feat(helmfile): Add template support for annotations

`*.yaml.gotmpl`., please read migrations.md for more details

.gitignore

@@ -5,9 +5,23 @@
 .yamllint
 
 # Ignore changes to sample environments
-helmfile/environments/dev/values.yaml.gotmpl
+helmfile/environments/dev/*.yaml.gotmpl
-helmfile/environments/prod/values.yaml.gotmpl
+helmfile/environments/test/*.yaml.gotmpl
+helmfile/environments/prod/*.yaml.gotmpl
+!helmfile/environments/dev/sample.yaml.gotmpl
+!helmfile/environments/test/sample.yaml.gotmpl
+!helmfile/environments/prod/sample.yaml.gotmpl
 
 # Ignore in CI generated files
 .kyverno/opendesk.yaml
 .kyverno/kyverno-test.yaml
+
+# Ignore editor backup files
+*~
+
+# Ignore ./log directory and *.log files
+logs
+*.log
+
+# Ignore backup files, e.g. created by the script that eases the local chart development
+*.bak

.gitlab-ci.yml

@@ -1,9 +1,10 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 include:
   - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "main"
+    ref: "v2.4.3"
     file:
       - "ci/common/automr.yml"
       - "ci/common/lint.yml"
@@ -11,47 +12,65 @@ include:
   - local: "/.gitlab/generate/generate-docs.yml"
   - project: "${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
     file: "gitlab/environments.yaml"
-    rules:
+    ref: "main"
-      - if: "$INCLUDE_ENVIRONMENTS_ENABLED != 'false'"
   - local: "/.gitlab/lint/lint-opendesk.yml"
     rules:
-      - if: "$JOB_OPENDESK_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'"
+      - if: >
+            $JOB_OPENDESK_LINTER_ENABLED == 'false' ||
+            $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event|web|trigger|api'
         when: "never"
       - when: "always"
   - local: "/.gitlab/lint/lint-kyverno.yml"
     rules:
-      - if: "$JOB_KYVERNO_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'"
+      - if: >
+            $JOB_OPENDESK_LINTER_ENABLED == 'false' ||
+            $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event|web|trigger|api'
         when: "never"
       - when: "always"
 
 stages:
   - ".pre"
+  - "renovate"
   - "scan"
   - "automr"
-  - "lint"
   - "env-cleanup"
   - "env"
-  - "basic-services-deploy"
+  - "pre-services-deploy"
-  - "component-deploy-stage-1"
+  - "010-migrations-pre"
-  - "component-deploy-stage-2"
+  - "030-services"
-  - "tests"
+  - "050-components"
+  - "060-components"
+  - "090-migrations-post"
+  - "lint"
+  - "post-prepare"
+  - "post-execute"
   - "env-stop"
-  - "generate-release-assets"
   - ".post"
 
 variables:
+  RELEASE_BRANCH: "main"
   NAMESPACE:
     description: "The name of namespaces to deploy to."
     value: ""
   CLUSTER:
-    description: "Define which cluster to use. Cluster must be defined in gitlab/environments.yaml of
+    description: "Which cluster to use. Cluster must be defined in `gitlab/environments.yaml` of the
-      sovereign-workplace-env included above."
+        repo that is included above using the env var `PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG`:
+        ${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
     value: "dev"
   MASTER_PASSWORD_WEB_VAR:
-    description: "Optional: Provide a passphrase to be used for password generation."
+    description: >
+      Optional: Provide a seed to be used for generation of all internal secrets.
+      Same seed will result in same secrets.
     value: ""
   ENV_STOP_BEFORE:
-    description: "Stop environment/delete namespace for the deployment"
+    description: "Stop environment/delete namespace for the deployment."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
+  DEBUG_ENABLED:
+    description: "Allows to set `debug.enabled` to true for a deployment, needs to be supported by stage specific\
+     configuration containting: `debug.enabled: {{ env \"DEBUG_ENABLED\" | default false }}`"
     value: "no"
     options:
       - "yes"
@@ -62,6 +81,12 @@ variables:
     options:
       - "yes"
       - "no"
+  DEPLOY_MIGRATIONS:
+    description: "Deploy K8s job for migrations (pre & post)."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
   DEPLOY_SERVICES:
     description: "Enable Service deployment."
     value: "no"
@@ -69,13 +94,7 @@ variables:
       - "yes"
       - "no"
   DEPLOY_UMS:
-    description: "Enable Univention Management Stack deployment."
+    description: "Enable Nubus deployment."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
-  DEPLOY_PROVISIONING:
-    description: "Enable Provisioning Components."
     value: "no"
     options:
       - "yes"
@@ -104,12 +123,6 @@ variables:
     options:
       - "yes"
       - "no"
-  DEPLOY_ICS:
-    description: "Enable ICS deployment."
-    value: "no"
-    options:
-      - "yes"
-      - "no"
   DEPLOY_XWIKI:
     description: "Enable XWiki deployment."
     value: "no"
@@ -134,22 +147,48 @@ variables:
     options:
       - "yes"
       - "no"
+  CREATE_DEFAULT_ACCOUNTS:
+    description: "Creates `default` and `default-admin` in the instance using the password defined as CI variable
+                 `DEFAULT_ACCOUNTS_PASSWORD`."
+    value: "no"
+    options:
+      - "yes"
+      - "no"
   RUN_TESTS:
     description: "Triggers execution of E2E-tests."
-    value: "yes"
+    value: "no"
+    options:
+      - "yes"
+      - "no"
+  RUN_RENOVATE:
+    description: "Triggers the Renovate based check for dependency updates."
+    value: "no"
     options:
       - "yes"
       - "no"
   TESTS_BRANCH:
     description: "Branch of E2E-tests on which the test pipeline is triggered"
-    value: "main"
+    value: "develop"
+  TESTS_PROJECT_URL:
+    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
+    value: "gitlab.opencode.de/api/v4/projects/1506"
+  TESTS_TESTSET:
+    description: "Selects test set for E2E-tests"
+    value: "Smoke"
+    options:
+      - "Regression"
+      - "Smoke"
+  TESTS_GRACE_PERIOD:
+    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail.
+                  GRACE_PERIOD is the period in seconds that should be waited before running the tests."
+    value: "0"
 
 .deploy-common:
   cache: {}
   dependencies: []
   extends: ".environments"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.0.1\
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.1.0\
-          @sha256:d38f41b88374e055332860018f2936db8807b763caf6089735db0484cbb2842a"
+          @sha256:74f349066ac5d20e3afaa6abd28781b4c8dc086f67e3d3c1b8345e4a9c3371b1"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
     # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD
@@ -159,7 +198,7 @@ variables:
       fi;
     - >
       echo "Installing ${COMPONENT} into ${NAMESPACE} namespace as ${HELMFILE_ENVIRONMENT} environment on ${CLUSTER}"
-    - "helmfile --namespace ${NAMESPACE} apply --suppress-diff"
+    - "helmfile --namespace ${NAMESPACE} apply --suppress-diff ${ADDITIONAL_ARGS}"
   tags:
     - "docker"
     - "kubernetes"
@@ -175,7 +214,7 @@ env-cleanup:
   needs: []
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           $ENV_STOP_BEFORE != "no"
       when: "on_success"
@@ -187,102 +226,145 @@ env-cleanup:
         done
         kubectl delete pvc --all --namespace ${NAMESPACE};
         kubectl delete jobs --all --namespace ${NAMESPACE};
+        kubectl delete configmaps --all --namespace ${NAMESPACE};
       else
         helmfile destroy --namespace ${NAMESPACE};
       fi
   stage: "env-cleanup"
 
 env-start:
-  environment:
-    name: "${NAMESPACE}"
-    on_stop: "env-stop"
   extends: ".deploy-common"
-  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/
       when: "on_success"
   script:
     - "echo \"Deploying to Environment ${NAMESPACE} in ${CLUSTER} Cluster\""
     - "kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -"
-    - >
+    - "export FILENAME_CERT_SECRET=cert_to_import.yaml"
-      kubectl create secret
+    # from self-signed-certificates.md:
-      --namespace "${NAMESPACE}"
+    # "Copy this cert's secret into the/each namespace you want to make use of the cert."
-      docker-registry external-registry
+    - |
-      --docker-server "${EXTERNAL_REGISTRY}"
+      kubectl get secret opendesk-root-cert-secret -n cert-manager -o yaml | \
-      --docker-username "${EXTERNAL_REGISTRY_USERNAME}"
+        grep -v \ uid\: | \
-      --docker-password "${EXTERNAL_REGISTRY_PASSWORD}"
+        grep -v \ resourceVersion\: | \
-      --dry-run=client -o yaml | kubectl apply -f -
+        grep -v \ creationTimestamp\: | \
+        sed --expression 's/namespace\:\ cert-manager/namespace: '"${NAMESPACE}"'/g' \
+        >${FILENAME_CERT_SECRET} || true
+    - |
+      if [ -s ${FILENAME_CERT_SECRET} ]; then
+        echo "Applying ${FILENAME_CERT_SECRET}"
+        kubectl apply -f ${FILENAME_CERT_SECRET}
+      fi
+    # from self-signed-certificates.md:
+    # "Create issuer in the/each namespace you want to make use of the cert."
+    - |
+      kubectl apply -f - <<EOF
+      apiVersion: cert-manager.io/v1
+      kind: Issuer
+      metadata:
+        name: "selfsigned-issuer"
+        namespace: ${NAMESPACE}
+      spec:
+        ca:
+          secretName: opendesk-root-cert-secret
+      EOF
   stage: "env"
 
-services-deploy:
+policies-deploy:
-  stage: "basic-services-deploy"
+  stage: "pre-services-deploy"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
       when: "on_success"
   variables:
-    COMPONENT: "services"
+    COMPONENT: "opendesk-services"
+    ADDITIONAL_ARGS: "-l name=opendesk-otterize"
 
-provisioning-deploy:
+migrations-pre:
-  stage: "component-deploy-stage-2"
+  stage: "010-migrations-pre"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no" || $DEPLOY_PROVISIONING != "no")
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
       when: "on_success"
   variables:
-    COMPONENT: "provisioning"
+    COMPONENT: "opendesk-migrations-pre"
 
-ums-deploy:
+migrations-post:
-  stage: "component-deploy-stage-1"
+  stage: "090-migrations-post"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_MIGRATIONS != "no")
+      when: "on_success"
+  variables:
+    COMPONENT: "opendesk-migrations-post"
+
+services-external-deploy:
+  stage: "030-services"
+  extends: ".deploy-common"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
+      when: "on_success"
+  variables:
+    COMPONENT: "services-external"
+
+opendesk-services-deploy:
+  stage: "030-services"
+  extends: ".deploy-common"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
+          $NAMESPACE =~ /.+/ &&
+          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
+      when: "on_success"
+  variables:
+    COMPONENT: "opendesk-services"
+
+nubus-deploy:
+  stage: "050-components"
+  extends: ".deploy-common"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no")
       when: "on_success"
   variables:
-    COMPONENT: "univention-management-stack"
+    COMPONENT: "nubus"
 
 ox-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   timeout: "30m"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_OX != "no")
       when: "on_success"
   variables:
     COMPONENT: "open-xchange"
 
-ics-deploy:
-  stage: "component-deploy-stage-1"
-  extends: ".deploy-common"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
-          $NAMESPACE =~ /.+/ &&
-          ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ICS != "no")
-      when: "on_success"
-  variables:
-    COMPONENT: "intercom-service"
-
 xwiki-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_XWIKI != "no")
       when: "on_success"
@@ -290,11 +372,11 @@ xwiki-deploy:
     COMPONENT: "xwiki"
 
 collabora-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no" || $DEPLOY_COLLABORA != "no")
       when: "on_success"
@@ -302,11 +384,11 @@ collabora-deploy:
     COMPONENT: "collabora"
 
 cryptpad-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no" || $DEPLOY_CRYPTPAD != "no")
       when: "on_success"
@@ -314,11 +396,11 @@ cryptpad-deploy:
     COMPONENT: "cryptpad"
 
 nextcloud-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no")
       when: "on_success"
@@ -326,11 +408,11 @@ nextcloud-deploy:
     COMPONENT: "nextcloud"
 
 openproject-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_OPENPROJECT != "no")
       when: "on_success"
@@ -338,23 +420,23 @@ openproject-deploy:
     COMPONENT: "openproject"
 
 openproject-bootstrap-deploy:
-  stage: "component-deploy-stage-2"
+  stage: "060-components"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || ($DEPLOY_OPENPROJECT != "no" && $DEPLOY_NEXTCLOUD != "no"))
       when: "on_success"
   variables:
-    COMPONENT: "openproject-bootstrap"
+    COMPONENT: "opendesk-openproject-bootstrap"
 
 jitsi-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_JITSI != "no")
       when: "on_success"
@@ -362,60 +444,83 @@ jitsi-deploy:
     COMPONENT: "jitsi"
 
 element-deploy:
-  stage: "component-deploy-stage-1"
+  stage: "050-components"
   extends: ".deploy-common"
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" &&
           $NAMESPACE =~ /.+/ &&
           ($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ELEMENT != "no")
       when: "on_success"
   variables:
     COMPONENT: "element"
 
-env-stop:
+fetch-administrator-credentials:
   extends: ".deploy-common"
   environment:
     name: "${NAMESPACE}"
-    action: "stop"
+  stage: "post-prepare"
-  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/alpine/k8s:1.25.6"
-  needs: []
   rules:
     - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api"
-      when: "manual"
+          && $NAMESPACE =~ /.+/
-  script:
+          && ($CREATE_DEFAULT_ACCOUNTS == "yes" || $RUN_TESTS == "yes")
-    - "echo 'We do not stop the env (delete the namespace) at the moment in this stage, as deleting a branches also
-      triggers this env-stop stage and we do not want this to happen.'"
-    # - kubectl delete namespace "${NAMESPACE}"
-  stage: "env-stop"
-  variables:
-    GIT_STRATEGY: "none"
-
-.ums-default-password: &ums-default-password
-  - |
-    UMS_PASSWORDS=$( \
-      kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}' \
-      | yq '.properties.password' > passwords.txt \
-    )
-    DEFAULT_USER_PASSWORD=$( \
-      awk 'NR==1{print $1}' passwords.txt \
-    )
-    DEFAULT_ADMIN_PASSWORD=$(
-      awk 'NR==3{print $1}' passwords.txt \
-    )
-
-run-tests:
-  extends: ".deploy-common"
-  environment:
-    name: "${NAMESPACE}"
-  stage: "tests"
-  rules:
-    - if: >
-          $CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
       when: "on_success"
   script:
-    - *ums-default-password
+    - |
+      echo "DEFAULT_ADMINISTRATOR_PASSWORD=$(
+       kubectl \
+         -n ${NAMESPACE} \
+         get secret ums-nubus-credentials \
+         -o jsonpath='{.data.administrator_password}' | base64 -d \
+      )" >> .env
+  artifacts:
+    reports:
+      dotenv: ".env"
+
+import-default-accounts:
+  stage: "post-execute"
+  extends: ".environments"
+  dependencies:
+    - "fetch-administrator-credentials"
+  environment:
+    name: "${NAMESPACE}"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $CREATE_DEFAULT_ACCOUNTS == "yes"
+      when: "on_success"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0"
+  script:
+    - "echo \"Starting default account import for ${DOMAIN}\""
+    - "cd /app"
+    - |
+      ./user_import_udm_rest_api.py \
+        --import_domain ${DOMAIN} \
+        --udm_api_password ${DEFAULT_ADMINISTRATOR_PASSWORD} \
+        --set_default_password ${DEFAULT_ACCOUNTS_PASSWORD} \
+        --import_filename ./template.ods \
+        --admin_enable_fileshare True \
+        --admin_enable_knowledgemanagement True \
+        --admin_enable_projectmanagement True \
+        --create_admin_accounts True
+
+run-tests:
+  stage: "post-execute"
+  extends: ".deploy-common"
+  dependencies:
+    - "fetch-administrator-credentials"
+  environment:
+    name: "${NAMESPACE}"
+  rules:
+    - if: >
+          $CI_PIPELINE_SOURCE =~ "web|schedules|trigger|api" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
+      when: "on_success"
+  parallel:
+    matrix:
+      - LANGUAGE:
+          - "de"
+          - "en"
+  script:
     - |
       curl --request POST \
       --header "Content-Type: application/json" \
@@ -423,35 +528,35 @@ run-tests:
         \"ref\": \"${TESTS_BRANCH}\", \
         \"token\": \"${CI_JOB_TOKEN}\", \
         \"variables\": { \
-          \"url\": \"https://portal.${DOMAIN}\", \
+          \"operator\": \"${OPERATOR}\", \
-          \"user_name\": \"${DEFAULT_USER_NAME}\", \
+          \"cluster\": \"${CLUSTER}\", \
-          \"user_password\": \"${DEFAULT_USER_PASSWORD}\", \
+          \"namespace\": \"${NAMESPACE}\", \
-          \"admin_name\": \"${DEFAULT_ADMIN_NAME}\", \
+          \"url\": \"https://portal.${DOMAIN}/\", \
-          \"admin_password\": \"${DEFAULT_ADMIN_PASSWORD}\", \
+          \"language\": \"${LANGUAGE}\", \
-          \"DEPLOY_ALL_COMPONENTS\": \"${DEPLOY_ALL_COMPONENTS}\", \
+          \"udm_api_username\": \"Administrator\", \
-          \"DEPLOY_COLLABORA\": \"${DEPLOY_COLLABORA}\", \
+          \"udm_api_password\": \"${DEFAULT_ADMINISTRATOR_PASSWORD}\", \
-          \"DEPLOY_ELEMENT\": \"${DEPLOY_ELEMENT}\", \
+          \"screenshot_test\": \"yes\", \
-          \"DEPLOY_ICS\": \"${DEPLOY_ICS}\", \
+          \"screenshot_before_step\": \"yes\", \
-          \"DEPLOY_JITSI\": \"${DEPLOY_JITSI}\", \
+          \"screenshot_after_step\": \"yes\", \
-          \"DEPLOY_KEYCLOAK\": \"${DEPLOY_UMS}\", \
+          \"screenshot_redirect_step\": \"yes\", \
-          \"DEPLOY_NEXTCLOUD\": \"${DEPLOY_NEXTCLOUD}\", \
+          \"testset\": \"${TESTS_TESTSET}\", \
-          \"DEPLOY_OPENPROJECT\": \"${DEPLOY_OPENPROJECT}\", \
+          \"testprofile\": \"Namespace\", \
-          \"DEPLOY_OX\": \"${DEPLOY_OX}\", \
+          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\" \
-          \"DEPLOY_SERVICES\": \"${DEPLOY_SERVICES}\", \
-          \"DEPLOY_UCS\": \"${DEPLOY_UMS}\", \
-          \"DEPLOY_XWIKI\": \"${DEPLOY_XWIKI}\", \
-          \"DEPLOY_PROVISIONING\": \"${DEPLOY_PROVISIONING}\" \
         } \
       }" \
       "https://${TESTS_PROJECT_URL}/trigger/pipeline"
+  retry: 1
 
 avscan-prepare:
   stage: ".pre"
   rules:
-    - if: "$JOB_AVSCAN_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: >
+          $JOB_AVSCAN_ENABLED != 'false' &&
+          $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+          $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "always"
     - when: "never"
-  image: "external-registry.souvap-univention.de/docker-remote/mikefarah/yq"
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/mikefarah/yq"
   script:
     - |
       cat << 'EOF' > dynamic-scans.yml
@@ -467,7 +572,7 @@ avscan-prepare:
           - "freshclam"
           - "mkdir /scan"
         script:
-          - "export IMAGE=${EXTERNAL_REGISTRY:-${CONTAINER_REGISTRY}}/${CONTAINER_IMAGE}:${CONTAINER_TAG}"
+          - "export IMAGE=${AV_SCAN_PROXY:-${CONTAINER_REGISTRY}}/${CONTAINER_IMAGE}:${CONTAINER_TAG}"
           - "echo Pulling and scanning $IMAGE..."
           - "crane pull $IMAGE /scan/image.tar"
           - "clamscan /scan"
@@ -475,13 +580,14 @@ avscan-prepare:
           CONTAINER_IMAGE: ""
           CONTAINER_REGISTRY: ""
           CONTAINER_TAG: ""
-          DATABASE_MIRROR: "https://nexus.souvap-univention.de/repository/ClamAV"
+          DATABASE_MIRROR: "https://gitlab.opencode.de/bmi/opendesk/tooling/clamav-db-mirror/-/raw/main"
       EOF
     - >
       yq '.images
       | with_entries(.key |= "scan-" + .)
       | .[].extends=".container-clamav"
-      | with(.[]; .variables.CONTAINER_IMAGE = .repository | .variables.CONTAINER_TAG = .tag | .variables.CONTAINER_REGISTRY = .registry)
+      | with(.[]; .variables.CONTAINER_IMAGE = .repository
+      | .variables.CONTAINER_TAG = .tag | .variables.CONTAINER_REGISTRY = .registry)
       | del(.[].repository)
       | del(.[].tag)
       | del(.[].registry)'
@@ -494,7 +600,10 @@ avscan-prepare:
 avscan-start:
   stage: "scan"
   rules:
-    - if: "$JOB_AVSCAN_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: >
+        $JOB_AVSCAN_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "always"
     - when: "never"
   trigger:
@@ -503,70 +612,52 @@ avscan-start:
         job: "avscan-prepare"
     strategy: "depend"
 
