                |
+| Versioning                     |                                                                                              |
+| Authentication                 | Performed in the context of an (authenticated) user or anonymously                           |
+| In openDesk provided by        | Jitsi                                                                                        |
+| Transport protocol             |                                                                                              |
+| Usage within component         |                                                                                              |
+| Usage within openDesk          | none                                                                                         |
+| Usage for external integration | none                                                                                         |
+| Parallel access                | Allowed                                                                                      |
+| Message protocol               |                                                                                              |
+| Supported standards            |                                                                                              |
+| Documentation                  | https://www.xwiki.org/xwiki/bin/view/Documentation/DevGuide/FrontendResources/JavaScriptAPI/ |

docs/baseline-requirements.md

@@ -0,0 +1,278 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Baseline Requirements</h1>
+
+* [Preamble / Scope](#preamble--scope)
+* [Software bill of materials (SBOMs)](#software-bill-of-materials-sboms)
+  * [Artifact SBOMs](#artifact-sboms)
+  * [Source code SBOMs](#source-code-sboms)
+* [License compliance](#license-compliance)
+* [Software supply chain security](#software-supply-chain-security)
+* [Container architectural basics](#container-architectural-basics)
+* [Security](#security)
+  * [IT-Grundschutz](#it-grundschutz)
+* [Accessibility](#accessibility)
+* [Data protection](#data-protection)
+* [Functionality and features](#functionality-and-features)
+  * [Non-overlapping](#non-overlapping)
+  * [User lifecycle](#user-lifecycle)
+    * [Pull: LDAP](#pull-ldap)
+    * [Push: Provisioning](#push-provisioning)
+  * [Authentication](#authentication)
+  * [Top bar](#top-bar)
+    * [Look and feel](#look-and-feel)
+    * [Central navigation](#central-navigation)
+  * [Functional administration](#functional-administration)
+  * [Theming](#theming)
+  * [Central user profile](#central-user-profile)
+* [Footnotes](#footnotes)
+
+# Preamble / Scope
+
+This document lays out the requirements for open-source products that should become part of openDesk.
+
+As this is a comprehensive set of requirements most new components will not adhere to all of them.
+
+This document can be used to assess the status and possible gaps for a component which might itself be the basis for a decision if a component should be integrated into openDesk by working on closing the identified gaps.
+
+> [!note]
+> Even an already integrated application might not adhere to all aspects of the documented requirements yet.
+> Closing the gaps for existing applications therefore is an openDesk priority.
+
+# Software bill of materials (SBOMs)
+
+openDesk is looking into options for in-depth SBOM creation first for container images and later for source code. It is still expected by the suppliers to provide artifact and source code SBOMs in a standardized manner, ideally in the openCode preferred [SPDX 2.2.1](https://spdx.org/rdf/ontology/spdx-2-2-1/) format.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/deployment/SBOM/-/tree/main/sboms/0.5.74
+
+## Artifact SBOMs
+
+There are various free tools like [syft](https://github.com/anchore/syft) available to generate SBOMs for container images. It is expected that this kind of artifact SBOMs is provided (and signed) for all containers delivered to be integrated into openDesk.
+
+**Reference:** As part of [openDesk's standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) a container image SBOM is derived from the container's content and gets signed. Both artifacts (SBOM and signature) are placed next to the image in the related registry ([e.g.](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release/container_registry/827)).
+
+## Source code SBOMs
+
+Today's software development platforms like GitLab or GitHub provide dependency list/graph features that are the basis for your source code SBOMs. These features are usually based on analysis of language-specific package manager dependency definition files. As part of a supplier's software development process, it is expected that source code SBOMs are at least created on the level of the already defined software dependencies within the source code tree of the component.
+
+**Reference:** Currently we do not have source code SBOMs in place.
+
+# License compliance
+
+All parts of openDesk Community Edition must be open source with source code (also) published or at least publishable on openCode.
+
+openCode provides some boundaries when it comes to open source license compliance openDesk has to adhere to:
+
+- The components must be published under a license listed in the [openCode license allow list](https://opencode.de/de/wissen/rechtssichere-nutzung/open-source-lizenzen).
+- Delivered artifacts (container images) must contain only components licensed under the aforementioned allow list. A container must not contain any artifact using a license from the [openCode license block list](https://opencode.de/de/wissen/rechtssichere-nutzung/open-source-lizenzen#3.-Negativliste-aller-nicht-freigegebenen-Lizenzen).
+
+Deviations from the above requirements must be documented in the openDesk license deviation report.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/deployment/SBOM/-/blob/main/sboms/openDesk%20Deviation%20Report-0.5.74.md
+
+# Software supply chain security
+
+ZenDiS plans to provide secured key storage as a service on openCode.
+
+openDesk is going to implement [SLSA v1.0](https://slsa.dev/spec/v1.0/).
+
+The minimum requirement for all of openDesk's functional components is that all component artifacts (i.e. container images, Helm charts) are signed and their signature can be verified based on the ZenDiS-provided secure key store.
+
+**Reference:** The [openDesk standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) ensures that each container image being built and each Helm chart being released is signed. In the case of container images, the related SBOMs are signed as well.
+
+# Container architectural basics
+
+Note: openDesk is operated as a Kubernetes (K8s) workload.
+
+openDesk applications should adhere to best practices for K8s application/container design. While there are dozens of documents about these best practices please use them as references:
+- https://cloud.google.com/architecture/best-practices-for-building-containers
+- https://cloud.google.com/architecture/best-practices-for-operating-containers
+
+As some applications were initially created years before K8s was introduced they naturally might take different approaches.
+
+You will find below some of the most common best practice requirements, some of which are auto-tested as part of the openDesk deployment automation:
+
+- Containers come with readiness and liveness probes.
+- Containers are stateless and immutable (read-only root file system), state should be placed into a database (or similar).
+- Allow horizontal scaling (auto-scaling is of course nice to have).
+- Provide resource requests and limits (we do not want to limit CPU though).
+- Provide application-specific monitoring endpoints and expose the health of the application.
+- Write your logs to STDOUT/STDERR and ideally provide JSON-based logs.
+- Use one service per container (microservice pattern).
+- Minimize the footprint of your container e.g. removing unnecessary tools, ideally providing a distroless container.
+- Allow restrictive setting of the security contexts (see [security-context.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/security-context.md) for reference).
+- Support for external secrets.
+- Support for externally provided/self-signed certificates.
+
+**Reference:** Some of these requirements are tested and/or documented within the deployment automation:
+- CI executed Kyverno tests: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/tree/main/.kyverno/policies
+- Generated documentation regarding security contexts: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/security-context.md
+
+# Security
+
+openDesk should be compliant with the "Deutsche Verwaltungscloud Strategie" (DVS). While this is a moving target it references some already established standards like the BSI's [IT-Grundschutz](https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/IT-Grundschutz/IT-Grundschutz-Kompendium/it-grundschutz-kompendium_node.html) and [C5](https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5_AktuelleVersion/C5_AktuelleVersion_node.html). These standards address hundreds of requirements which are published at the given links. So here's just a summary to understand the approach of the broadest requirements from IT-Grundschutz.
+
+**Reference:** [Deutsche Verwaltungscloud-Strategie – Rahmenwerk der Zielarchitektur](https://www.cio.bund.de/SharedDocs/downloads/Webs/CIO/DE/cio-bund/steuerung-it-bund/beschluesse_cio-board/2023_11_Beschluss_CIO_Board_DVS_Rahmenwerk_Anlage.pdf)
+
+## IT-Grundschutz
+
+The IT-Grundschutz catalog knowns a lot of modules ("Bausteine"), but not all of them apply to all components, as there are some related to hardware or some just relevant for the operator while openDesk is "just" the software platform. The first step for an IT-Grundschutz evaluation of a component (or the platform as a whole) requires defining which modules are applicable. Other modules apply to all components e.g. [APP.4.4 Kubernetes](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2023/06_APP_Anwendungen/APP_4_4_Kubernetes_Edition_2023.pdf), [SYS.1.6 Containerisierung](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2023/07_SYS_IT_Systeme/SYS_1_6_Containerisierung_Edition_2023.pdf) and [CON.2 Datenschutz](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Grundschutz/IT-GS-Kompendium_Einzel_PDFs_2023/03_CON_Konzepte_und_Vorgehensweisen/CON_2_Datenschutz_Edition_2023.pdf).
+
+Within each module are multiple requirements ("Anforderungen") that are usually composed of multiple partial requirements ("Teilanforderungen"). Each requirement has a given category:
+- B for basic ("Basis") - the requirement must be fulfilled.
+- S for standard ("Standard") - the requirement should also be fulfilled, if not there must be a good reason why it is not the case that does not tamper the security of the overall system. There is only a defined amount of deviations allowed for standard requirements.
+- H for high ("Hoch") - in certain scenarios you have extended security requirements, in that case, the high requirements must be fulfilled. openDesk is working towards making that possible.
+
+Different requirements address different roles in IT-Grundschutz.
+
+- Supplier: processes & product (component -> e.g. Open-Xchange, OpenProject)
+- Provider: processes & product (platform -> openDesk)
+- Operator: processes & product (service)
+- Customer: processes.
+
+As a supplier of an openDesk component, you will focus on the "Supplier" requirements, while the outcome (your product) must enable the Provider to fulfill the requirements that lay with its responsibility for the openDesk platform. Operators use openDesk to provide a service, therefore the openDesk platform must enable an Operator to fulfill the related requirements. Finally, the service must enable the customer to align with the scope of the IT-Grundschutz catalog. So it will happen that a requirement from e.g. the customer level needs a specific capability by the product (Supplier's responsibility), a defined core configuration from the platform (Provider's responsibility), or a certain service setup from the Operator.
+
+We are aware that IT-Grundschutz is a complex topic and are working towards a streamlined process to reduce overhead as much as possible and ensure to maximize the use of synergies.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/documentation/it-grundschutz
+
+# Accessibility
+
+Accessibility is a key requirement for software that is being used in the public sector. Therefore the products of the suppliers are expected to adhere to the relevant standards.
+
+Please find more context about the topic on the [website of the German CIO](https://www.cio.bund.de/Webs/CIO/DE/digitaler-wandel/it-barrierefreiheit/vorgaben-und-richtlinien/vorgaben-und-richtlinien-node.html) followed by a more detailed look at the actual accessibility standard [WCAG 2.1](https://www.barrierefreiheit-dienstekonsolidierung.bund.de/Webs/PB/DE/gesetze-und-richtlinien/wcag/wcag-artikel.html).
+
+Each vendor must provide a certificate that their product - or the parts of the product relevant for openDesk - complies with at least WCAG 2.1 AA or [BITV 2.0](https://www.bundesfachstelle-barrierefreiheit.de/DE/Fachwissen/Informationstechnik/EU-Webseitenrichtlinie/BGG-und-BITV-2-0/Die-neue-BITV-2-0/die-neue-bitv-2-0_node.html). As the certification and related product improvements are time-consuming the focus of openDesk is that a supplier provides a plan and certification partner (contract) that shows the supplier is working towards the certification. While the aforementioned standard states the priority is the "A" level requirements, the "AA" level must be met at the end of the process.
+
+> [!note]
+> Please keep in mind that WCAG 2.2 and 3.0 are work in progress. If you already work on accessibility
+> improvements you might want to take these standards already into consideration.
+
+**Reference:** In the past the [accessibility evaluations](https://gitlab.opencode.de/bmi/opendesk/info/-/tree/main/24.03/Barrierefreiheit) have been executed by Dataport. But they do not do certifications.
+
+# Data protection
+
+Each component must be able to operate according to the [EU's General Data Protection Regulation (GDPR)](https://gdpr.eu/). This requires some key messages to be answered when it comes to personal data[^1]:
+
+- Who are the affected data subjects?
+- What personal data (attributes) from the subjects is being processed?
+- Who is the controller and processor of the subject's data?
+- Which processing activities involve which data attributes?
+- How can the data be deleted?
+- Are personal data-related activities traceable?
+- How can data be provided uniformly to affected people?
+- What does a data privacy-friendly configuration look like?
+
+While this can be answered by each component that will be in the spotlight for the suppliers, we also need an aligned overall picture for openDesk that at least has the platform-specific user lifecycle and cross-application interfaces in focus.
+
+Note: The topics of availability, integrity, and confidentiality of personal data are also being addressed by the IT-Grundschutz module "CON.2". It has to be ensured that it is not in contradiction to what is being done in the general area of data protection.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/documentation/datenschutz
+
+# Functionality and features
+
+## Non-overlapping
+
+To avoid having functionality twice in openDesk it might be required to disable certain functionality within a component. There needs to be an assessment for each new component if it has overlapping functionality and how to deal with that.
+
+**Reference:** The contact management from Nextcloud is done in OX, so Nextcloud has its internal contact management disabled, as well as most of the Nextcloud Talk functionality, due to the presence of Element and Jitsi.
+
+## User lifecycle
+
+With a central Identity- and Access Management (IAM) also the user lifecycle (ULC) that addresses account create-update-delete actions with support for "inactive" accounts must be harmonized within the platform.
+
+The focus is to have all the account information in all applications including the account's state, profile picture ([reference](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues/27)) and - where required - the user's group memberships. This cannot be done purely by pushing that data through OIDC claims when a user logs in to an application therefore two ways of managing an account are applicable and described in the following subchapters.
+
+> [!note]
+> Allowing ad hoc updates of account data through OIDC claims during login is still encouraged.
+
+### Pull: LDAP
+
+Applications can access the IAM's LDAP to access all data necessary for managing their part of the ULC.
+
+**Reference:** Most applications use LDAP access as per https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/components.md?ref_type=heads#identity-data-flows
+
+> [!note]
+> The direct access to LDAP is going to be deprecated for most use cases. openDesk is looking into active
+> provisioning of the user/group data into the applications using [SCIM](https://scim.cloud/).
+
+### Push: Provisioning
+
+Some applications require active provisioning of the centrally maintained IAM data. As the actual provisioning is part of the openDesk provisioning framework it is necessary to define the ULC flow regarding its different states to get a matching provisioning connector implemented. This is done collaboratively between the supplier and openDesk product management.
+
+**Reference:** New applications will make use of the [provisioning framework](https://gitlab.opencode.de/bmi/opendesk/component-code/crossfunctional/univention/ums-provisioning-api). At the moment to only active (push) provisioned component is OX AppSuite fed by the [OX-connector](https://github.com/univention/ox-connector/tree/ucs5.0).
+
+## Authentication
+
+The central IdP ensures the single sign-on and logout workflows. As standard openDesk uses [Open ID Connect](https://openid.net/). It can be configured to provide additional user information from the IAM when required by a component.
+
+Minimum requirements regarding the OIDC support in an application besides the actual login flow:
+
+- Back-channel logout: [OIDC Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) must be supported by the components unless there is a significant reason why it technically cannot be supported, in that case [OIDC Front-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html) is the alternative.
+- IdP Session Refresh: Ensure that your application regularly checks the IdP session for its validity and invalidates the local session when there is no longer an IdP session.
+
+**Reference:** Most applications are directly connected to the IdP and are using OIDC: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/docs/architecture.md#identity-data-flows
+
+## Top bar
+
+The top bar of all applications should provide a common UX.
+
+### Look and feel
+
+The current status is subject to review, but the basics will most likely stay the same. Ensure that the top bar can be customized (or adheres to a given openDesk standard) in various settings:
+
+- Size (height) of the bar.
+- Foreground and -background colors, including hover/active.
+- Size and color of the bar's bottom line.
+- Logo position, size, and link including the link's target.
+- Icon position and size of the central navigation.
+- Ideally have the user's menu on the right-hand side of the top bar using the user's profile picture.
+- Have the search option/bar as the leftmost option in the right content section of the top bar or even allow the search bar to be rendered in the center of the top bar.
+
+**Reference:** This is available in current deployments, see e.g. Nextcloud, Open-Xchange, and XWiki.
+
+### Central navigation
+
+From the top bar, the user can access the central navigation. A menu that gets its contents from the portal, rending the categories and (sub-)applications available to the logged-in user.
+
+When implementing the central navigation into an application there are two options to access the user's data from the portal:
+
+- Frontend-based: Issuing an IFrame-based silent login against the intercom service (ICS) to get a session with the ICS, followed by a request for the JSON containing the user's central navigation contents through the ICS.
+- Backend-based: Requesting the JSON using a backend call to the portal providing the user's name and a shared secret.
+
+**Reference:** This is available in current deployments in all applications except for Jitsi, Collabora, and CryptPad.
+
+## Functional administration
+
+While applications usually support technical and functional administration the technical part should be in the responsibility of the operator and is usually done at (re)deployment time. Therefore the administrative tasks within an application should be limited to functional administration.
+
+Example for "technical administration":
+- Configuring the SMTP relay for an application to send out emails.
+
+Example of "functional administration":
+- Creating and maintaining users and groups.
+
+**Reference:** OpenProject took the approach that all settings pre-defined in the deployment are still rendered in the admin section of OpenProject, but can not be changed.
+
+## Theming
+
+Theming should be controlled with the deployment and affect all components that support branding options.
+
+**Reference:** https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues/27
+
+## Central user profile
+
+The user profile is maintained centrally, therefore the applications should make use of that central data and not allow local editing of the data within the application except for data that is required by the application and cannot be provided by the central IAM.
+
+The data can still be rendered but must not be tampered with in any way within an openDesk application outside of the IAM, as it would either cause inconsistent data within the platform or the changed data being overwritten, which is at least unexpected by the user.
+
+The user's preferred language and theme (light/dark) are also selected in the IAM's portal and the setting should be respected in all applications.
+
+**Reference:** No reference yet.
+
+# Footnotes
+
+^1: For definitions see [GDPR Article 4](https://gdpr.eu/article-4-definitions/).

docs/ci.md

@@ -1,42 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
--->
-<h1>CI/CD</h1>
-
-This page will cover openDesk automation via Gitlab CI.
-
-<!-- TOC -->
-* [Deployment](#deployment)
-* [Tests](#tests)
-<!-- TOC -->
-
-# Deployment
-
-The project includes a `.gitlab-ci.yml` that allows you to execute the deployment from a Gitlab instance of your choice.
-
-
-When starting the pipeline through the Gitlab UI, you will be queried for some variables plus the following ones:
-
-- `DOMAIN` = The domain to deploy to.
-- `ISTIO_DOMAIN` = istio.`DOMAIN`
-- `NAMESPACE`: Defines into which namespace of your K8s cluster the SWP will be installed
-- `MASTER_PASSWORD_WEB_VAR`: Overwrites value of `MASTER_PASSWORD`
-
-Based on your input, the following variables will be set:
-- `MASTER_PASSWORD` = `MASTER_PASSWORD_WEB_VAR`. If `MASTER_PASSWORD_WEB_VAR`
-  is not set, the default for `MASTER_PASSWORD` will be used, unless you set
-  `MASTER_PASSWORD` as a masked CI/CD variable in Gitlab to supersede the default.
-
-You might want to set credential variables in the Gitlab project at `Settings` > `CI/CD` > `Variables`.
-
-# Tests
-
-The gitlab-ci pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another gitlab project.
-The `DEPLOY_`-variables are used to determine which components should be tested.
-In order for the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this gitlab project's CI variables
-that can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
-`<domain of gitlab>/api/v4/projects/<id>`.
-
-If the branch of the test pipeline is not `main` this can be set with the .gitlab-ci.yml variable
-`TESTS_BRANCH` while creating a new pipeline.

docs/components.md

@@ -1,175 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
--->
-<h1>Components</h1>
-
-This section covers the internal system requirements as well as external service requirements for productive use.
-
-<!-- TOC -->
-* [Overview](#overview)
-* [Component integration](#component-integration)
-  * [Intercom Service (ICS)](#intercom-service-ics)
-  * [Filepicker](#filepicker)
-  * [Central Navigation](#central-navigation)
-  * [(Read \& write) Central contacts](#read--write-central-contacts)
-  * [OpenProject Filestore](#openproject-filestore)
-* [Identity data flows](#identity-data-flows)
-* [Provisioning](#provisioning)
-* [Component specific documentation](#component-specific-documentation)
-* [Links to component docs](#links-to-component-docs)
-<!-- TOC -->
-
-# Overview
-
-openDesk consists out of a variety of open-source projects. Here is a list with the description and type.
-
-Components of type `Eval` are used for development and evaluation purposes only,
-they need to be replaced in production deployments.
-
-| Component                   | Description                    | Type       |
-|-----------------------------|--------------------------------|------------|
-| Certificates                | TLS certificates               | Eval       |
-| ClamAV (Distributed)        | Antivirus engine               | Eval       |
-| ClamAV (Simple)             | Antivirus engine               | Eval       |
-| Collabora                   | Weboffice                      | Functional |
-| CryptPad                    | Weboffice                      | Functional |
-| Dovecot                     | Mail backend                   | Functional |
-| Element                     | Secure communications platform | Functional |
-| Intercom Service            | Cross service data exchange    | Functional |
-| Jitsi                       | Videoconferencing              | Functional |
-| MariaDB                     | Database                       | Eval       |
-| Memcached                   | Cache Database                 | Eval       |
-| MinIO                       | Object Storage                 | Eval       |
-| Nextcloud                   | File share                     | Functional |
-| OpenProject                 | Project management             | Functional |
-| OX Appsuite                 | Groupware                      | Functional |
-| Provisioning                | Backend provisioning           | Functional |
-| Postfix                     | MTA                            | Eval       |
-| PostgreSQL                  | Database                       | Eval       |
-| Redis                       | Cache Database                 | Eval       |
-| Univention Management Stack | Identity Management & Portal   | Functional |
-| XWiki                       | Knowledgebase                  | Functional |
-
-# Component integration
-
-Some use cases require inter component integration.
-
-```mermaid
-flowchart TD
-  OXAppSuiteFrontend-->|SilentLogin, Filepicker, CentralNavigation|IntercomService
-  IntercomService-->|SilentLogin, TokenExchange|IdP
-  IntercomService-->|Filepicker|Nextcloud
-  IntercomService-->|CentralNavigation|Portal
-  OXAppSuiteBackend-->|Filepicker|Nextcloud
-  Nextcloud-->|CentralNavigation|Portal
-  OpenProject-->|CentralNavigation|Portal
-  XWiki-->|CentralNavigation|Portal
-  Nextcloud-->|CentralContacts|OXAppSuiteBackend
-  OXAppSuiteFrontend-->|Filepicker|OXAppSuiteBackend
-```
-
-## Intercom Service (ICS)
-
-The UCS Intercom Service's role is to enable cross-application integration based on browser interaction.
-Handling authentication when the frontend of an application is using the API from another application is often a
-challenge.
-For more details on the ICS please refer to its own [doc](./components/intercom-service.md).
-
-To establish a session with the Intercom Service, the application that wants to use the ICS must initiate a silent
-login.
-
-Currently only OX AppSuite is using the frontend-based integration, and therefore it is right now the only consumer of
-the ICS API.
-
-## Filepicker
-
-The Nextcloud filepicker which is integrated into the OX AppSuite allows you to add attachments or links to files from
-and saving attachments to Nextcloud.
-
-The filepicker is using frontend and backend based integration.
-Frontend-based integration means that OX AppSuite in the browser is communicating with ICS.
-While using backend-based integration, OX AppSuite middleware is communicating with Nextcloud, which is especially used
-when adding a file to an email or storing a file into Nextcloud.
-
-## Central Navigation
-
-Central navigation is based on an API endpoint in the portal that provides the contents of the portal for a user to
-allow components to render the menu showing all available SWP applications for the user.
-
-## (Read & write) Central contacts
-
-Open-Xchange App Suite is used to manage contacts within openDesk. There is an API in the AppSuite that is being used by
-Nextcloud to lookup contacts as well as to create contacts. This is maybe done when a file is shared with a not yet
-available personal contact.
-
-## OpenProject Filestore
-
-By default, Nextcloud is a configured option for storing attachments in OpenProject.
-The Filestore can be enabled on a per-project level in OpenProject's project admin section.
-
-# Identity data flows
-
-An overview of
-- components that consume the LDAP service. Mostly by using a dedicated LDAP search account.
-- components using Univention Keycloak as identity provider (IdP). If not otherwise denoted based on the OAuth2 / OIDC flows.
-
-Some components trust others to handle authentication for them.
-
-```mermaid
-flowchart TD
-    K[IdP]-->L[LDAP]
-    N[Nextcloud]-->L
-    O[OpenProject] --> L
-    A[OX AppSuite]-->L
-    D[OX Dovecot]-->L
-    P[Portal/Admin]-->L
-    X[XWiki]-->|in 2023|L
-    A-->K
-    N-->K
-    D-->K
-    O-->K
-    X-->K
-    P-->|SAML|K
-    E[Element]-->K
-    J[Jitsi]-->K
-    I[IntercomService]-->K
-    C[Collabora]-->N
-    R[CryptPad]-->N
-    F[Postfix]-->D
-```
-
-# Provisioning
-
-Currently, active provisioning is only done for OX AppSuite. The OX-Connector is synchronizing, creating, modifying and
-deleting activities for the following objects to the OX AppSuite using the AppSuite's SOAP API:
-
-- Contexts
-- Users
-- Groups
-- Functional Mailboxes
-- Resources
-
-# Component specific documentation
-
-We want to provide more information per component in separate, component-specific markdown file.
-To establish a common view on the components, we are going to cover various aspects:
-
-- **Component overview**: Shall provide a quick introduction including the components prerequisites and subcomponents (f.e. pods).
-- **Resources**: Will contain a link to the component upstream documentation, the helm chart and image locations.
-- **Operational Capabilities**
-  - **Install**: The components install within the SWP.
-  - **Restart**: Deleting and restarting pods works seamlessly.
-  - **Update**: Redeploying the component with a different configuration works as expected. The component makes use of the updates configuration afterwards.
-  - **Upgrade**: Component allows upgrading existing deployments with more current versions of itself.
-  - **Secrets**: The component uses K8s secrets.
-  - **Logging**: Only logging to STDOUT, no logs inside the container.
-  - **Monitoring**: Application provides based on kube-prometheus-stack CRD: ServiceMonitor and PrometheusRule. Optional: Grafana Dashboard.
-  - **Scale**: If supported (as we use community products) the component should be manually scalable. Optional: Autoscaling.
-  - **Network policies**: Deny by default, allow application related traffic.
-  - **Uninstall**: Documented and working complete uninstallation of the component.
-- **Debugging**: Some helpful information when it comes to debugging a component, e.g. setting log level.
-
-# Links to component docs
-
-- [Intercom-Service](./components/intercom-service.md)

docs/components/intercom-service.md

@@ -1,43 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
--->
-**Content / Quick navigation**
-
-[[_TOC_]]
-
-# Component overview
-
-The Intercom Service (ICS) is used to address integrational use cases where the frontend of one application has to call APIs from another application.
-
-# Resources
-
-- External documentation: https://docs.software-univention.de/intercom-service/latest/index.html
-- Helm chart: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/sovereign-workplace-intercom-service
-- Image: not yet published on Open CoDE, image will be provided through external artifactory.
-
-# Operational Capabilities
-
-## Install
-
-## Restart
-
-## Update
-
-## Upgrade
-
-## Secrets
-
-## Logging
-
-## Monitoring
-
-## Scale
-
-## Network policies
-
-## Uninstall
-
-# Debugging
-
-ICS does not have a debug level option yet. But please refer to the most current documentation of the component. You just want to look into the standard log output of the component.

docs/data-storage.md

@@ -0,0 +1,133 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Application Data Storages</h1>
+
+To provide a feasible backup and restore concept, a thorough overview of all openDesk
+applications and their related data storages (ephemeral & persistent) is provided in the
+following subsection.
+
+<!-- TOC -->
+* [Overview](#overview)
+* [Details](#details)
+<!-- TOC -->
+
+# Overview
+
+The provided diagram shows all relevant openDesk applications on the left and
+their utilized data storages on the right. For more detailed information about each
+application refer to the table in [Details](#details).
+
+```mermaid
+---
+config:
+  sankey:
+    showValues: false
+    linkColor: target
+---
+sankey-beta
+
+ClamAV,PersistentVolume,1
+
+Element/Synapse,PostgreSQL,1
+Element/Synapse,PersistentVolume,1
+
+Intercom-Service,Redis,1
+
+Jitsi,PersistentVolume,1
+
+Nextcloud,PostgreSQL,1
+Nextcloud,S3,1
+Nextcloud,Redis,1
+
+Nubus,PostgreSQL,1
+Nubus,S3,1
+Nubus,PersistentVolume,1
+Nubus,Memcached,1
+
+OpenProject,PostgreSQL,1
+OpenProject,S3,1
+OpenProject,PersistentVolume,1
+OpenProject,Memcached,1
+
+OX App Suite,MariaDB,1
+OX App Suite,Redis,1
+OX App Suite,S3,1
+
+OX Connector,PersistentVolume,1
+
+OX Dovecot,Cassandra,1
+OX Dovecot,PersistentVolume,1
+OX Dovecot,S3,1
+
+Postfix,PersistentVolume,1
+
+XWiki,PostgreSQL,1
+XWiki,PersistentVolume,1
+```
+
+# Details
+
+| Application          | Data Storage | Backup   | Content                                                                           | (Default) Identifier                           | Details                                                                                                   |
+| -------------------- | ------------ | -------- | --------------------------------------------------------------------------------- | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| **ClamAV**           | PVC          | No       | ClamAV Database                                                                   | `clamav-database-clamav-simple-0`              | `/var/lib/clamav`                                                                                         |
+| **Dovecot**          | PVC          | Yes      | openDesk CE only: User mail directories                                           | `dovecot`                                      | `/srv/mail`                                                                                               |
+|                      | PVC          | Yes       | openDesk EE only: Metacache directory                                             | `var-lib-dovecot-dovecot-0`                    | `/var/lib/dovecot`                                                                                        |
+|                      | S3           | Yes      | openDesk EE only: User mail                                                       | `dovecot`                                      | `dovecot`                                                                                                 |
+|                      | Cassandra    | Yes      | openDesk EE only: Metadata and ACLs                                               | `dovecot_dictmap`, `dovecot_acl`               |                                                                                                           |
+| **Element/Synapse**  | PostgreSQL   | Yes      | Application's main database                                                       | `matrix`                                       |                                                                                                           |
+|                      | PVC          | Yes      | Attachments                                                                       | `media-opendesk-synapse-0`                     | `/media`                                                                                                  |
+|                      |              | Yes      | Sync and state data                                                               | `matrix-neodatefix-bot`                        | `/app/storage`                                                                                            |
+| **Intercom-Service** | Redis        | No       | Shared session data                                                               |                                                |                                                                                                           |
+| **Jitsi**            | PVC          | Optional | Meeting recordings (feature not enabled in openDesk)                              | `prosody-data-jitsi-prosody-0`                 | `/config/data`                                                                                            |
+| **Nextcloud**        | PostgreSQL   | Yes      | Application's main database Meta-Data                                             | `nextcloud`                                    |                                                                                                           |
+|                      | S3           | Yes      | The Nextcloud managed user files                                                  | `nextcloud`                                    |                                                                                                           |
+|                      | Redis        | No       | Distributed caching, as well as transactional file locking                        |                                                |                                                                                                           |
+| **Nubus**            | PostgreSQL   | Yes      | Main database for Nubus' IdP Keycloak                                             | `keycloak`                                     |                                                                                                           |
+|                      |              | Yes      | Login actions and device-fingerprints                                             | `keycloak_extensions`                          |                                                                                                           |
+|                      |              | Optional | Store of the temporary password reset token                                       | `selfservice`                                  |                                                                                                           |
+|                      |              | Optional | OIDC session storage                                                              | `umsAuthSession`                               |                                                                                                           |
+|                      |              | No       | At the moment the notification feature not enabled in openDesk                    | `notificationsapi`                             |                                                                                                           |
+|                      |              | No       | At the moment the Guardian features are currently not enabled in openDesk         | `guardianmanagementapi`                        |                                                                                                           |
+|                      | S3           | No       | Static files for Portal                                                           | `ums`                                          |                                                                                                           |
+|                      | PVC          | Yes      | openLDAP database (primary R/W Pods), when restore select the one from the leader | `shared-data-ums-ldap-server-primary-0`        | `/var/lib/univention-ldap`                                                                                |
+|                      |              | Yes      | openLDAP process data                                                             | `shared-run-ums-ldap-server-primary-0`         | `/var/run/slapd`                                                                                          |
+|                      |              | No       | openLDAP database (secondary R/O Pods), secondaries can sync from the primary     | `shared-data-ums-ldap-server-secondary-0`      | `/var/lib/univention-ldap`                                                                                |
+|                      |              | No       | openLDAP process data                                                             | `shared-run-ums-ldap-server-secondary-0`       | `/var/run/slapd`                                                                                          |
+|                      |              | Yes      | The state of the listener                                                         | `data-ums-provisioning-udm-listener-0`         | `/var/log/univention`<br>`/var/lib/univention-ldap/schema/id`<br>`/var/lib/univention-directory-listener` |
+|                      |              | No       | Cache                                                                             | `group-membership-cache-ums-portal-consumer-0` | `/usr/share/univention-group-membership-cache/caches`                                                     |
+|                      |              | Yes      | Queued provisioning objects                                                       | `nats-data-ums-provisioning-nats-0`            | `/data`                                                                                                   |
+|                      | Memcached    | No       | Cache for UMC Server                                                              |                                                |                                                                                                           |
+| **OpenProject**      | PostgreSQL   | Yes      | Application's main database                                                       | `openproject`                                  |                                                                                                           |
+|                      | S3           | Yes      | Attachments, custom styles                                                        | `openproject`                                  |                                                                                                           |
+|                      | Memcached    | No       | Cache                                                                             |                                                |                                                                                                           |
+|                      | PVC          | No       | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs      | `openproject-<web/worker>-*-tmp`               | `/tmp`                                                                                                    |
+|                      |              | No       | PVC backed `emptyDir` as K8s cannot set the sticky bit on standard emptyDirs      | `openproject-<web/worker>-app-*-tmp`           | `/app/tmp`                                                                                                |
+| **OX App Suite**     | MariaDB      | Yes      | Application's control database to coordiate dynamically created ones              | `configdb`                                     |                                                                                                           |
+|                      |              | Yes      | Dynamically creates databases of schema `PRIMARYDB_n`containing multiple contexts | `PRIMARYDB_*`                                  |                                                                                                           |
+|                      |              | Yes      | OX Guard related settings                                                         | `oxguard*`                                     |                                                                                                           |
+|                      | S3           | Yes      | Attachments of meetings, contacts and tasks                                       | `openxchange`                                  |                                                                                                           |
+|                      | Redis        | Optional | Cache, session related data, distributed maps                                     |                                                |                                                                                                           |
+| **OX Connector**     | PVC          | Optional | OX Connector: Caching of OX object data                                           | for backup                                     | `/var/lib/univention-appcenter/apps/ox-connector`                                                         |
+|                      |              | Yes      | OX Connector: OX SOAP API credentials                                             | `ox-connector-ox-contexts-ox-connector-0`      | `/etc/ox-secrets`                                                                                         |
+| **OX Dovecot**       | PVC          | Yes      | openDesk CE only: User mail directories                                           | `dovecot`                                      | `/srv/mail`                                                                                               |
+|                      | PVC          | Yes      | openDesk EE only: Various meta data and caches                                    | `var-lib-dovecot`                              | `/var/lib/dovecot`                                                                                        |
+|                      | S3           | Yes      | Dovecot Pro/openDesk EE only: User mail                                           | `dovecot`                                      | `dovecot`                                                                                                 |
+|                      | Cassandra    | Yes      | Dovecot Pro/openDesk EE only: Metadata and ACLs                                   | `dovecot_dictmap`, `dovecot_acl`               |                                                                                                           |
+| **Postfix**          | PVC          | Yes      | Mail spool                                                                        | `postfix`                                      | `/var/spool/postfix`                                                                                      |
+| **XWiki**            | PostgreSQL   | Yes      | Application's main database                                                       | `xwiki`                                        |                                                                                                           |
+|                      | PVC          | Yes      | Attachments                                                                       | `xwiki-data-xwiki-0`                           | `/usr/local/xwiki/data`                                                                                   |
+
+Additionally, the following persistent volumes are mounted by Pods that serve as a data storage for the applications mentioned above.
+
+These services are not ment for production use, so you can ignore these as you surely backup your production services instead.
+
+| Service    | Pod              | Volume Name  | PVC                         | MountPath             | Comment          |
+|------------|------------------|--------------|-----------------------------|-----------------------|------------------|
+| MariaDB    | `mariadb-*`      | `data`       | `data-mariadb-0`            | `/var/lib/mysql`      |                  |
+| MinIO      | `minio-*-*`      | `data`       | `minio`                     | `/bitnami/minio/data` |                  |
+| PostgreSQL | `postgresql-*`   | `data`       | `data-postgresql-0`         | `/mnt/postgresql`     |                  |
+| Redis      | `redis-master-*` | `redis-data` | `redis-data-redis-master-0` | `/data`               |                  |
+| Cassandra  | `cassandra-*`    | `data`       | `data-cassandra-*`          | `/bitnami/cassandra`  | openDesk EE only |