-generate-release-assets:
+# Declare .environments which is in `opendesk-env` repository. In case it is not available
-  stage: "generate-release-assets"
+# 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
-  image: "registry.souvap-univention.de/souvap/tooling/images/ansible:4.10.0"
-  rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
-      when: "on_success"
-    - when: "never"
-  script:
-    - |
-      git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/${ASSET_GENERATOR_REPO_PATH}
-      cd opendesk-asset-generator
-      export OPENDESK_DEPLOYMENT_AUTOMATION_PATH=${CI_PROJECT_DIR}
-      ./opendesk_asset_generator.py
-      mv ./build_artefacts ${CI_PROJECT_DIR}
-      cd ..
-      rm -rf opendesk-asset-generator
-      ls -l ./build_artefacts
-  artifacts:
-    paths:
-      - "./build_artefacts/chart-index.json"
-      - "./build_artefacts/image-index.json"
-  tags: []
-  variables:
-    ASSET_GENERATOR_REPO_PATH: "bmi/opendesk/tooling/opendesk-asset-generator"
-
-# Declare .environments which is in environments repository and only loaded when INCLUDE_ENVIRONMENTS_ENABLED not false.
-# 'cache' is used because job must contain at least one key, so cache is just a dummy key.
 .environments:
   cache: {}
 
 # Overwrite shared settings
 .common-semantic-release:
-  image: "registry.souvap-univention.de/souvap/tooling/images/semantic-release-patched:latest"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
   tags: []
 
 conventional-commits-linter:
   rules:
-    - if: "$JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'"
+    - if: >
+          $RUN_RENOVATE == "yes" ||
+          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
+          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
       when: "never"
     - when: "always"
 
 common-yaml-linter:
   rules:
-    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"
+    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
       when: "never"
     - when: "always"
 
 reuse-linter:
   allow_failure: false
   rules:
-    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|triggers|web|merge_request_event'"
+    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
       when: "never"
     - when: "always"
 
 generate-release-version:
   rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false'"
+    - if: >
+        $JOB_RELEASE_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "on_success"
 
 release:
-  dependencies:
-    - "generate-release-assets"
   rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: >
+        $JOB_AVSCAN_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
       when: "on_success"
   script:
     - >
@@ -581,8 +672,8 @@ release:
       fi
     - |
       echo -e "\n[INFO] Writing data to helm value file..."
-      cat <<EOF >helmfile/environments/default/global.generated.yaml
+      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
-      # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+      # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
       # SPDX-License-Identifier: Apache-2.0
       ---
       global:
@@ -593,18 +684,9 @@ release:
     - |
       cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
       {
-        "branches": ["main"],
+        "branches": ["${RELEASE_BRANCH}"],
         "plugins": [
-          ["@semantic-release/gitlab",
+          "@semantic-release/gitlab",
-            {
-              "assets": [
-                { "path": "./build_artefacts/chart-index.json",
-                  "label": "Chart Index JSON" },
-                { "path": "./build_artefacts/image-index.json",
-                  "label": "Image Index JSON" },
-              ]
-            }
-          ],
           "@semantic-release/release-notes-generator",
           "@semantic-release/changelog",
           ["@semantic-release/git", {
@@ -612,7 +694,7 @@ release:
               "charts/**/Chart.yaml",
               "CHANGELOG.md",
               "charts/**/README.md",
-              "helmfile/environments/default/global.generated.yaml",
+              "helmfile/environments/default/global.generated.yaml.gotmpl",
               ".kyverno/kyverno-test.yaml",
               "docs"
             ],
@@ -623,6 +705,21 @@ release:
       EOF
     - "semantic-release"
   needs:
-    - "generate-release-assets"
     - "generate-docs"
+
+renovate:
+  rules:
+    - if: >
+        $RUN_RENOVATE == "yes"
+      when: "on_success"
+  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
+  variables:
+    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
+    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
+    # Increase the renovatebot log level on stdout
+    LOG_LEVEL: "DEBUG"
+  script:
+    - "renovate ${RENOVATE_EXTRA_FLAGS}"
+  stage: "renovate"
 ...

.gitlab/common/common.yml

@@ -2,14 +2,13 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.4.2\
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.5.3\
-    @sha256:7a866a34b82dddea8867862afaaccb1d1e385854ce344fc71be492800a5b16a6"
+    @sha256:1296e8590b59f02311881307bb14c58b72bafc92a58e7e7e7212508abf902b00"
-  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.3\
+  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.8\
-    @sha256:096e649b985dd8e46e9dadff5f7e9c7a8772bf5a1b3df1bb2b4a887716c2ca85"
+    @sha256:59e714cad38e873cf8a9a132af76ad868b46a51ed12d0bd45477f328c0136991"
 
 .common:
   cache: {}
   needs: []
-  tags:
+  tags: []
-    - "docker"
 ...

.gitlab/generate/generate-docs.yml

@@ -13,7 +13,7 @@ generate-docs:
   extends: ".generate-common"
   image: "${OPENDESK_CI_CLI_IMAGE}"
   rules:
-    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
+    - if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $RELEASE_BRANCH"
       when: "on_success"
   script:
     - "node /app/src/index.js generate-docs -d ${CI_PROJECT_DIR}"

.gitlab/lint/lint-kyverno.yml

@@ -14,22 +14,39 @@ lint-kyverno:
           - "collabora"
           - "cryptpad"
           - "element"
-          - "intercom-service"
           - "jitsi"
           - "nextcloud"
+          - "nubus"
           - "open-xchange"
           - "openproject"
           - "openproject-bootstrap"
-          - "provisioning"
           - "services"
-          - "univention-management-stack"
           - "xwiki"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${APP}"
-    - "helmfile template -e test --include-needs > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
+    - >
-    - "node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests -d ${CI_PROJECT_DIR}/.kyverno -t required -s manifest -f opendesk.yaml --skip-tests true ${APP}"
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-env
-    - "node /app/opendesk-ci-cli/src/index.js filter-for-kinds -f ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
+      -d ${CI_PROJECT_DIR}/helmfile/environments
+    - "helmfile template -e test --include-needs --skip-tests > ${CI_PROJECT_DIR}/.kyverno/opendesk.yaml"
     - "cd ${CI_PROJECT_DIR}/.kyverno"
+    # Test optional
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
+      -d ${CI_PROJECT_DIR}/.kyverno
+      -t optional
+      -s manifest
+      -f opendesk.yaml
+      --skip-tests true
+      ${APP}
+    - "kyverno test . || true"
+    # Test required
+    - >
+      node /app/opendesk-ci-cli/src/index.js generate-kyverno-tests
+      -d ${CI_PROJECT_DIR}/.kyverno
+      -t required
+      -s manifest
+      -f opendesk.yaml
+      --skip-tests true
+      ${APP}
     - "kyverno test ."
-
 ...

.gitlab/lint/lint-opendesk.yml

@@ -7,6 +7,11 @@ include:
 lint-opendesk:
   extends: ".lint-common"
   image: "${OPENDESK_CI_CLI_IMAGE}"
+  rules:
+    - if: >
+        $RUN_RENOVATE == "yes"
+      when: "never"
+    - when: "always"
   script:
     - "node /app/src/index.js sort-all -d ${CI_PROJECT_DIR}/helmfile"
     - "git diff --exit-code"

.gitlab/merge_request_templates/Default.md

@@ -0,0 +1,16 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Summary
+
+- *describe the reason for/content of the MR*
+
+# Commits
+
+%{all_commits}
+
+# Authors
+
+%{co_authored_by}

.kyverno/policies/_policies.yaml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 pod:
@@ -12,16 +12,16 @@ pod:
       - "Pod"
       - "DaemonSet"
   - name: "disallow-default-serviceaccount"
-    rule: "require-sa"
+    rule: "disallow-default-serviceAccountName"
-    type: "required"
+    type: "optional"
     kinds:
       - "StatefulSet"
       - "Deployment"
       - "Job"
       - "Pod"
       - "DaemonSet"
-  - name: "require-imagepullsecrets"
+  - name: "template-imagepullsecrets"
-    rule: "require-imagepullsecrets"
+    rule: "template-imagePullSecrets"
     type: "required"
     kinds:
       - "StatefulSet"
@@ -30,7 +30,7 @@ pod:
       - "Pod"
       - "DaemonSet"
   - name: "disallow-latest-tag"
-    rule: "validate-image-tag"
+    rule: "disallow-latest-tag"
     type: "required"
     kinds:
       - "StatefulSet"
@@ -38,8 +38,17 @@ pod:
       - "Job"
       - "Pod"
       - "DaemonSet"
-  - name: "require-imagepullpolicy-always"
+  - name: "disallow-latest-tag"
-    rule: "require-imagepullpolicy-always"
+    rule: "require-image-tag-or-digest"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-imagepullpolicy"
+    rule: "require-imagePullPolicy"
     type: "required"
     kinds:
       - "StatefulSet"
@@ -49,29 +58,29 @@ pod:
       - "DaemonSet"
   - name: "require-health-and-liveness-check"
     rule: "require-health-and-liveness-check"
-    type: "required"
+    type: "optional"
     kinds:
       - "StatefulSet"
       - "Deployment"
       - "Pod"
       - "DaemonSet"
-  - name: "require-storage"
+  - name: "template-storage"
-    rule: "require-storageclass-pvc"
+    rule: "template-storageClassName-pod"
     type: "required"
     kinds:
       - "PersistentVolumeClaim"
-  - name: "require-storage"
+  - name: "template-storage"
-    rule: "require-storageclass-pod"
+    rule: "template-storageClassName-pvc"
     type: "required"
     kinds:
       - "StatefulSet"
-  - name: "require-storage"
+  - name: "template-storage"
-    rule: "require-storage-size-pvc"
+    rule: "template-requests-storage-pod"
     type: "required"
     kinds:
       - "PersistentVolumeClaim"
-  - name: "require-storage"
+  - name: "template-storage"
-    rule: "require-storage-size-pod"
+    rule: "template-requests-storage-pvc"
     type: "required"
     kinds:
       - "StatefulSet"
@@ -84,8 +93,8 @@ pod:
       - "Job"
       - "Pod"
       - "DaemonSet"
-  - name: "restrict-image-registries"
+  - name: "template-image-registries"
-    rule: "validate-registries"
+    rule: "template-image-registries"
     type: "required"
     kinds:
       - "StatefulSet"
@@ -149,7 +158,7 @@ pod:
       - "DaemonSet"
   - name: "require-containersecuritycontext"
     rule: "require-seccomp-profile"
-    type: "required"
+    type: "optional"
     kinds:
       - "StatefulSet"
       - "Deployment"
@@ -165,4 +174,119 @@ pod:
       - "Job"
       - "Pod"
       - "DaemonSet"
+  - name: "require-containersecuritycontext"
+    rule: "require-empty-seLinuxOptions"
+    type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-containersecuritycontext"
+    rule: "require-default-procMount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "require-containersecuritycontext"
+    rule: "restrict-sysctls"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-docker-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-containerd-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-crio-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-container-sock-mounts"
+    rule: "validate-dockerd-sock-mount"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-namespaces"
+    rule: "disallow-host-namespaces"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-path"
+    rule: "disallow-host-path"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-ports"
+    rule: "disallow-host-ports"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "disallow-host-process"
+    rule: "disallow-host-process"
+    type: "required"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
+      - "Job"
+      - "Pod"
+      - "DaemonSet"
+  - name: "template-ingress"
+    rule: "template-ingressClassName"
+    type: "required"
+    kinds:
+      - "Ingress"
+  - name: "template-ingress"
+    rule: "template-tls-secretName"
+    type: "required"
+    kinds:
+      - "Ingress"
+  - name: "template-replicas"
+    rule: "template-replicas"
+    type: "optional"
+    kinds:
+      - "StatefulSet"
+      - "Deployment"
 ...

.kyverno/policies/disallow-container-sock-mounts.yaml

@@ -0,0 +1,80 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-container-sock-mounts"
+  annotations:
+    policies.kyverno.io/title: "Disallow CRI socket mounts"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Container daemon socket bind mounts allow access to the container engine on the node.
+      This access can be used for privilege escalation and to manage containers outside of Kubernetes, and hence should
+      not be allowed.
+      This policy validates that the sockets used for CRI engines Docker, Containerd, and CRI-O are not used.
+      In addition to or replacement of this policy, preventing users from mounting the parent directories
+      (/var/run and /var) may be necessary to completely prevent socket bind mounts.
+spec:
+  background: true
+  rules:
+    - name: "validate-docker-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the Docker Unix socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/docker.sock"
+          - spec:
+              =(volumes):
+    - name: "validate-containerd-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the Containerd Unix socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/containerd/containerd.sock"
+          - spec:
+              =(volumes):
+    - name: "validate-crio-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the CRI-O Unix socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/crio/crio.sock"
+          - spec:
+              =(volumes):
+    - name: "validate-dockerd-sock-mount"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: "Use of the Docker CRI socket is not allowed."
+        anyPattern:
+          - spec:
+              =(volumes):
+                - =(hostPath):
+                    path: "!/var/run/cri-dockerd.sock"
+          - spec:
+              =(volumes):

.kyverno/policies/disallow-default-serviceaccount.yaml

@@ -1,10 +1,20 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "disallow-default-serviceaccount"
+  annotations:
+    policies.kyverno.io/title: "Prevent default ServiceAccount privilege escalation"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Kubernetes automatically creates a ServiceAccount object named default for every namespace in your cluster.
+      These default service accounts get no permissions by default.
+      Accidental or intended assignment of permissions on the default service account results in elevated permissions
+      for all pods with default service account assigned.
+      This risk can be mitigated by creating a custom ServiceAccount for each application or reduce the risk by disable
+      auto mounting the default service account into the pod.
 spec:
   background: true
   rules:
@@ -12,11 +22,15 @@ spec:
         resources:
           kinds:
             - "Pod"
-      name: "require-sa"
+      name: "disallow-default-serviceAccountName"
       validate:
-        message: "serviceAccountName must be set to anything other than 'default'."
+        message: >-
-        pattern:
+          Field serviceAccountName must be set to anything other than 'default'.
-          spec:
+          When serviceAccountName is 'default' then automountServiceAccountToken must set to 'false' .
-            serviceAccountName: "!default"
+        anyPattern:
+          - spec:
+              serviceAccountName: "!default"
+          - spec:
+              automountServiceAccountToken: "false"
   validationFailureAction: "audit"
 ...

.kyverno/policies/disallow-host-namespaces.yaml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-namespaces"
+  annotations:
+    policies.kyverno.io/title: "Disallow Host Namespaces"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Host namespaces (Process ID namespace, Inter-Process Communication namespace, and network namespace) allow access
+      to shared information and can be used to elevate privileges.
+      Pods should not be allowed access to host namespaces.
+      This policy ensures fields which make use of these host namespaces are unset or set to `false`.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-namespaces"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
+          spec.hostIPC, and spec.hostPID must be unset or set to `false`.
+        pattern:
+          spec:
+            =(hostPID): "false"
+            =(hostIPC): "false"
+            =(hostNetwork): "false"

.kyverno/policies/disallow-host-path.yaml

@@ -0,0 +1,32 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-path"
+  annotations:
+    policies.kyverno.io/title: "Disallow hostPath"
+    policies.kyverno.io/subject: "Pod,Volume"
+    policies.kyverno.io/description: >-
+      HostPath volumes let Pods use host directories and volumes in containers.
+      Using host resources can be used to access shared data or escalate privileges and should not be allowed.
+      This policy ensures no hostPath volumes are in use.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-path"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.
+        anyPattern:
+          - spec:
+              =(volumes):
+                - X(hostPath): "null"
+          - spec:
+              =(volumes):

.kyverno/policies/disallow-host-ports.yaml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-ports"
+  annotations:
+    policies.kyverno.io/title: "Disallow hostPorts"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Access to host ports allows potential snooping of network traffic and should not be allowed, or at minimum
+      restricted to a known list. This policy ensures the `hostPort` field is unset or set to `0`.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-ports"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort
+          , spec.initContainers[*].ports[*].hostPort, and spec.ephemeralContainers[*].ports[*].hostPort
+          must either be unset or set to `0`.
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(ports):
+                  - =(hostPort): 0
+            =(initContainers):
+              - =(ports):
+                  - =(hostPort): 0
+            containers:
+              - =(ports):
+                  - =(hostPort): 0

.kyverno/policies/disallow-host-process.yaml

@@ -0,0 +1,45 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "disallow-host-process"
+  annotations:
+    policies.kyverno.io/title: "Disallow hostProcess"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Windows pods offer the ability to run HostProcess containers which enables privileged access to the Windows node.
+      Privileged access to the host is disallowed in the baseline policy.
+      HostProcess pods are an alpha feature as of Kubernetes v1.22.
+      This policy ensures the `hostProcess` field, if present, is set to `false`.
+spec:
+  background: true
+  rules:
+    - name: "disallow-host-process"
+      match:
+        any:
+          - resources:
+              kinds:
+                - "Pod"
+      validate:
+        message: >-
+          HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess,
+          spec.containers[*].securityContext.windowsOptions.hostProcess,
+          spec.initContainers[*].securityContext.windowsOptions.hostProcess, and
+          spec.ephemeralContainers[*].securityContext.windowsOptions.hostProcess must either be undefined or set to
+          `false`.
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(securityContext):
+                  =(windowsOptions):
+                    =(hostProcess): "false"
+            =(initContainers):
+              - =(securityContext):
+                  =(windowsOptions):
+                    =(hostProcess): "false"
+            containers:
+              - =(securityContext):
+                  =(windowsOptions):
+                    =(hostProcess): "false"

.kyverno/policies/disallow-latest-tag.yaml

@@ -1,10 +1,18 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "disallow-latest-tag"
+  annotations:
+    policies.kyverno.io/title: "Disallow usage of latest tag"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      The ':latest' tag is mutable and can lead to unexpected errors if the image changes.
+      A best practice is to use an immutable tag that maps to a specific version of an application Pod.
+      This policy validates that the image specifies a tag and that it is not called `latest`.
+      Defining no image tag or digest result in the container engine retrieving the latest tag.
 spec:
   background: true
   rules:
@@ -12,7 +20,7 @@ spec:
         resources:
           kinds:
             - "Pod"
-      name: "validate-image-tag"
+      name: "disallow-latest-tag"
       validate:
         message: "Using a mutable image tag e.g. 'latest' is not allowed."
         pattern:
@@ -23,5 +31,27 @@ spec:
               - image: "!*:latest"
             containers:
               - image: "!*:latest"
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "require-image-tag-or-digest"
+      validate:
+        message: "A image tag or a digest is required, otherwise latest tag is chosen."
+        anyPattern:
+          - spec:
+              =(ephemeralContainers):
+                - image: "*:*"
+              =(initContainers):
+                - image: "*:*"
+              containers:
+                - image: "*:*"
+          - spec:
+              =(ephemeralContainers):
+                - image: "*@*"
+              =(initContainers):
+                - image: "*@*"
+              containers:
+                - image: "*@*"
   validationFailureAction: "audit"
 ...

.kyverno/policies/require-containersecuritycontext.yaml

@@ -1,10 +1,16 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-containersecuritycontext"
+  annotations:
+    policies.kyverno.io/title: "ContainerSecurityContext best practices are set."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      The containerSecurityContext is the most important security-related section because it has the highest precedence
+      and restricts the container to its minimal privileges.
 spec:
   background: true
   rules:
@@ -169,5 +175,70 @@ spec:
               - securityContext:
                   runAsNonRoot: true
 
+    - name: "require-empty-seLinuxOptions"
+      match:
+        resources:
+          kinds:
+            - "Pod"
+      validate:
+        message: "SELinux options have to be unset."
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - securityContext:
+                  seLinuxOptions:
+            =(initContainers):
+              - securityContext:
+                  seLinuxOptions:
+            containers:
+              - securityContext:
+                  seLinuxOptions:
+
+    - name: "require-default-procMount"
+      match:
+        resources:
+          kinds:
+            - "Pod"
+      validate:
+        message: >-
+          Changing the proc mount from the default is not allowed. The fields
+          spec.containers[*].securityContext.procMount, spec.initContainers[*].securityContext.procMount,
+          and spec.ephemeralContainers[*].securityContext.procMount must be unset or
+          set to `Default`.
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - =(securityContext):
+                  =(procMount): "Default"
+            =(initContainers):
+              - =(securityContext):
+                  =(procMount): "Default"
+            containers:
+              - =(securityContext):
+                  =(procMount): "Default"
+
+    - name: "restrict-sysctls"
+      match:
+        resources:
+          kinds:
+            - "Pod"
+      validate:
+        message: >-
+          Setting additional sysctls above the allowed type is not allowed.
+          The field spec.securityContext.sysctls must be unset or not use any other names
+          than kernel.shm_rmid_forced, net.ipv4.ip_local_port_range,
+          net.ipv4.ip_unprivileged_port_start, net.ipv4.tcp_syncookies and
+          net.ipv4.ping_group_range.
+        pattern:
+          spec:
+            =(securityContext):
+              =(sysctls):
+                - =(name): >-
+                    kernel.shm_rmid_forced |
+                    net.ipv4.ip_local_port_range |
+                    net.ipv4.ip_unprivileged_port_start |
+                    net.ipv4.tcp_syncookies |
+                    net.ipv4.ping_group_range
+
   validationFailureAction: "audit"
 ...