docs/debugging.md

@@ -0,0 +1,235 @@
+<!--
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Debugging</h1>
+
+<!-- TOC -->
+* [Disclaimer](#disclaimer)
+* [Enable debugging](#enable-debugging)
+* [Adding containers to a pod for debugging purposes](#adding-containers-to-a-pod-for-debugging-purposes)
+  * [Adding a container to a pod/deployment - Dev/Test only](#adding-a-container-to-a-poddeployment---devtest-only)
+  * [Temporary/ephemeral containers](#temporaryephemeral-containers)
+* [Components](#components)
+  * [Helmfile](#helmfile)
+  * [MariaDB](#mariadb)
+  * [Nextcloud](#nextcloud)
+  * [OpenProject](#openproject)
+  * [PostgreSQL](#postgresql)
+  * [Keycloak](#keycloak)
+    * [Setting the log level](#setting-the-log-level)
+    * [Accessing the Keycloak admin console](#accessing-the-keycloak-admin-console)
+<!-- TOC -->
+
+# Disclaimer
+
+This document collects information on how to go about debugging an openDesk deployment.
+
+It will be extended over time as we deal with debugging cases.
+
+We for sure do not want to reinvent the wheel, so we might link to external sources that contain helpful
+information where available.
+
+> [!warning]
+> You should never enable the debug option in production environments! By looking up `debug.enabled` in the
+> deployment, you will find the various places changes are applied when enabling debugging. So, outside of
+> development and test environments, you should use them thoughtfully and carefully if needed.
+
+# Enable debugging
+
+Check the openDesk [`debug.yaml.gotmpl`](../helmfile/environments/default/debug.yaml.gotmpl) and configure it for your deployment
+```
+debug:
+  enabled: true
+```
+
+This will result in:
+- setting most component's log level to debug
+- making the Keycloak admin console available by default at `https://id.<your_domain>/admin/`
+- ingress for `http://minio-console.<your_domain>` being configured
+
+> [!note]
+> When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In
+> debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.
+
+> [!note]
+> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container which
+> were not in STDOUT, please let us know!
+
+# Adding containers to a pod for debugging purposes
+
+During testing or development, you may need to execute tools, browse, or even change things in the filesystem of another container.
+
+This can be a challenge the more security-hardened the container images are because there are no debugging tools available, and sometimes, there is not even a shell.
+
+Adding a container to a Pod can ease the pain.
+
+Below are some brief notes on debugging openDesk by adding debug containers. Of course, there are many more detailed resources out there.
+
+## Adding a container to a pod/deployment - Dev/Test only
+
+You can add a container by editing and updating an existing deployment, which is quite comfortable with tools like [Lens](https://k8slens.dev/).
+
+- Select the container you want to use as a debugging container; in the example below, it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
+- Ensure the `shareProcessNamespace` option is enabled for the Pod.
+- Reference the selected container within the `containers` array of the deployment.
+- If you want to access another container's filesystem, ensure both containers' user/group settings match.
+- Save & update the deployment.
+
+The following example can be used to debug the `openDesk-Nextcloud-PHP` container; if you want to modify files, remember to set `readOnlyRootFilesystem` to `true` on the PHP container.
+
+```yaml
+      shareProcessNamespace: true
+      containers:
+        - name: debugging
+          image: registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest
+          command: ["/bin/bash", "-c", "while true; do echo 'This is a temporary container for debugging'; sleep 5 ; done"]
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            runAsUser: 65532
+            runAsGroup: 65532
+            runAsNonRoot: true
+            readOnlyRootFilesystem: false
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+```
+
+- After the deployment has been reloaded, open the shell of the debugging container.
+- When you've succeeded, you will see the processes of both/all containers in the Pod when executing `ps aux`.
+- To access other containers' filesystems, select the PID of a process from the other container and do a `cd /proc/<selected_process_id>/root`.
+
+## Temporary/ephemeral containers
+
+An interesting read from which we picked most of the details below from: https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/
+
+Sometimes, you do not want to add a container permanently to your existing deployment. In that case, you could use [ephemeral containers](https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/).
+
+For the commands further down this section, we need to set some environment variables first:
+- `NAMESPACE`: The namespace in which the Pod you want to inspect is running.
+- `DEPLOYMENT_NAME`: The deployment's name responsible for spawning the Pod you want to inspect within the aforementioned namespace.
+- `POD_NAME`: The name of the Pod you want to inspect within the aforementioned namespace.
+- `EPH_CONTAINER_NAME`: The name of your debugging container, "debugging" seems obvious.
+- `DEBUG_IMAGE`: The image you want to use for debugging purposes.
+
+e.g.
+
+```shell
+export NAMESPACE=my_test_deployment
+export DEPLOYMENT_NAME=opendesk-nextcloud-php
+export POD_NAME=opendesk-nextcloud-php-6686d47cfb-7642f
+export EPH_CONTAINER_NAME=debugging
+export DEBUG_IMAGE=registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest
+```
+
+You still need to ensure that your deployment supports process namespace sharing:
+
+```shell
+kubectl -n ${NAMESPACE} patch deployment ${DEPLOYMENT_NAME} --patch '
+spec:
+  template:
+    spec:
+      shareProcessNamespace: true'
+```
+
+Now, you can add the ephemeral container with:
+```shell
+kubectl -n ${NAMESPACE} debug -it --attach=false -c ${EPH_CONTAINER_NAME} --image={DEBUG_IMAGE} ${POD_NAME}
+```
+and open its interactive terminal with
+```shell
+kubectl -n ${NAMESPACE} attach -it -c ${EPH_CONTAINER_NAME} ${POD_NAME}
+```
+
+# Components
+
+## Helmfile
+
+When refactoring the Helmfile structure, you want to ensure that there are no unintended edits by executing e.g. `diff` and
+comparing the output of Helmfile from before and after the change by calling:
+
+```shell
+helmfile template -e dev >output_to_compare.yaml
+```
+
+## MariaDB
+
+When using the openDesk bundled MariaDB, you can explore the database(s) using the MariaDB interactive terminal from the Pod's command line: `mariadb -u root -p`. On the password prompt, provide the value for `MARIADB_ROOT_PASSWORD` which can be found in the Pod's environment.
+
+While you will find all the details for the CLI tool in the [MariaDB documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some commonly used commands are:
+
+- `help`: Get help on the psql command set
+- `show databases`: Lists all databases
+- `use <databasename>`: Connect to `<databasename>`
+- `show tables`: Lists tables within the currently connected database
+- `quit`: Quit the client
+
+## Nextcloud
+
+`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/stable/admin_manual/occ_command.html).
+
+You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`
+
+## OpenProject
+
+OpenProject is a Ruby on Rails application. Therefore, you can make use of the Rails console from the Pod's command line `bundle exec rails console`
+and run debug code like this:
+
+```
+uri = URI('https://nextcloud.url/apps/integration_openproject/check-config')
+Net::HTTP.start(uri.host, uri.port,
+ :use_ssl => uri.scheme == 'https') do |http|
+ request = Net::HTTP::Get.new uri
+ response = http.request request # Net::HTTPResponse object
+end
+```
+
+## PostgreSQL
+
+Using the openDesk bundled PostgreSQL, you can explore database(s) using the PostgreSQL interactive terminal from the Pod's command line: `psql -U postgres`.
+
+While you will find all details about the cli tool `psql` in the [PostgreSQL documentation](https://www.postgresql.org/docs/current/app-psql.html)), some commonly used commands are:
+
+- `\?`: Get help on the psql command set
+- `\l`: Lists all databases
+- `\c <databasename>`: Connect to `<databasename>`
+- `\dt`: List (describe) tables within the currently connected database
+- `\q`: Quit the client
+
+## Keycloak
+
+### Setting the log level
+
+Keycloak is the gateway to integrate other authentication management systems or applications. It is undesirable to enable debug mode for the whole platform if you just need to look into Keycloak.
+
+Enabling debugging mode for Keycloak can easily be achieved in two steps:
+
+1. Updating the value for `KC_LOG_LEVEL` in the related configmap `ums-keycloak`.
+```shell
+export NAMESPACE=<your_namespace>
+export CONFIGMAP_NAME=ums-keycloak
+kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"data":{"KC_LOG_LEVEL":"DEBUG"}}'
+```
+
+2. Restart the Keycloak Pod(s).
+
+> [!note]
+> Because the `ums-keycloak-extensions-handler` is sending frequent requests (one per second) to Keycloak for
+> retrieval of the Keycloak event history, you might want to stop/remove the deployment while
+> debugging/analysing Keycloak to not get your debug output spammed by these requests.
+
+> [!note]
+> While you can set the standard log levels like `INFO`, `DEBUG`, `TRACE` etc. you can also set class specific
+> logs by comma separating the details in the `KC_LOG_LEVEL` environment variable like
+> e.g. `INFO,org.keycloak.protocol.oidc.endpoints:TRACE`. The example sets the overall loglevel to `INFO` but
+> provides trace logs for `org.keycloak.protocol.oidc.endpoints`.
+
+### Accessing the Keycloak admin console
+
+Deployments set to `debug.enable: true` expose the Keycloak admin console at `http://id.<your_opendesk_domain>/admin/`. This can also be achieved by updating the Ingress `ums-keycloak-extensions-proxy` with an additional path that allows access to `/admin/`.
+
+The admin console login is using the default Keycloak admin account `kcadmin` and the password from the secret `ums-opendesk-keycloak-credentials`.

docs/developer/ci.md

@@ -0,0 +1,39 @@
+<!--
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>CI/CD</h1>
+
+This page covers openDesk deployment automation via Gitlab CI.
+
+<!-- TOC -->
+* [Deployment](#deployment)
+* [Tests](#tests)
+<!-- TOC -->
+
+# Deployment
+
+The project includes a `.gitlab-ci.yml` that allows you to execute the deployment from a GitLab instance of your choice.
+
+When starting the pipeline through the GitLab UI, you will be queried for some variables, including the following:
+
+- `DOMAIN`: The primary domain for your deployment, making the openDesk services available, e.g., as `https://portal.DOMAIN`.
+- `MAIL_DOMAIN` (optional): The domain for the users' email addresses; it defaults to `DOMAIN`.
+- `MATRIX_DOMAIN` (optional): The domain for the users' Matrix IDs; it defaults to `DOMAIN`.
+- `NAMESPACE`: Namespace of your K8s cluster openDesk will be installed.
+- `MASTER_PASSWORD_WEB_VAR`: Overwrites value of `MASTER_PASSWORD`.
+
+You might want to set credential variables in the GitLab project at `Settings` > `CI/CD` > `Variables`, the values of which can then be hidden from output logs.
+
+# Tests
+
+The GitLab CI pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another GitLab project.
+For the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this GitLab project's CI variables,
+which can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
+`<domain of gitlab>/api/v4/projects/<id>`.
+To select the current test suite, use the variable `TESTS_TESTSET`. Default: `Smoke`.
+If the branch of the test pipeline is not `main`, this can be set with the `.gitlab-ci.yml` variable
+`TESTS_BRANCH` while creating a new pipeline.
+
+The variable `testprofile` within the job is set to `Namespace`, which tells the e2e tests to use environment-specific settings that will be read from the cluster and namespace-specific file which is found in the project internal `opendesk-env` repository.

docs/developer/development.md

@@ -0,0 +1,161 @@
+<!--
+SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Developing openDesk deployment automation</h1>
+
+Active development on the deployment is currently only available to project members.
+However, contributions are possible using the [CLA](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md?ref_type=heads) process.
+
+<!-- TOC -->
+* [Overview](#overview)
+* [Default branch, `develop` and other branches](#default-branch-develop-and-other-branches)
+* [External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`](#external-artifacts---chartsyamlgotmpl-and-imagesyamlgotmpl)
+  * [Linting](#linting)
+    * [Disable linting selectively](#disable-linting-selectively)
+  * [Renovate](#renovate)
+  * [Mirroring](#mirroring)
+    * [Get new artifacts mirrored](#get-new-artifacts-mirrored)
+* [Creating new charts/images](#creating-new-chartsimages)
+<!-- TOC -->
+
+# Overview
+
+The following sketch provides a high-level overview to get a basic understanding of the deployment-relevant
+structure of this repository. Understanding that structure is vital if you want to contribute to
+developing the openDesk platform.
+
+```mermaid
+flowchart TD
+ J[helmfile.yaml.gotmpl\nor a helmfile outside of this repository]-->A
+ J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor another environment values file]
+ A[./helmfile_generic.yaml.gotmpl]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml.gotmpl\nReferences the relevant app Helm\ncharts using details from 'charts.yaml.gotmpl']
+ B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml.gotmpl`]
+ A-->D[./helmfile/environments/default/*\nwith just some examples below]
+ D-->F[charts.yaml.gotmpl]
+ D-->G[images.yaml.gotmpl]
+ D-->H[global.*]
+ D-->I[secrets.yaml.gotmpl\nreplicas.yaml.gotmpl\nresources.yaml.gotmpl\n...]
+ A-->|overwrite defaults with your\ndeployment/environment specific values|E[./helmfile/environments/default/values.yaml.gotmpl]
+```
+
+The `helmfile.yaml.gotmpl` file in the root folder is the foundation
+for the entire deployment. It references the `helmfile_generic.yaml.gotmpl`
+file, which includes app-specific `helmfile.yaml.gotmpl` files and
+global values files located in `./environments/default`.
+
+`helmfile.yaml.gotmpl` also refers to three predefined environments: `dev`,
+`test`, and `prod`.
+
+The `helmfile_generic.yaml.gotmpl` file is designed to be referenced from
+external repositories, where custom environments may be defined. An
+example is demonstrated in the `helmfile.yaml.gotmpl` file.
+
+Before you investigate any app-specific configuration, it is recommended that you review the contents of `./helmfile/environments/default` to understand what configuration details are set there, as the app deployments reference them.
+
+# Default branch, `develop` and other branches
+
+The `main` branch is configured to be the default branch, as visitors to the project on openCode should see that
+branch by default.
+
+Please use the `develop` branch to diverge your branch(es) from. See the [workflow guide](./docs/developer/workflow.md)
+for more details on naming conventions.
+
+# External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`
+
+The `charts.yaml.gotmpl` and `images.yaml.gotmpl` files are the central place to reference any external artifacts used for the deployment.
+
+Besides the deployment automation itself, some tools work with the contents of the files:
+
+- **Linting**: Ensures consistency of the file contents for the other tools.
+- **Renovate**: Automatically create MRs that update the components to their latest version.
+- **Mirror**: Mirror artifacts to openCode.
+
+Please find details on these tools below.
+
+## Linting
+
+In the project's CI, there is a step dedicated to lint the two yaml files, as we want them to be in
+- alphabetical order regarding the components
+- logical order regarding the non-commented lines (registry > repository > tag).
+
+In the linting step, the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
+aforementioned sorting, and the result is compared with the unsorted version. If there is a delta, the linting fails, and you can fix it by running the CLI tool locally, verifying and applying the result to your branch.
+
+> [!note]
+> Please ensure that in component blocks, you use comments only at the beginning of the block or at its
+> end. Ideally, you stick with the many available examples in the yaml files.
+
+Example:
+```yaml
+ synapse:
+ # providerCategory: "Supplier"
+ # providerResponsible: "Element"
+ # upstreamRegistry: "https://registry-1.docker.io"
+ # upstreamRepository: "matrixdotorg/synapse"
+ # upstreamMirrorTagFilterRegEx: '^v(\d+)\.(\d+)\.(\d+)$'
+ # upstreamMirrorStartFrom: ["1", "91", "2"]
+ registry: "registry.opencode.de"
+ repository: "BMI/opendesk/components/supplier/element/images-mirror/synapse"
+ tag: "v1.91.2@sha256:1d19508db417bb2b911c8e086bd3dc3b719ee75c6f6194d58af59b4c32b11322"
+```
+
+### Disable linting selectively
+
+If you follow the "push early, push often" paradigm to save your work to the central Git instance, or you just fix a typo in
+existing documentation, you can avoid the CI and its linting being executed, as it might not offer additional value.
+
+GitLab offers two options to skip the CI on a commit/push:
+1. Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
+**Note:** The string has to be removed before merging your feature branch into `develop`.
+2. Use the related git push option `git push -o ci.skip` ([details](https://docs.gitlab.com/topics/git/commit/#push-options)).
+
+## Renovate
+
+Uses a regular expression to match the values of the following attributes:
+
+- `# upstreamRegistry` *required*: Attribute's value must be prefixed with `https://` for Renovate.
+- `# upstreamRepository` *required*
+- `tag` *required*
+
+Checks for newer versions of the given artifact and creates an MR containing the newest version's tag (and digest).
+
+## Mirroring
+
+- See also: https://gitlab.opencode.de/bmi/opendesk/tooling/oci-pull-mirror
+
+> [!note]
+> The mirror is scheduled to run every hour at 42 minutes past the hour.
+
+openDesk strives to make all relevant artifacts available on openCode so there is a mirroring process
+configured to pull artifacts that do not originate from openCode into projects called `*-Mirror` within the
+[openDesk Components section](https://gitlab.opencode.de/bmi/opendesk/components).
+
+The mirror script takes the information on what artifacts to mirror from the annotation inside the two yaml files:
+- `# upstreamRegistry` *required*: To identify the source registry
+- `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public, the access credentials have to be specified as environment variables and contain the value of this key in their name, so you want to specify the key in uppercase:
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORD`
+- `# upstreamRepository` *required*: To identify the source repository
+- `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set, the mirror for the component will be activated. Only tags that match the given regular expression will be mirrored. **Note:** You must use single quotes for this attribute's value if you use backslash leading regex notation like `\d`.
+- `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing group
+ in `# upstreamMirrorTagFilterRegEx` to identify the single numeric elements of the version within the tag and use per capturing group (left to right) one numeric array
+ element here to define the version the mirror should start with.
+
+### Get new artifacts mirrored
+
+If you want new images or charts mirrored that are not yet included in one of the yaml files, you can add them in your branch, including the aforementioned mirror annotations, and ask somebody from the platform development team to trigger the mirror's CI based on your branch.
+
+Once your branch is merged into develop, your artifacts are mirrored hourly.
+
+# Creating new charts/images
+
+When you create new Helm charts, please check out the
+[openDesk Best Practices](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-best-practises)
+for Helm charts.
+
+You may also want to make use of our [standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) to
+quickly get Helm charts and container images that are signed, linted, scanned, and released.
+Check out the `.gitlab-ci.yaml` files in the project's [Charts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts) or [Images](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images) to get an idea just how little you need to do by yourself.

docs/developer/workflow.md

@@ -0,0 +1,394 @@
+<!--
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Technical development and release workflow</h1>
+
+<!-- TOC -->
+* [Scope](#scope)
+* [Roles and responsibilities](#roles-and-responsibilities)
+* [Deployment automation](#deployment-automation)
+  * [openDesk technical component classes](#opendesk-technical-component-classes)
+  * [Functional vs. service components](#functional-vs-service-components)
+  * [Origins](#origins)
+  * [Reference CI for creating Images and Helm charts (gitlab-config)](#reference-ci-for-creating-images-and-helm-charts-gitlab-config)
+  * [Licensing](#licensing)
+  * [Development workflow](#development-workflow)
+    * [Disclaimer](#disclaimer)
+    * [Workflow](#workflow)
+      * [Branching concept](#branching-concept)
+      * [Standard Quality Gate (SQG)](#standard-quality-gate-sqg)
+      * [Branch workflows](#branch-workflows)
+        * [`main`](#main)
+        * [`develop`](#develop)
+        * [`docs`](#docs)
+        * [`fix`](#fix)
+        * [`feat`](#feat)
+      * [Branch names](#branch-names)
+      * [Commit messages / Conventional Commits](#commit-messages--conventional-commits)
+      * [Verified commits](#verified-commits)
+* [Footnotes](#footnotes)
+<!-- TOC -->
+
+# Scope
+
+This document covers the development of a technical release, thereby addressing:
+- the development and branching concept for the openDesk deployment automation
+- the related quality gates
+- the creation of technical releases
+
+It does not cover additional artifacts that might be related to a functional release.
+
+# Roles and responsibilities
+
+The following section provides a high-level view of the involved parties in the openDesk context and their responsibilities:
+
+- **Open source product suppliers**
+  - Focus areas
+    - Development of upstream products
+    - Development of integrative functionality relevant to openDesk and others
+    - Providing source code and the artifacts required to install openDesk to openCode
+  - Hand over to _openDesk platform development_
+    - Helm charts
+    - Container images
+    - Documentation
+- **openDesk platform development**
+  - Focus areas
+    - Integration of the supplier's artifacts, addressing basic operational needs
+    - Implementation of services required (e.g. persistence layer) to develop and test openDesk
+    - Implementation of the required quality gates (QG)
+    - Ensuring the quality gates are passed
+  - Hand over to _Operator_
+    - Deployment automation
+- **Operator**
+  - Focus areas
+    - Provide production-grade services (e.g. persistence layer) to operate openDesk
+    - Rollout, operate, and support openDesk
+    - Further develop the deployment automation to meet extended operational requirements, ideally providing these developments upstream to the openDesk platform development in order to have them included as standard in the future.
+  - The operator can either use a self-operated Kubernetes cluster to deploy openDesk or make use of a managed Kubernetes offering from a **Cloud Provider**
+
+# Deployment automation
+
+The openDesk deployment automation is the core outcome of the platform development process.
+
+The openDesk platform development team created and maintains the deployment automation, which allows interested parties to deploy openDesk onto their cloud infrastructure with a low barrier to entry. The core technology for the automation is [Helm](https://helm.sh/), which is orchestrated using [Helmfile](https://github.com/helmfile/helmfile). Of course, this deployment is also used by the suppliers and the platform team in everyday work.
+
+Please find the deployment automation, including its documentation, in the following project: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk
+
+The automation supports Gitlab CI/CD, local execution, and triggering the Helmfile deployment for the whole platform or single applications.
+
+## openDesk technical component classes
+
+The below rendering in [class diagram](https://en.wikipedia.org/wiki/Class_diagram) notation shows the three component classes openDesk consists of. In each of these:
+- the first section below the name of the class shows the required **characteristics** of each component of the given class
+- the second section shows the **methods** like linting that must be applied to that class's artifacts
+
+> [!note]
+> The methods prefixed with '-' are not yet available in `gitlab-config`. You will learn about them later.
+
+```mermaid
+classDiagram
+ Images <|-- Helm_charts
+ Images <|-- Helmfile_based_deployment_automation
+ Helm_charts <|-- Helmfile_based_deployment_automation
+ class Images{
+ SBOM
+ SBOM signature
+ Image signature
+ reuseLint()
+ CVE analysis()
+ hadolint()
+ Malware scan()
+ }
+ class Helm_charts{
+ HelmDocs
+ Helm chart signature
+ reuseLint()
+ KubeLinter()
+ YamlLint()
+ -Kubescape()
+ }
+ class Helmfile_based_deployment_automation{
+ reuseLint()
+ YamlLint()
+ -markdownlint()
+ }
+```
+
+## Functional vs. service components
+
+The focus of openDesk is to provide an integrated and functional productivity platform based on the involved suppliers' functional components (products). These functional components usually rely on specific service components, e.g. database services for persistence. When running openDesk in production, the operator is responsible for providing these production-grade services. For evaluation and development purposes, the openDesk deployment automation includes these services.
+
+Find the list of functional and service components in the [archictecture documentation](./docs/architecture.md).
+
+## Origins
+
+The openDesk platform consolidates the technical components from various origins:
+
+1) *Supplier* for functional components: Provide their upstream product, sometimes including openDesk-specific builds or extensions and product deployment (Helm charts).
+2) *Third-party upstream* for service components: The platform development team tries to use as many community upstream components as possible for the services they have to provide within openDesk.
+3) *Platform development* filling the gap: Some suppliers might not provide Helm charts or images for their products that fit the needs of openDesk, and some third-party upstream components are not built to fit into openDesk. In such cases, the platform development team creates its own Helm charts and images.
+
+## Reference CI for creating Images and Helm charts (gitlab-config)
+
+As mentioned in the chapter "Origins" above, the openDesk platform development also creates images and Helm charts when needed.
+
+For that purpose openDesk provides a [GitLab CI-based reference implementation](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/tooling/gitlab-config) called `gitlab-config` to achieve the required characteristics and apply the necessary methods including releasing the artifacts based on [Semantic Release](https://github.com/semantic-release/semantic-release#readme) into the GitLab container registry.
+
+## Licensing
+
+As a standard, the openDesk platform development team uses [reuse.software](https://reuse.software/) wherever possible to annotate license and copyright information.
+
+openDesk uses Apache 2.0 as the license for their work. A typical reuse copyright and license header looks like this:
+```
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+```
+The way to mark the license header as a comment differs between the various file types. Please find matching examples for all types across the [deployment automation repository](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk).
+
+> [!note]
+> If a `SPDX-FileCopyrightText` already exists with the copyright owner described above but with a past year
+> (e.g. 2024), please update this copyright header line to cover (up to and including) the current year,
+> e.g. `2024-2025`.
+
+> [!note]
+> If line(s) with `SPDX-FileCopyrightText` containing a different copyright owner exist in the file you are
+> working on, do not replace existing one(s), but rather add another header above these.
+
+## Development workflow
+
+### Disclaimer
+
+openDesk consists only of community products, so there is no SLA related to service updates or backport of critical security fixes. This has two consequences:
+- In production scenarios, you should replace the community versions of the functional components with supported, SLA-backed paid versions.
+- openDesk aims to update to the community components' latest available releases continually; therefore, we have rolling technical releases.
+
+### Workflow
+
+This chapter describes the deployment automation's development workflow. The suppliers have their own development processes and workflows. While we aim to always update to the most recent community version(s) available, openDesk also sponsors the development done by the suppliers. As the openDesk team has to take a closer look at these sponsored features, they are referred to as *supplier deliverables* within the platform development workflow.
+
+#### Branching concept
+
+The picture below uses Gitflow notation to give an overview of the different types of development flows.
+
+The basic facts for the flow are:
+- When the `develop` branch is merged into `main`, a technical release is created (except when the merge commit(s) are of type `chore` or `docs`).
+- Changes that will be applied to openDesk have to branch off from `develop`; we call these branches *feature* branches.
+  - Developers can create sub-branches from their feature branch(es) as needed.
+- When a *feature* branch gets pushed a Merge Request in `Draft` state is automatically created.
+- We know three types of *feature* branches:
+  - `docs`: Includes only documentation changes.
+  - `fix`: Maintenance of the openDesk software components and minor configurational changes.
+  - `feat`: All changes that do not fall into the two categories above, especially:
+    - supplier deliverables
+    - configuration changes that have a significant impact on openDesk users or require migrations
+- The *QG* entries in the workflow refer to quality gates that are explained in more detail later.
+- All merges into `develop` or `main` require two approvals from the platform development team[^1]. Those approving must ensure that the defined quality gates have been successfully passed.
+
+```mermaid
+gitGraph
+ commit id: "QA 'nightly main'"
+ commit id: " "
+ branch "develop"
+ checkout "develop"
+ commit id: "QA 'nightly develop'"
+ commit id: "  "
+ branch "docs"
+ checkout "docs"
+ commit id: "Documentation commits" type: HIGHLIGHT
+ checkout "develop"
+ merge "docs"
+ checkout "main"
+ merge "develop" tag: "No release"
+ checkout "develop"
+ commit id: "   "
+ branch "fix"
+ checkout "fix"
+ commit id: "Maintenance commits" type: HIGHLIGHT
+ commit id: "QG 'fix'" type: REVERSE
+ checkout "develop"
+ merge "fix"
+ commit id: "QA 'release merge'" type: REVERSE
+ checkout "main"
+ merge "develop" tag: "Patch or minor release"
+ checkout "develop"
+ commit id: "    "
+ branch "feat"
+ checkout "feat"
+ commit id: "Feature commits" type: HIGHLIGHT
+ commit id: "QG 'feat'" type: REVERSE
+ commit id: "Manual Feature QA" type: REVERSE
+ commit id: "Develop Tests"
+ commit id: "Documentation"
+ checkout "develop"
+ merge "feat"
+ commit id: "QA 'release merge' " type: REVERSE
+ checkout "main"
+ merge "develop" tag: "Minor or major release"
+ checkout "develop"
+ checkout "main"
+ commit id: "     "
+ commit id: "Manual Functional Release Activities" type: HIGHLIGHT
+ commit id: "      "
+```
+
+#### Standard Quality Gate (SQG)
+
+The Standard Quality Gate addresses quality assurance steps that should be executed within each of the mentioned quality gates in the workflow.
+
+1. Linting
+   - Blocking
+     - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
+     - openDesk specific: Especially `images.yaml.gotmpl` and `charts.yaml.gotmpl`, find more details in [development.md](./docs/developer/development.md).
+   - Non-Blocking
+     - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
+     - Formal: Yaml
+2. Deploy the full openDesk stack from scratch:
+   - All deployment steps must be successful (green)
+   - All tests from the end-to-end test set must be successful
+3. Update deployment of the full openDesk stack and apply the quality measures from the step #1:
+   - Deploy the current merge target baseline (`develop` or `main`)
+   - Update deploy from your QA branch into the instance from the previous step
+4. No showstopper found regarding:
+   - SBOM compliance[^2]
+   - Malware check
+   - CVE check[^3]
+   - Kubescape scan[^3]
+
+Steps #1 to #3 from above are executed as GitLab CI and documented within GitLab.
+
+Step #4 is focused on security and has not been fully implemented yet. Its main objective is to check for regressions. That step is just the second step of a security check and monitoring chain, as shown below. While some checks can be executed against static artifacts (e.g., container images), others might require an up-and-running instance. These are specifically located in the third step below, which has not yet been implemented.
+
+```mermaid
+flowchart TD
+ A[<u><b>Container image</b></u>
+ checks during build time
+ e.g. based on openDesk
+ reference implementation 'gitlab-config'.
+ >> Can the artifact be integrated? <<
+ ] -->|integrate artifacts| B[<u><b>Deployment automation</b></u> SQG
+ based on GitLab CI, during
+ technical release process.
+ >> Can the platform be released? <<
+ ]
+ B-->|release| C[<u><b>openDesk release</b></u> monitoring
+ on a regular e.g. daily or live basis.
+ >> Do we need to fix something? <<
+ ]
+```
+
+#### Branch workflows
+
+This section will explain the workflow for each branch type based on the Gitflow picture from above.
+
+##### `main`
+
+- `QA 'nightly main'`: Execute the SQG based on the most recent release. The upgrade test environment should be a long-standing environment that only gets built from scratch with the previous technical release when something breaks the environment.
+Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release), which is based on the [Semantic Versioning (SemVer) notation](https://semver.org), to automatically create technical releases on the merge points.
+  - "No release": When a merge from `develop` includes only changes from `docs` branches, the merge into `main` will only consist of `docs` or `chore` commits. That merge will generate no new release.
+  - "Patch or minor release": When changes from `fix` branches get merged, these might contain `fix` or `feat` commits, causing a new technical release to be built with an updated version on the Patch or Minor level.
+  - "Minor or major release": When changes from `feat` branches get merged, these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on the Minor or Major level.
+- "Manual Functional Release Activities": Technical releases are loosely coupled to functional releases. The additional activities for a functional release select an existing technical release as a basis to generate the artifacts required for a functional release, for example:
+  - Conduct additional manual explorative and regression tests.
+  - Perform checks like IT Grundschutz, Accessibility, or Data Protection.
+
+##### `develop`
+
+- `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based on the head revision of the `develop` branch.
+- `QA 'release merge'`: The Merge Request for this merge has to be created manually by members of the platform development team. It should document:
+  - That the SQG was successfully executed upon the to-be merged state - it could be done explicitly or based on a `QA 'nightly develop'`
+  - In case of `fix` changes that usually have no test automation, Changes have been verified by a member of the platform development team.
+  - That the changes have been reviewed by at least two members of the platform development team, giving their approval on the Merge Request.
+- Merge points (from `docs`, `fix`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the aforementioned branch types.
+
+##### `docs`
+
+Branches of type `docs` only contain the commits themselves and have to adhere to the workflow basic fact that: All merges into `develop` or `main` require two approvals from the platform development team.
+
+##### `fix`
+
+Besides the actual changes being committed in an `fix` branch, there is only the:
+- `QG 'fix'`: Besides validating the actual change, the branch's owner has to ensure the successful execution of the SQG.
+
+##### `feat`
+
+This branch type requires the most activities on top of the actual development:
+- `QG 'feat'`: The branch owner has to validate the implemented functionality and ensure the SQG is passed successfully.
+- `Manual Feature QA`:
+  - This is the interface between the platform development workflow and the supplier work package workflow.
+  - The openDesk QA team validates the change, ideally based on the acceptance criteria defined in the supplier's work package definition.
+    - QA passes on the feedback to the developer/supplier if improvements are needed.
+    - Test cases for the feature's test automation are defined if the QA was successful.
+    - QA should also evaluate if there is a need for end-user documentation of the feature.
+- `Develop Test`: The test cases are implemented by the openDesk platform development and added to the openDesk end-to-end test suite.
+- `Documentation`: When required, the documentation team has to update the end-user documentation.
+
+#### Branch names
+
+Branches created from the `develop` branch have to adhere to the following notation: `<responsible_developer>/<type>_<details>`:
+
+- `<responsible_developer>`: Something that makes you identifiable as the owner of the branch, e.g. the first letter of your first name followed by your family name.
+- `<type>`: From the list of branch types explained above:
+  - `docs`
+  - `fix`
+  - `feat`
+- `<details>`: A very short note about what is going to happen in the branch and ideally what component is affected from the following list of components:
+  - `helmfile`
+  - `ci`
+  - `docs`
+  - `collabora`
+  - `cryptpad`
+  - `element`
+  - `jitsi`
+  - `nextcloud`
+  - `nubus`
+  - `open-xchange`
+  - `openproject`
+  - `services`
+  - `xwiki`
+
+Example: `tmueller/fix_jitsi_theming`.
+
+> [!note]
+> The above naming convention has yet to be enforced, but please ensure you use it.
+
+#### Commit messages / Conventional Commits
+
+Commit messages must adhere to the [Conventional Commit standard](https://www.conventionalcommits.org/en/v1.0.0/#summary). Commits that do not adhere to the standard get rejected by either [Gitlab push rules](https://docs.gitlab.com/ee/user/project/repository/push_rules.html) or the CI.
+
+> [!note]
+> The first letter after the `: ` must be uppercase.
+
+```text
+<type>(<scope>): <Short summary> [path/to/issue#1]
+ │       │              │                │
+ │       │              |                └─> Issue reference (optional)
+ │       │              |
+ │       │              └─> Summary in present tense, sentence case, with no period at the end
+ │       │
+ │       └─> Commit Scope: helmfile, docs, collabora, nextcloud, open-xchange, etc.
+ │
+ └─> Commit Type: chore, ci, docs, feat, fix
+```
+
+Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`
+
+> [!note]
+> The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/releases) as the release notes are generated from these messages.
+
+#### Verified commits
+
+We only allow verified commits; please read on about the options you have to make your commits verified:
+- https://docs.gitlab.com/user/project/repository/signed_commits/ssh/
+- https://docs.gitlab.com/user/project/repository/signed_commits/gpg/
+- https://docs.gitlab.com/user/project/repository/signed_commits/x509/
+
+# Footnotes
+
+[^1]: These approval rules are not available in the GitLab Free Tier, which is one of the main reasons why deployment automation is not developed on openCode.
+
+[^2]: The SBOM process is executed asynchronously with the development process and tests the most current technical release from the `main` branch. The process still needs to be fully automated.
+
+[^3]: The quality gate needs to be implemented primarily when identifying regressions.

docs/enhanced-configuration.md

@@ -0,0 +1,17 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Enhanced configuration use cases for openDesk</h1>
+
+# Overview
+
+The following enhanced configuration use cases are described in their respective documents:
+
+- [Separate mail & Matrix domain](./enhanced-configuration/separate-mail-matrix-domain.md)
+- [Federation with external identity provider](./enhanced-configuration/idp-federation.md)
+- [Matrix federation](./enhanced-configuration/matrix-federation.md)
+- [Groupware migration from M365 to openDesk](./enhanced-configuration/groupware-migration.md)
+- [Self-signed certificate and custom Certificate Authority (CA)](./enhanced-configuration/self-signed-certificates.md)
+- [GitOps deployments using Argo CD](./enhanced-configuration/gitops.md)

docs/enhanced-configuration/gitops.md

@@ -0,0 +1,66 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>GitOps Deployment</h1>
+
+<!-- TOC -->
+* [Considerations](#considerations)
+* [ArgoCD](#argocd)
+  * [Option 1: Use YAML manifests](#option-1-use-yaml-manifests)
+  * [Option 2: Helmfile plugin](#option-2-helmfile-plugin)
+<!-- TOC -->
+
+The recommended deployment method for openDesk is via Helmfile. This can be done "by hand", via CI/CD (Gitlab) or using
+the [GitOps](https://about.gitlab.com/topics/gitops/) approach with tools like [Argo CD](https://argoproj.github.io/cd/).
+
+This documentation will use Argo CD to explain how to deploy openDesk GitOps-style.
+
+# Considerations
+
+- openDesk consists of multiple applications which have to be deployed in order.
+- During upgrades, migrations have to run before and after applications.
+
+# ArgoCD
+
+We are continuously improving our Argo CD support, please share you experience with Argo CD deployments e.g. by [creating
+a ticket](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues).
+
+There are two options to deploy openDesk via Argo CD described in the following sections.
+
+## Option 1: Use YAML manifests
+
+> [!warning]
+> Pre-rendering the YAML files will also embed all referenced secrets into the resulting outputs.
+> You must ensure that these files are accessible solely to individuals who are expressly authorized
+> to view the corresponding secrets, as well as the infrastructure and data protected by them.
+
+This option requires a preprocessing step before using Argo CD. This step requires you to compile the Helmfile based
+deployment into Kubernetes YAML manifest, to do so you need to execute the helmfile binary:
+
+```shell
+helmfile template > opendesk.yaml
+```
+
+References:
+- [Helmfile CLI documentation](https://helmfile.readthedocs.io/en/latest/#cli-reference)
+- [Generate K8s YAML Manifests for openDesk](https://gitlab.opencode.de/bmi/opendesk/deployment/options/generate-k8s-yaml-manifests)
+
+Afterwards, you can use the resulting manifests within a standard Argo CD workflow.
+
+> [!note]
+> When creating the Argo CD application based on the resulting manifests, you must not use the `Automated Sync
+> Policy` offered by Argo CD, as you have to manually ensure the applications are updated in the required
+> sequence.
+
+## Option 2: Helmfile plugin
+
+It is possible to deploy openDesk via Argo CD with the community developed
+[Helmfile plugin](https://github.com/travisghansen/argo-cd-helmfile).
+
+You can find an example for this approach in the
+[Argo CD Deployments](https://gitlab.opencode.de/bmi/opendesk/deployment/options/argocd-deploy) repository.
+It contains an example Helm chart (`opendesk-parent`) to create Argo CD Applications via a Helm chart (`opendesk`)
+according to `app of apps pattern`. It uses sync waves to ensure the deployment matches requirements and the update sequence
+for openDesk is satisfied.

docs/enhanced-configuration/groupware-migration.md

@@ -0,0 +1,229 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Migration from M365 with audriga migration service and master authentication</h1>
+
+<!-- TOC -->
+* [Prerequisites](#prerequisites)
+  * [Prepare M365 tenant for access](#prepare-m365-tenant-for-access)
+  * [Provisioning user accounts in openDesk](#provisioning-user-accounts-in-opendesk)
+  * [Deploy openDesk with master authentication](#deploy-opendesk-with-master-authentication)
+* [Migration configuration](#migration-configuration)
+  * [Select the source provider and configure your openDesk instance](#select-the-source-provider-and-configure-your-opendesk-instance)
+  * [Adding accounts](#adding-accounts)
+    * [Add user accounts individually](#add-user-accounts-individually)
+    * [Add multiple user accounts via CSV file](#add-multiple-user-accounts-via-csv-file)
+  * [Start the migration](#start-the-migration)
+  * [Monitor migration status](#monitor-migration-status)
+* [Appendix](#appendix)
+  * [Validating master authentication](#validating-master-authentication)
+<!-- TOC -->
+
+Most organizations already have email accounts on various platforms that need to be migrated to openDesk. This document describes the migration from M365 accounts to openDesk using the [audriga Migration Service](https://www.audriga.com) in combination with the master authentication option in openDesk. Other source platforms are also supported, and their migrations work in a similar manner.
+
+The migration can be configured on audriga's self-service website, accessed with most common web browsers (e.g. IE, Firefox, Safari or Chrome). No software needs to be installed on your machine. The service connects to your mailbox similarly to what your email client does. Emails, attachments, folders, and, depending on the source systems, contacts, tasks, notes, and calendar data are copied to your destination account. See [M365 to OX Migration Guide](https://audriga.com/fileadmin/guides/en/MS365-OX.pdf) for the scope and limitations of the process.
+
+The data in the source mailbox will not be deleted or altered. To configure a migration, only three simple steps in audriga's self-service portal have to be completed. After the migration has started, its status can be continuously monitored on the website.
+
+It may not be possible to complete especially large or complex migrations with only this guide. If you identify issues related to I/O, bandwidth, time constraints, or anything else that makes the migration more complicated than you are comfortable handling on your own using the self-service, please contact [audriga's support](mailto:support@audriga.com).
+
+# Prerequisites
+
+## Prepare M365 tenant for access
+
+The following instructions provide information on how to authenticate Microsoft 365 / Exchange Online accounts in the audriga migration service with "modern authentication" using a service account without the need to provide a username and password for each mailbox that will be migrated.
+
+You will have to select an existing user account that will be used as a service account for the migration. You have to register the audriga application and create an M365 email group known only to you, as described in the following steps:
+
+***1. Select one account to serve as a service account***
+
+Please note that the account that shall serve as the service account requires a Microsoft 365/Exchange online license (mailbox).
+
+> [!note]
+> If you want to designate your admin account as a service account, you have to provide the admin with a
+> license.
+
+***2. Register the audriga app in your tenant***
+
+To register the audriga app in your tenant, log into your admin account and access the following URL:
+
+ https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=3cd27a72-a19e-4945-9715-fc24d940428f&redirect_uri=https://umzug.audriga.com/SMESwitchWebApp/oauth_complete.jsp&scope=https://outlook.office.com/.default
+
+- Accept the App "audriga CloudMovr migration"
+- You will be redirected to an audriga page, which you can close - it does not require additional interaction.
+
+> [!note]
+> The audriga application is created under the "Enterprise application" tab in the AzureAD console.
+
+***3. Create a "secret" group in the M365 tenant***
+
+Create a "secret" group in the customer tenant.
+
+- Go to <https://aad.portal.azure.com> > Azure Active Directory > Groups > New Group
+- Choose a group name and group email address that includes the word "audriga" in lowercase ("Audriga" will not work), like *audriga-migration@your-maildomain.tld*
+- Choose the group type "Microsoft 365"
+- Appoint your service account (see 1.) as the owner of this group
+
+
+## Provisioning user accounts in openDesk
+
+In openDesk, you have to have all user accounts with mailboxes pre-defined before running the migration. You can either manually create your accounts using an IAM administrator or use the [user import tool](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) to batch import user accounts to your openDesk deployment.
+
+## Deploy openDesk with master authentication
+
+With openDesk 1.0 Enterprise, you can set openDesk's email components (OX AppSuite and OX Dovecot) to master authentication mode to run the migration as described in this document using the following two settings for your deployment. This is NOT available in openDesk Community deployments:
+
+```
+secrets:
+  oxAppSuite:
+    migrationsMasterPassword: "your_temporary_master_password"
+functional:
+  migration:
+    oxAppSuite:
+      enabled: true
+```
+
+1. You must specify a master password, it will be referenced later in this document.
+2. You need to enable the actual master authentication mode.
+
+To validate the master authentication mode please read the appendix section at the end of the document.
+
+Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppSuite.migrationsMasterPassword` and need to turn off the migration mode by setting `functional.migration.oxAppSuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
+
+> [!note]
+> For the changes to take effect, it is sufficient to re-deploy the `open-xchange` component alone. But you
+> have to restart the Dovecot Pod(s) manually when switching to/from the master authentication mode for the
+> changes to take effect.
+
+> [!note]
+> While in master authentication mode, regular users cannot log in to the webmail module of openDesk or access
+> the mail using IMAP, as it is not recommended that users interact with the target mail infrastructure during
+> the migration scenario described in this document.
+
+# Migration configuration
+
+The migration is configured in 3 steps using the [audriga migration self-service](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware).
+
+Ensure you meet the prerequisites. For example, this document does not support using the standard username/password-based authentication option for M365.
+
+## Select the source provider and configure your openDesk instance
+
+Choose [Microsoft 365 / Exchange Online (Admin)](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware#src=onmicrosoft.com) as your current provider.
+
+> [!note]
+> You may need to start typing in "Microsoft Office 365/Exchange Online" for it to appear in the list.
+
+Configure openDesk as your destination server:
+- Select "Configure provider or server" in the provider selection box of the migration application.
+- In the following dialog, select "Open-Xchange" as protocol.
+- On the tab "IMAP"
+  - For "Mailserver (host name or IP address)" enter your IMAP host, e.g. "webmail.your-opendesk-domain.tld".
+  - If your IMAP server is not running on default port 993, enter your nonstandard IMAP port under Details -> Port.
+  - Press check.
+- On the tab "Open-Xchange"
+  - Set the hostname of your OX AppSuite installation, e.g. "webmail.your-opendesk-domain.tld".
+  - Press check.
+- If you receive a green checkmark on both tabs, click "Save". Otherwise, check your settings until you get the green checkmark.
+
+## Adding accounts
+
+You can add accounts one by one, which seems only feasible for test scenarios, or when you migrate a handful of mailboxes, or you can add accounts using CSV upload. Both options are described in the following subsections.
+
+### Add user accounts individually
+
+By default, you will enter the "Add Mailbox" tab where you can add individual accounts for M365:
+
+```
+Username:             enter the username of the service account, e.g. eva@your-maildomain.tld
+Password:             enter the particular group email address, e.g. audriga-migration@your-maildomain.tld
+Details -> mailbox:   enter the user's mailbox you want to migrate, e.g. pia@your-maildomain.tld
+```
+
+On the openDesk site, please provide:
+```
+Username:             enter the username of the mailbox you want to migrate to, e.g. pia@your-maildomain.tld
+Password:             enter the master password
+```
+
+Click on check to verify the credentials. If the data is correct, a green checkmark will appear. A red cross will be displayed if the credentials need to be corrected.
+
+After checking and confirming, you can use the same procedure to add further mailboxes.
+
+Alternatively, you can add multiple accounts via CSV upload. More info on that below.
+
+### Add multiple user accounts via CSV file
+
+Prepare a CSV file with all necessary information. Unsurprisingly, this is the same information as described in the "Add User Accounts Individually" section above.
+
+The CSV requires the following column order with a closing semicolon after the last value - but no headline is expected; the first line must be your migration data already:
+```
+M365ServiceAccount;M365GroupEmailAddress;M365Mailbox;openDeskMailbox;openDeskMasterPassword;
+```
+
+Example CSV:
+```
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;eva@your-maildomain.tld;eva;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;max@your-maildomain.tld;max;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;pia@your-maildomain.tld;pia;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;ida@your-maildomain.tld;ida;YourMasterPassword;
+```
+
+Select the "Add multiple accounts" tab to configure up to 50 user accounts by uploading a CSV file. If you need to migrate more accounts, you can execute the migration multiple times.
+
+Click "Check" and save afterwards.
+
+## Start the migration
+
+You will see a summary of the migration, including the number of accounts and the amount of data. Even if the analysis of the source accounts has not yet been completed, you can proceed.
+
+Ensure you have a valid voucher; otherwise, you must complete the payment process.
+
+Press "Start Migration" to proceed.
+
+## Monitor migration status
+
+The migration process may take some time to start. For large amounts of data, it may take a couple of hours.
+
+Click on "Details" to get further information about the migration.
+
+You can access a detailed log for each account by clicking "Protocol" on the right-hand side. Here, you can see detected duplicates or encountered errors (e.g., if emails cannot be transferred due to your provider's size limitations).
+
+You will receive status emails for the migration job's submission and start, as well as when the migration job is finished. The emails are sent to the email address you have entered during the configuration. Those emails include a link to the status website so you can easily track and monitor your migration. Once the migration has been started, you can safely close the status website and shut down your computer; the migration will continue. You can re-open the status website anytime.
+
+# Appendix
+
+## Validating master authentication
+
+Below are details in case you want to verify master authentication for Dovecot and OX AppSuite.
+
+Set a few variables first:
+
+```shell
+export MIG_DOMAIN=your-opendesk-domain.tld
+export MIG_WEBMAIL_HOST=webmail
+export MIG_USERNAME=eva
+export MIG_MASTER_PASSWORD=YourMasterPassword
+export MIG_IMAP_PORT=31123
+```
+
+Ensure that you have defined a (your) default context for the migration where the account (in this example `eva`) can be found. The following should be executed in OX App Suite's `open-xchange-core-mw-default-0` container, in the example we set the default context to `1`:
+
+```shell
+/opt/open-xchange/sbin/changecontext -c 1 -L defaultcontext -A $MASTER_ADMIN_USER -P $MASTER_ADMIN_PW
+```
+
+With the preparation from above you should be able to successfully authenticate to both components:
+
+**OX App Suite**
+
+```shell
+curl -X POST -d "name=${MIG_USERNAME}&password=${MIG_MASTER_PASSWORD}" "https://${MIG_WEBMAIL_HOST}.${MIG_DOMAIN}/appsuite/api/login?action=login"
+```
+
+**Dovecot**
+
+```shell
+echo "a001 LOGIN ${MIG_USERNAME} ${MIG_MASTER_PASSWORD}" | openssl s_client -ign_eof -connect ${MIG_DOMAIN}:${MIG_IMAP_PORT}
+```