.kyverno/policies/require-health-and-liveness-check.yaml

@@ -1,10 +1,20 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-health-and-liveness-check"
+  annotations:
+    policies.kyverno.io/title: "Disallow usage of latest tag"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      Liveness and readiness probes need to be configured to correctly manage a Pod's lifecycle during deployments,
+      restarts, and upgrades.
+      For each Pod, a periodic `livenessProbe` is performed by the kubelet to determine if the Pod's containers are
+      running or need to be restarted.
+      A `readinessProbe` is used by Services and Pods to determine if the Pod is ready to receive network traffic.
+      This policy validates that all containers have livenessProbe and readinessProbe defined.
 spec:
   background: true
   rules:
@@ -14,8 +24,9 @@ spec:
             - "Pod"
       name: "require-health-and-liveness-check"
       validate:
-        message: "Liveness and readiness probes are required. spec.containers[*].livenessProbe.periodSeconds
+        message: >-
-          must be set to a value greater than 0."
+          Liveness and readiness probes are required. spec.containers[*].livenessProbe.periodSeconds must be set to a
+          value greater than 0.
         pattern:
           spec:
             containers:

.kyverno/policies/require-imagepullpolicy-always.yaml

@@ -1,40 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-apiVersion: "kyverno.io/v1"
-kind: "ClusterPolicy"
-metadata:
-  name: "require-imagepullpolicy-always"
-spec:
-  background: true
-  rules:
-    - match:
-        resources:
-          kinds:
-            - "Pod"
-      name: "require-imagepullpolicy-always"
-      validate:
-        message: "The imagePullPolicy must be set to `Always` when the tag `latest` is used."
-        anyPattern:
-          - spec:
-              =(ephemeralContainers):
-                - (image): "*:latest"
-                  imagePullPolicy: "Always"
-              =(initContainers):
-                - (image): "*:latest"
-                  imagePullPolicy: "Always"
-              containers:
-                - (image): "*:latest"
-                  imagePullPolicy: "Always"
-          - spec:
-              =(ephemeralContainers):
-                - (image): "!*:latest"
-                  imagePullPolicy: "IfNotPresent"
-              =(initContainers):
-                - (image): "!*:latest"
-                  imagePullPolicy: "IfNotPresent"
-              containers:
-                - (image): "!*:latest"
-                  imagePullPolicy: "IfNotPresent"
-  validationFailureAction: "audit"
-...

.kyverno/policies/require-imagepullpolicy.yaml

@@ -0,0 +1,51 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "require-imagepullpolicy"
+  annotations:
+    policies.kyverno.io/title: "Disallow usage of latest tag"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      If the `latest` tag is allowed for images, it is a good idea to have the imagePullPolicy field set to `Always` to
+      ensure later pulls get an updated image in case the latest tag gets updated.
+      This policy validates the imagePullPolicy is set to `Always` when the `latest` tag is specified explicitly or
+      where a tag is not defined at all.
+      Additionally this policy checks if the variable `.Values.global.imagePullPolicy` is used in templates.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "require-imagePullPolicy"
+      validate:
+        message: >-
+          The imagePullPolicy must be set to `Always` when the `latest` tag is used, otherwise the value from
+          `.Values.global.imagePullPolicy` has to be used.
+        anyPattern:
+          - spec:
+              =(ephemeralContainers):
+                - (image): "*:latest | !*:*"
+                  imagePullPolicy: "Always"
+              =(initContainers):
+                - (image): "*:latest | !*:*"
+                  imagePullPolicy: "Always"
+              containers:
+                - (image): "*:latest | !*:*"
+                  imagePullPolicy: "Always"
+          - spec:
+              =(ephemeralContainers):
+                - (image): "!*:latest"
+                  imagePullPolicy: "kyverno"
+              =(initContainers):
+                - (image): "!*:latest"
+                  imagePullPolicy: "kyverno"
+              containers:
+                - (image): "!*:latest"
+                  imagePullPolicy: "kyverno"
+  validationFailureAction: "audit"
+...

.kyverno/policies/require-imagepullsecets.yaml

@@ -1,23 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-apiVersion: "kyverno.io/v1"
-kind: "ClusterPolicy"
-metadata:
-  name: "require-imagepullsecrets"
-spec:
-  background: true
-  rules:
-    - match:
-        resources:
-          kinds:
-            - "Pod"
-      name: "require-imagepullsecrets"
-      validate:
-        message: "ImagePullSecrets are required."
-        pattern:
-          spec:
-            imagePullSecrets:
-              - name: "*"
-  validationFailureAction: "audit"
-...

.kyverno/policies/require-requests-limits.yaml

@@ -1,10 +1,20 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-requests-limits"
+  annotations:
+    policies.kyverno.io/title: "Require resources cpu/memory request and limits."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      As application workloads share cluster resources, it is important to limit resources requested and consumed by
+      each Pod.
+      It is recommended to require resource requests and limits per Pod, especially for memory and CPU.
+      If a Namespace level request or limit is specified, defaults will automatically be applied to each Pod based on
+      the LimitRange configuration.
+      This policy validates that all containers have specified requests for memory and CPU and a limit for memory.
 spec:
   background: true
   rules:
@@ -17,6 +27,20 @@ spec:
         message: "CPU and memory resource requests and limits are required."
         pattern:
           spec:
+            =(ephemeralContainers):
+              - resources:
+                  limits:
+                    memory: "?*"
+                  requests:
+                    cpu: "?*"
+                    memory: "?*"
+            =(initContainers):
+              - resources:
+                  limits:
+                    memory: "?*"
+                  requests:
+                    cpu: "?*"
+                    memory: "?*"
             containers:
               - resources:
                   limits:

.kyverno/policies/require-tag-and-digest.yaml

@@ -1,10 +1,18 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
   name: "require-tag-and-digest"
+  annotations:
+    policies.kyverno.io/title: "Require tag and digest for image."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      To ensure that containers are not compromised in container registry by pushing malicious code to the same tag, it
+      is required to reference images by setting a sha256 hashed digest.
+      Setting only the digest is complicated for humans to compare software versions, therefore in openDesk it is
+      required to reference container images by tag and digest.
 spec:
   background: true
   rules:

.kyverno/policies/restrict-image-registries.yaml

@@ -1,27 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-apiVersion: "kyverno.io/v1"
-kind: "ClusterPolicy"
-metadata:
-  name: "restrict-image-registries"
-spec:
-  background: true
-  rules:
-    - match:
-        resources:
-          kinds:
-            - "Pod"
-      name: "validate-registries"
-      validate:
-        message: "Unknown image registry."
-        pattern:
-          spec:
-            =(ephemeralContainers):
-              - image: "external-registry.souvap-univention.de/*"
-            =(initContainers):
-              - image: "external-registry.souvap-univention.de/*"
-            containers:
-              - image: "external-registry.souvap-univention.de/*"
-  validationFailureAction: "audit"
-...

.kyverno/policies/template-image-registries.yaml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-image-registries"
+  annotations:
+    policies.kyverno.io/title: "Check image registry template"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy verifies that a custom external registry can be template to allow downloads from a private registry or
+      cache.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "template-image-registries"
+      validate:
+        message: "Unknown image registry."
+        pattern:
+          spec:
+            =(ephemeralContainers):
+              - image: "my_private_registry.domain.tld/*"
+            =(initContainers):
+              - image: "my_private_registry.domain.tld/*"
+            containers:
+              - image: "my_private_registry.domain.tld/*"
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-ingress.yaml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-ingress"
+  annotations:
+    policies.kyverno.io/title: "Validate openDesk Ingress templating"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy verifies that ingress variables are templated.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Ingress"
+      name: "template-ingressClassName"
+      validate:
+        message: "Verifies that ingressClassName can be customized by `.Values.ingress.ingressClassName` variable."
+        pattern:
+          spec:
+            ingressClassName: "kyverno"
+    - match:
+        resources:
+          kinds:
+            - "Ingress"
+      name: "template-tls-secretName"
+      validate:
+        message: "Verifies that tls.secretName can be customized by `.Values.ingress.tls.secretName` variable."
+        pattern:
+          spec:
+            tls:
+              - secretName: "kyverno-tls"
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-replicas.yaml

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-replicas"
+  annotations:
+    policies.kyverno.io/title: "Validate openDesk Pod replicas templating"
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy verifies that `.Values.replicas.<app>` variables are templated.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Deployment"
+            - "StatefulSet"
+      name: "template-replicas"
+      validate:
+        message: "Verifies that replica count can be customized by `.Values.replicas.<app>` variable."
+        pattern:
+          spec:
+            replicas: 42
+
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-require-imagepullsecets.yaml

@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+apiVersion: "kyverno.io/v1"
+kind: "ClusterPolicy"
+metadata:
+  name: "template-imagepullsecrets"
+  annotations:
+    policies.kyverno.io/title: "ImagePullSecrets template variable have to be implemented."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      It is recommended to cache images to ensure continuous image availability during network partitions, rate limiting
+      or registry outages.
+      These caches as well as a company proxy may require authentication which will be provided as ImagePullSecrets.
+      This is a openDesk test to ensure that environment variables are templated in Helmfile deployment.
+spec:
+  background: true
+  rules:
+    - match:
+        resources:
+          kinds:
+            - "Pod"
+      name: "template-imagePullSecrets"
+      validate:
+        message: "ImagePullSecrets are required."
+        pattern:
+          spec:
+            imagePullSecrets:
+              - name: "kyverno-test"
+  validationFailureAction: "audit"
+...

.kyverno/policies/template-storage.yaml

@@ -4,7 +4,13 @@
 apiVersion: "kyverno.io/v1"
 kind: "ClusterPolicy"
 metadata:
-  name: "require-storage"
+  name: "template-storage"
+  annotations:
+    policies.kyverno.io/title: "Validate storageClass and size templates."
+    policies.kyverno.io/subject: "Pod"
+    policies.kyverno.io/description: >-
+      This policy validates if `.Values.persistence.storageClassNames` variables are used in templates and if the size
+      of volumes can be customized by `.Values.persistence.size` variable.
 spec:
   background: true
   rules:
@@ -12,9 +18,9 @@ spec:
         resources:
           kinds:
             - "StatefulSet"
-      name: "require-storageclass-pod"
+      name: "template-storageClassName-pod"
       validate:
-        message: "VolumeClaims inside pods need to have storageClass set when templated."
+        message: "VolumeClaims inside pods needs to have storageClass set when templated."
         pattern:
           spec:
             (volumeClaimTemplates):
@@ -24,9 +30,9 @@ spec:
         resources:
           kinds:
             - "PersistentVolumeClaim"
-      name: "require-storageclass-pvc"
+      name: "template-storageClassName-pvc"
       validate:
-        message: "Persistent Volume Claim need to have storageClassName set when templated."
+        message: "PersistentVolumeClaim needs to have storageClassName set when templated."
         pattern:
           spec:
             storageClassName: "kyverno-test"
@@ -35,9 +41,9 @@ spec:
         resources:
           kinds:
             - "StatefulSet"
-      name: "require-storage-size-pod"
+      name: "template-requests-storage-pod"
       validate:
-        message: "VolumeClaims inside pods need to have storageClass set when templated."
+        message: "VolumeClaims inside pods needs to have storageClass set when templated."
         pattern:
           spec:
             (volumeClaimTemplates):
@@ -49,9 +55,9 @@ spec:
         resources:
           kinds:
             - "PersistentVolumeClaim"
-      name: "require-storage-size-pvc"
+      name: "template-requests-storage-pvc"
       validate:
-        message: "Persistent Volume Claim need to have storageClassName set when templated."
+        message: "PersistentVolumeClaim needs to have storageClassName set when templated."
         pattern:
           spec:
             resources:

.renovate/config.yaml

@@ -0,0 +1,92 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# Platform type of repository
+platform: "gitlab"
+
+# Enable onboarding merge request
+onboarding: false
+
+# If set to true: keep repository data between runs instead of deleting the data
+persistRepoData: false
+
+# Controls Renovate's behavior regarding repository config files such as renovate.json
+requireConfig: "ignored"
+
+# List of Repositories
+# See: https://docs.renovatebot.com/configuration-options/
+repositories:
+  - repository: "bmi/opendesk/deployment/opendesk"
+    # Set the branch to read current dependency state from, this is especially useful during
+    # renovate setup when looking into your feature branch or when your default branch is
+    # not the one you want to check on.
+    baseBranches: [ "develop" ]
+    # Set a limit for the maximum number of parallel MRs (default 10)
+    prConcurrentLimit: 50
+    # Prefix to use for all branch names created by renovate bot (default: "renovate/")
+    branchPrefix: "renovate/"
+    # Lowercase merge request and commit titles ("never" = leave titles untouched )
+    commitMessageLowerCase: "never"
+    # Commit scope to use if Semantic Commits are enabled (fix(<scope>)...)
+    semanticCommitScope: "renovate"
+    # Commit type to use if Semantic Commits are enabled (default: "chore")
+    semanticCommitType: "chore"
+    # Enable dependency dashboard
+    dependencyDashboard: true
+    # Include package files only within these defined paths
+    includePaths:
+      - "helmfile/environments/default/images.yaml.gotmpl"
+      - "helmfile/environments/default/charts.yaml.gotmpl"
+    customManagers:
+      - customType: "regex"
+        fileMatch:
+          - "helmfile/environments/default/images.yaml.gotmpl"
+        datasourceTemplate: "docker"
+        matchStrings:
+          # yamllint disable rule:line-length rule:quoted-strings
+          - ' providerResponsible: "(?<depType>.+?)"[\s\S]+? upstreamRegistry: "(?<registryUrl>.+?)"[\s\S]+? upstreamRepository: "(?<depName>.+?)"[\s\S]+? tag: "(?<currentValue>[^@]+)@(?<currentDigest>sha256:[a-f0-9]+)"'
+          # yamllint enable rule:line-length rule:quoted-strings
+      - customType: "regex"
+        fileMatch:
+          - "helmfile/environments/default/charts.yaml.gotmpl"
+        datasourceTemplate: "docker"
+        matchStrings:
+          # yamllint disable rule:line-length rule:quoted-strings
+          - ' providerResponsible: "(?<depType>.+?)"[\s\S]+? upstreamRegistry: "(?<registryUrl>.+?)"[\s\S]+? upstreamRepository: "(?<depName>.+?)"[\s\S]+? version: "(?<currentValue>.+?)"'
+          # yamllint enable rule:line-length rule:quoted-strings
+    # Rules for matching packages
+    packageRules:
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "openDesk" ]
+        groupName: "Platform"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Collabora" ]
+        groupName: "Collabora"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Element" ]
+        groupName: "Element"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Nordeck" ]
+        groupName: "Nordeck"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Open-Xchange" ]
+        groupName: "Open-Xchange"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "OpenProject" ]
+        groupName: "OpenProject"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "OpenProject" ]
+        groupName: "OpenProject"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "Univention" ]
+        groupName: "Univention"
+      - matchDatasources: [ "docker" ]
+        matchDepTypes: [ "XWiki" ]
+        groupName: "XWiki"
+    # Add merge request labels
+    labels:
+      - "renovate"
+    # Enable custom regex manager only
+    enabledManagers:
+      - "custom.regex"
+...

.reuse/dep5

@@ -1,12 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: openDesk
-Upstream-Contact: <git+bmi-souveraener-arbeitsplatz-cla-1339-29pr0g9pj4or9yi6wfly6pbhg-issue@opencode.de>
-Source: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace
-
-Files: helmfile/environments/default/theme/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: Apache-2.0
-
-Files: helmfile/files/gpg-pubkeys/*
-Copyright: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-License: CC0-1.0