docs/enhanced-configuration/idp-federation.md

@@ -0,0 +1,186 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Federation with external identity provider (IdP)</h1>
+
+<!-- TOC -->
+* [References](#references)
+* [Prerequisites](#prerequisites)
+  * [User accounts](#user-accounts)
+  * [External IdP with OIDC](#external-idp-with-oidc)
+* [Example configuration](#example-configuration)
+  * [Versions](#versions)
+  * [Example values](#example-values)
+  * [Keycloak admin console access](#keycloak-admin-console-access)
+  * [Your organizations IdP](#your-organizations-idp)
+    * [Separate realm](#separate-realm)
+    * [OIDC Client](#oidc-client)
+  * [openDesk IdP](#opendesk-idp)
+<!-- TOC -->
+
+Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on (SSO) to internal or external web applications.
+
+This document helps in setting up your organization's IdP and openDesk to enable IdP federation.
+
+# References
+
+We would like to list successful IdP federation scenarios:
+
+| External IdP                                                        | openDesk versions tested |
+|---------------------------------------------------------------------|--------------------------|
+| [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0, v1.2.0           |
+| [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                   |
+
+> If you have successfully federated using another External IdP, please let us know so we can update the list above.
+
+# Prerequisites
+
+## User accounts
+
+In addition to the configuration, it is required that user accounts with the same name exist within openDesk. While this prerequisite is outside the scope of this document, the following approaches are feasible:
+
+- Manual user management
+  - A lightweight option to test your IdP federation setup or if you have only a small number of users to manage.
+  - Create and maintain your user(s) in openDesk and ensure the username in your IAM and openDesk is identical.
+- User import
+  - If you need to create more than just a couple of test accounts, you can use the [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) that utilizes the UDM REST API for user account creation.
+  - Downsides: Managing groups and deleting accounts needs to be done manually.
+- Automated Pre-provisioning:
+  - Pre-provisioning users and groups, including de-provisioning (deleting) accounts, is the best practice to ensure that openDesk is in sync with your organization's IAM.
+  - There are at least two ways of implementing the pre-provisioning:
+  - UDM REST API:
+    - Build a provisioning solution using the [UDM REST API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html).
+    - The API gives you complete control over the contents of the IAM to create, update, or delete users and groups.
+  - Nubus Directory Importer:
+    - It is based on a Python one-way directory synchronization for users and groups.
+    - Please find more details in the [upstream product's documentation](https://docs.software-univention.de/nubus-kubernetes-operation/latest/en/howto-connect-external-iam.html).
+- Ad-hoc provisioning (AHP)
+  - This feature is currently unavailable in openDesk's Keycloak, but Univention plans to make it available in the future.
+  - Ad-hoc provisioning creates a user account on the fly during a user's first login.
+  - While ad-hoc provisioning is an excellent approach for a quick start with openDesk, it has various downsides:
+    - Users are created after their first login, so you cannot find your colleagues in the openDesk apps unless they have already logged in once.
+    - A user account would never be deactivated or deleted in openDesk.
+    - Group memberships are not transferred.
+
+## External IdP with OIDC
+
+This document focuses on the OIDC federation between an external IdP and the openDesk IdP. It uses the OpenID Connect (OIDC) protocol, so your external IdP must support OIDC.
+
+# Example configuration
+
+The following section explains how to configure the IdP federation manually in an example upstream IdP and in openDesk.
+
+With openDesk 1.4.0 IdP federation has to be enabled as part of the deployment using the `functional.authentication.ssoFederation` section, see [`functional.yaml.gotmpl`](../../helmfile/environments/default/functional.yaml.gotmpl) for reference.
+
+You can use the description below to configure and test the federation that can be exported and used as part of the deployment afterwards, e.g. with the following commands from within the Keycloak Pod:
+
+```shell
+# Set the variables according to your deployment first, below are just example values.
+export FEDERATION_IDP_ALIAS=sso-federation-idp
+export NAMESPACE=example_namespace
+export CLUSTER_NETWORKING_DOMAIN=svc.cluster.local
+# Authenticate with Keycloak
+/opt/keycloak/bin/kcadm.sh config credentials --server http://ums-keycloak.${NAMESPACE}.${CLUSTER_NETWORKING_DOMAIN}:8080 --realm master --user ${KEYCLOAK_ADMIN} --password ${KEYCLOAK_ADMIN_PASSWORD}
+# Request details of IdP configuration
+/opt/keycloak/bin/kcadm.sh get identity-provider/instances/${FEDERATION_IDP_ALIAS} -r opendesk
+```
+
+## Versions
+
+The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3. As external IdP, we also used an openDesk deployment of the same version, but created a separate realm for proper configuration separation.
+
+## Example values
+
+The following values are used in this example documentation. Please ensure when you come across such a value, even if it is part of a URL hostname or path, that you adapt it where needed to your setup:
+
+- `idp.organization.tld`: hostname for your organization's IdP.
+- `id.opendesk.tld`: hostname for the openDesk IdP, so openDesk is deployed at `opendesk.tld`.
+- `fed-test-idp-realm`: realm name for your organization's IdP.
+- `opendesk-federation-client`: OIDC client for the openDesk federation defined in your organization's IdP.
+- `sso-federation-idp`: Identifier of your organization IdP's configuration within the openDesk Keycloak.
+- `sso-federation-flow`: Identifier of the required additional login flow to be created and referenced in the openDesk Keycloak.
+
+## Keycloak admin console access
+
+To access the Keycloak admin console in an openDesk deployment, you must add a route for `/admin` to the Keycloak ingress. This is done automatically if you deploy openDesk with `debug.enabled: true`, but beware that this will also cause a lot of log output across all openDesk pods.
+
+The admin console will be available at:
+- Organization's IdP: https://idp.organization.tld/admin/master/console/
+- openDesk IdP: https://id.opendesk.tld/admin/master/console/
+
+For the following configuration steps, log in with user `kcadmin` and grab the password from the `ums-keycloak` pod's `KEYCLOAK_ADMIN_PASSWORD` variable.
+
+## Your organizations IdP
+
+In this example, we use the Keycloak of another openDesk instance to simulate your organization's IdP. However, URL paths differ if you use another product.
+
+Please let us know about your experiences or any differences you encountered.
+
+### Separate realm
+
+To not interfere with an existing configuration for our test scenario, we create a separate realm:
+
+- `Create realm` (from the realm selection drop-down menu in the left upper corner)
+- *Realm name*: `fed-test-idp-realm`
+- `Create`
+
+### OIDC Client
+
+If you just created the `fed-test-idp-realm`, you are already in the admin screen for the realm; if not, use the realm selection drop-down menu in the upper left corner to switch to the realm.
+
+- *Clients* > *Create Client*
+  - Client create wizard page 1:
+    - *Client type*: `OpenID Connect`
+    - *Client-ID*: `opendesk-federation-client`
+    - *Name*: `openDesk @ your organization` (this is the descriptive text of the client that might show up in your IdP's UI and therefore should explain what the client is used for)
+  - Client create wizard page 2:
+    - *Client authentication*: `On`
+    - *Authorization*: `Off` (default)
+    - *Authentication flow*: leave defaults
+      - `Standard flow`
+      - `Direct access grants`
+  - Client create wizard page 3:
+    - *Valid Redirect URLs*: `https://id.opendesk.tld/realms/opendesk/broker/sso-federation-idp/endpoint`
+  - When completed with *Save*, you get to the detailed client configuration that also needs some updates:
+    - Tab *Settings* > Section *Logout settings*
+      - *Front channel logout*: `Off`
+      - *Back channel logout URL*: `https://id.opendesk.tld/realms/opendesk/protocol/openid-connect/logout/backchannel-logout`
+    - Tab *Credentials*
+      - Copy the *Client Secret* and the *Client-ID* as we need them to configure the openDesk IdP.
+
+## openDesk IdP
+
+> [!note]
+> While manual configuration is possible, an SSO federation can also be configured as part of the deployment.
+> Check `functional.authentication.ssoFederation` section from the `functional.yaml.gotmpl` for details.
+
+The following configuration is taking place in the Keycloak realm `opendesk`.
+
+- *Authentication* > *Create flow*
+  - *Name*: `sso-federation-flow`
+  - *Flow type*: `Basic flow`
+  - *Create*
+  - *Add execution*: Add `Detect existing broker user` and set it to `Required`
+  - *Add step*: `Automatically set existing user` and set it to `Required`
+
+- *Identity providers* > *User-defined* > *OpenID Connect 1.0*
+  - *Alias*: `sso-federation-idp` (used in our example)
+  - *Display Name*: A descriptive Name, in case you do not forcefully redirect the user to the IdP, that name is shown on the login screen for manual selection.
+  - *Use discovery endpoint*: `On` (default)
+  - *Discovery endpoint*: `https://idp.organization.tld/realms/fed-test-idp-realm/.well-known/openid-configuration` - this URL may look different if you do not use Keycloak or a different Keycloak version as IdP in your organization
+    - You will get an error if the IdP metadata cannot be auto-discovered.
+    - If everything is fine, you can review the discovered metadata for your IdP by clicking on *Show metadata*.
+  - *Client authentication*: `Client secret sent as post` (default)
+  - *Client ID*: Use the client ID you took from your organization's IdP config (`opendesk-federation-client` in this example)
+  - *Client Secret*: Use the secret you took from your organization's IdP config
+  - When completed with *Add*, you get to the detailed IdP configuration which at least needs the following update:
+    - *First login flow override*: `sso-federation-flow`
+    - Depending on your organizations IdP and process preferences, additional configuration may be required
+
+- In case you want to forcefully redirect all users to your organization's IdP (disabling login with local openDesk accounts):
+  - *Authentication* > `2fa-browser`
+    - Click on the cogwheel next to the *Identity Provider Re-director*
+      - *Alias*: `sso-federation-idp`
+      - *Default Identity Provider*: `sso-federation-idp`

docs/enhanced-configuration/matrix-federation.md

@@ -0,0 +1,59 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Matrix federation</h1>
+
+<!-- TOC -->
+* [Example configuration](#example-configuration)
+  * [Disable federation](#disable-federation)
+  * [Separate Matrix domain](#separate-matrix-domain)
+<!-- TOC -->
+
+The Element chat application and its server component Synapse are based on the Matrix protocol,
+which supports federation with other Matrix servers, allowing communication with the users with accounts on these servers.
+
+By default, you can chat with users who have an account within your openDesk installation and federate with other
+matrix-based servers.
+Federation support can be turned off.
+
+# Example configuration
+
+The following values are used in this example documentation.
+Please ensure when you come across such a value,
+even if it is part of a URL hostname or path, that you adapt it where needed to your setup:
+
+- `opendesk.domain.tld`: the mandatory `DOMAIN` setting for your deployment resulting in
+`https://chat.opendesk.domain.tld` for access to the Element chat.
+- `my_organization.tld`: an optional alternative domain used for mail and/or Matrix.
+It is also set to `opendesk.domain.tld` if not used.
+
+## Disable federation
+
+The following setting can turn off federation:
+
+```yaml
+functional:
+  externalServices:
+    matrix:
+      federation:
+        enabled: false
+```
+
+## Separate Matrix domain
+
+If you want to federate with other Matrix instances and use a separate Matrix domain, you need to provide a JSON file for
+the Matrix domain to use delegation. It is not part of your openDesk deployment.
+
+Domain path: `https://my_organization.tld/.well-known/matrix/server`
+
+Content:
+```JSON
+{
+    "m.server": "matrix-federation.opendesk.domain.tld:443"
+}
+```
+
+More detailed information can be found in the Matrix/Synapse documentation:
+[Matrix Delegation](https://element-hq.github.io/synapse/latest/delegate.html)

docs/enhanced-configuration/self-signed-certificates.md

@@ -0,0 +1,117 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Self-signed certificates and custom Certificate Authority (CA)</h1>
+
+<!-- TOC -->
+* [Configuration](#configuration)
+  * [Option 1: Bring Your Own Certificate](#option-1-bring-your-own-certificate)
+  * [Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate](#option-2a-use-cert-managerio-with-auto-generated-namespace-based-root-certificate)
+  * [Option 2b: Use cert-manager.io with a pre-defined or shared root-certificate](#option-2b-use-cert-managerio-with-a-pre-defined-or-shared-root-certificate)
+<!-- TOC -->
+
+This document covers:
+* Deploying openDesk into an environment with custom public key infrastructure (PKI) that is usually not part of
+public certificate authority chains
+* deploying openDesk into a local cluster without ACME challenge
+
+# Configuration
+
+There are two options to address these use case:
+
+## Option 1: Bring Your Own Certificate
+
+This option is useful when you have your own PKI in your environment which is also trusted by all clients that should
+access openDesk.
+
+1. Disable cert-manager.io certificate resource creation:
+
+    ```yaml
+    certificates:
+      enabled: false
+    ```
+
+2. Enable mount of self-signed certificates:
+
+    ```yaml
+    certificate:
+      selfSigned: true
+      caCertificate:
+        create: false
+    ```
+
+3. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
+wildcard certificate or a certificate with [all required subdomains](../../helmfile/environments/default/global.yaml.gotmpl)
+set as SANs (Subject Alternative Name).
+
+4. Create a Kubernetes secret with name `opendesk-certificates-ca-tls` of type `kubernetes.io/tls` containing the custom
+CA certificate as X.509 encoded (`ca.crt`) and as jks trust store (`truststore.jks`).
+
+5. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
+trust store password.
+
+> [!note]
+> XWiki does not support the use of an existing secret to access the keystore. Therefore you have to set the
+> password from step 5 also as `secrets.certificates.password`.
+
+## Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate
+
+This option is useful when you do not have a trusted certificate available and can't fetch a certificate from
+Let’s Encrypt. It will result in a cert-manager managed root certificate in the namespace you deploy openDesk into.
+
+1. Create self-signed cert-manager.io Cluster Issuer:
+    ```yaml
+    apiVersion: "cert-manager.io/v1"
+    kind: "ClusterIssuer"
+    metadata:
+      name: "selfsigned-issuer"
+    spec:
+      selfSigned: {}
+    ```
+
+2. Enable mount and creation of self-signed certificates:
+    ```yaml
+    certificate:
+      issuerRef:
+        name: "selfsigned-issuer"
+      selfSigned: true
+    ```
+
+## Option 2b: Use cert-manager.io with a pre-defined or shared root-certificate
+
+Use this approach if you like to use a pre-created CA root certificate that can be "shared" (as copy) between
+multiple namespaces in a cluster.
+
+1. Create self-signed cert-manager.io Cluster Issuer root certificate the same way as in *Option 2a*.
+
+2. Create the root certificate for the previously created CA, in the example it is placed into the namespace `cert-manager`.
+    ```yaml
+    apiVersion: cert-manager.io/v1
+    kind: Certificate
+    metadata:
+      name: opendesk-root
+      namespace: cert-manager
+    spec:
+      isCA: true
+      commonName: opendesk.eu
+      secretName: opendesk-root-cert-secret
+      subject:
+        organizations: [ "openDesk cluster root certificate organization" ]
+      privateKey:
+        algorithm: ECDSA
+        size: 256
+      issuerRef:
+        name: selfsigned-issuer
+        kind: ClusterIssuer
+        group: cert-manager.io
+      duration: 87600h # 10y
+      renewBefore: 87599h
+    ```
+
+3. Copy this certificates secret into all namespaces you want to make use of the certificate in.
+
+4. Create an issuer resource in all namespaces you want to make use of the certificate in.
+
+>The latter two steps are part of the `env-start:` section within [`.gitlab-ci.yml`](../../.gitlab-ci.yml).

docs/enhanced-configuration/separate-mail-matrix-domain.md

@@ -0,0 +1,98 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Separate domains for mail and or Matrix </h1>
+
+<!-- TOC -->
+* [Example configuration](#example-configuration)
+  * [Mail domain](#mail-domain)
+  * [Matrix domain](#matrix-domain)
+    * [DNS](#dns)
+    * [Webserver](#webserver)
+      * [Content Security Policy](#content-security-policy)
+      * [.well-known](#well-known)
+<!-- TOC -->
+
+As communication over mail and chat can go beyond the borders of your openDesk installation, you may want to use different domains for the mail and/or Matrix.
+
+# Example configuration
+
+The following values are used in this example documentation. Please ensure when you come across such a value, even if it is part of a URL hostname or path, that you adapt it where needed to your setup:
+
+- `opendesk.domain.tld`: the mandatory `DOMAIN` setting for your deployment resulting in `https://mail.opendesk.domain.tld` to access emails and `https://chat.opendesk.domain.tld` to access the Element chat that is based on the Matrix protocol.
+- `my_organization.tld`: the alternative domain used for mail and/or Matrix.
+
+## Mail domain
+
+By default, all email addresses in openDesk are created based on the `DOMAIN` you specified for your deployment. In our example, the users have `<username>@opendesk.domain.tld` as their mail addresses. In case you prefer the users to send and receive emails with another domain, you can set that one using the optional `MAIL_DOMAIN` in the deployment:
+
+```yaml
+global:
+  mailDomain: "my_organization.tld"
+```
+
+or via environment variable
+
+```shell
+export MAIL_DOMAIN=my_organization.tld
+```
+
+Of course, this requires the domain's MX record to point to the mail host for your openDesk deployment. You can optionally add the SPF and DMARC records.
+
+| Record name                | Type | Value                                            |
+| -------------------------- | ---- | ------------------------------------------------ |
+| my_organization.tld        | MX   | `10 mail.opendesk.domain.tld` |
+| my_organization.tld        | TXT  | `v=spf1 +a +mx +a:mail.opendesk.domain.tld ~all` |
+| _dmarc.my_organization.tld | TXT  | `v=DMARC1; p=quarantine` |
+
+## Matrix domain
+
+Similar to the specific domain for email addresses, you may want to specify a domain that differs from your deployment's default `DOMAIN` to define your user's Matrix IDs. Use the `MATRIX_DOMAIN` to do so:
+
+```yaml
+global:
+  matrixDomain: "my_organization.tld"
+```
+
+or via environment variable
+
+```shell
+export MATRIX_DOMAIN=my_organization.tld
+```
+
+### DNS
+
+The following changes apply to the standard DNS:
+
+| Record name                      | Type | Value                                  | Comment                                                                                |
+| -------------------------------- | ---- | -------------------------------------- | -------------------------------------------------------------------------------------- |
+| _matrix._tcp.my_organization.tld | SRV  | `1 10 PORT matrix.opendesk.domain.tld` | `PORT` is your NodePort/LoadBalancer port of the `opendesk-synapse-federation` service |
+
+*Note:* `matrix.opendesk.domain.tld` in the "Value" column can also be the IP address synapse TLS port listens to.
+
+### Webserver
+
+#### Content Security Policy
+
+The `my_organization.tld` webserver should add `*.opendesk.domain.tld` to its CSP header.
+
+#### .well-known
+
+If you want to use other Matrix clients,
+e.g., Element Messenger for [iOS](https://apps.apple.com/de/app/element-messenger/id1083446067)
+or [Android](https://play.google.com/store/apps/details?id=im.vector.app),
+you need to create a JSON file with the following contents that is served from
+`https://my_organization.tld/.well-known/matrix/client`:
+
+```json
+{
+  "m.homeserver": {
+    "base_url": "https://matrix.opendesk.domain.tld"
+  }
+}
+```
+
+The above configuration ensures clients know where to find the Matrix protocol endpoint when users specify `my_organization.tld`
+as their homeserver.

docs/external-services.md

@@ -5,77 +5,123 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>External services</h1>
 
-This document will cover the additional configuration to use external services like databases, caches or buckets.
+This document will cover the additional configuration for external services like databases, caches, or buckets.
 
 <!-- TOC -->
 * [Database](#database)
-* [Objectstore](#objectstore)
+* [Object storage](#object-storage)
 * [Cache](#cache)
+* [Footnotes](#footnotes)
 <!-- TOC -->
 
 # Database
 
-When deploying this suite to production, you need to configure the applications to use your production grade database
+When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.
 
-| Component   | Name               | Type       | Parameter | Key                                      | Default                    |
-|-------------|--------------------|------------|-----------|------------------------------------------|----------------------------|
-| Element     | Synapse            | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
-|             |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
-|             |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
-|             |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
-|             |                    |            | Password  | `databases.synapse.password`             |                            |
-| Keycloak    | Keycloak           | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
-|             |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
-|             |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
-|             |                    |            | Password  | `databases.keycloak.password`            |                            |
-|             | Keycloak Extension | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
-|             |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
-|             |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
-|             |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
-| UMS         | Notifications API  | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
-|             |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
-|             |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
-|             |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
-|             |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
-|             | Self Service       | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
-|             |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
-|             |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
-|             |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
-|             |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
-| Nextcloud   | Nextcloud          | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
-|             |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
-|             |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
-|             |                    |            | Password  | `databases.nextcloud.password`           |                            |
-| OpenProject | OpenProject        | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
-|             |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
-|             |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
-|             |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
-|             |                    |            | Password  | `databases.openproject.password`         |                            |
-| OX Appsuite | OX Appsuite        | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.oxAppsuite.name`              | `CONFIGDB`                 |
-|             |                    |            | Host      | `databases.oxAppsuite.host`              | `mariadb`                  |
-|             |                    |            | Username  | `databases.oxAppsuite.username`          | `root`                     |
-|             |                    |            | Password  | `databases.oxAppsuite.password`          |                            |
-| XWiki       | XWiki              | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
-|             |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
-|             |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
-|             |                    |            | Password  | `databases.xwiki.password`               |                            |
+> [!note]
+> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely
+> to become the preferred option/default in the future should MariaDB become deprecated. This would cause
+> migration[^1] to be necessary if you do not select PostgreSQL for new installations.
 
-# Objectstore
+| Component          | Name               | Parameter | Key                                           | Default                      |
+| ------------------ | ------------------ | --------- | --------------------------------------------- | ---------------------------- |
+| Element            | Synapse            |           |                                               |                              |
+|                    |                    | Type      | `databases.synapse.type`                      | `postgresql`                 |
+|                    |                    | Name      | `databases.synapse.name`                      | `matrix`                     |
+|                    |                    | Host      | `databases.synapse.host`                      | `postgresql`                 |
+|                    |                    | Port      | `databases.synapse.port`                      | `5432`                       |
+|                    |                    | Username  | `databases.synapse.username`                  | `matrix_user`                |
+|                    |                    | Password  | `databases.synapse.password`                  |                              |
+| Nubus              | Guardian Mgmt API  |           |                                               |                              |
+|                    |                    | Type      | `databases.umsGuardianManagementApi.type`     | `postgresql`                 |
+|                    |                    | Name      | `databases.umsGuardianManagementApi.name`     | `guardianmanagementapi`      |
+|                    |                    | Host      | `databases.umsGuardianManagementApi.host`     | `postgresql`                 |
+|                    |                    | Port      | `databases.umsGuardianManagementApi.port`     | `5432`                       |
+|                    |                    | Username  | `databases.umsGuardianManagementApi.username` | `guardianmanagementapi_user` |
+|                    |                    | Password  | `databases.umsGuardianManagementApi.password` |                              |
+|                    | Keycloak           |           |                                               |                              |
+|                    |                    | Type      | `databases.keycloak.type`                     | `postgresql`                 |
+|                    |                    | Name      | `databases.keycloak.name`                     | `keycloak`                   |
+|                    |                    | Host      | `databases.keycloak.host`                     | `postgresql`                 |
+|                    |                    | Port      | `databases.keycloak.port`                     | `5432`                       |
+|                    |                    | Username  | `databases.keycloak.username`                 | `keycloak_user`              |
+|                    |                    | Password  | `databases.keycloak.password`                 |                              |
+|                    | Keycloak Extension |           |                                               |                              |
+|                    |                    | Type      | `databases.keycloakExtension.type`            | `postgresql`                 |
+|                    |                    | Name      | `databases.keycloakExtension.name`            | `keycloak_extensions`        |
+|                    |                    | Host      | `databases.keycloakExtension.host`            | `postgresql`                 |
+|                    |                    | Port      | `databases.keycloakExtension.port`            | `5432`                       |
+|                    |                    | Username  | `databases.keycloakExtension.username`        | `keycloak_extensions_user`   |
+|                    |                    | Password  | `databases.keycloakExtension.password`        |                              |
+|                    | Notifications API  |           |                                               |                              |
+|                    |                    | Type      | `databases.umsNotificationsApi.type`          | `postgresql`                 |
+|                    |                    | Name      | `databases.umsNotificationsApi.name`          | `notificationsapi`           |
+|                    |                    | Host      | `databases.umsNotificationsApi.host`          | `postgresql`                 |
+|                    |                    | Port      | `databases.umsNotificationsApi.port`          | `5432`                       |
+|                    |                    | Username  | `databases.umsNotificationsApi.username`      | `notificationsapi_user`      |
+|                    |                    | Password  | `databases.umsNotificationsApi.password`      |                              |
+|                    | Self Service       |           |                                               |                              |
+|                    |                    | Type      | `databases.umsSelfservice.type`               | `postgresql`                 |
+|                    |                    | Name      | `databases.umsSelfservice.name`               | `selfservice`                |
+|                    |                    | Host      | `databases.umsSelfservice.host`               | `postgresql`                 |
+|                    |                    | Port      | `databases.umsSelfservice.port`               | `5432`                       |
+|                    |                    | Username  | `databases.umsSelfservice.username`           | `selfservice_user`           |
+|                    |                    | Password  | `databases.umsSelfservice.password`           |                              |
+| Nextcloud          | Nextcloud          |           |                                               |                              |
+|                    |                    | Type      | `databases.nextcloud.type`                    | `postgresql`                 |
+|                    |                    | Name      | `databases.nextcloud.name`                    | `nextcloud`                  |
+|                    |                    | Host      | `databases.nextcloud.host`                    | `postgresql`                 |
+|                    |                    | Port      | `databases.nextcloud.port`                    | `5432`                       |
+|                    |                    | Username  | `databases.nextcloud.username`                | `nextcloud_user`             |
+|                    |                    | Password  | `databases.nextcloud.password`                |                              |
+| Notes              | Notes              |           |                                               |                              |
+|                    |                    | Type      | `databases.notes.type`                        | `postgresql`                 |
+|                    |                    | Name      | `databases.notes.name`                        | `notes`                      |
+|                    |                    | Host      | `databases.notes.host`                        | `postgresql`                 |
+|                    |                    | Port      | `databases.notes.port`                        | `5432`                       |
+|                    |                    | Username  | `databases.notes.username`                    | `notes_user`                 |
+|                    |                    | Password  | `databases.notes.password`                    |                              |
+| OpenProject        | OpenProject        |           |                                               |                              |
+|                    |                    | Type      | `databases.openproject.type`                  | `postgresql`                 |
+|                    |                    | Name      | `databases.openproject.name`                  | `openproject`                |
+|                    |                    | Host      | `databases.openproject.host`                  | `postgresql`                 |
+|                    |                    | Port      | `databases.openproject.port`                  | `5432`                       |
+|                    |                    | Username  | `databases.openproject.username`              | `openproject_user`           |
+|                    |                    | Password  | `databases.openproject.password`              |                              |
+| OX App Suite[^2]   | OX App Suite       |           |                                               |                              |
+|                    |                    | Type      | `databases.oxAppSuite.type`                   | `mariadb`                    |
+|                    |                    | Name      | `databases.oxAppSuite.name`                   | `openxchange`                |
+|                    |                    | Host      | `databases.oxAppSuite.host`                   | `mariadb`                    |
+|                    |                    | Port      | `databases.oxAppSuite.port`                   | `3306`                       |
+|                    |                    | Username  | `databases.oxAppSuite.username`               | `root`                       |
+|                    |                    | Password  | `databases.oxAppSuite.password`               |                              |
+| OX Dovecot Pro[^3] | ACLs               |           |                                               |                              |
+|                    |                    | Type      | `databases.dovecotACL.type`                   | `cassandra`                  |
+|                    |                    | Name      | `databases.dovecotACL.name`                   | `dovecot_acl`                |
+|                    |                    | Host      | `databases.dovecotACL.host`                   | `cassandra`                  |
+|                    |                    | Port      | `databases.dovecotACL.port`                   | `9042`                       |
+|                    |                    | Username  | `databases.dovecotACL.username`               | `dovecot_acl_user`           |
+|                    |                    | Password  | `databases.dovecotACL.password`               |                              |
+|                    | Dictmap            |           |                                               |                              |
+|                    |                    | Type      | `databases.dovecotDictmap.type`               | `cassandra`                  |
+|                    |                    | Name      | `databases.dovecotDictmap.name`               | `dovecot_dictmap`            |
+|                    |                    | Host      | `databases.dovecotDictmap.host`               | `cassandra`                  |
+|                    |                    | Port      | `databases.dovecotDictmap.port`               | `9042`                       |
+|                    |                    | Username  | `databases.dovecotDictmap.username`           | `dovecot_dictmap_user`       |
+|                    |                    | Password  | `databases.dovecotDictmap.password`           |                              |
+| XWiki[^4]          | XWiki              |           |                                               |                              |
+|                    |                    | Type      | `databases.xwiki.type`                        | `postgresql`                 |
+|                    |                    | Name      | `databases.xwiki.name`                        | `xwiki`                      |
+|                    |                    | Host      | `databases.xwiki.host`                        | `postgresql`                 |
+|                    |                    | Port      | `databases.xwiki.port`                        | `5432`                       |
+|                    |                    | Username  | `databases.xwiki.username`                    | `xwiki_user`                 |
+|                    |                    | Password  | `databases.xwiki.password`                    |                              |
 
-When deploying this suite to production, you need to configure the applications to use your production grade objectstore
-service.
+# Object storage
+
+When deploying this suite to production, you need to configure the applications to use your production-grade object
+storage service.
 
 | Component   | Name        | Parameter       | Key                                      | Default            |
 |-------------|-------------|-----------------|------------------------------------------|--------------------|
@@ -91,7 +137,7 @@ service.
 
 # Cache
 
-When deploying this suite to production, you need to configure the applications to use your production grade cache
+When deploying this suite to production, you need to configure the applications to use your production-grade cache
 service.
 
 | Component        | Name             | Type      | Parameter | Key                          | Default          |
@@ -108,3 +154,17 @@ service.
 | UMS              | Self Service     | Memcached |           |                              |                  |
 |                  |                  |           | Host      | `cache.umsSelfservice.host`  | `memcached`      |
 |                  |                  |           | Port      | `cache.umsSelfservice.port`  | `11211`          |
+
+# Footnotes
+
+[^1] The upstream product documentation provides some valuable information regarding database migrations:
+- Nextcloud: https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
+- XWiki:
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
+  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
+
+[^2] OX App Suite only supports MariaDB and requires root access, as it manages its databases itself.
+
+[^3] openDesk Enterprise only.
+
+[^4] XWiki requires root access when using MariaDB due to the fact that sub-wikis use separate databases that are managed by XWiki. When using PostgreSQL with XWiki no root user is required as the sub-wikis are managed within multiple schemas within a single database.

docs/functional.md

@@ -0,0 +1,40 @@
+<!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Functional configuration</h1>
+
+This document addresses the available functional configuration options of an openDesk deployment.
+
+<!-- TOC -->
+* [Supported functional configuration](#supported-functional-configuration)
+* [Customization of functional options](#customization-of-functional-options)
+<!-- TOC -->
+
+## Supported functional configuration
+
+While the openDesk applications allow a wide range of configuration options, only a small subset of them are supported by openDesk. This subset can be found in [`helmfile/environments/default/functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl)
+
+The following categories are available. Each category contains a set of options to tailor your openDesk deployment to your needs. Please find the actual options including inline documentation in [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl) itself.
+
+* Administrative options (`functional.admin.*`): Options affecting the IAM administrator role (users that are member of the LDAP group `Domain Admins`) of openDesk.
+* Authentication options (`functional.authentication.*`): Authentication related settings, e.g. define additional [OIDC](https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)) clients or scopes.
+* External Services options (`functional.externalServices.*`): Settings controlling externally available services like APIs.
+* Filestore options (`functional.filestore.*`): Configuration options for the filestore component of openDesk, like default storage quota or file sharing options.
+* Data Protection options (`functional.dataProtection.*`): Data protection related settings.
+* Portal options (`functional.portal.*`): Options to customize the openDesk portal, e.g. if the login dialog should be enforced.
+* Chat options (`functional.chat.*`): Configuration options for the chat component of openDesk.
+* Migration options (`functional.migration.*`): Helpful setting(s) for migration scenarios.
+* Groupware options (`functional.groupware.*`): Options to customize Open-Xchange and mail settings, e.g. mail quota.
+
+## Customization of functional options
+
+In case the options from [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl) are not sufficient, you might want to look into [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl). The customizations give you control over all templating that is being done in openDesk, but be aware it is an unsupported approach, so in case you have a strong need for customizations, please let us know by opening a ticket. We will check if it is a use case that can be supported by implementing it as part of the aforementioned [`functional.yaml.gotmpl`](../helmfile/environments/default/functional.yaml.gotmpl).
+
+> [!note]
+> You can not directly template your own values in the structure found in
+> [`customization.yaml.gotmpl`](../helmfile/environments/default/customization.yaml.gotmpl), rather, you need
+> to reference your custom value files to overwrite the openDesk defaults. In the app specific
+> `helmfile-child.yaml.gotmpl` files, the openDesk value files are referenced first, then afterwards, the
+> files you define in the customizations are read.

docs/getting-started.md

@@ -3,13 +3,14 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 -->
 
-<h1>Getting stated</h1>
+<h1>Getting started</h1>
 
-This documentation should enable you to create your own evaluation instance of openDesk on your Kubernetes cluster.
+This documentation lets you create an openDesk evaluation instance on your Kubernetes cluster.
 
 <!-- TOC -->
 * [Requirements](#requirements)
 * [Customize environment](#customize-environment)
+  * [DNS](#dns)
   * [Domain](#domain)
     * [Apps](#apps)
   * [Private registries](#private-registries)
@@ -19,7 +20,11 @@ This documentation should enable you to create your own evaluation instance of o
     * [Ingress](#ingress)
     * [Container runtime](#container-runtime)
     * [Volumes](#volumes)
+  * [Customize deployment](#customize-deployment)
   * [Connectivity](#connectivity)
+    * [Ports](#ports)
+      * [Web-based user interface](#web-based-user-interface)
+      * [Mail clients](#mail-clients)
     * [Mail/SMTP configuration](#mailsmtp-configuration)
     * [TURN configuration](#turn-configuration)
     * [Certificate issuer](#certificate-issuer)
@@ -27,34 +32,56 @@ This documentation should enable you to create your own evaluation instance of o
   * [Install](#install)
   * [Install single app](#install-single-app)
   * [Install single release/chart](#install-single-releasechart)
+  * [Using from external repository](#using-from-external-repository)
 * [Access deployment](#access-deployment)
+  * [Login](#login)
+  * [Credentials](#credentials)
 * [Uninstall](#uninstall)
 <!-- TOC -->
 
-Thanks for looking into the openDesk Getting started guide. This documents covers essentials configuration steps to
-deploy openDesk onto your kubernetes infrastructure.
+Thanks for looking into the openDesk Getting Started guide. This document covers essential configuration steps to
+deploy openDesk onto your Kubernetes infrastructure.
 
 # Requirements
 
-Detailed system requirements are covered on [requirements](requirements.md) page.
+Detailed system requirements are covered on the [requirements](./docs/requirements.md) page.
 
 # Customize environment
 
-Before deploying openDesk, you have to configure the deployment to suit your environment.
-To keep your deployment up to date, we recommend customizing in `dev`, `test` or `prod` and not in `default` environment
+Before deploying openDesk, you must configure the deployment to fit your environment.
+To keep your deployment up to date, we recommend customizing in `dev`, `test`, or `prod` and not in `default` environment
 files.
 