CHANGELOG.md

@@ -1,3 +1,312 @@
+# [1.0.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.9.0...v1.0.0) (2024-10-14)
+
+
+### Bug Fixes
+
+* **ci:** Add TESTS_GRACE_PERIOD variable for run-tests job. ([1023f3d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1023f3d081a980a794850399f133cf817448c431))
+* **ci:** Re-enable e2e test trigger. ([603b102](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/603b102f41b8a7e3bfab1c7d45cd05da96c455f6))
+* **ci:** Remove K8s secret creation for `EXTERNAL_REGISTRY_USERNAME` / `EXTERNAL_REGISTRY_PASSWORD`. ([cbe6b1a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cbe6b1ae6c01beb68ae3bcc0d2444f4b48c8e2ea))
+* **ci:** Trigger e2e tests for multiple languages. ([9d7d89f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d7d89f74f49c384e9632b74cbe20a641725caa7))
+* **collabora:** Add ipFamilies cluster.networking option ([add2ab1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/add2ab1a41e422295ccd58c09aa9fab9b45f18cb))
+* **collabora:** Reduce Collabora's securityContext capabilities. ([a7ea701](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7ea701cc65ab230d269e4f6b91b39a03c126fad))
+* **collabora:** Set Nextcloud URL for custom font support. ([370c7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/370c7cd836b46fb31c79b59d76297abd8748a711))
+* **collabora:** Update to 24.04.6.1.1. ([97f7a1c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/97f7a1cafd743c5e91f9cce6d028c54281afda81))
+* **collabora:** Update to 24.04.6.2.1. ([3d44193](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d441933ca1c28911218ebc073e7b1d39e402325))
+* **collabora:** Update to 24.04.7.1.2. ([11ebb80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11ebb80494d181b8ef4793e3e59f3e6ac225b072))
+* **collabora:** Update to 24.04.7.2. ([5f72da4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5f72da4e579aeb749c045bb7f25355b3e12b411a))
+* **docs:** Update `replicas.yaml` and  `docs/scaling.md`. ([45715a2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/45715a20594dafe833041d5843c857bc0e23dcbc))
+* **docs:** Various updates. ([8aa1a7f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8aa1a7fa7d106d2e70b1e31b6bda5febb3afec66))
+* **element:** Feature toggle for user controlled updates of their Element display name; new default for generating MatrixID, check docs/migrations.md for details. ([efc41cb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/efc41cb3aa0294d79f6cad3d9e879380745fef57))
+* **element:** Set Synapse rate limit. ([4ff720d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4ff720d36fa30f5f3a7328edd3bfc7edf89cf48f))
+* **element:** Update 'capabilities_approved' for NeoBoard Widget ([ade8535](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ade8535c4456ef9db8c8ef7915bcc4c5ae215f6a))
+* **element:** Update NeoBoard to 1.20.0 and `synapse-guest-module` to 2.0.0. ([11b0d44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11b0d441e0c886b5360690d23bf266a4ccb57a10))
+* **element:** Update NeoDateFix translations. ([71f21dc](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/71f21dc4333765f4bdaf7cfd8910b9b6982b0340))
+* **element:** Update Synapse to v0.1150. ([12680e5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/12680e5c1ae40a7722db0417751b014229bdd559))
+* **element:** Use Element upstream without widgets. ([bdc6ad2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bdc6ad286425e429c8195014251046ac0cfe6424))
+* **helmfile:** Add `cluster.networking.proxies`. Deployments need to set this if their load balancer or reverse proxy IPs are not part of the `cluster.networking.cidr`. ([a395759](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a3957595516e6864c762fbeedb9fdc50c02920cb))
+* **helmfile:** Add `sample.yaml.gotmpl` to `dev` and `prod` env directories. ([dd80abe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dd80abe622fd824b8af358a8923d6fb47715825d))
+* **helmfile:** Add new settings to `functional.yaml` for fileshare expiry dates. ([6b88f73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6b88f731eb2b6c8ceebc9a7a0c96e63d13743b24))
+* **helmfile:** Check imagePullSecrets templates for all resources ([13e0bb8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13e0bb8d68df12b8451b7318059d35f7eaa018b8))
+* **helmfile:** Move Intercom-Service to Nubus component. ([ef1dad7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ef1dad7433bbf64b9d021bd581d9016ffc68e610))
+* **helmfile:** Move OX-Connector to Open-Xchange component. ([751f578](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/751f5783d05ec4577e563d135c04d2925a14da47))
+* **helmfile:** Remove NET_RAW capabilities ([e512486](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e512486e74545449a0e3dca5254ffb44f2d1790f))
+* **helmfile:** Remove some YAML linter warnings. ([d641359](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d641359c29c81c774880196febaf4e979b98e5d6))
+* **helmfile:** Remove toggle `functional.email.systemGenerated.useComponentInSenderdomain`. Mails will no longer use a component subdomain in their sender address. ([b60fe39](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b60fe39b5c7f6479180495eb76a52b77385fb92d))
+* **helmfile:** Switch fom dep5 to REUSE.toml. ([592f031](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/592f03135f226a18038dff534c5b8f8dfc327670))
+* **helmfile:** Update portal and branding. ([6ba6923](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6ba69236129e2176afd14d05060f6db1671df863))
+* **helmfile:** Update replicas.yaml. ([8ef69ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8ef69ecaf22a8cee51ea4029173d30ff5f1213a0))
+* **helmfile:** Update to support Helmfile 1.0.0-rc5. ([f4b9395](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f4b9395b4134b28eb969e71bc2321eae3054da00))
+* **intercom-service:** Customizable user mapper. ([a7e5f64](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7e5f64b50f102855bd15568ff698160f2b616e3))
+* **jitsi:** Improve handling of non authorized users. ([8bca56d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8bca56d4acb1e8baf1d9bd6e640080b15aac35df))
+* **jitsi:** Update chart for improved openDesk look & feel. ([f297d8c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f297d8c0b70bd923670a6107471dafe750d8a352))
+* **jitsi:** Update Helm chart and Keycloak Adapter image. ([3ad81e6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3ad81e6b92ac652fbf20f56f2cc85e6d8eb5d0d4))
+* **jitsi:** Update images to `9646-stable`. ([49ad36e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/49ad36ef4e04640493373e0ba9f4d596968e5412))
+* **jitsi:** Updated branding and new option `functional.dataProtection.jitsiRoomHistory.enabled` defaulting to `[secure]`. ([67d52c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/67d52c771ef596e444d021886cf5554e12fc1a65))
+* **nextcloud:** Add support for secret keys for administrator and ldap credentials ([7aee88e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7aee88ec94be75f096c31bbb08246c563736b5bc))
+* **nextcloud:** Bump image to incorporate latest PHP fixes. ([c9ae039](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c9ae0391b07e18f22c91f4eb6ac746f43210a3f3))
+* **nextcloud:** Remove `/index.php`. ([3baf37c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3baf37c5097e763069ad66163362e19a90bd5d4e))
+* **nextcloud:** Update to 29.0.5 and support for new functional settings regarding sharing of files. See the options related to `functional.filestore.sharing` in `functional.yaml` and also `migrations.md` regarding their defaults that differ from the previous standard behaviour of openDesk. ([ac148d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ac148d0c28cf8382c8b96dbedddeccdd0fcd762b))
+* **nextcloud:** Update to 29.0.6 including latest app updates. ([9950b73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9950b73ae3789fbae31e98a6ad9845822797cb78))
+* **nubus:** Add interim ingress configuration fixing UMC in German ([6a60c6d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6a60c6dd43a31e6e972d7149977638d077cbe77b))
+* **nubus:** Only use one LDAP Primary and make replica count of Secondary and Proxy others configurable ([31753ff](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31753ffb19dcd4a82766ed39e7584cbba46b57b0))
+* **nubus:** Reduce lint failures, especially take care of pullSecrets ([e923468](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e923468cd6070615c5ba776bb223759988283ecd))
+* **nubus:** Remove duplicated "nubusPortalFrontend" ([8cd2f3a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8cd2f3a993af673eba3c931a2a9e5a9756943a5d))
+* **nubus:** Remove superfluous variables ([a7d3d25](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a7d3d2585ca73543902d5240f3629bc4e1bc4fe8))
+* **nubus:** Update "openDesk Standard" OX profile. ([fdb37c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fdb37c3943b08a49badf15da93f4d07abf8f7706))
+* **nubus:** Update customization for improved UX. ([b9db81f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b9db81f69d19985571486aaa4cc11077e0a2abc2))
+* **nubus:** Update LDAP openDesk schemas and add related openDesk config options to user. ([e3238f9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e3238f96f74bfea0b52125d0b5c384aacb75287c))
+* **nubus:** Update LDAP to openLDAP 2.5. ([c63e725](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c63e7255254db140d622b658603b99dee5af9879))
+* **nubus:** Update opendesk-nubus to set default OXContext and improved OXProfile, update migrations to (optionally) ldap-patch OXContext for `Administrator`/`default.admin` as well as patch the OXProfile to 1.0 default state. ([e619db6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e619db6da20710a9c1f3df6d8777a370be90c697))
+* **nubus:** Update to 0.63.2 ([28dd762](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/28dd762db397f47f0741087fd376be9e3e194dbe))
+* **nubus:** Update to 0.64.2. ([fc7099a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fc7099a8a6d71f10be1e9ac92279cfdb5f0ebb7d))
+* **nubus:** Update to Nubus 0.62.2. ([8229949](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8229949b47b15933fd4bcc198ec8b27302e2ea32))
+* **nubus:** Update to version 0.57.3. ([11f750e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11f750e1d603c44fdcbc9711fbe66cbf15ff0c10))
+* **open-xchange:** DisplayName settings for OX-Connector. ([b7faa24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b7faa24d76d6078336d222b195fb83f0860e7e35))
+* **open-xchange:** Update cluster internal Nextcloud URL. ([b1946d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b1946d0c1df6a8825bb5ba6ce61bb8d51d8eefa5))
+* **open-xchange:** Update Migrations for OX-Connector. ([6325b69](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6325b69a9145d90328237c359315d057bb187fc5))
+* **open-xchange:** Update OpenXchange Appsuite Bootstrap to v2.1.0 ([fb8f7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fb8f7cd28a82025be5bdc1f9eb92cb2497e22e16))
+* **open-xchange:** Update OX AppSuite to 8.26 and improve configuration including server-side Element integration. ([61d7496](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/61d74966d0427ed9214858af2126f250117a8962))
+* **openproject:** Bump OpenProject to 14.5.1. ([deacbc9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/deacbc9db5f30a492e77eb1516182a40427b0c02))
+* **openproject:** Remove `OPENPROJECT_PER__PAGE__OPTIONS` to enable functional administration of the setting. ([df9380b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/df9380b92445b992dc3917c63f1d3ce02f9c6633))
+* **openproject:** Update Helm chart to v8.0.0 and explicitly template resources. ([91e34aa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/91e34aabaae8e72b0edb6afe466d4de028dc6a38))
+* **openproject:** Update to 14.6.0. ([560aa30](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/560aa30cba2e528094231cb41474a2554f535438))
+* **openproject:** Update to 14.6.1. ([cc4b359](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cc4b35912428b6f4f5541500020f7a4aaff1674e))
+* **openproject:** Updated bootstrap image does not fail on rerun. ([7d0d6ea](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7d0d6ea8d15a226d34a0605daf6d635f6c1caae9))
+* **services:** Bump Postfix Helm chart to 2.2.0. ([f194f24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f194f248459ac0bd39246c72f937672ed24e5f14))
+* **services:** Support application based connection limits and password updates for PostgreSQL and MariaDB. ([c03566d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c03566dd63afd0c66de4627880b33ae359cba54f))
+* **xwiki:** Disable check for local Office component. ([a91f181](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a91f181c463a5feaa3ac04b4b39fcd27a55fe4a1))
+* **xwiki:** Enable IAM controlled functional admin role. ([fa8572f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fa8572f785e59b0797c0e5fee12776d0fdc66361))
+* **xwiki:** Update to 16.4.4 - updated. ([6347966](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6347966765c3a1caeec0840d2132c8c41a5d1237))
+* **xwiki:** Update to 16.4.4. ([d693ff9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d693ff94f4f79ee26df661f738c843bd4d887716))
+
+
+### Features
+
+* **element:** Add feature flag `functional.dataProtection.matrixPresence.enabled` that defaults to `[secure]` to avoid that openDesk provides presence information on users unintended. We include the hardcoded configuration in openDesk Synapse that users cannot change their displayname. ([4b99357](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4b99357b21176f57b75b745a9e3fa04d3cba9d9a))
+* **helmfile:** Add customization.yaml to define custom files for helmfile releases ([180ccdd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/180ccddfaa71e6dcf5f0383bbf1175e6568fc7ee))
+* **helmfile:** Add fine-granular registry overwrites ([7348547](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7348547d9602edb2f52c73d26749c4a4d8aadd91))
+* **helmfile:** Add support for argocd git-ops deployment ([9f081d8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9f081d856724c06928dbb3d6119fd7a090bb4048))
+* **helmfile:** Change default subdomain names. Attention, consult docs/migrations.md for upgrade deployments. ([3d84e80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d84e804c2e93d758e42a477888faf681aa56e7e))
+* **helmfile:** Full ArgoCD support ([7bf8e69](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7bf8e6976a14a1bb3d1a06135c17211d6530a1c3))
+* **helmfile:** Support feature toggle `email.systemGenerated.useComponentInSenderdomain`. ([a46a632](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a46a6326164e2462cd95a7421c7785e7d529e9c0))
+* **nextcloud:** Use nextcloud image with bundled nginx ([81f5969](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/81f5969653388b6ce4ef4d15f4fe1cbd61a17e10))
+* **nubus:** Update IAM components. ([ce03400](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ce03400043414ce0d13e2a0f90909d65d7b6eb99))
+* **nubus:** Update to Nubus 0.39.2 chart ([7345563](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/73455630fdfada47d0f4895d3f2969c7e80b8847))
+* **open-xchange:** Support for email migration feature toggle enabling masterpassword authentication in Dovecot and AppSuite. Requires openDesk Enterprise. ([356d8df](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/356d8dfbfd3825f30fc6c0786551d239e1c5e02e))
+* **services:** [bmi/opendesk/deployment/opendesk[#66](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/66)] Add dkimpy-milter to sign outgoing emails with DKIM and use local postfix as mail relay in all components. ([fbe4909](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fbe4909a8e4c78fd541facea4bd052d10100ea71))
+
+
+### BREAKING CHANGES
+
+* **helmfile:** Upgrading from previous releases requires manual steps, read `./docs/migrations.md` carefully.
+
+# [0.9.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.1...v0.9.0) (2024-07-24)
+
+
+### Bug Fixes
+
+* **collabora:** Update to 24.04.5.1.1. ([8a2d951](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8a2d951c3b59c3f8ddb508ad8f95798774b7c4b0))
+* **collabora:** Update to 24.04.5.1.2. ([74d444e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/74d444e2d6065082be3ca90373a4d3b1836ea7a8))
+* **docs:** Update workflow.md. ([fd3df7d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fd3df7df6740d8e54b433c039d294843582e8947))
+* **docu:** Update documentation on integration uses cases ([#95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/95)). ([382af1d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/382af1dfb966b5d10da4790212d6422a4a8c5618))
+* **helmfile:** Add S3 bucket for migrations. ([972020f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/972020f946d8238e65b1c1e2942682c797306e1a))
+* **helmfile:** Streamline prefixes for customizable defaults. UPGRADES: See `./docs/migrations.md` for more details. ([26a7641](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/26a7641a5ab764196af6bbe26d97907de86f541e))
+* **jitsi:** Raise memory limit for jicofo and jvb as required by upstream product. ([fe923bb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fe923bb9cd58873957adb018c1410d33bb4d8f3a))
+* **keycloak:** Support for custom OIDC Clients and ClientScopes. ([46412d1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/46412d1a9e4547dea8d0da3e322400ea148edf19))
+* **nextcloud:** Support templating of default quota and `*_retention_obligation` settings ([#93](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/93)). ([23ef1d5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/23ef1d557bc0fdf6faac59f7a287f1ef1b302404))
+* **nextcloud:** Update to 28.0.7 including latest apps for 28. ([671f57a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/671f57a809eb4bb791698cda39f7711ac4833334))
+* **nextcloud:** Update to 28.0.7 including the apps, fix admin panel warnings ([#94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/94)). Updated `cluster.networking.cidr` potentially requires manual migration, see `docs/migrations.md` for details. ([63f8394](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63f8394e044670a89a642e933600b68ff740a102))
+* **openproject:** Bump to 14.3.0 and update Helm chart to 7.0.0. ([6b609ed](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6b609edc4a60601ca45372b4fc691f0ac7c9ed93))
+* **openproject:** Support for adding token to enable OpenProject Premium. ([dfaf4be](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dfaf4be640209f5908815cceaf29db591212ddaa))
+* **xwiki:** Add email address mapping to LDAP sync; Fix hostname `null` value in notification links. ([1067e72](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1067e725b3dabce4ddfeb60b4cbe9e5b4d0db0e5))
+* **xwiki:** Remove .rtf and .odt export options as they are currently non functional. ([b806d51](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b806d51311c6d406ea3c93842601ddf5dbd13bb3))
+* **xwiki:** Update to 16.4. ([db7f5d6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/db7f5d60bdae437cebe58ab10f928a4a348e1ee3))
+* **xwiki:** Update to 16.4.1. ([e54aaab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e54aaab072f31713b5172e4bab9ba7e9ca9c5c26))
+
+
+### Features
+
+* **authentication:** Avoid that users can open a app they do not have the appropriate LDAP group set for. Implementation is based on role based client scopes. Introducing also an openDesk migration approach with a pre and post deployment stage. ([b4570a9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4570a9a873efa6c896fe543ab0ba3b94fd086c0))
+
+## [0.8.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.8.0...v0.8.1) (2024-07-01)
+
+
+### Bug Fixes
+
+* **collabora:** Bump image to 24.04.4.1.1. ([368fe13](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/368fe13ddb080f0c8f42cbd3612a29f818308708))
+* **collabora:** Bump image to 24.04.4.2.1. ([01767d3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01767d38061259853e4bd8b2eba31d3b04c4e672))
+* **docs:** Add Ports section to getting started. ([c07b25c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c07b25c4b9a702e214373fe08d95827286ebd866))
+* **docs:** Correction regarding the currently supported ingress controller. ([8514908](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/85149086ae70cb85a1718715747985a3da2a7b64))
+* **docs:** Update regarding the currently supported ingress controller. ([064a5ad](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/064a5ad246ea7217c2fb107787228d7aca9b5028))
+* **element:** Provide the internal cluster domain to `synapse-web`. ([a8692d5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a8692d5506dc65895a562423d8ddb7da9078fc3a))
+* **helmfile:** Add script to ease local development of platform charts. ([d8f3e05](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d8f3e05e584116f6196d43e0ea9bb8946ab2e5ab))
+* **helmfile:** Enable SMTP for XWiki and Element/Synapse; Streamline mail sender addresses within platform based on `<localpart>@<component>.<domain>` and allow configuration of `<localpart>`. ([01c5e6b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/01c5e6b359dd5eb42c98e818da301871bea79264))
+* **helmfile:** Include all `.yaml.gotmpl` files for the envs in `environments.yaml`. ([e523434](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e52343440d81c0596177399058b4711cc0d5da67))
+* **helmfile:** Streamline `functional.yaml`. *Upgrade notice:* If you set a non default value for `.Values.portal.enableDeploymentInformation` please change it to `.Values.admin.portal.deploymentInformation.enabled` with this version. ([e89b16a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e89b16a747f95be7661b1fd4f5c90acce638542e))
+* **jitsi:** Update PatchJVB bitnami/kubectl image to 1.30.2. ([6ef3641](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6ef3641d82d88d6fed80652b239bc63115abbf2d))
+* **nubus:** Enable Keycloak's user account console. ([c03e4a5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c03e4a534090dde46363a7cfab718bb307e22621))
+* **nubus:** Remove doublette ingress annotations. ([890b36e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/890b36ecbb8c9311b5048d8d6d50ee5acf00ea61))
+* **open-xchange:** Fixing YAML indentation of updater resources ([0ce346b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0ce346b162feb0bc6fee7f18caee84917117abe1))
+* **openproject:** Bump image to 14.2.0. ([1ad35f1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1ad35f1e12e236607e3830da6d08010eb465b501))
+* **openproject:** Switch DBInit container image to Alpine based version to reduce footprint. ([c90f7c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c90f7c1742d415d5a787ff5832959e2974b77b83))
+* **openproject:** Update PostgreSQL image for DB init to 16.3. ([45e5699](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/45e569955d09c584490e6826651f7564567c1f9b))
+* **services:** Allow Postfix "relayHost" to be empty. ([7268f60](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7268f607a5839c6e940ce07fa15c1ffec9610d19))
+
+# [0.8.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.7.1...v0.8.0) (2024-06-10)
+
+
+### Bug Fixes
+
+* **ci:** Allow CI to be triggered by API authorized personal access token. ([b95fd11](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b95fd1152a2122de0fbc2b31cacb8a1b1c5917b7))
+* **collabora:** Semi-disable update checker. ([d7a127f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d7a127fe269ddf0347adce692f138eb1a6359508))
+* **collabora:** Update to 24.04.3.1.1. ([5869316](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/58693162e6c2f72ba6254dd0168dea48539b7d43))
+* **docs:** Spell check and streamline. ([4d99bf3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4d99bf3bf085a6f8d4dbdef442fa969150dfff4d))
+* **element:** Bump container images (widgets, community artifacts). ([f856205](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f856205afce914ea62a9e309b9400714f4c4d040))
+* **element:** Bump to v1.11.67. ([a4ff89b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a4ff89b213afef9fd35dd6ab3c54bf0e8e8b20c9))
+* **element:** Update Synapse. ([9fa8ace](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9fa8ace80f9af5d5c96073fe836cf606956c4f43))
+* **helmfile:** Remove unused ox-provisioning hostname. ([e31a0a2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e31a0a258e274274e20aab41c4c757d891bff639))
+* **jitsi:** Update jitsi-keycloak-adapter image to Docker tag v20240314. ([6202bc4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6202bc4719e96c537c67a65a9419aa183edc6d55))
+* **nubus:** Change to new Univention upstream registry. ([d7fbc57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d7fbc572ca5b3ee4eca31bf50f4e00f257a72b83))
+* **nubus:** Disable UDM REST API routing by default and always disable UMC local login. ([e1e8a7f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e1e8a7f121c41c3f23db4541211d255dfb06591a))
+* **nubus:** Guardian version bump and refactoring. ([2f88752](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2f88752ae6a9df7ff3cb9a3c2d158589f7defb33))
+* **nubus:** Re-add selfservice-listener image configuration. ([af711b0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/af711b0edb05bb96fe2ad7e51d5862ed97043178))
+* **open-xchange:** Set Nubus LDAP attribute to render manager_name in address book. See https://forge.univention.org/bugzilla/show_bug.cgi?id=53741 for reference. ([4f92001](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4f92001d688416133fcfd3415afb5f4bbceb7356))
+* **openproject:** Bump library/postgres image to v16. ([742c293](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/742c293243e5c8165e065b5b53af7bac6647fad1))
+* **openproject:** Bump to 14.1.0, set default timezone on deployment to `Europe/Berlin` and raise default memory limit to 2Gi. ([6e49721](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6e4972107e8eac498ace98217488f4e07fabb6b1))
+* **openproject:** Update Helm chart to v5.1.4. ([75cd077](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/75cd077351c0a892afcd57c835b77206ea90da66))
+* **openproject:** Update to 14.1.1 and bump PostgreSQL 13 image for InitDB. ([bd2d7cf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bd2d7cf748f8cb6b1693056c4a5fc4a60b598acd))
+* **services:** Update `opendesk-home` to v1.0.2 to fix issue with Element `.well-known` ingress collision. ([b0eb28b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b0eb28bc3f577a46021444832e0cc132f6e4b0e1))
+* **univention-management-stack:** Add functional switch to disable deployment information. ([a31c5f5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a31c5f59a68e90ba9e80350ebd5827e7b05d4ef5))
+
+
+### Features
+
+* **element:** Enable Matrix federation via https. ([ecb566f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ecb566f61e9818ff204501730576af360e4e90d0))
+* **helmfile:** Add support for Ingress parameter configuration (proxy-body-size, proxy-read-timeout, proxy-send-timeout). ([dc39b94](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/dc39b94e8824683e54e0f2902e8b4bfe1c43442a))
+* **helmfile:** Create child helmfile for GitOps approach. ([a899699](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a899699e21b1d8da9886a93a2e74442799e23e96))
+* **nubus:** Cleanup Keycloak values. ([f3d8cf0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f3d8cf08efbba1b1dd5969821c3af7603202e67f))
+
+## [0.7.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.7.0...v0.7.1) (2024-05-21)
+
+
+### Bug Fixes
+
+* **ci:** Add Renovate dependency update automation. ([650c41c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/650c41c3f04b6c7c04a1d5eca76aba7f75e14b96))
+* **cryptpad:** Update Helm chart v0.0.19 and include CryptPad app in Helmfile deployment. ([931ed95](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/931ed95ce16d5be6bde7ea1c1140406f00fef060))
+* **docu:** Add IdP federation documentation. ([7167055](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7167055303bdbe9ad677b16635089c0328a849ff))
+* **docu:** Rename SYNAPSE_DOMAIN to MATRIX_DOMAIN. If you use SYNAPSE_DOMAIN in your deployment, ensure you set the MATRIX_DOMAIN accordingly before upgrading. ([96baa6c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/96baa6cc15bac8d3ce315132699e301093d5d6d8))
+* **element:** Provide certificate for alternative Synapse domain. ([88ac239](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/88ac2396e6888e0f28a80ceebaa0f51d2ba436ee))
+* **helmfile:** Use Open CoDE as default registry for Univention helm chart ([#71](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/71)). ([4e56ce4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4e56ce4073105003dffbcaa91af473c1f707cd13))
+* **jitsi:** Bump images to stable-9457-2. ([1d47fa6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1d47fa681adf29e4b4ca432a9d5390972098d2e0))
+* **jitsi:** Raise Jibri memory limits to fullfil Jibri's 2Gi /dev/shm requirement and update Helm chart; To update an existing installation you need to manually delete the `jitsi-prosody` stateful set before the update e.g. `kubectl -n <your_namespace> delete --cascade=orphan statefulsets jitsi-prosody`. Ensure you use the `--cascade=orphan` part, otherwise you have to remove and reinstall the complete deployment. ([6570c13](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6570c13f3a3ad5864de5afe6afb4c60483cd489f))
+* **nextcloud:** Bump to 28.0.5 incl. latest app versions. ([04d9372](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/04d9372cfccc80145962faf4c2387949a43c8f2c))
+* **nubus:** Bump Keycloak to 24.0.3. ([923533d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/923533d7b7527de728f73813397ed0c2a0427da5))
+* **nubus:** Enable 2FA for group "Domain Admins" by default. ([1179669](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/11796699bb551f8b83badd13204654c880b65efe))
+* **nubus:** Update keycloak-bootstap and keycloak-extensions. ([1c6666f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1c6666fe45fb7acd83c26b5f2b808fce3fb9e20b))
+* **open-xchange:** Support change of username. ([b2cfa8b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b2cfa8b9965ce50f593295c80c363bad7ef0454e))
+* **openproject:** Bump version to 14.0.1, update Helm chart to 4.5.0. ([e085211](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e0852119e8e248431f51a86e3bd5177cef0b1e93))
+
+# [0.7.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.6.0...v0.7.0) (2024-05-06)
+
+
+### Bug Fixes
+
+* **ci:** Add debug option. Has to be supported by stage specific configuration containing: `debug.enabled: {{ env "DEBUG_ENABLED" | default false }}` ([3dc6484](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3dc648421b80d4e170a11792604be127a3960c0e))
+* **element:** Provide the internal cluster domain to synapse web ([b9ac5ec](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b9ac5ecf2def57bba0070f1c2f4a01449808f106))
+* **univention-management-stack:** Add the image configuration for NATS ([e9ec2f3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e9ec2f3a6e51975ccdbd6d3575b5fc6a909502aa))
+* **univention-management-stack:** Fix [#55](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/55), [#35](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/35) by updating chart "ums" to 0.11.2 and image "portal-listener" to 0.20.6; To update an existing installation you need to manually delete the `ums-portal-listener` stateful set before the update: `kubectl -n <your_namespace> delete statefulsets ums-portal-listener` ([2ad0270](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2ad027082f4cb958d68d7728d8db05f786dba0f0))
+* **univention-management-stack:** Migrate UDM-REST-API image to new Univention registry ([9be3b78](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9be3b78761610db0274572d5a7c526aa34d0615f))
+* **univention-management-stack:** Objectstore credentials ([d1bd43f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d1bd43fa957accdb70f0cda69983e0490ac6cfa0))
+* **univention-management-stack:** Update Helm chart to 0.12.0 including required changes to openDesk Helmfile deployment. ([fefd2f6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fefd2f6cae3617ba1f00ef0c5fa3a80cde1d6ba1))
+* **univention-management-stack:** Use the NATS related image configuration ([cd22570](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cd225703ebe67bc78faa878080639dd7cc1845a9))
+
+
+### Features
+
+* **element:** Add support for Matrix federation ([36139b4](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/36139b42f1df9785b8414059bf70dc3e37616e8a))
+* **helmfile:** Introduce additional variables for mailDomain and synapseDomain ([e6fe2a7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e6fe2a7c18581f637d6bd4d0553d558f753dadd2))
+* **services:** Add opendesk-home service, which redirects on domain to portal ([c7e2172](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c7e217208c4cb812cc23f9aa5ea42fcb77ea7c3a))
+
+# [0.6.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.81...v0.6.0) (2024-04-11)
+
+
+### Bug Fixes
+
+* **helmfile:** Improve support for external Objectstore, and fix issue with DoveCot storageClassName ([1b748b6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1b748b6bf63d75fc5232c90407a3fa885c2dd3c8)), closes [#57](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/57) [#60](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/60) [#56](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/56)
+* **nextcloud:** Bump to 28.0.4 ([cb33a92](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cb33a929ef7c13a9a578e56a631951292d14d0e4))
+* **univention-management-stack:** add Guardian provisioning job image ([79c52d0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/79c52d014cec188d010a2827bb63b2635abafb2c))
+* **univention-management-stack:** Update UMC to 0.11.8 ([5e3f4fa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5e3f4faade2ea02e51f260d1d614296a6a484848))
+* **univention-management-stack:** Use umbrella helm chart ([10ecb44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/10ecb44aa675d2f139aaec6fe8d4246fa1d3dd40))
+* **xwiki:** Bump to 15.10.8 and enable OIDC backchannel logout ([c395d35](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c395d35dd77bbec5e6b7d01768533f87af843560))
+
+
+### Features
+
+* **open-xchange:** Bump to 8.23 and remove Istio prerequisite ([3be3564](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3be3564ec7168a1a2d72b58f11da84e89e81911d))
+
+## [0.5.81](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.80...v0.5.81) (2024-03-28)
+
+
+### Bug Fixes
+
+* **docs:** Various updates ([50e2638](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/50e263866be8b51ef295ebf8025c3117821a2b6c))
+* **element:** Update Element Web to v1.11.59 with widget sync fix and NeoBoard v1.14.0 ([0fd4a26](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0fd4a26c711fb345b79cdff1c775d7ef20335768))
+* **helmfile:** Fix OpenAPI validations for Kubernetes v1.28 ([0aa4cfb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0aa4cfb46f793369a472a736b28eea834a545439))
+* **nextcloud:** Bump to 28.0.3 ([34d2c05](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/34d2c059596466f8f7d6d09c2855c595391a7e0d))
+* **nextcloud:** Rename default shared folder to `__Shared_with_me__` ([5f9d015](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5f9d015f0b98579d652fd4172e74835ed67ccf11))
+* **open-xchange:** Bump to 8.22 ([5ebf291](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5ebf291a4dbe88a09c0afe2befa6140ad33bf30b))
+* **openproject:** Bump OpenProject to 13.4.0 ([d565c05](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d565c057ddb7b348f7a829e0f931b1ea448b454b))
+* **openproject:** Bump version to 13.4.1 ([7cc3964](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7cc39647d89538630bac9caa158c47b5cb8d2c45))
+* **services:** Update Otterize Policies ([42f63e3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/42f63e399230495c83f934e07beb9fc950ef5e29))
+* **univention-management-stack:** Add missing authenticator secret mount to portal-server ([5a39e87](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5a39e8725b6454591f552f87f12535201e52df7c))
+* **univention-management-stack:** Update LDAP server for BSI base security compliance ([8e889db](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8e889db63eaf05b24cc23838545f63d969232c65))
+* **univention-management-stack:** Update ldap-notifier and ldap-server ([a41ddd5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a41ddd5451a9fbd3c6319827fee3eaffbd931271))
+* **univention-management-stack:** Update provisioning charts, images and helm value to add authentication ([8c97bcf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8c97bcf994487281ae94e6d66c73f4a11c08a0be))
+
+## [0.5.80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.79...v0.5.80) (2024-03-11)
+
+
+### Bug Fixes
+
+* **ci:** Remove creation of release artefacts, use the `images.yaml` and `charts.yaml` in `./helmfile/environments/default` for information about the artefacts instead. ([ee99eef](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ee99eefb72d3207866ffd1b3bd21a36bd55ad288))
+* **collabora:** Bump image to 23.05.9.4.1 ([9c32058](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9c32058fcc21a14e9e66a46064ea044402638920))
+* **docs:** Add development.md and refactor `images.yaml` and `charts.yaml` ([a2b333b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a2b333b46277a4bb86b75ca04edb64e69efff916))
+* **helmfile:** YAML handling of seLinuxOptions and align overall `toYaml` syntax ([011ad2c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/011ad2cd6bfe552e04a598452e8814d4d1029152))
+* **nextcloud:** Update images digests ([bc18724](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc18724d70ffff749d5192487944e62233cf4376))
+* **openproject:** Bump to 13.3.1 ([7ee9e47](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ee9e47e8269334294c80093a359b247d86f5d62))
+
+## [0.5.79](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.78...v0.5.79) (2024-02-29)
+
+
+### Bug Fixes
+
+* **collabora:** Bump image to 23.05.9.2.1 ([f4b8226](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f4b8226ea13971a38d61145ea9ac3821bc35f6b3))
+* **collabora:** Fix aliasgroups configuration whitelisting the Nextcloud host ([8b065fd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8b065fd9d789cdd597a584937fefaae40f42bba2))
+* **docs:** Update version numbers of functional components for release in README.md ([31e5cf3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31e5cf317ca7cd84a94cf42d57d0964152904471))
+* **element:** Provide end-to-end encryption as user controlled option ([3d31127](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d31127a6ab0fa1d3af02695b521db5918932279))
+* **helmfile:** Enhance objectore environment variables to allow external Object Store ([d444226](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d4442261aa141e21222dc13407023b96570d055f))
+* **helmfile:** Set debuglevel to WARN instead of INFO when debug is not enabled. ([2efceef](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2efceef076beb06a3719859d7f4e2f0d03b99f44))
+* **nextcloud:** Bump images to enable password_policy and fix email with groupware ([8807b24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8807b24ce09e59aaea39c349e9e12ee2a44a117a))
+* **univention-management-stack:** Bump Keycloak Extensions chart and configure the `/univention/meta.json` to be retrieved from `ums-stack-gateway` to avoid the inline 404 during Keycloak login. ([2023d5b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2023d5bce4642f794831670713b1a2520a0419d6))
+* **univention-management-stack:** Provisioning version bump ([410a023](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/410a0237149a5e41434c09795959bc53e57fb4ca))
+* **univention-management-stack:** Template more Keycloak Extension values incl. logLevel ([7ec123b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ec123b9a174c8dade1fe9f6679796979749efab))
+
+## [0.5.78](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.77...v0.5.78) (2024-02-23)
+
+
+### Bug Fixes
+
+* **ci:** Move main development repo OpenCoDE ([43718b8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/43718b8da2966b87fab8e206df449c923f6615e7))
+* **ci:** Run release pipeline only on pushes to main ([13dcb00](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/13dcb004419b4efd8ded8c25e7afa41d10156be8))
+* **ci:** Update kyverno rules ([d9263c9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d9263c90110df241adaef8d1a5df8e8d8ceda11b))
+* **docs:** Add missing footnote regarding Nubus ([bc6e4f8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc6e4f8e5dcc32cc476de579fd56dbade79b7c31))
+* **nextcloud:** Set admin priviledges for users in central IAM ([a3e415d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a3e415d575ba24b99e741994fb29d0f0cfd11d8a))
+* **univention-management-stack:** Scaling udm-rest-api ([57d0f61](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/57d0f61b2c3e789b72a0098907817c97fee69268))
+* **univention-management-stack:** Set Keycloak CSP header to allow session continuation in admin portal. ([a398e5a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a398e5aaf131c1f00b09e1776d6daf10f2c343ad))
+* **univention-management-stack:** UMS portal-server scalability ([b1b4c28](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b1b4c28618e0eca31b59719e9e1f2db8ecff7f5c))
+* **univention-management-stack:** Univention Portal upstream codefixes version bump ([c2f62f7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c2f62f7c9487b2119b0d3efd98b40c92efb97c5d))
+* **univention-management-stack:** Update provisioning to fix high CPU usage when in idle ([d9c23bd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d9c23bdf0b955c0b5e4c82dd1ee785b75ce18a3b))
+
 ## [0.5.77](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.76...v0.5.77) (2024-02-16)
 