-> All configuration options and their default values can be found in files at `helmfile/environments/default/`
+> All configuration options and their default values can be found in files at [`helmfile/environments/default/`](../helmfile/environments/default/)
 
-For the following guide, we will use `dev` as environment, where variables can be set in
-`helmfile/environments/dev/values.yaml`.
+For the following guide, we will use `dev` as environment where variables can be set in
+`helmfile/environments/dev/values.yaml.gotmpl`.
+
+## DNS
+
+The deployment is designed to deploy each application/service under a dedicated subdomain.
+For your convenience, we recommend creating a `*.domain.tld` A-Record for your cluster Ingress Controller; otherwise, you must create an A-Record for each subdomain.
+
+| Record name                   | Type | Value                                              | Additional information                                            |
+|-------------------------------|------|----------------------------------------------------|-------------------------------------------------------------------|
+| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                   |
+| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                   |
+| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional, mail should directly be delivered to openDesk's Postfix |
+| domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                   |
+| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                        |
+| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                          |
+| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional, DKIM settings                                           |
+| _caldavs._tcp.domain.tld      | SRV  | 10 1 443 dav.domain.tld.                           | Optional, CalDav auto discovery                                   |
+| _caldav._tcp.domain.tld       | SRV  | 10 1  80 dav.domain.tld.                           | Optional, CalDav auto discovery                                   |
+| _carddavs._tcp.domain.tld     | SRV  | 10 1 443 dav.domain.tld.                           | Optional, CardDav auto discovery                                  |
+| _carddav._tcp.domain.tld      | SRV  | 10 1  80 dav.domain.tld.                           | Optional, CardDav auto discovery                                  |
 
 ## Domain
 
-The deployment is designed to deploy each app under a subdomains. For your convenience, we recommend to create a
-`*.domain.tld` A-Record to your cluster ingress controller, otherwise you need to create an A-Record for each subdomain.
+As example base domain for your deployment we use `domain.tld` in this document.
 
-A list of all subdomains can be found in `helmfile/environments/default/global.yaml`.
+A list of all subdomains can be found in `helmfile/environments/default/global.yaml.gotmpl`.
 
 All subdomains can be customized. For example, _Nextcloud_ can be changed to `files.domain.tld` in `dev` environment:
 
@@ -64,95 +91,97 @@ global:
     nextcloud: "files"
 ```
 
-The domain have to be set either via `dev` environment
+The domain has to be set either via `dev` environment:
 
 ```yaml
 global:
-  domain: "my.open.desk"
-istio:
-  domain: "istio.my.open.desk"
+  domain: "domain.tld"
 ```
 
-or via environment variable
+or alternatively via environment variable:
 
 ```shell
-export DOMAIN=my.open.desk
-export ISTIO_DOMAIN=istio.my.open.desk
+export DOMAIN=domain.tld
 ```
 
-When you configure each subdomain individually, you can set `global.domain` and `istio.domain` to the same value.
-
-Istio is only used for Open-Xchange Appsuite 8, when you don't want to install it, you can disable Istio:
-
-```yaml
-istio:
-  enabled: false
-oxAppsuite:
-  enabled: false
-```
+> [!warning]
+> Due to a limitation caused by a [bug in the SSSD subcomponent](https://github.com/SSSD/sssd/issues/7246), there
+> is an upper bound on the total domain length used by openDesk. To avoid issues, we recommend keeping the openDesk
+> base domain length below 94 characters.
 
 ### Apps
 
-All available apps and their default value can be found in `helmfile/environments/default/workplace.yaml`.
+Depending on your ideal openDesk deployment, you may wish to disable or enable certain apps.
+All available apps and their default values are located in `helmfile/environments/default/opendesk_main.yaml.gotmpl`.
 
-| Component                   | Name                                | Default | Description                    |
-|-----------------------------|-------------------------------------|---------|--------------------------------|
-| Certificates                | `certificates.enabled`              | `true`  | TLS certificates               |
-| ClamAV (Distributed)        | `clamavDistributed.enabled`         | `false` | Antivirus engine               |
-| ClamAV (Simple)             | `clamavSimple.enabled`              | `true`  | Antivirus engine               |
-| Collabora                   | `collabora.enabled`                 | `true`  | Weboffice                      |
-| CryptPad                    | `cryptpad.enabled`                  | `true`  | Weboffice                      |
-| Dovecot                     | `dovecot.enabled`                   | `true`  | Mail backend                   |
-| Element                     | `element.enabled`                   | `true`  | Secure communications platform |
-| Intercom Service            | `intercom.enabled`                  | `true`  | Cross service data exchange    |
-| Jitsi                       | `jitsi.enabled`                     | `true`  | Videoconferencing              |
-| MariaDB                     | `mariadb.enabled`                   | `true`  | Database                       |
-| Memcached                   | `memcached.enabled`                 | `true`  | Cache Database                 |
-| MinIO                       | `minio.enabled`                     | `true`  | Object Storage                 |
-| Nextcloud                   | `nextcloud.enabled`                 | `true`  | File share                     |
-| OpenProject                 | `openproject.enabled`               | `true`  | Project management             |
-| OX Appsuite                 | `oxAppsuite.enabled`                | `true`  | Groupware                      |
-| Provisioning                | `oxConnector.enabled`               | `true`  | Backend provisioning           |
-| Postfix                     | `postfix.enabled`                   | `true`  | MTA                            |
-| PostgreSQL                  | `postgresql.enabled`                | `true`  | Database                       |
-| Redis                       | `redis.enabled`                     | `true`  | Cache Database                 |
-| Univention Management Stack | `univentionManagementStack.enabled` | `true`  | Identity Management & Portal   |
-| XWiki                       | `xwiki.enabled`                     | `true`  | Knowledgebase                  |
+| Component            | Name                        | Default | Description                    |
+| -------------------- | --------------------------- | ------- | ------------------------------ |
+| Certificates         | `apps.certificates.enabled`      | `true`  | TLS certificates               |
+| ClamAV (Distributed) | `apps.clamavDistributed.enabled` | `false` | Antivirus engine               |
+| ClamAV (Simple)      | `apps.clamavSimple.enabled`      | `true`  | Antivirus engine               |
+| Collabora            | `apps.collabora.enabled`         | `true`  | Weboffice                      |
+| CryptPad             | `apps.cryptpad.enabled`          | `true`  | Weboffice                      |
+| dkimpy               | `apps.dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
+| Dovecot              | `apps.dovecot.enabled`           | `true`  | Mail backend                   |
+| Element              | `apps.element.enabled`           | `true`  | Secure communications platform |
+| Home                 | `apps.home.enabled`              | `true`  | Base domain portal redirect    |
+| Jitsi                | `apps.jitsi.enabled`             | `true`  | Videoconferencing              |
+| MariaDB              | `apps.mariadb.enabled`           | `true`  | Database                       |
+| Memcached            | `apps.memcached.enabled`         | `true`  | Cache Database                 |
+| MinIO                | `apps.minio.enabled`             | `true`  | Object Storage                 |
+| Nextcloud            | `apps.nextcloud.enabled`         | `true`  | File share                     |
+| Nubus                | `apps.nubus.enabled`             | `true`  | Identity Management & Portal   |
+| OpenProject          | `apps.openproject.enabled`       | `true`  | Project management             |
+| OX App Suite         | `apps.oxAppSuite.enabled`        | `true`  | Groupware                      |
+| Postfix              | `apps.postfix.enabled`           | `true`  | MTA                            |
+| PostgreSQL           | `apps.postgresql.enabled`        | `true`  | Database                       |
+| Redis                | `apps.redis.enabled`             | `true`  | Cache Database                 |
+| XWiki                | `apps.xwiki.enabled`             | `true`  | Knowledge management           |
 
-Exemplary, Jitsi can be disabled like:
+For example, Jitsi can be disabled like this:
 
 ```yaml
-jitsi:
-  enabled: false
+apps:
+  jitsi:
+    enabled: false
 ```
 
 ## Private registries
 
-By default Helm charts and container images are fetched from OCI registries. These registries can be found for most cases
-in the [openDesk/component section on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/components).
+By default, Helm charts and container images are fetched from OCI registries. These registries can be found in most cases
+in the [openDesk/component section on openCode](https://gitlab.opencode.de/bmi/opendesk/components).
 
-For untouched upstream artefacts that do not belong to a functional component's core we use upstream registries
+For untouched upstream artifacts that do not belong to a functional component's core, we use upstream registries
 like Docker Hub.
 
-Doing a test deployment will most likely be fine with this setup. In case you want to deploy multiple times a day
-and fetch from the same IP address you might run into rate limits at Docker Hub. In that case and in cases you
-prefer the use of a private image registry anyway you can configure such for
-[your target environment](./../helmfile/environments/dev/values.yaml.gotmpl.sample) by setting
+Doing a test deployment will be fine with this setup. In case you want to deploy multiple times a day
+and fetch from the same IP address, you might run into rate limits at Docker Hub. In that case, and in case you
+prefer the use of a private image registry, you can configure these in
+[your target environment](../helmfile/environments/dev/values.yaml.gotmpl.sample) by setting
 - `global.imageRegistry` for a private image registry and
 - `global.helmRegistry` for a private Helm chart registry.
 
 ```yaml
 global:
-  imageRegistry: "external-registry.souvap-univention.de/sovereign-workplace"
+  imageRegistry: "my_private_registry.domain.tld"
 ```
 
-alternatively you can use an environment variable:
+alternatively, you can use an environment variable:
 
 ```shell
-export PRIVATE_IMAGE_REGISTRY_URL=external-registry.souvap-univention.de/sovereign-workplace
+export PRIVATE_IMAGE_REGISTRY_URL=my_private_registry.domain.tld
 ```
 
-If authentication is required, you can reference imagePullSecrets as following:
+or for more granular control over repository overrides per registry (rewrites):
+
+```yaml
+repositories:
+  image:
+    dockerHub: "my_private_registry.domain.tld/docker.io/"
+    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
+```
+
+If authentication is required, you can reference `imagePullSecrets` as follows:
 
 ```yaml
 global:
@@ -164,9 +193,9 @@ global:
 
 ### Service
 
-Some apps, like Jitsi or Dovecot, require HTTP and external TCP connections.
+Some apps, like Jitsi and Dovecot, require HTTP and external TCP connections.
 These apps create a Kubernetes service object.
-You can configure, whether `NodePort` (for on-premise), `LoadBalancer` (for cloud) or `ClusterIP` (to disable) should be
+You can configure whether `NodePort` (for on-premises), `LoadBalancer` (for cloud), or `ClusterIP` (to disable) should be
 used:
 
 ```yaml
@@ -177,7 +206,7 @@ cluster:
 
 ### Networking
 
-If your cluster has not the default `cluster.local` domain configured, you need to provide the domain via:
+If your cluster does not have the default `cluster.local` domain configured, you need to provide the domain via:
 
 ```yaml
 cluster:
@@ -185,28 +214,45 @@ cluster:
     domain: "acme.internal"
 ```
 
-If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via:
+If your cluster does not have the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via the following:
 
 ```yaml
 cluster:
   networking:
-    cidr: "127.0.0.0/8"
+    cidr:
+      - "127.0.0.0/8"
+```
+
+If your load balancer / reverse proxy IPs are not already included in the above `cidr` you need to
+explicitly configure their related IPs or IP ranges:
+
+```yaml
+cluster:
+  networking:
+    incomingCIDR:
+      - "172.16.0.0/12"
 ```
 
 ### Ingress
 
-By default, the `ingressClassName` is empty to choose your default ingress controller, you may want to customize it by
-setting:
+The default value for the `ingressClassName` in openDesk is set to `nginx`. This prevents fallback to the
+cluster’s default ingress class, since the Helm charts used by openDesk components are not consistently aligned in
+how they handle a missing or empty `ingressClassName`. In case you are using a non-standard `ingressClassName` for
+your `ingress-nginx` controller you have to configure it as follows:
 
 ```yaml
 ingress:
-  ingressClassName: "cilium"
+  ingressClassName: "nginx"
 ```
 
+> [!note]
+> Currently, the only supported ingress controller is `ingress-nginx` (see
+> [requirements.md](./docs/requirements.md) for reference).
+
 ### Container runtime
 
-Some apps require specific configuration for container runtimes. You can set your container runtime like `cri-o`,
-`containerd` or `docker` by:
+Some apps require specific configurations for the container runtime. You can set your container runtime like `cri-o`,
+`containerd` or `docker` by using the following attribute:
 
 ```yaml
 cluster:
@@ -215,17 +261,7 @@ cluster:
 ```
 
 ### Volumes
-
-When your cluster has a `ReadWriteMany` volume provisioner, you can benefit from distributed or scaling of apps. By
-default, only `ReadWriteOnce` is enabled. To enable `ReadWriteMany` you can set:
-
-```yaml
-cluster:
-  persistence:
-    readWriteMany: true
-```
-
-The **StorageClass** can be set by:
+The StorageClass must be set using the following attribute:
 
 ```yaml
 persistence:
@@ -234,23 +270,80 @@ persistence:
     RWO: "my-read-write-once-class"
 ```
 
+`RWX` is optional and requires that your cluster has a `ReadWriteMany` volume provisioner. If you can make use
+of it, it largely benefits the distribution and scaling of apps. By default, only `ReadWriteOnce` is enabled.
+To enable `ReadWriteMany` you can use the following attribute:
+
+```yaml
+cluster:
+  persistence:
+    readWriteMany: true
+```
+
+## Customize deployment
+
+While openDesk configures the applications with meaningful defaults, you can check [functional.md](./docs/functional.md) if you want to change these defaults to better match your use case.
+
 ## Connectivity
 
+### Ports
+
+> [!note]
+> If you use `NodePort` for service exposure, you must check your deployment for the actual ports and ensure
+> they are opened where necessary.
+
+#### Web-based user interface
+
+To use the openDesk functionality with its web-based user interface, you need to expose the following ports publicly:
+
+| Component          | Description             |  Port | Type |
+| ------------------ | ----------------------- | ----: | ---: |
+| openDesk           | Kubernetes Ingress      |    80 |  TCP |
+| openDesk           | Kubernetes Ingress      |   443 |  TCP |
+| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
+
+#### Mail clients
+
+To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need to be publicly exposed:
+
+| Component          | Description             |  Port | Type |
+| ------------------ | ----------------------- | ----: | ---: |
+| Dovecot            | IMAPS                   |   993 |  TCP |
+|                    | POP3S                   |   995 |  TCP |
+| Postfix            | SMTP                    |    25 |  TCP |
+|                    | SMTPS                   |   587 |  TCP |
+
 ### Mail/SMTP configuration
 
-To use the full potential of the openDesk, you need to set up an SMTP Smarthost/Relay which allows to send emails from
-the whole subdomain.
+Enabling DKIM signing for outgoing emails helps reduce the risk of messages being marked as spam and improves recipient trust.
+openDesk includes `dkimpy-milter` as a Postfix milter for signing emails. You can configure the following attributes:
+
+```yaml
+apps:
+  dkimpy:
+    enabled: true
+smtp:
+  dkim:
+    key:
+      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
+    selector: "default"
+    useED25519: true # when false, RSA is used
+```
+
+A common scenario for outgoing mail is to send it through a smarthost or mail relay, which often handles DKIM signing as well.
+
+If you prefer to use a smarthost, you can configure it as follows:
 
 ```yaml
 smtp:
-  host: "mail.open.desk"
-  username: "openDesk"
+  host: "smarthost.domain.tld"
+  username: "smarthost-auth-username"
   password: "secret"
 ```
 
 ### TURN configuration
 
-Some components (Jitsi, Element) use for direct communication a TURN server. You can configure your own TURN server with
+Some components (Jitsi, Element) use a TURN server for direct communication. You can configure your own TURN server with
 these options:
 
 ```yaml
@@ -258,25 +351,26 @@ turn:
   transport: "udp" # or tcp
   credentials: "secret"
   server:
-    host: "turn.open.desk"
+    host: "turn.domain.tld"
     port: "3478"
   tls:
-    host: "turns.open.desk"
+    host: "turns.domain.tld"
     port: "5349"
 ```
 
 ### Certificate issuer
 
-As mentioned in [requirements](requirements.md#certificate-management) you can provide your own valid certificate. A TLS
-secret with name `opendesk-certificates-tls` needs to be present in application namespace. For deployment, you can
-disable `Certificate` resource creation by:
+As mentioned in [requirements](requirements.md#certificate-management), you can provide your own valid certificate. A TLS type
+secret named `opendesk-certificates-tls` must be present in the application namespace. For deployment, you can
+turn off `Certificate` resource creation with:
 
 ```yaml
-certificates:
-  enabled: false
+apps:
+  certificates:
+    enabled: false
 ```
 
-If you want to leverage the `cert-manager.io` to handle certificates, like `Let's encrypt`, you need to provide the
+If you want to leverage `cert-manager.io` to handle certificates, like `Let's encrypt`, you need to provide the
 configured cluster issuer:
 
 ```yaml
@@ -285,7 +379,7 @@ certificate:
     name: "letsencrypt-prod"
 ```
 
-Additionally, it is possible to request wildcard certificates by:
+Additionally, it is possible to request wildcard certificates with:
 
 ```yaml
 certificate:
@@ -294,16 +388,33 @@ certificate:
 
 ## Password seed
 
-All secrets are generated from a single master password via Master Password (algorithm).
-To prevent others from using your openDesk instance, we highly recommend setting an individual master password via:
+All secrets are generated from a master password via [Master Password (algorithm)](https://en.wikipedia.org/wiki/Master_Password_(algorithm)).
+To prevent others from using your openDesk instance, you must set your individual master password via:
 
 ```shell
-export MASTER_PASSWORD="openDesk"
+export MASTER_PASSWORD="your_individual_master_password"
 ```
 
+> [!important]
+> Currently a
+> [documented](https://docs.software-univention.de/nubus-kubernetes-operation/1.x/en/configuration/nats.html#configure-the-secrets)
+> upstream [bug](https://forge.univention.org/bugzilla/show_bug.cgi?id=58357) causes a failure when
+> passwords/secrets beginning with certain numbers are using for the Nubus subcomponent NATS. With openDesk
+> 1.6.0 an update-aware workaround was implemented that prefixes the affected secrets in the openDesk included
+> `secrets.yaml.gotmpl` that derives all secrets from the previously mentioned `MASTER_PASSWORD`. If you are
+> using externally provided passwords/secrets make sure that none of the ones listed below are starting with a
+> number:
+>
+> - `secrets.nubus.provisioning.api.natsPassword`
+> - `secrets.nubus.provisioning.dispatcherNatsPassword`
+> - `secrets.nubus.provisioning.prefillNatsPassword`
+> - `secrets.nubus.provisioning.udmListenerNatsPassword`
+> - `secrets.nubus.provisioning.udmTransformerNatsPassword`
+> - `secrets.nats.natsAdminPassword`
+
 ## Install
 
-After setting your environment specific values in `dev` environment, you can start deployment by:
+After setting your environment-specific values in `dev` environment, you can start deployment by:
 
 ```shell
 helmfile apply -e dev -n <NAMESPACE> [-l <label>] [--suppress-diff]
@@ -318,13 +429,13 @@ helmfile apply -e dev -n <NAMESPACE> [-l <label>] [--suppress-diff]
 
 ## Install single app
 
-You can also install or upgrade only a single app like Collabora, either by label selector:
+You can also install or upgrade only a single app like Collabora, either by using a label selector:
 
 ```shell
 helmfile apply -e dev -n <NAMESPACE> -l component=collabora
 ```
 
-or by switching into the apps' directory (faster):
+or by switching to the apps' directory (faster) and install or upgrade from there directly:
 
 ```shell
 cd helmfile/apps/collabora
@@ -333,56 +444,84 @@ helmfile apply -e dev -n <NAMESPACE>
 
 ## Install single release/chart
 
-Instead of iteration through all services, you can also deploy a single release like mariadb by:
+Instead of iterating through all services, you can also deploy a single release like `mariadb` by executing the following:
 
 ```shell
 helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
 ```
 
+## Using from external repository
+
+Referring to `./helmfile_generic.yaml.gotmpl` from an external
+directory or repository is possible. The `helmfile.yaml.gotmpl` that refers to
+`./helmfile_generic.yaml.gotmpl` may define custom environments. These custom
+environments may overwrite specific configuration values. These
+configuration values are:
+
+* `global.domain`
+* `global.helmRegistry`
+* `global.master_password`
+
 # Access deployment
 
-When all apps are successfully deployed and pod status' went to `Running` or `Succeeded`, you can navigate to
+## Login
+
+When all apps are successfully deployed, and their Pod status is `Running` or `Succeeded`, you can navigate to
+
+```text
+https://domain.tld
+```
+
+which will redirect you to the actual URL of the openDesk portal:
 
 ```text
 https://portal.domain.tld
 ```
 
-If you change the subdomain of `univentionManagementStack`, you need to replace `portal`
-by your specified subdomain.
+By default the portal will send you to openDesk's login screen.
 
-**Credentials:**
+## Credentials
+
+openDesk deploys with the standard user account `Administrator`, the password for which can be retrieved as follows:
 
 ```shell
-# Replace with your namespace
-NAMESPACE=your-namespace
+# Set your namespace
+NAMESPACE=<your_namespace>
 
-# Get credentials from ConfigMap
-kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}' \
-  | yq '.properties.username,.properties.password'
-# default.user
-# 40615..............................e9e2f
-# ---
-# default.admin
-# bdbbb..............................04db6
+# Get password for IAM "Administrator" account
+kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.administrator_password}' | base64 -d
 ```
 
-Now you can log in with obtained credentials:
+Using the aforementioned account, you can either create new accounts manually or make use of the
+[openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import/)
+script or container.
 