 

README.md

@@ -1,5 +1,6 @@
 <!--
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
 
@@ -7,74 +8,75 @@ SPDX-License-Identifier: Apache-2.0
 
 <!-- TOC -->
 * [Overview](#overview)
-* [Disclaimer](#disclaimer)
+* [Upgrades](#upgrades)
 * [Requirements](#requirements)
 * [Getting started](#getting-started)
 * [Advanced customization](#advanced-customization)
-* [Releases](#releases)
 * [Components](#components)
+* [Releases](#releases)
 * [Feedback](#feedback)
+* [Development](#development)
 * [License](#license)
 * [Copyright](#copyright)
 <!-- TOC -->
 
 # Overview
 
-openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the "Projektgruppe für
+openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the
-Aufbau ZenDiS" of Germany's Federal Ministry of the Interior.
+*Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH*.
 
 openDesk currently features the following functional main components:
 
-| Function             | Functional Component        | Component<br/>Version | Upstream Documentation |
+| Function             | Functional Component        | Component<br/>Version                                                                                | Upstream Documentation                                                                                                                |
-| -------------------- | --------------------------- | --------------------- | ----------------- |
+| -------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
-| Chat & collaboration | Element ft. Nordeck widgets | [1.11.52](https://github.com/element-hq/element-desktop/blob/develop/CHANGELOG.md#changes-in-11152-2023-12-19) | [For the most recent release](https://element.io/user-guide) |
+| Chat & collaboration | Element ft. Nordeck widgets | [1.11.87](https://github.com/element-hq/element-desktop/releases/tag/v1.11.87)                       | [For the most recent release](https://element.io/user-guide)                                                                          |
-| Diagram editor       | Cryptpad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0) | [For the most recent release](https://docs.cryptpad.org/en/) |
+| Diagram editor       | CryptPad ft. diagrams.net   | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0)                                     | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | [28.0.2](https://nextcloud.com/de/changelog/#28-0-2) | [Nextcloud 28](https://docs.nextcloud.com/) |
+| File management      | Nextcloud                   | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8)                                                 | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                           |
-| Groupware            | OX Appsuite                 | [8.20](https://documentation.open-xchange.com/appsuite/releases/8.20/) | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
+| Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
-| Knowledge management | XWiki                       | [15.10.4](https://www.xwiki.org/xwiki/bin/view/Blog/XWiki15104Released) | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation) |
+| Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)                       | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
-| Portal & IAM         | Nubus                       | Product Preview[^1]   | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html) |
+| Portal & IAM         | Nubus                       | [1.4.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | [13.3.0](https://www.openproject.org/docs/release-notes/13-3-0/) | [For the most recent release](https://www.openproject.org/docs/user-guide/) |
+| Project management   | OpenProject                 | [15.0.2](https://www.openproject.org/docs/release-notes/15-0-2/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
-| Videoconferencing    | Jitsi                       | [2.0.8922](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_8922) | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/) |
+| Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
-| Weboffice            | Collabora                   | [23.05.9.1.1](https://www.collaboraoffice.com/collabora-online-23-05-release-notes/) | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/) |
+| Weboffice            | Collabora                   | [24.04.9.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
 
 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
-align the applications with best practises regarding container design and operations.
+align the applications with best practices regarding container design and operations.
 
 This documentation aims to give you all that is needed to set up your own instance of the openDesk.
 
 Basic knowledge of Kubernetes and DevOps processes is required though.
 
-# Disclaimer
+# Upgrades
 
-openDesk will face breaking changes in the near future without upgrade paths before
+You want to upgrade an existing openDesk installation?
-[technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
-v1.0.0 is reached.
 
-While most components support upgrades, major configuration or component changes may occur, therefore we recommend
+⟶ Visit our detailed documentation about [Updates & Upgrades](./docs/migrations.md).
-from scratch installations for now.
-
-In the next months, we not only expect to integrate upstream updates of the functional components to include their
-most recent feature and security sets, but also to address operational topics like scalability for the openDesk
-platform.
-
-Of course, further development also includes enhancing the documentation itself.
 
 # Requirements
 
-⟶ Visit our detailed [Requirements](./docs/requirements.md) overview.
+You want to understand what is required to install openDesk yourself?
+
+⟶ Visit our [Requirements](./docs/requirements.md) overview.
 
 # Getting started
 
-⟶ Visit our detailed [Getting started](./docs/getting-started.md) guide.
+You would like to install openDesk in your own infrastructure?
+
+⟶ Visit our detailed [Getting started guide](./docs/getting-started.md).
 
 # Advanced customization
 
+- [Enhanced Configuration](./docs/enhanced-configuration.md)
 - [External services](./docs/external-services.md)
 - [Security](./docs/security.md)
 - [Scaling](./docs/scaling.md)
 - [Monitoring](./docs/monitoring.md)
 - [Theming](./docs/theming.md)
 
+# Components
+
+More information on openDesk's components and their integration can be found in our detailed [Component docs](./docs/components.md).
+
 # Releases
 
 All technical releases are created using [Semantic Versioning](https://semver.org/lang/de/).
@@ -83,15 +85,12 @@ Gitlab provides an
 [overview on the releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
 of this project.
 
-The following release artefacts are provided beside the default source code assets:
+Please find a list of the artifacts related to the release either in the source code archive attached to the release or
-- `chart-index.json`: An overview of all Helm charts used by the release.
+in the files from the release's git-tag:
-- `image-index.json`: An overview of all container images used by the release.
+- `./helmfile/environments/default/images.yaml.gotmpl`
+- `./helmfile/environments/default/charts.yaml.gotmpl`
 
-⟶ Visit our detailed [Workflow](./docs/workflow.md) docs.
+Find more information in our [Workflow documentation](./docs/workflow.md).
-
-# Components
-
-⟶ Visit our detailed [Component](./docs/components.md) docs.
 
 # Feedback
 
@@ -101,7 +100,11 @@ Related to the deployment / contents of this repository,
 please use the [issues within this project](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues).
 
 If you want to address other topics, please check the section
-["Rückmeldungen und Beteiligung" of the Infos' project OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung).
+["Rückmeldungen und Beteiligung" in the OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung) of the [openDesk Info Repository](https://gitlab.opencode.de/bmi/opendesk/info).
+
+# Development
+
+If you want to join or contribute to the development of openDesk please read the [Development guide](./docs/development.md).
 
 # License
 
@@ -109,4 +112,4 @@ This project uses the following license: Apache-2.0
 
 # Copyright
 
-Copyright (C) 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+Copyright (C) 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH

REUSE.toml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+
+version = 1
+
+[[annotations]]
+path = "cspell.json"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/gpg-pubkeys/*"
+SPDX-FileCopyrightText = "2023 Bundesministerium des Innern und für Heimat, PG ZenDiS \"Projektgruppe für Aufbau ZenDiS\""
+SPDX-License-Identifier = "CC0-1.0"
+
+[[annotations]]
+path = "helmfile/files/theme/*"
+SPDX-FileCopyrightText = "2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "helmfile/files/portal-tiles/*"
+SPDX-FileCopyrightText = "2024 Google LLC"
+SPDX-License-Identifier = "Apache-2.0"

cspell.json

@@ -0,0 +1,83 @@
+{
+    "version": "0.2",
+    "ignorePaths": [],
+    "dictionaryDefinitions": [],
+    "dictionaries": [],
+    "words": [
+        "openDesk",
+        "AppSuite",
+        "Collabora",
+        "Digitale",
+        "Jitsi",
+        "Nextcloud",
+        "Öffentlichen",
+        "OpenProject",
+        "Souveränität",
+        "Verwaltung",
+        "Zentrum",
+        "Keycloak",
+        "NATS",
+        "slapadd",
+        "slapcat",
+        "RDBMS",
+        "Velero",
+        "Univention",
+        "OIDC",
+        "kcadmin",
+        "DMARC",
+        "homeserver",
+        "Bundesministerium",
+        "Innern",
+        "Heimat",
+        "Projektgruppe",
+        "Aufbau",
+        "Filepicker",
+        "Weboffice",
+        "Xchange",
+        "opencode",
+        "seccomp",
+        "psql",
+        "databasename",
+        "helmfile",
+        "gotmpl",
+        "containerd",
+        "letsencrypt",
+        "CNCF",
+        "kubespray",
+        "ICAP",
+        "Ceph",
+        "Coturn",
+        "Minio",
+        "Kyverno",
+        "Otterize",
+        "IBAC",
+        "pubkeys",
+        "Grundschutz",
+        "Kubescape",
+        "Gitflow",
+        "hadolint",
+        "explorative",
+        "Nordeck",
+        "Nubus",
+        "Souveräne",
+        "Arbeitsplatz",
+        "commandline",
+        "helmfiles",
+        "SMTPS",
+        "IMAPS",
+        "xwiki",
+        "cryptpad",
+        "clamav",
+        "templating",
+        "localpart",
+        "Addressbooks",
+        "filestore",
+        "trashbin",
+        "bootstrap",
+        "configurability",
+        "selfsigned",
+        "truststore"
+    ],
+    "ignoreWords": [],
+    "import": []
+}

dev/README.md

@@ -0,0 +1,36 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Tools for local development</h1>
+
+* [charts-local.py](#charts-localpy)
+  * [Commandline parameter](#commandline-parameter)
+    * [`--branch`](#--branch)
+    * [`--revert`](#--revert)
+
+# charts-local.py
+
+This script helps you on cloning the platform development Helm charts and referencing them directly in the openDesk
+Helmfile deployment for comfortable local test and development. The charts will be cloned into a directory
+parallel created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
+The name of the chart directory is derived from the branch name you are working with in this `opendesk` repo.
+
+The script will create `.bak` copies of the helmfiles that have been touched.
+
+Run the script with `-h` to get information about the script's parameter on commandline.
+
+## Commandline parameter
+
+### `--branch`
+
+Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
+does not exist yet. Otherwise it will switch to defined branch.
+
+If parameter is omitted the current branch of the `opendesk` repo will be used.
+
+### `--revert`
+
+Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
+scripts itself back to their original location.

dev/charts-local.py

@@ -0,0 +1,170 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+
+import os.path
+import logging
+import yaml
+import sys
+import shutil
+import re
+import configargparse
+
+from pathlib import Path
+from git import Repo
+
+p = configargparse.ArgParser()
+p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work with. Will be created by the script if it does not exist yet.')
+p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
+p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
+p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
+options = p.parse_args()
+
+script_path = os.path.dirname(os.path.realpath(__file__))
+# some static definitions
+log_path = script_path+'/../logs'
+charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml.gotmpl'
+base_repo_path = script_path+'/..'
+base_helmfile = base_repo_path+'/helmfile_generic.yaml.gotmpl'
+helmfile_backup_extension = '.bak'
+
+Path(log_path).mkdir(parents=True, exist_ok=True)
+
+logFormatter = logging.Formatter("%(asctime)s %(levelname)-5.5s %(message)s")
+rootLogger = logging.getLogger()
+rootLogger.setLevel(options.loglevel)
+
+fileHandler = logging.FileHandler("{0}/{1}.log".format(log_path, os.path.basename(__file__)))
+fileHandler.setFormatter(logFormatter)
+rootLogger.addHandler(fileHandler)
+
+consoleHandler = logging.StreamHandler()
+consoleHandler.setFormatter(logFormatter)
+rootLogger.addHandler(consoleHandler)
+
+logging.debug(f"Working with relative paths from script location: {script_path}")
+logging.debug(f"Log directory:      {log_path}")
+logging.debug(f"charts.yaml.gotmpl: {charts_yaml}")
+
+
+def create_or_switch_branch_base_repo():
+    base_repo = Repo(path=base_repo_path)
+    current_branch = base_repo.active_branch.name
+    if not options.branch:
+        branch = current_branch
+        logging.debug(f"No branch specified on commandline, working with current branch: {current_branch}")
+    else:
+        branch = options.branch
+        if branch in base_repo.branches:
+            if branch != current_branch:
+                logging.debug(f"Selected {branch} already exists, switching.")
+                # ToDo: Graceful handle: "Please commit your changes or stash them before you switch branches."
+                base_repo.git.switch(branch)
+            else:
+                logging.debug(f"Already on selected brach {branch}")
+        else:
+            logging.debug(f"Creating branch {branch} and switching")
+            base_repo.git.branch(branch)
+            base_repo.git.switch(branch)
+    return branch
+
+
+def clone_charts_locally(branch, charts):
+    charts_clone_path = script_path+'/../../'+branch.replace('/', '_')
+    charts_dict = {}
+    doublette_dict = {}
+    if os.path.isdir(charts_clone_path):
+        logging.warning(f"Path {charts_clone_path} already exists, will not clone any charts.")
+    else:
+        logging.debug(f"creating directory {charts_clone_path} to clone charts into")
+        Path(charts_clone_path).mkdir(parents=True, exist_ok=True)
+
+    for chart in charts['charts']:
+        if 'opendesk/components/platform-development/charts' in charts['charts'][chart]['repository']:
+            tag = charts['charts'][chart]['version']
+            logging.debug(f"Working on {chart} / tag {tag}")
+            repository = charts['charts'][chart]['repository']
+            git_url = options.git_hostname+':'+repository
+            chart_repo_path = charts_clone_path+'/'+charts['charts'][chart]['name']
+            if git_url in doublette_dict:
+                logging.debug(f"{chart} located at {git_url} is already checked out to {doublette_dict[git_url]}")
+                charts_dict[chart] = doublette_dict[git_url]
+            else:
+                if os.path.isdir(chart_repo_path):
+                    logging.debug(f"Already exists {chart_repo_path} leaving it unmodified")
+                else:
+                    logging.debug(f"Cloning into {chart_repo_path}")
+                    Repo.clone_from(git_url, chart_repo_path)
+                    chart_repo = Repo(path=chart_repo_path)
+                    chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
+                doublette_dict[git_url] = chart_repo_path
+                charts_dict[chart] = chart_repo_path
+    return charts_dict
+
+
+def grep_yaml(file):
+    with open(file, 'r') as file:
+        content = ''
+        for line in file.readlines():
+            if not ': {{' in line and not '- {{' in line:
+                content += line
+    return yaml.safe_load(content)
+
+
+def get_child_helmfiles():
+    child_helmfiles = []
+    root_helmfile = grep_yaml(base_helmfile)
+    for entry in root_helmfile['helmfiles']:
+        child_helmfiles.append(base_repo_path+'/'+entry['path'])
+    return child_helmfiles
+
+
+def process_the_helmfiles(charts_dict, charts):
+    chart_def_prefix = '    chart: "'
+    child_helmfiles = get_child_helmfiles()
+    for child_helmfile in child_helmfiles:
+        child_helmfile_updated = False
+        output = []
+        with open(child_helmfile, 'r') as file:
+            for line in file:
+                if chart_def_prefix in line:
+                    for chart_ident in charts_dict:
+                        if '.Values.charts.'+chart_ident+'.name' in line:
+                            logging.debug(f"found match with {chart_ident} in {line.strip()}")
+                            line = chart_def_prefix+charts_dict[chart_ident]+'/charts/'+charts['charts'][chart_ident]['name']+'" # replaced by local-dev script'+"\n"
+                            child_helmfile_updated = True
+                            break
+                output.append(line)
+        if child_helmfile_updated:
+            child_helmfile_backup = child_helmfile+helmfile_backup_extension
+            if os.path.isfile(child_helmfile_backup):
+                logging.debug("backup {child_helmfile_backup} already exists, will not create a new one.")
+            else:
+                logging.debug(f"creating backup {child_helmfile_backup}.")
+                shutil.copy2(child_helmfile, child_helmfile_backup)
+            logging.debug(f"Updating {child_helmfile}")
+            with open(child_helmfile, 'w') as file:
+                file.writelines(output)
+
+
+def revert_the_helmfiles():
+    child_helmfiles = get_child_helmfiles()
+    for child_helmfile in child_helmfiles:
+        child_helmfile_backup = child_helmfile+helmfile_backup_extension
+        if os.path.isfile(child_helmfile_backup):
+            logging.debug(f"Reverting {child_helmfile} from backup {child_helmfile_backup}")
+            os.rename(child_helmfile_backup, child_helmfile)
+        else:
+            logging.debug(f"Did not found the backup file {child_helmfile_backup}")
+
+##
+## Main program
+##
+if options.revert:
+    revert_the_helmfiles()
+else:
+    branch = create_or_switch_branch_base_repo()
+    with open(charts_yaml, 'r') as file:
+        charts = yaml.safe_load(file)
+    charts_dict = clone_charts_locally(branch, charts)
+    process_the_helmfiles(charts_dict, charts)

dev/requirements.txt

@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+
+configargparse
+pyyaml
+GitPython

docs/ci.md

@@ -2,9 +2,10 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>CI/CD</h1>
 
-This page will cover openDesk automation via Gitlab CI.
+This page covers openDesk deployment automation via Gitlab CI.
 
 <!-- TOC -->
 * [Deployment](#deployment)
@@ -13,30 +14,26 @@ This page will cover openDesk automation via Gitlab CI.
 
 # Deployment
 
-The project includes a `.gitlab-ci.yml` that allows you to execute the deployment from a Gitlab instance of your choice.
+The project includes a `.gitlab-ci.yml` that allows you to execute the deployment from a GitLab instance of your choice.
 
+When starting the pipeline through the GitLab UI, you will be queried for some variables plus the following ones:
 
-When starting the pipeline through the Gitlab UI, you will be queried for some variables plus the following ones:
+- `DOMAIN`: The primary domain for your deployment, making the openDesk services available, e.g., as `https://portal.DOMAIN`.
+- `MAIL_DOMAIN` (optional): The domain for the users' email addresses; it defaults to `DOMAIN`.
+- `MATRIX_DOMAIN` (optional): The domain for the users' Matrix IDs; it defaults to `DOMAIN`.
+- `NAMESPACE`: Namespace of your K8s cluster openDesk will be installed.
+- `MASTER_PASSWORD_WEB_VAR`: Overwrites value of `MASTER_PASSWORD`.
 
-- `DOMAIN` = The domain to deploy to.
+You might want to set credential variables in the GitLab project at `Settings` > `CI/CD` > `Variables`.
-- `ISTIO_DOMAIN` = istio.`DOMAIN`
-- `NAMESPACE`: Defines into which namespace of your K8s cluster the SWP will be installed
-- `MASTER_PASSWORD_WEB_VAR`: Overwrites value of `MASTER_PASSWORD`
-
-Based on your input, the following variables will be set:
-- `MASTER_PASSWORD` = `MASTER_PASSWORD_WEB_VAR`. If `MASTER_PASSWORD_WEB_VAR`
-  is not set, the default for `MASTER_PASSWORD` will be used, unless you set
-  `MASTER_PASSWORD` as a masked CI/CD variable in Gitlab to supersede the default.
-
-You might want to set credential variables in the Gitlab project at `Settings` > `CI/CD` > `Variables`.
 
 # Tests
 
-The gitlab-ci pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another gitlab project.
+The GitLab CI pipeline contains a job named `run-tests` that can trigger a test suite pipeline on another GitLab project.
-The `DEPLOY_`-variables are used to determine which components should be tested.
+For the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this GitLab project's CI variables,
-In order for the trigger to work, the variable `TESTS_PROJECT_URL` has to be set on this gitlab project's CI variables
+which can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
-that can be found at `Settings` -> `CI/CD` -> `Variables`. The variable should have this format:
 `<domain of gitlab>/api/v4/projects/<id>`.
-
+To select the current test set, use the variable `TESTS_TESTSET`. Default: `Smoke`.
-If the branch of the test pipeline is not `main` this can be set with the .gitlab-ci.yml variable
+If the branch of the test pipeline is not `main`, this can be set with the `.gitlab-ci.yml` variable
 `TESTS_BRANCH` while creating a new pipeline.
+
+The variable `testprofile` within the job is set to `Namespace`, which tells the e2e tests to use environment-specific settings that will be read from the cluster and namespace-specific file to be found in the project internal `opendesk-env` repository.

docs/components.md

@@ -1,177 +1,189 @@
 <!--
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Components</h1>
 
-This section covers the internal system requirements as well as external service requirements for productive use.
+This section covers the internal system requirements and external service requirements for productive use.
 
 <!-- TOC -->
 * [Overview](#overview)
 * [Component integration](#component-integration)
-  * [Intercom Service (ICS)](#intercom-service-ics)
+  * [Intercom Service / Silent Login](#intercom-service--silent-login)
   * [Filepicker](#filepicker)
   * [Central Navigation](#central-navigation)
-  * [(Read \& write) Central contacts](#read--write-central-contacts)
+  * [Central Contacts](#central-contacts)
-  * [OpenProject Filestore](#openproject-filestore)
+  * [File Store (OpenProject -\> Nextcloud)](#file-store-openproject---nextcloud)
 * [Identity data flows](#identity-data-flows)
 * [Provisioning](#provisioning)
-* [Component specific documentation](#component-specific-documentation)
-* [Links to component docs](#links-to-component-docs)
 <!-- TOC -->
 
 # Overview
 
-openDesk consists out of a variety of open-source projects. Here is a list with the description and type.
+openDesk consists of a variety of open-source projects. Here is a list with the description and type.
 
 Components of type `Eval` are used for development and evaluation purposes only,
 they need to be replaced in production deployments.
 
-| Component                   | Description                    | Type       |
+| Component            | Description                    | Type       |
-|-----------------------------|--------------------------------|------------|
+| -------------------- | ------------------------------ | ---------- |
-| Certificates                | TLS certificates               | Eval       |
+| Certificates         | TLS certificates               | Eval       |
-| ClamAV (Distributed)        | Antivirus engine               | Eval       |
+| ClamAV (Distributed) | Antivirus engine               | Eval       |
-| ClamAV (Simple)             | Antivirus engine               | Eval       |
+| ClamAV (Simple)      | Antivirus engine               | Eval       |
-| Collabora                   | Weboffice                      | Functional |
+| Collabora            | Weboffice                      | Functional |
-| CryptPad                    | Weboffice                      | Functional |
+| CryptPad             | Weboffice                      | Functional |
-| Dovecot                     | Mail backend                   | Functional |
+| dkimpy-milter        | DKIM milter for Postfix        | Eval       |
-| Element                     | Secure communications platform | Functional |
+| Element              | Secure communications platform | Functional |
-| Intercom Service            | Cross service data exchange    | Functional |
+| Jitsi                | Videoconferencing              | Functional |
-| Jitsi                       | Videoconferencing              | Functional |
+| MariaDB              | Database                       | Eval       |
-| MariaDB                     | Database                       | Eval       |
+| Memcached            | Cache Database                 | Eval       |
-| Memcached                   | Cache Database                 | Eval       |
+| MinIO                | Object Storage                 | Eval       |
-| MinIO                       | Object Storage                 | Eval       |
+| Nextcloud            | File share                     | Functional |
-| Nextcloud                   | File share                     | Functional |
+| Nubus (UMS)          | Identity Management & Portal   | Functional |
-| OpenProject                 | Project management             | Functional |
+| OpenProject          | Project management             | Functional |
-| OX Appsuite                 | Groupware                      | Functional |
+| OX App Suite         | Groupware                      | Functional |
-| Provisioning                | Backend provisioning           | Functional |
+| OX Dovecot           | Mail backend (IMAP)            | Functional |
-| Postfix                     | MTA                            | Eval       |
+| Postfix              | MTA                            | Eval       |
-| PostgreSQL                  | Database                       | Eval       |
+| PostgreSQL           | Database                       | Eval       |
-| Redis                       | Cache Database                 | Eval       |
+| Redis                | Cache Database                 | Eval       |
-| Univention Management Stack | Identity Management & Portal   | Functional |
+| XWiki                | Knowledge Management           | Functional |
-| XWiki                       | Knowledgebase                  | Functional |
 
 # Component integration
 
-Some use cases require inter component integration.
+Some use cases require inter-component integration.
 
 ```mermaid
 flowchart TD
-  OXAppSuiteFrontend-->|SilentLogin, Filepicker, CentralNavigation|IntercomService
+ OX-AppSuite_Frontend-->|Silent Login, Filepicker, Central Navigation|Intercom_Service
-  Element-->|CentralNavigation|IntercomService
+ Element-->|Silent Login, Central Navigation|Intercom_Service
-  IntercomService-->|SilentLogin, TokenExchange|IdP
+ Intercom_Service-->|Silent Login, Token Exchange|IdP
-  IntercomService-->|Filepicker|Nextcloud
+ Intercom_Service-->|Filepicker|Nextcloud
-  IntercomService-->|CentralNavigation|Portal
+ Intercom_Service-->|Central Navigation|Portal
-  OXAppSuiteBackend-->|Filepicker|Nextcloud
+ OX-AppSuite_Backend-->|Filepicker|Nextcloud
-  Nextcloud-->|CentralNavigation|Portal
+ Nextcloud-->|Central Navigation|Portal
-  OpenProject-->|CentralNavigation|Portal
+ OpenProject-->|Central Navigation|Portal
-  OpenProject-->|Filestore|Nextcloud
+ OpenProject-->|File Store|Nextcloud
-  XWiki-->|CentralNavigation|Portal
+ XWiki-->|Central Navigation|Portal
-  Nextcloud-->|CentralContacts|OXAppSuiteBackend
+ Nextcloud-->|Central Contacts|OX-AppSuite_Backend
-  OXAppSuiteFrontend-->|Filepicker|OXAppSuiteBackend
+ OX-AppSuite_Frontend-->|Filepicker|OX-AppSuite_Backend
 ```
 
-## Intercom Service (ICS)
+Most details can be found in the upstream documentation that is linked in the respective sections.
 
-The UCS Intercom Service's role is to enable cross-application integration based on browser interaction.
+## Intercom Service / Silent Login
-Handling authentication when the frontend of an application is using the API from another application is often a
-challenge.
-For more details on the ICS please refer to its own [doc](./components/intercom-service.md).
 
-To establish a session with the Intercom Service, the application that wants to use the ICS must initiate a silent
+The Intercom Service is deployed in the context of Nubus/UMS. Its role is to enable cross-application integration
-login.
+based on the user's browser interaction as handling authentication when the frontend of an application has to call
+the API from another application is often a challenge.
 
-Currently only OX AppSuite is using the frontend-based integration, and therefore it is right now the only consumer of
+To establish a session with the Intercom Service, applications can use the silent login feature within an iframe.
-the ICS API.
+
+Currently, only OX AppSuite and Element are using the frontend-based integration.
+
+**Links**
+- [Intercom Service upstream documentation](https://docs.software-univention.de/intercom-service/latest/index.html).
 
 ## Filepicker
 
-The Nextcloud filepicker which is integrated into the OX AppSuite allows you to add attachments or links to files from
+The Nextcloud Filepicker is integrated into the OX AppSuite, supporting the following use cases against the respective openDesk instance's Nextcloud:
-and saving attachments to Nextcloud.
+- Attach files from Nextcloud to emails.
+- Create and add links to Nextcloud files into emails.
+- Save attachments from emails into Nextcloud.
+- Attach files from Nextcloud to calendar entries.
 
-The filepicker is using frontend and backend based integration.
+The Filepicker uses frontend and backend-based integration:
-Frontend-based integration means that OX AppSuite in the browser is communicating with ICS.
+- For frontend-based integration, the OX AppSuite frontend uses the Intercom Service.
-While using backend-based integration, OX AppSuite middleware is communicating with Nextcloud, which is especially used
+- Backend-based integration is coming from OX AppSuite middleware. The middleware communicates directly with Nextcloud
-when adding a file to an email or storing a file into Nextcloud.
+when adding a file to an email or storing a file into Nextcloud to avoid passing these files through the user's browser.
+
+**Links**
+- [OX AppSuite Nextcloud Integration upstream documentation](https://gitlab.open-xchange.com/extensions/nextcloud-integration/-/tree/main/documentation).
 
 ## Central Navigation
 
-Central navigation is based on an API endpoint in the portal that provides the contents of the portal for a user to
+Central navigation is based on an API endpoint in the Nubus portal that returns a JSON containing the portal's contents for
-allow components to render the menu showing all available SWP applications for the user.
+a given user. The response from the API endpoint is used in the openDesk applications to render the central navigation.
 
-## (Read & write) Central contacts
+The API can be called by
+- frontend services through the Intercom Service's `/navigation.json` endpoint or
+- backend services directly at the portal's `/univention/portal/navigation.json` endpoint.
 
-Open-Xchange App Suite is used to manage contacts within openDesk. There is an API in the AppSuite that is being used by
+The central navigation expects the API caller to present a shared secret for authentication and the username for whom the portal
-Nextcloud to lookup contacts as well as to create contacts. This is maybe done when a file is shared with a not yet
+contents should be returned for.
-available personal contact.
 
-## OpenProject Filestore
+A `curl` based request returning the navigation contents looks like this:
 
-By default, Nextcloud is a configured option for storing attachments in OpenProject.
+```
-The Filestore can be enabled on a per-project level in OpenProject's project admin section.
+curl 'https://portal.<DOMAIN>/univention/portal/navigation.json?base=https%3A//portal.<DOMAIN>&language=de-DE' -u "<USERNAME>:<SHARED_SECRET>"
+```
+
+## Central Contacts
+
+OX App Suite is managing contacts in openDesk. Therefore, Nextcloud's PHP backend is using the OX AppSuite's middleware Contacts API to
+- create a new contact in the user's contacts folder when a file is shared with an unknown email address.
+- retrieve contacts from the user's contacts folder to support search-as-you-type when starting to share a file.
+
+**Links:**
+- Currently used [OX Contacts API (deprecated)](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Contacts).
+- New [OX Addressbooks API](https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Addressbooks) the Central Contacts integration will switch to.
+
+## File Store (OpenProject -> Nextcloud)
+
+While OpenProject allows you to attach files to work packages directly, it is often preferred that the files are
+stored within Nextcloud or to link an existing file from your openDesk Nextcloud to a work package.
+
+Therefore, openDesk pre-configures the trust between the openDesk instance's OpenProject and Nextcloud during the `openproject-boostrap` deployment step. As a prerequisite for that, openDesk's Nextcloud contains the `integration_openproject` app.
+
+The file store must still be enabled per project in OpenProject's project admin section.
+
+**Links:**
+- [OpenProject's documentation on Nextcloud integration](https://www.openproject.org/docs/system-admin-guide/integrations/nextcloud/)
+- [OpenProject Integration Nextcloud app](https://apps.nextcloud.com/apps/integration_openproject)
 
 # Identity data flows
 
 An overview of
-- components that consume the LDAP service. Mostly by using a dedicated LDAP search account.
+- components that consume the LDAP service.
-- components using Univention Keycloak as identity provider (IdP). If not otherwise denoted based on the OAuth2 / OIDC flows.
+  - The components access the LDAP using a component-specific LDAP search account.
+- components using Univention Keycloak as an identity provider (IdP).
+  - The components should use OAuth2 / OIDC flows if not otherwise denoted.
+  - All components have a client configured in Keycloak, except for Jitsi, which is using authentication with the
+ [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) that does not
+ require an OIDC client to be configured in Keycloak.
 