-| Username        | Password                                   | Description      |
-|-----------------|--------------------------------------------|------------------|
-| `default.user`  | `40615..............................e9e2f` | Application user |
-| `default.admin` | `bdbbb..............................04db6` | Administrator    |
+In the following snippet, after defining the values of the first three lines and executing the command,
+you get two accounts, `default` and `default-admin`:
+
+```shell
+ADMINISTRATOR_PASSWORD=<your_administrator_password_see_above>
+DOMAIN=<your_domain>
+DEFAULT_USERS_PASSWORD=<password_for_the_created_default_accounts>
+docker run --rm registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0 \
+  ./user_import_udm_rest_api.py \
+    --import_domain ${DOMAIN} \
+    --udm_api_password ${ADMINISTRATOR_PASSWORD} \
+    --set_default_password ${DEFAULT_USERS_PASSWORD} \
+    --import_filename template.ods \
+    --create_admin_accounts True
+```
 
 # Uninstall
 
-You can uninstall the deployment by:
+You can uninstall the deployment by executing the following:
 
 ```shell
 helmfile destroy -n <NAMESPACE>
 ```
 
-> **Note**
-> Not all Jobs, PersistentVolumeClaims or Certificates are deleted; you have to delete them manually
+> [!note]
+> Not all Jobs, PersistentVolumeClaims, or Certificates are deleted; you have to delete them manually
 
 **'Sledgehammer destroy'** - for fast development turn-around times (at your own risk):
 
@@ -397,7 +536,8 @@ done
 # Delete leftover resources
 kubectl delete pvc --all --namespace ${NAMESPACE};
 kubectl delete jobs --all --namespace ${NAMESPACE};
+kubectl delete configmaps --all --namespace ${NAMESPACE};
 ```
 
-> **Warning**
-> Without specifying or empty `--namespace` flag, cluster-wide components get deleted!
+> [!warning]
+> Without specifying a `--namespace` flag, or by leaving it empty, cluster-wide components will get deleted!

docs/monitoring.md

@@ -5,8 +5,8 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Monitoring</h1>
 
-This document will cover how you can enable observability with Prometheus based monitoring and Grafana dashboards, as
-well as the overall status of monitoring integration.
+This document will cover how you can enable observability with Prometheus-based monitoring and Grafana dashboards as
+well as the overall status of the monitoring integration.
 
 <!-- TOC -->
 * [Technology](#technology)
@@ -14,27 +14,26 @@ well as the overall status of monitoring integration.
 * [Metrics](#metrics)
 * [Alerts](#alerts)
 * [Dashboards for Grafana](#dashboards-for-grafana)
-* [Components](#components)
+* [Component overview](#component-overview)
 <!-- TOC -->
 
 # Technology
 
-We provide integration into the Prometheus based monitoring.
-Together with
-[kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) you
-easily leverage the full potential of open-source cloud-native observability stack.
+openDesk includes integration with Prometheus-based monitoring.
 
-Before enabling the following options, you need to install the respective CRDs from the kube-prometheus-stack
-repository or prometheus operator.
+Together with [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack), you can easily leverage the full potential of the open-source cloud-native observability stack.
+
+Before enabling the following options, you need to install the respective custom resource definitions (CRDs) from the kube-prometheus-stack
+repository or Prometheus operator.
 
 # Defaults
 
 All configurable options and their defaults can be found in
-[`monitoring.yaml`](../helmfile/environments/default/monitoring.yaml).
+[`monitoring.yaml.gotmpl`](../helmfile/environments/default/monitoring.yaml.gotmpl).
 
 # Metrics
 
-To deploy podMonitor and serviceMonitor custom resources, enable it by:
+To deploy `podMonitor` and `serviceMonitor` custom resources, enable it by:
 
 ```yaml
 prometheus:
@@ -46,7 +45,10 @@ prometheus:
 
 # Alerts
 
-Some helm-charts provide a default set of prometheusRules for alerting, enable it by:
+openDesk ships with a set of Prometheus alerting rules that are specific to the operation of openDesk.
+Some of these are created by our partners while others are defined in [opendesk-alerts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts).
+
+All alert rules are deployed as [PrometheusRule](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PrometheusRule) and can be enabled like this:
 
 ```yaml
 prometheus:
@@ -56,7 +58,7 @@ prometheus:
 
 # Dashboards for Grafana
 
-To deploy optional ConfigMaps with Grafana dashboards, enable it by:
+To deploy optional Grafana dashboards with ConfigMaps, enable the functionality with:
 
 ```yaml
 grafana:
@@ -64,9 +66,11 @@ grafana:
     enabled: true
 ```
 
-# Components
+Please find further details in the [related Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards).
 
-| Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
-|:----------|-----------------------------------|-------------------------|---------------------|
-| Collabora | :white_check_mark:                | :white_check_mark:      | :white_check_mark:  |
-| Nextcloud | :white_check_mark:                | :x:                     | :x:                 |
+# Component overview
+
+| Component | Metrics (pod- or serviceMonitor) | Alerts (prometheusRule) | Dashboard (Grafana) |
+|:----------|----------------------------------|-------------------------|---------------------|
+| Collabora | :white_check_mark:               | :white_check_mark:      | :white_check_mark:  |
+| Nextcloud | :white_check_mark:               | :x:                     | :x:                 |

docs/permissions.md

@@ -0,0 +1,210 @@
+<!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Roles & Permissions</h1>
+
+openDesk uses role-based access control (RBAC) to manage permissions. This system ensures that users have access only to the resources necessary for their role.
+
+<!-- TOC -->
+* [Identity and Access Management (IAM)](#identity-and-access-management-iam)
+  * [Permissions](#permissions)
+  * [Roles](#roles)
+    * [Application usage](#application-usage)
+    * [Application administration](#application-administration)
+  * [Groups](#groups)
+    * [Global groups](#global-groups)
+    * [Application groups](#application-groups)
+      * [Standard access to applications](#standard-access-to-applications)
+      * [Administrative access to applications](#administrative-access-to-applications)
+    * [Custom groups](#custom-groups)
+  * [Assigning roles/groups and permissions](#assigning-rolesgroups-and-permissions)
+  * [Predefined roles/user templates](#predefined-rolesuser-templates)
+    * [*openDesk User*](#opendesk-user)
+    * [*openDesk Administrator*](#opendesk-administrator)
+  * [Managing permissions](#managing-permissions)
+  * [Hierarchies and delegation](#hierarchies-and-delegation)
+  * [Audit/Logging](#auditlogging)
+  * [Reporting](#reporting)
+  * [Delegation](#delegation)
+  * [Regular review](#regular-review)
+* [Applications](#applications)
+  * [Roles/Groups](#rolesgroups)
+<!-- TOC -->
+
+# Identity and Access Management (IAM)
+
+Within openDesk's Identity and Access Management component, Nubus, openDesk user accounts are managed, as well as some core roles and permissions.
+
+## Permissions
+
+A permission represents a specific authorization that defines an action a user is allowed to perform on a resource.
+
+As openDesk consists of multiple applications, each application may have different needs regarding its fine-grained internal permissions. Usually these permissions are manged within each component.
+
+The high-level permissions required to access the application, as well as group membership of users is managed in the IAM.
+
+## Roles
+
+Roles are defined sets of permissions that can be assigned to users. Each role corresponds to a specific set of tasks and responsibilities within the system. In openDesk's IAM, two roles are defined by default:
+
+- **openDesk Administrator**: Manages openDesk-global settings, such as users and groups.
+- **openDesk User**: Can log in to openDesk to make use of defined openDesk applications.
+
+> [!note]
+> Although it is not enforced by openDesk, it is strongly recommended that a user account is not granted both
+> roles at the same time. This is to maintain the separation of duties.
+
+### Application usage
+
+To access and use applications in openDesk and to address [the principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), a user needs to have the necessary permissions set. openDesk defines the following permissions to access applications:
+
+- **Groupware**: Use email, calendar, and address book applications.
+- **Chat**: Use the chat application.
+- **Knowledge Management**: Use the wiki application.
+- **Project Management**: Use the project management application.
+- **File Sharing**: Use the file sharing application.
+- **Video Conference**: Use the video conferencing application.
+
+### Application administration
+
+For applications that provide application-specific administrative settings, openDesk defines the following permissions:
+
+- **Knowledge Management Admin**: Manage the wiki application.
+- **Project Management Admin**: Manage the project management application settings.
+- **File Sharing Admin**: Manage the file sharing administrative settings.
+
+## Groups
+
+Groups help with clustering users with similar responsibilities and make it easier to assign roles or permissions. It is often the case that a group maps directly to a role.
+
+openDesk includes predefined groups. Please see below.
+
+### Global groups
+
+- **Domain Users**: Members of this group are *openDesk Users*.
+- **Domain Admins**: Members of this group are *openDesk IAM Administrators*. By default, this group has two-factor authentication (2FA) enabled.
+- **2FA Users**: Members of this group that are forced to use two-factor authentication (2FA).
+- **IAM API - Full Access**: Members of this group have full (read and write) access to the IAM's REST API.
+
+### Application groups
+
+When editing a user in the IAM, you can select if a user can access or get elevated admin permission for a specific application within the "openDesk" tab. The selection is stored as an attribute on the user object, but in other applications, it is helpful to also expose this information as a group membership. Therefore, openDesk comes with the following [groups](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/63-groups.yaml).
+
+To easily identify these groups, all of them are prefixed with `managed-by-Attribute-`.
+
+> [!note]
+> The membership of these groups is automatically managed based on the user's attributes from the "openDesk"
+> tab. Any changes directly to the groups will be overwritten, so please always use the "openDesk" tab of the
+> respective user. The IAM supports editing user attributes across multiple accounts simultaneously.
+
+#### Standard access to applications
+
+Unless a user is a member of a group, the respective application is not shown in the portal.
+
+> [!note]
+> In openDesk's identity provider, the required OIDC claims to access an application are only granted when the
+> respective group membership is available. This means that even if a user who is not a member of an
+> application group knows the link to the application and calls it directly, the single sign-on will be
+> unsuccessful.
+
+- **managed-by-Attribute-Groupware**: Members of this group have access to the groupware applications.
+- **managed-by-Attribute-Fileshare**: Members of this group have access to the file sharing application.
+- **managed-by-Attribute-Projectmanagement**: Members of this group have access to the project management application.
+- **managed-by-Attribute-Knowledgemanagement**: Members of this group have access to the wiki application.
+- **managed-by-Attribute-Livecollaboration**: Members of this group have access to the chat application.
+- **managed-by-Attribute-Videoconference**: Members of this group have access to the video conferencing application.
+
+#### Administrative access to applications
+
+Within some applications it is possible to grant users elevated permissions, these are also primarily managed by attributes from the "openDesk" tab when editing a user, but are also automatically mapped to the following groups:
+
+- **managed-by-Attribute-FileshareAdmin**: Members of this group can administrate the file sharing application.
+- **managed-by-Attribute-ProjectmanagementAdmin**: Members of this group can administrate the project management application.
+- **managed-by-Attribute-KnowledgemanagementAdmin**: Members of this group can administrate the wiki application.
+
+### Custom groups
+
+While openDesk ships with predefined groups, additional groups can be [created](https://docs.opendesk.eu/administration/gruppen/) by an *IAM Administrator*.
+
+## Assigning roles/groups and permissions
+
+Users get roles assigned based on their responsibilities and the tasks they need to perform. This assignment can be done by an admin through the [administration portal](https://docs.opendesk.eu/administration/).
+
+## Predefined roles/user templates
+
+openDesk defines [templates](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/blob/main/udm/udm-data-loader/65-usertemplate.yaml) for the *User* and *Administrator* roles. The templates can be used by an *openDesk Administrator* to create users with these roles using the [administration portal](https://docs.opendesk.eu/administration/).
+
+> [!note]
+> Additional/custom templates can be created using the UDM REST API.
+
+### *openDesk User*
+
+The *openDesk User* template sets the primary group to *Domain Users* and initially sets the following permissions:
+
+- **Groupware**: Enabled
+- **Chat**: Enabled
+- **Knowledge Management**: Enabled
+- **Project Management**: Enabled
+- **File Sharing**: Enabled
+- **Video Conference**: Enabled
+- **Knowledge Management Admin**: Disabled
+- **Project Management Admin**: Disabled
+- **File Sharing Admin**: Disabled
+
+### *openDesk Administrator*
+
+The *openDesk Administrator* template sets the primary group to *Domain Admins* and initially sets the following permissions:
+
+- **Groupware**: Disabled
+- **Chat**: Disabled
+- **Knowledge Management**: Disabled
+- **Project Management**: Disabled
+- **File Sharing**: Disabled
+- **Video Conference**: Disabled
+- **Knowledge Management Admin**: Disabled
+- **Project Management Admin**: Disabled
+- **File Sharing Admin**: Disabled
+
+## Managing permissions
+
+*Administrators* can manage permissions of *Users* using the [administration portal](https://docs.opendesk.eu/administration/).
+
+By using roles and permissions, openDesk ensures that users have the appropriate level of access, enhancing both security and efficiency.
+
+## Hierarchies and delegation
+
+The IAM allows for the nesting of groups, for example, a group can be both assigned to members and other groups, or just groups.
+
+## Audit/Logging
+
+Univention is about to provide audit logging which brings the idea of the [UCS based directory logger](https://docs.software-univention.de/manual/5.0/en/domain-ldap/ldap-directory.html#audit-proof-logging-of-ldap-changes) to Nubus. openDesk will offer this feature as soon as it is made available in Nubus.
+
+## Reporting
+
+The IAM webinterface supports the export of reports on users and groups, which are the essential objects when it comes to permissions. These data exports can be subjected to custom data analysis.
+
+## Delegation
+
+Currently, the temporary assignment of roles is not supported. Role membership must be managed at the time of granting / revoking the membership.
+
+## Regular review
+
+While the overall role and permission setup must be checked by the customer, including the respective custom roles, the openDesk team constantly challenges and improves role and permission management, for example, addressing the need for a distinct "support" role.
+
+# Applications
+
+Managing all application permissions within the IAM would require a superset of permissions to be available in the IAM. This would lead to a high level of administrative complexity. Instead, the application specific permissions are usually managed within an application itself and mapped to roles/groups that are managed in the IAM.
+
+## Roles/Groups
+
+Within IAM groups, the visibility of openDesk applications can be configured. Like with users, this is done in the "openDesk" tab of the [group administration](https://docs.opendesk.eu/administration/gruppen/).
+
+> [!note]
+> Currently the openDesk applications do not support nested groups. As a result only direct group memberships
+> of users are processed in the application.<br> The plan is to enable the openDesk applications to either
+> support nested groups or to actively provision users into an application while resolving the nested group
+> memberships for the application.
+
+Within an application, each available group can have a set of application specific permissions assigned.

docs/releases.md

@@ -0,0 +1,125 @@
+<!--
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Release management</h1>
+
+This document outlines the release and patch management strategy for **openDesk**, ensuring that all updates, patches, and new releases are systematically **planned, tested, documented**, and **reliably deployed** into production. The process is designed to align with operational planning requirements and maintain system stability and security.
+
+<!-- TOC -->
+* [Release cycle](#release-cycle)
+  * [Release types](#release-types)
+  * [Release schedule](#release-schedule)
+  * [Upgrades](#upgrades)
+* [Patch management process](#patch-management-process)
+  * [Patch identification \& prioritization](#patch-identification--prioritization)
+  * [Patch workflow](#patch-workflow)
+* [Communication plan](#communication-plan)
+  * [Announcement channels](#announcement-channels)
+  * [Timing of communications](#timing-of-communications)
+* [Documentation requirements](#documentation-requirements)
+* [Compliance \& review](#compliance--review)
+<!-- TOC -->
+
+# Release cycle
+
+openDesk follows a structured release cycle to ensure predictability and reliability:
+
+## Release types
+
+| Type           | Frequency     | Content                                                       |
+|----------------|---------------|---------------------------------------------------------------|
+| **Major**      | Annually (Q3) | Large feature sets, architecture changes, breaking changes |
+| **Minor**      | Monthly        | New features, enhancements, may contain breaking changes or refactors (clearly flagged in the notes)              |
+| **Patch**      | On demand      | Bug fixes, security updates, minor improvements, no intended breaking changes               |
+
+> [!note]
+> openDesk does **not** guarantee that minor releases are 100% backward‑compatible. When a breaking > change
+> is unavoidable it is announced in the release notes under a dedicated header **“Breaking Changes”** > and a
+> migration guide is provided.
+
+## Release schedule
+
+- **Major releases** are scheduled for **Q3 each year**, with planning beginning in Q1.
+- **Minor releases** occur **monthly on Mondays**, typically **around 10:00 AM** local time.
+  - Each minor release follows a **4-week cycle**.
+  - **Week 1–3**: Active development of new features and improvements.
+  - **End of Week 3**: **Feature freeze** is enforced to allow stabilization and testing.
+  - **Week 4**: Final testing, approvals, and preparation for release.
+  - At the **end of Week 4**, a new minor version is released, and a new cycle begins.
+- **Patch releases** are created **on demand**, based on criticality and urgency.
+
+## Upgrades
+
+- openDesk does not guarantee an in‑place upgrade between two major versions. Always consult the release notes and plan appropriate migration efforts.
+- Even within the same major line, skipping multiple monthly minor versions is not guaranteed to work without intermediate upgrade steps.
+- All breaking changes, including those in monthly minor releases, are highlighted in the release notes under Breaking Changes.
+- Additional, non‑binding migration hints are collected in [migrations.md](./migrations.md)
+
+# Patch management process
+
+A standardized process ensures patches are developed, prioritized, and deployed efficiently.
+
+## Patch identification & prioritization
+
+Patches are categorized by severity and urgency:
+
+| Priority Level | Criteria                                                                 |
+|----------------|--------------------------------------------------------------------------|
+| **Critical**   | Security vulnerabilities, system outages, data loss risks                |
+| **High**       | Major bugs affecting multiple users, performance degradation             |
+| **Medium**     | Functional bugs with workarounds, minor usability issues                 |
+| **Low**        | Cosmetic issues, documentation updates                                   |
+
+## Patch workflow
+
+The following steps define the patch workflow from issue identification to post-deployment review. This process ensures consistent quality and minimal disruption to users:
+
+1. **Identification**: Potential issues are detected through automated monitoring, internal testing, audits, or user reports submitted via the support ticketing system.
+2. **Assessment**: The product and engineering teams triage the issue, determine severity based on business and user impact, and prioritize it within the patch queue.
+3. **Development**: A fix is implemented on a dedicated feature or hotfix branch, adhering to coding standards and version control protocols.
+4. **Testing**: All patches undergo automated unit and integration tests, as well as manual QA validation in a staging environment that closely mirrors production.
+5. **Approval**: Once tested, the patch must be approved by the product owner or a designated release manager, with proper documentation and change control entries.
+6. **Deployment**: The patch is rolled out using CI/CD pipelines during predefined deployment windows or as soon as possible for critical issues.
+7. **Post-deployment review**: After deployment, the fix is verified in production, and monitoring tools are used to detect regressions or unintended side effects.
+
+This workflow ensures that patches are handled with the same level of discipline as planned releases, supporting both reliability and agility.
+
+# Communication plan
+
+A lightweight approach reduces manual effort while maintaining transparency.
+
+## Announcement channels
+
+| Channel | Audience | Purpose | Owner |
+|---------|----------|---------|-------|
+| **openCode Changelog** | Community & EE | Primary source of truth for every release | DevOps |
+| **Account‑Manager Mail / Ticket** | Enterprise customers | Targeted information & upgrade advice | Customer Success |
+
+## Timing of communications
+
+| Release Type | What | When |
+|--------------|------|------|
+| **Major** | Roadmap entry + migration highlights | 4 weeks before release |
+|            | Final confirmation | 1 week before release |
+| **Minor** | Changelog entry (draft) | Immediately after feature freeze (end of week 3) |
+|            | EE mail/ticket | 2 business days before deployment |
+| **Patch** | Changelog entry | Right after production deploy |
+|            | EE mail/ticket (only if impacted) | Within 1 business day |
+
+Community users consume information via openCode; Enterprise customers get an additional nudge via their account manager – **no mass mailings are sent manually**.
+
+# Documentation requirements
+
+Each release (major, minor, or patch) must include:
+
+- **Release notes** outlining new features, fixes, and known issues
+- **Change logs** with commit references and affected components
+- **Test reports** confirming QA coverage and results
+- **Deployment checklist** reviewed and approved by the product owner
+
+# Compliance & review
+
+- The release process is reviewed **bi-annually** to incorporate feedback and evolving requirements
+- Emergency patches (e.g., zero-day security issues) may bypass the standard schedule but must be documented post-deployment