 Some components trust others to handle authentication for them.
 
 ```mermaid
 flowchart TD
-    K[IdP]-->L[LDAP]
+ K[IdP]-->L[LDAP]
-    N[Nextcloud]-->L
+ N[Nextcloud]-->L
-    O[OpenProject] --> L
+ O[OpenProject] --> L
-    A[OX AppSuite]-->L
+ A[OX AppSuite]-->L
-    D[OX Dovecot]-->L
+ D[OX Dovecot]-->L
-    P[Portal/Admin]-->L
+ P[Portal/Admin]-->L
-    X[XWiki]-->L
+ X[XWiki]-->L
-    A-->K
+ A-->K
-    N-->K
+ N-->K
-    D-->K
+ D-->K
-    O-->K
+ O-->K
-    X-->K
+ X-->K
-    P-->|SAML|K
+ P-->|SAML|K
-    E[Element]-->K
+ E[Element]-->K
-    J[Jitsi]-->K
+ J[Jitsi]-->K
-    I[IntercomService]-->K
+ I[IntercomService]-->K
-    C[Collabora]-->N
+ C[Collabora]-->N
-    R[CryptPad]-->N
+ R[CryptPad]-->N
-    F[Postfix]-->D
+ F[Postfix]-->D
 ```
 
 # Provisioning
 
-Currently, active provisioning is only done for OX AppSuite. The OX-Connector is synchronizing, creating, modifying and
+Currently, active provisioning is only done for OX AppSuite. The OX-Connector synchronizes the following objects to the OX AppSuite using the AppSuite's SOAP API:
-deleting activities for the following objects to the OX AppSuite using the AppSuite's SOAP API:
 
 - Contexts
 - Users
 - Groups
 - Functional Mailboxes
 - Resources
-
-# Component specific documentation
-
-We want to provide more information per component in separate, component-specific markdown file.
-To establish a common view on the components, we are going to cover various aspects:
-
-- **Component overview**: Shall provide a quick introduction including the components prerequisites and subcomponents (f.e. pods).
-- **Resources**: Will contain a link to the component upstream documentation, the helm chart and image locations.
-- **Operational Capabilities**
-  - **Install**: The components install within the SWP.
-  - **Restart**: Deleting and restarting pods works seamlessly.
-  - **Update**: Redeploying the component with a different configuration works as expected. The component makes use of the updates configuration afterwards.
-  - **Upgrade**: Component allows upgrading existing deployments with more current versions of itself.
-  - **Secrets**: The component uses K8s secrets.
-  - **Logging**: Only logging to STDOUT, no logs inside the container.
-  - **Monitoring**: Application provides based on kube-prometheus-stack CRD: ServiceMonitor and PrometheusRule. Optional: Grafana Dashboard.
-  - **Scale**: If supported (as we use community products) the component should be manually scalable. Optional: Autoscaling.
-  - **Network policies**: Deny by default, allow application related traffic.
-  - **Uninstall**: Documented and working complete uninstallation of the component.
-- **Debugging**: Some helpful information when it comes to debugging a component, e.g. setting log level.
-
-# Links to component docs
-
-- [Intercom-Service](./components/intercom-service.md)

docs/components/intercom-service.md

@@ -1,43 +0,0 @@
-<!--
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-SPDX-License-Identifier: Apache-2.0
--->
-**Content / Quick navigation**
-
-[[_TOC_]]
-
-# Component overview
-
-The Intercom Service (ICS) is used to address integrational use cases where the frontend of one application has to call APIs from another application.
-
-# Resources
-
-- External documentation: https://docs.software-univention.de/intercom-service/latest/index.html
-- Helm chart: https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/components/charts/sovereign-workplace-intercom-service
-- Image: not yet published on Open CoDE, image will be provided through external artifactory.
-
-# Operational Capabilities
-
-## Install
-
-## Restart
-
-## Update
-
-## Upgrade
-
-## Secrets
-
-## Logging
-
-## Monitoring
-
-## Scale
-
-## Network policies
-
-## Uninstall
-
-# Debugging
-
-ICS does not have a debug level option yet. But please refer to the most current documentation of the component. You just want to look into the standard log output of the component.

docs/debugging.md

@@ -2,46 +2,151 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Debugging</h1>
 
+<!-- TOC -->
 * [Disclaimer](#disclaimer)
 * [Enable debugging](#enable-debugging)
+* [Adding containers to a pod for debugging purposes](#adding-containers-to-a-pod-for-debugging-purposes)
+  * [Adding a container to a pod/deployment - Dev/Test only](#adding-a-container-to-a-poddeployment---devtest-only)
+  * [Temporary/ephemeral containers](#temporaryephemeral-containers)
 * [Components](#components)
   * [MariaDB](#mariadb)
   * [Nextcloud](#nextcloud)
   * [OpenProject](#openproject)
   * [PostgreSQL](#postgresql)
+  * [Keycloak](#keycloak)
+<!-- TOC -->
 
 # Disclaimer
 
-This document collects information how to deal with debugging an openDesk deployment.
+This document collects information on how to deal with debugging an openDesk deployment.
 
-It will be extended over time as we have to deal with debugging cases.
+It will be extended over time as we deal with debugging cases.
 
 We for sure do not want to reinvent the wheel, so we might link to external sources that contain helpful
 information where available.
 
-**Note:** You should never enable debug in production environments! By looking up `debug.enable` in the deployment you
+> **Warning**<br>
-will find the various places changes are applied when enabling debugging. So outside of development and test
+> You should never enable the debug option in production environments! By looking up `debug.enable` in the deployment, you
-environments you may want to make use of them in a very thoughtful and selective manner if needed.
+will find the various places changes are applied when enabling debugging. So, outside of development and test
+environments, you should use them thoughtfully and carefully if needed.
 
 # Enable debugging
 
-Set `debug.enable` to `true` in [`debug.yaml`](../helmfile/environments/default/debug.yaml) to set the
+Check the openDesk [`debug.yaml.gotmpl`](../helmfile/environments/default/debug.yaml.gotmpl) and set for your deployment
-component's loglevel to debug and it get some features like:
+```
-- The `/admin` console is routed for Keycloak.
+debug:
-- An ingress for `http://minio-console.<your_domain>` is configured.
+  enable: true
-and set the loglevel for components to "Debug".
+```
 
-**Note:** All containers should write their log output to STDOUT, if you find (valuable) logs inside a container, please let us know!
+This will result in:
+- setting most component's log level to debug
+- making the Keycloak admin console available by default at `https://id.<your_domain>/admin/`
+- configured the ingress for `http://minio-console.<your_domain>`
+
+> **Note**<br>
+> When enabling debug mode and updating your deployment, you must manually delete all jobs before updating. In debug mode, we keep the jobs, and some job fields are immutable, leading to a deployment failure.
+
+> **Note**<br>
+> All containers should write their log output to STDOUT; if you find (valuable) logs inside a container, please let us know!
+
+# Adding containers to a pod for debugging purposes
+
+During testing or development, you may need to execute tools, browse, or even change things in the filesystem of another container.
+
+This can be a challenge the more security-hardened the container images are because there are no debugging tools available, and sometimes, there is not even a shell.
+
+Adding a container to a Pod can ease the pain.
+
+Below are some wrap-up notes on debugging openDesk by adding debug containers. Of course, there are many more detailed resources out there.
+
+## Adding a container to a pod/deployment - Dev/Test only
+
+You can add a container by editing and updating an existing deployment, which is quite comfortable with tools like [Lens](https://k8slens.dev/).
+
+- Select the container you want to make use of as a debugging container; in the example below, it is `registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest`.
+- Ensure the `shareProcessNamespace` option is enabled for the Pod.
+- Reference the selected container within the `containers` array of the deployment.
+- If you want to access another container's filesystem, ensure both containers' user/group settings match.
+- Save & update the deployment.
+
+The following example can be used to debug the `openDesk-Nextcloud-PHP` container; if you want to modify files, remember to set `readOnlyRootFilesystem` to `true` on the PHP container.
+
+```yaml
+      shareProcessNamespace: true
+      containers:
+        - name: debugging
+          image: registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest
+          command: ["/bin/bash", "-c", "while true; do echo 'This is a temporary container for debugging'; sleep 5 ; done"]
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            runAsUser: 65532
+            runAsGroup: 65532
+            runAsNonRoot: true
+            readOnlyRootFilesystem: false
+            allowPrivilegeEscalation: false
+            seccompProfile:
+              type: RuntimeDefault
+```
+
+- After the deployment has been reloaded, open the shell of the debugging container.
+- When you've succeeded, you will see the processes of both/all containers in the Pod when doing a `ps aux`.
+- To access other containers' filesystems, select the PID of a process from the other container and do a `cd /proc/<selected_process_id>/root`.
+
+## Temporary/ephemeral containers
+
+An interesting read we picked most of the details below from: https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/
+
+Sometimes, you do not want to add a container permanently to your existing deployment. In that case, you could use [ephemeral containers](https://kubernetes.io/docs/concepts/workloads/pods/ephemeral-containers/).
+
+For the commands further down this section, we set some environment variables first:
+- `NAMESPACE`: The namespace in which the Pod you want to inspect is running.
+- `DEPLOYMENT_NAME`: The deployment's name responsible for spawning the Pod you want to inspect within the pre-mentioned namespace.
+- `POD_NAME`: The name of the Pod you want to inspect within the pre-mentioned namespace.
+- `EPH_CONTAINER_NAME`: Choose the name for the container, and "debugging" seems obvious.
+- `DEBUG_IMAGE`: The image you want to use for debugging purposes.
+
+e.g.
+
+```shell
+export EPH_CONTAINER_NAME=debugging
+export NAMESPACE=my_test_deployment
+export DEPLOYMENT_NAME=opendesk-nextcloud-php
+export POD_NAME=opendesk-nextcloud-php-6686d47cfb-7642f
+export DEBUG_IMAGE=registry.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-debugging-image:latest
+```
+
+You still need to ensure that your deployment supports process namespace sharing:
+
+```shell
+kubectl -n ${NAMESPACE} patch deployment ${DEPLOYMENT_NAME} --patch '
+spec:
+  template:
+    spec:
+      shareProcessNamespace: true'
+```
+
+Now, you can add the ephemeral container with:
+```shell
+kubectl -n ${NAMESPACE} debug -it --attach=false -c ${EPH_CONTAINER_NAME} --image={DEBUG_IMAGE} ${POD_NAME}
+```
+and open its interactive terminal with
+```shell
+kubectl -n ${NAMESPACE} attach -it -c ${EPH_CONTAINER_NAME} ${POD_NAME}
+```
 
 # Components
 
 ## MariaDB
 
-When using the openDesk bundled MariaDB you can explore database(s) using the MariaDB interactive terminal from the pod's command line: `mariadb -u root -p`. As password provide the value for `MARIADB_ROOT_PASSWORD` set in the pod's environment.
+When using the openDesk bundled MariaDB, you can explore the database(s) using the MariaDB interactive terminal from the Pod's command line: `mariadb -u root -p`. On the password prompt, provide the value for `MARIADB_ROOT_PASSWORD` found in the Pod's environment.
 
-While you will find all details for the CLI tool in [the online documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some quick commands are:
+While you will find all the details for the CLI tool in [the online documentation](https://mariadb.com/kb/en/mariadb-command-line-client/), some quick commands are:
 
 - `help`: Get help on the psql command set
 - `show databases`: Lists all databases
@@ -51,28 +156,27 @@ While you will find all details for the CLI tool in [the online documentation](h
 
 ## Nextcloud
 
-`occ` is the CLI for Nextcloud, all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
+`occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
 
 You can run occ commands in the `opendesk-nextcloud-php` pod like this: `php /var/www/html/occ config:list`
 
 ## OpenProject
 
-OpenProject is a Ruby on Rails application. Therefore you can make use of the Rails console from the pod's command line `bundle exec rails console`
+OpenProject is a Ruby on Rails application. Therefore, you can make use of the Rails console from the Pod's command line `bundle exec rails console`
-
 and run debug code like this:
 
 ```
-uri = URI('https://nextcloud.url/index.php/apps/integration_openproject/check-config')
+uri = URI('https://nextcloud.url/apps/integration_openproject/check-config')
 Net::HTTP.start(uri.host, uri.port,
-  :use_ssl => uri.scheme == 'https') do |http|
+ :use_ssl => uri.scheme == 'https') do |http|
-  request = Net::HTTP::Get.new uri
+ request = Net::HTTP::Get.new uri
-  response = http.request request # Net::HTTPResponse object
+ response = http.request request # Net::HTTPResponse object
 end
 ```
 
 ## PostgreSQL
 
-When using the openDesk bundled PostgreSQL you can explore database(s) using the PostgreSQL interactive terminal from the pod's command line: `psql -U postgres`.
+Using the openDesk bundled PostgreSQL, you can explore database(s) using the PostgreSQL interactive terminal from the Pod's command line: `psql -U postgres`.
 
 While you will find all details in the [psql subsection](https://www.postgresql.org/docs/current/app-psql.html)) of the PostgreSQL documentation, some quick commands are:
 
@@ -81,3 +185,22 @@ While you will find all details in the [psql subsection](https://www.postgresql.
 - `\c <databasename>`: Connect to `<databasename>`
 - `\dt`: List (describe) tables within the currently connected database
 - `\q`: Quit the client
+
+## Keycloak
+
+Keycloak is the gateway to integrate other authentication management systems or applications. It can be desired to
+avoid enabling debug mode for the whole platform when you just need to look into Keycloak.
+
+That can easily be achieved in two steps:
+
+1. Updating the value for `KC_LOG_LEVEL` in the related configmap `ums-keycloak`.
+```shell
+export NAMESPACE=<your_namespace>
+export CONFIGMAP_NAME=ums-keycloak
+kubectl patch -n ${NAMESPACE} configmap ${CONFIGMAP_NAME} --type merge -p '{"data":{"KC_LOG_LEVEL":"DEBUG"}}'
+```
+
+2. Restart the Keycloak Pod(s).
+
+> **Note**<br>
+> As the `ums-keycloak-extensions-handler` is performing frequent (one per second) requests to Keycloak for retrieval of the Keycloak event history, you might want to stop/remove the deployment while debugging/analysing Keycloak to not get your debug output spammed by these requests.

docs/development.md

@@ -0,0 +1,166 @@
+<!--
+SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Developing openDesk deployment automation</h1>
+
+Active development on the deployment is currently only available for project members.
+However, contributions are possible using the [CLA](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/CONTRIBUTING.md?ref_type=heads) process.
+
+<!-- TOC -->
+* [Overview](#overview)
+* [Default branch, `develop` and other branches](#default-branch-develop-and-other-branches)
+* [External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`](#external-artifacts---chartsyamlgotmpl-and-imagesyamlgotmpl)
+  * [Linting](#linting)
+    * [Disable linting selectively](#disable-linting-selectively)
+  * [Renovate](#renovate)
+  * [Mirroring](#mirroring)
+    * [Get new artifacts mirrored](#get-new-artifacts-mirrored)
+* [Creating new charts/images](#creating-new-chartsimages)
+<!-- TOC -->
+
+# Overview
+
+The following sketch provides a high-level overview to get a basic understanding of the deployment-relevant
+structure of this repository. Understanding that structure is vital if you want to contribute to
+developing the openDesk platform.
+
+```mermaid
+flowchart TD
+ J[helmfile.yaml.gotmpl\nor a helmfile outside of this repository]-->A
+ J-->K[./helmfile/environemnts/*your_environment*/values.yaml.gotmpl\nor any an environment values file]
+ A[./helmfile_generic.yaml.gotmpl]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml.gotmpl\nReferences the relevant app Helm\ncharts using details from 'charts.yaml.gotmpl']
+ B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml.gotmpl`]
+ A-->D[./helmfile/environments/default/*\nwith just some examples below]
+ D-->F[charts.yaml.gotmpl]
+ D-->G[images.yaml.gotmpl]
+ D-->H[global.*]
+ D-->I[secrets.yaml.gotmpl\nreplicas.yaml.gotmpl\nresources.yaml.gotmpl\n...]
+ A-->|overwrite defaults with your\ndeployment/environment specific values|E[./helmfile/environments/default/values.yaml.gotmpl]
+```
+
+The `helmfile.yaml.gotmpl` file in the root folder is the foundation
+for the entire deployment. It references the `helmfile_generic.yaml.gotmpl`
+file, which includes app-specific `helmfile.yaml.gotmpl` files and
+global values files located in `./environments/default`.
+
+`helmfile.yaml.gotmpl` also refers to three predefined environments: `dev`,
+`test`, and `prod`.
+
+The `helmfile_generic.yaml.gotmpl` file is designed to be referenced from
+external repositories, where custom environments may be defined. An
+example is demonstrated in the `helmfile.yaml.gotmpl` file.
+
+Before you investigate any app-specific configuration, it is recommended that you review the contents of `./helmfile/environments/default` to understand what configuration details are set there, as the app deployments reference them.
+
+# Default branch, `develop` and other branches
+
+The `main` branch is configured to be the default branch, as visitors of the project on Open CoDE should see that
+branch by default.
+
+Please use the `develop` branch to diverge your branch(es) from. See the [workflow guide](./workflow.md)
+for more details on naming conventions.
+
+There is a CI bot that automatically creates a merge request once you initially push your branch to Open CoDE.
+Of course, the merge request will target the `develop` branch, be in status `draft`, and you are set as the assignee.
+
+If you do not plan to merge from the branch you have pushed, please close the auto-created MR.
+
+# External artifacts - `charts.yaml.gotmpl` and `images.yaml.gotmpl`
+
+The `charts.yaml.gotmpl` and `images.yaml.gotmpl` files are the central place to reference external artifacts used for the deployment.
+
+Besides the deployment automation itself, some tools work with the contents of the files:
+
+- **Linting**: Ensures consistency of the file contents for the other tools.
+- **Renovate**: Automatically create MRs that update the components to their latest version.
+- **Mirror**: Mirror artifacts to Open CoDE.
+
+Please find details on these tools below.
+
+## Linting
+
+In the project's CI, there is a step dedicated to lint the two yaml files, as we want them to be in
+- alphabetical order regarding the components and
+- in a logical order regarding the non-commented lines (registry > repository > tag).
+
+In the linting step, the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
+just mentioned sorting, and the result is compared with the unsorted version. If there is a delta, the linting fails, and you can fix it by running the CLI tool locally, verifying and applying the result to your branch.
+
+> **Note**<br>
+> Please ensure that in component blocks, you use comments only at the beginning of the block or at its end. Ideally, you stick
+with the many available examples in the yaml files.
+
+Example:
+```yaml
+ synapse:
+ # providerCategory: "Supplier"
+ # providerResponsible: "Element"
+ # upstreamRegistry: "https://registry-1.docker.io"
+ # upstreamRepository: "matrixdotorg/synapse"
+ # upstreamMirrorTagFilterRegEx: '^v(\d+)\.(\d+)\.(\d+)$'
+ # upstreamMirrorStartFrom: ["1", "91", "2"]
+ registry: "registry.opencode.de"
+ repository: "BMI/opendesk/components/supplier/element/images-mirror/synapse"
+ tag: "v1.91.2@sha256:1d19508db417bb2b911c8e086bd3dc3b719ee75c6f6194d58af59b4c32b11322"
+```
+
+### Disable linting selectively
+
+If you follow the "push early, push often" paradigm to save your work to the central Git instance, or you just fix a typo in
+existing documentation, you can avoid the CI and its linting being executed, as it might not offer additional value.
+
+GitLab offers two options to skip the CI on a commit/push:
+- Add `[ci skip]` to your commit message ([details](https://docs.gitlab.com/ee/ci/pipelines/#skip-a-pipeline)).
+**Note:** The string has to be removed before merging your feature branch into `develop`.
+- Use the related git push option `git push -o ci.skip` ([details](https://docs.gitlab.com/ee/user/project/push_options.html#push-options-for-gitlab-cicd)).
+
+## Renovate
+
+Uses a regular expression to match the values of the following attributes:
+
+- `# upstreamRegistry` *required*: Attribute's value must be prefixed with `https://` for Renovate.
+- `# upstreamRepository` *required*
+- `tag` *required*
+
+Checks for newer versions of the given artifact and creates an MR containing the newest version's tag (and digest).
+
+## Mirroring
+
+- See also: https://gitlab.opencode.de/bmi/opendesk/tooling/oci-pull-mirror
+
+> **Note:**<br>
+> The mirror is scheduled to run every hour at 42 minutes past the hour.
+
+openDesk strives to make all relevant artifacts available on Open CoDE so there is a mirroring process
+configured to pull artifacts that do not originate from Open CoDE into projects called `*-Mirror` within the
+[openDesk Components section](https://gitlab.opencode.de/bmi/opendesk/components).
+
+The mirror script takes the information on what artifacts to mirror from the annotation inside the two yaml files:
+- `# upstreamRegistry` *required*: To identify the source registry
+- `# upstreamRegistryCredentialId`: *optional*: In case the source registry is not public, the access credentials have to be specified as ENV variables containing the value of this key in their name, so you want to specify that key all uppercase:
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_USERNAME`
+  - `MIRROR_CREDENTIALS_SRC_<upstreamRegistryCredentialId>_PASSWORD`
+- `# upstreamRepository` *required*: To identify the source repository
+- `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set, the mirror for the component will be activated. Only tags that match the given regular expression are being mirrored. **Note:** You must use single quotes for this attribute's value if you use backslash leading regex notation like `\d`.
+- `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artifacts beginning with a specific version. You must use capturing group
+ in `# upstreamMirrorTagFilterRegEx` to identify the single numeric elements of the version within the tag and use per capturing group (left to right) one numeric array
+ element here to define the version the mirror should start with.
+
+### Get new artifacts mirrored
+
+If you want new images or charts mirrored that are not yet included in one of the yaml files, you can add them in your branch, including the aforementioned mirror annotations, and ask somebody from the platform development team to trigger the mirror's CI based on your branch.
+
+Once your branch is merged into develop, your artifacts are mirrored hourly.
+
+# Creating new charts/images
+
+When you create new Helm charts, please check out the
+[openDesk Best Practices](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-best-practises)
+for Helm charts.
+
+You may also want to make use of our [standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) to
+quickly get Helm charts and container images that are signed, linted, scanned, and released.
+Check out the `.gitlab-ci.yaml` files in the project's [Charts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts) or [Images](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images) to get an idea how little you need to do yourself.

docs/enhanced-configuration.md

@@ -0,0 +1,17 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Enhanced configuration use cases for openDesk</h1>
+
+# Overview
+
+The following enhanced configuration use cases are described in separate documents.
+
+- [Separate mail & Matrix domain](./enhanced-configuration/separate-mail-matrix-domain.md)
+- [Federation with external identity provider](./enhanced-configuration/idp-federation.md)
+- [Matrix federation](./enhanced-configuration/matrix-federation.md)
+- [Groupware migration from M365 to openDesk](./enhanced-configuration/groupware-migration.md)
+- [Self-signed certificate and custom Certificate Authority (CA)](./enhanced-configuration/self-signed-certificates.md)
+- [GitOps deployments using Argo CD](./enhanced-configuration/gitops.md)

docs/enhanced-configuration/gitops.md

@@ -0,0 +1,55 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>GitOps Deployment</h1>
+
+<!-- TOC -->
+* [Considerations](#considerations)
+* [ArgoCD](#argocd)
+  * [Option 1: Use YAML manifests](#option-1-use-yaml-manifests)
+  * [Option 2: Helmfile plugin](#option-2-helmfile-plugin)
+<!-- TOC -->
+
+The recommended deployment method for openDesk is via Helmfile. This can be done "by hand", via CI/CD (Gitlab) or using
+the [GitOps](https://about.gitlab.com/topics/gitops/) approach with tools like [Argo CD](https://argoproj.github.io/cd/).
+
+This documentation will use Argo CD to explain how to deploy openDesk GitOps-style.
+
+# Considerations
+
+- openDesk consists of multiple applications which have to be deployed in order.
+- During upgrades, migrations have to run before and after applications.
+
+# ArgoCD
+
+We are continuously improving our Argo CD support, please share you experience with Argo CD deployments e.g. by [creating
+at ticket](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues).
+
+There are two options to deploy openDesk via Argo CD described in the following sections.
+
+## Option 1: Use YAML manifests
+
+This option requires a preprocessing step before using Argo CD. This step requires you to compile the Helmfile based
+deployment into Kubernetes YAML manifest, to do so you need to execute the helmfile binary:
+
+```shell
+helmfile template > opendesk.yaml
+```
+
+References:
+- [Helmfile CLI documentation](https://helmfile.readthedocs.io/en/latest/#cli-reference)
+- [Generate K8s YAML Manifests for openDesk](https://gitlab.opencode.de/bmi/opendesk/deployment/options/generate-k8s-yaml-manifests)
+
+Afterwards, you can use the resulting manifests within an standard Argo CD workflow.
+
+## Option 2: Helmfile plugin
+
+It is possible to deploy openDesk via Argo CD with community developed
+[Helmfile plugin](https://github.com/travisghansen/argo-cd-helmfile).
+
+You can find an example for this approach in the
+[Argo CD Deployments](https://gitlab.opencode.de/bmi/opendesk/deployment/options/argocd-deploy) repository.
+It contains an example Helm chart (`opendesk-parent`) to create Argo CD Applications via a Helm chart (`opendesk`)
+according to `app of apps pattern` and is using sync waves to follow dependencies.

docs/enhanced-configuration/groupware-migration.md

@@ -0,0 +1,184 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Migration from M365 with audriga migration service and master authentication</h1>
+
+<!-- TOC -->
+* [Prerequisites](#prerequisites)
+  * [Prepare M365 tenant for access](#prepare-m365-tenant-for-access)
+  * [Provisioning user accounts in openDesk](#provisioning-user-accounts-in-opendesk)
+  * [Deploy openDesk with master authentication](#deploy-opendesk-with-master-authentication)
+* [Migration configuration](#migration-configuration)
+  * [Select the source provider and configure your openDesk instance](#select-the-source-provider-and-configure-your-opendesk-instance)
+  * [Adding accounts](#adding-accounts)
+    * [Add user accounts individually](#add-user-accounts-individually)
+    * [Add multiple user accounts via CSV file](#add-multiple-user-accounts-via-csv-file)
+  * [Start the migration](#start-the-migration)
+  * [Monitor migration status](#monitor-migration-status)
+<!-- TOC -->
+
+Most organizations already have email accounts on various platforms that need to be migrated to openDesk. This document describes the migration from M365 accounts to openDesk using the [audriga Migration Service](https://www.audriga.com) in combination with the master authentication option in openDesk. Other source platforms are also supported, and their migrations work in a similar manner.
+
+The migration can be configured on audriga's self-service website, accessed with most common web browsers (e.g. IE, Firefox, Safari or Chrome). No software needs to be installed on your machine. The service connects to your mailbox similarly to what your email client does. Emails, attachments, folders, and, depending on the source systems, contacts, tasks, notes, and calendar data are being copied to your destination account. See [M365 to OX Migration Guide](https://audriga.com/fileadmin/guides/en/MS365-OX.pdf) for the scope and limitations of the process.
+
+The data in the source mailbox will not be deleted or altered. To configure a migration, only three simple steps in audriga's self-service portal have to be completed. After the migration has started, its status can be continuously monitored on the website.
+
+It may not be possible to complete especially large or complex migrations with only this guide. If you identify issues related to I/O, bandwidth, timeline constraints, or anything else that makes the migration more complicated than you feel comfortable handling on your own using the self-service, please get in touch with contact [audriga's support](mailto:support@audriga.com).
+
+# Prerequisites
+
+## Prepare M365 tenant for access
+
+The following instructions provide information on how to authenticate Microsoft 365 / Exchange Online accounts in the audriga migration service with "modern authentication" using a service account without the need to provide a username and password for each mailbox that will be migrated.
+
+You will have to select an existing user account that will be used as a service account for the migration. You have to register the audriga application and create an M365 email group known only to you as described in the following steps:
+
+***1. Select one account to serve as a service account***
+
+Please note that the account that shall serve as the service account requires a Microsoft 365/Exchange online license (mailbox).
+
+> **Notes**<br>
+> If you want to designate your admin account as a service account, you have to provide the admin with a license.
+
+***2. Register the audriga app in your tenant***
+
+To register the audriga app in your tenant, log into your admin account and access the following URL:
+
+ https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=3cd27a72-a19e-4945-9715-fc24d940428f&redirect_uri=https://umzug.audriga.com/SMESwitchWebApp/oauth_complete.jsp&scope=https://outlook.office.com/.default
+
+- Accept the App "audriga CloudMovr migration"
+- You will be redirected to an audriga page, which you can close without requiring additional interaction.
+
+> **Note**<br>
+> The audriga application is created under the "Enterprise application" tab in the AzureAD console.
+
+***3. Create a "secret" group in the M365 tenant***
+
+Create a "secret" group in the customer tenant.
+
+- Go to <https://aad.portal.azure.com> > Azure Active Directory > Groups > New Group
+- Choose a group name and group email address that includes the word "audriga" in lowercase ("Audriga" will not work), like *audriga-migration@your-maildomain.tld*
+- Choose the group type "Microsoft 365"
+- Appoint your service account (see 1.) as the owner of this group
+
+
+## Provisioning user accounts in openDesk
+
+In openDesk, you have to have all user accounts with mailboxes pre-defined before running the migration. You can either manually create your accounts using an IAM administrator or use the [user import tool](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) to batch import user accounts to your openDesk deployment.
+
+## Deploy openDesk with master authentication
+
+With openDesk 1.0 Enterprise, you can set openDesk's email components (OX AppSuite and OX Dovecot) into master authentication mode to run the migration as described in this document using the following two settings for your deployment:
+
+```
+secrets:
+  oxAppSuite:
+    adminPassword: "your_temporary_master_password"
+functional:
+  migration:
+    oxAppSuite:
+      enabled: true
+```
+
+1. You must specify the master password referenced in the document's following sections.
+2. You need to enable the actual master authentication mode.
+
+Updating your deployment with these settings will allow you to continue with the migration scenario. Once the migration is completed, you can remove `secrets.oxAppSuite.adminPassword` and need to turn off the migration mode by setting `functional.migration.oxAppSuite.enabled` to `false` or removing that setting, as `false` is the default before you update your deployment once again.
+
+> **Note**<br>
+> For the changes to take effect, it is sufficient to deploy the `open-xchange` component.
+
+> **Note**<br>
+> While in master authentication mode, regular users cannot log in to the webmail module of openDesk or access the mail using IMAP, as it is not recommended that users interact with the target mail infrastructure during the migration scenario described in this document.
+
+# Migration configuration
+
+The migration is configured in 3 steps using the [audriga migration self-service](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware).
+
+Ensure you meet the prerequisites. For example, this document does not support using the standard username/password-based authentication option for M365.
+
+## Select the source provider and configure your openDesk instance
+
+Choose [Microsoft 365 / Exchange Online (Admin)](https://umzug.audriga.com/SMESwitchWebApp/?client=groupware#src=onmicrosoft.com) as your current provider.
+
+> **Note**<br>
+> You may need to start typing in "Microsoft Office 365/Exchange Online" for it to appear in the list.
+
+Configure openDesk as your destination server:
+- Select "Configure provider or server" in the provider selection box of the migration application.
+- In the following dialog, select "Open-Xchange" as protocol.
+- On the tab "IMAP"
+  - For "Mailserver (host name or IP address)" enter your IMAP host, e.g. "webmail.your-opendesk-domain.tld".
+  - If your IMAP server is not running on default port 993, enter your nonstandard IMAP port under Details -> Port.
+  - Press check.
+- On the tab "Open-Xchange"
+  - Set the hostname of your OX AppSuite installation, e.g. "webmail.your-opendesk-domain.tld".
+  - Press check.
+- If you receive a green checkmark on both tabs, click "Save". Otherwise, check your settings until you get the green checkmark.
+
+## Adding accounts
+
+You can add accounts one by one, which seems only feasible for test scenarios, or when you migrate a handful of mailboxes, or you can add accounts using CSV upload. Both options are described in the following subsections.
+
+### Add user accounts individually
+
+By default, you will enter the "Add Mailbox" tab where you can add individual accounts for M365:
+
+```
+Username:             enter the username of the service account, e.g. eva@your-maildomain.tld
+Password:             enter the particular group email address, e.g. audriga-migration@your-maildomain.tld
+Details -> mailbox:   enter the user's mailbox you want to migrate, e.g. pia@your-maildomain.tld
+```
+
+On the openDesk site, please provide:
+```
+Username:             enter the username of the mailbox you want to migrate to, e.g. pia@your-maildomain.tld
+Password:             enter the master password
+```
+
+Click on check to verify the credentials. If the data is correct, a green checkmark will appear. A red cross will be displayed if the credentials need to be corrected.
+
+After checking and confirming, you can use the same procedure to add further mailboxes.
+
+Alternatively, you can add multiple accounts via CSV upload. Find information in the following.
+
+### Add multiple user accounts via CSV file
+
+Prepare a CSV file with all necessary information. Unsurprisingly, this is the same information as described in the "Add User Accounts Individually" section above.
+
+The CSV requires the following column order with a closing semicolon after the last value - but no headline is expected; the first line must be your migration data already:
+```
+M365ServiceAccount;M365GroupEmailAddress;M365Mailbox;openDeskMailbox;openDeskMasterPassword;
+```
+
+Example CSV:
+```
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;eva@your-maildomain.tld;eva;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;max@your-maildomain.tld;max;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;pia@your-maildomain.tld;pia;YourMasterPassword;
+eva@your-maildomain.tld;audriga-migration@your-maildomain.tld;ida@your-maildomain.tld;ida;YourMasterPassword;
+```
+
+Select the "Add multiple accounts" tab to configure up to 50 user accounts by uploading a CSV file. If you need to migrate more accounts, you can execute the migration multiple times.
+
+Click "Check" and save afterwards.
+
+## Start the migration
+
+You will see a summary of the migration, including the number of accounts and the amount of data. Even if the analysis of the source accounts has not yet been completed, you can proceed.
+
+Ensure you have a valid voucher; otherwise, you must complete the payment process.
+
+Press "Start Migration" to proceed.
+
+## Monitor migration status
+
+The migration process may take some time to start. For large amounts of data, it may take a couple of hours.
+
+Click on "Details" to get further information about the migration.
+
+You can access a detailed log for each account by clicking "Protocol" on the right-hand side. Here, you can see detected duplicates or encountered errors (e.g., if emails cannot be transferred due to your provider's size limitations).
+
+You will receive status emails for the migration job's submission and start, as well as when the migration job is finished. The emails are sent to the email address you have entered during the configuration. Those emails include a link to the status website so you can easily track and monitor your migration. Once the migration has been started, you can safely close the status website and shut down your computer; the migration will continue. You can re-open the status website anytime.

docs/enhanced-configuration/idp-federation.md

@@ -0,0 +1,165 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Federation with external identity provider (IdP)</h1>
+
+<!-- TOC -->
+* [Context](#context)
+* [References](#references)
+* [Prerequisites](#prerequisites)
+  * [User accounts](#user-accounts)
+  * [External IdP with OIDC](#external-idp-with-oidc)
+* [Example configuration](#example-configuration)
+  * [Versions](#versions)
+  * [Example values](#example-values)
+  * [Keycloak admin console access](#keycloak-admin-console-access)
+  * [Your organizations IdP](#your-organizations-idp)
+    * [Separate realm](#separate-realm)
+    * [OIDC Client](#oidc-client)
+  * [openDesk IdP](#opendesk-idp)
+<!-- TOC -->
+
+Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on to internal or external web applications.
+
+This document shows how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk single sign-on based on your organization's login.
+
+# References
+
+We would like to list successful IdP federation scenarios, so we are also happy about input from the community:
+
+| External IdP                                                        | last openDesk version tested |
+| ------------------------------------------------------------------- | ---------------------------- |
+| [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0                       |
+| [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                       |
+
+# Prerequisites
+
+## User accounts
+
+In addition to the configuration, it is required that user accounts with the same name exist within openDesk. While this prerequisite is outside the scope of this document, the following approaches are feasible:
+
+- Manual user management
+  - A lightweight option to test your IdP federation setup or if you have only a small number of users to manage.
+  - Create and maintain your user(s) in openDesk and ensure the username in your IAM and openDesk is identical.
+- User import
+  - If you need to create more than just a couple of test accounts, you can use the [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) that utilizes the UDM REST API for user account creation.
+  - Downsides: Managing groups and deleting accounts needs to be done manually.
+- Automated Pre-provisioning:
+  - Pre-provisioning users and groups, including de-provisioning (deleting) accounts, is the best practice to ensure that openDesk is in sync with your organization's IAM.
+  - There are at least two ways of implementing the pre-provisioning:
+  - UDM REST API:
+    - Build a provisioning solution using the [UDM REST API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html).
+    - The API gives you complete control over the contents of the IAM to create, update, or delete users and groups.
+  - Nubus Directory Importer:
+    - It is based on a Python one-way directory synchronization for users and groups.
+    - Please find more details in the [upstream product's documentation](https://docs.software-univention.de/nubus-kubernetes-operation/latest/en/howto-connect-external-iam.html).
+- Ad-hoc provisioning (AHP)
+  - This feature is currently unavailable in openDesk's Keycloak, but Univention plans to make it available in the future.
+  - Ad-hoc provisioning creates a user account on the fly during a user's first login.
+  - While ad-hoc provisioning is an excellent approach for a quick start with openDesk, it has various downsides:
+    - Users are created after their first login, so you cannot find your colleagues in the openDesk apps unless they have already logged in.
+    - A user account would never be deactivated or deleted in openDesk.
+    - Group memberships are not transferred.
+
+## External IdP with OIDC
+
+This document focuses on the OIDC federation between an external IdP and the openDesk IdP. It uses the OpenID Connect (OIDC) protocol, so your external IdP must support OIDC.
+
+# Example configuration
+
+## Versions
+
+The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3. As external IdP, we also used an openDesk deployment of the same version but created a separate realm for proper configuration separation.
+
+## Example values
+
+The following values are used in this example documentation. Please ensure when you come across such a value, even if it is part of a URL hostname or path, that you adapt it where needed to your setup:
+
+- `idp.organization.tld`: hostname for your organization's IdP.
+- `id.opendesk.tld`: hostname for the openDesk IdP, so openDesk is deployed at `opendesk.tld`.
+- `fed-test-idp-realm`: realm name for your organization's IdP.
+- `opendesk-federation-client`: OIDC client for the openDesk federation defined in your organization's IdP.
+- `auto-federate-idp`: Identifier of your organization IdP's configuration within the openDesk Keycloak.
+- `auto-federate-flow`: Identifier of the required additional login flow to be created and referenced in the openDesk Keycloak.
+
+## Keycloak admin console access
+
+To access Keycloak's admin console in an openDesk deployment, you must add a route for `/admin` to the Keycloak's ingress. This is done automatically if you deploy openDesk with `debug.enabled: true`, but beware that this will also cause a lot of log output across all openDesk pods.
+
+The admin console will be available at:
+- Organization's IdP: https://idp.organization.tld/admin/master/console/
+- openDesk IdP: https://id.opendesk.tld/admin/master/console/
+
+For the following configuration steps, log in with user `kcadmin` and grab the password from the `ums-keycloak` pod's `KEYCLOAK_ADMIN_PASSWORD` variable.
+
+## Your organizations IdP
+
+In this example, we use the Keycloak of another openDesk instance to simulate your organization's IdP. However, URL paths differ if you use another product.
+
+Please let us know about your experiences or differences you came across.
+
+### Separate realm
+
+To not interfere with an existing configuration for our test scenario, we create a separate realm:
+
+- `Create realm` (from the realm selection drop-down menu in the left upper corner)
+- *Realm name*: `fed-test-idp-realm`
+- `Create`
+
+### OIDC Client
+
+If you just created the `fed-test-idp-realm`, you are already in the admin screen for the realm; if not, use the realm selection drop-down menu in the upper left corner to switch to the realm.
+
+- *Clients* > *Create Client*
+  - Client create wizard page 1:
+    - *Client type*: `OpenID Connect`
+    - *Client-ID*: `opendesk-federation-client`
+    - *Name*: `openDesk @ your organization` (is the descriptive text of the client that might show up in your IdP's UI and therefore should explain what the client is used for)
+  - Client create wizard page 2:
+    - *Client authentication*: `On`
+    - *Authorization*: `Off` (default)
+    - *Authentication flow*: leave defaults
+      - `Standard flow`
+      - `Direct access grants`
+  - Client create wizard page 3:
+    - *Valid Redirect URLs*: `https://id.opendesk.tld/realms/opendesk/broker/auto-federate-idp/endpoint`
+  - When completed with *Save*, you get to the detailed client configured that also needs some updates:
+    - Tab *Settings* > Section *Logout settings*
+      - *Front channel logout*: `Off`
+      - *Back channel logout URL*: `https://id.opendesk.tld/realms/opendesk/protocol/openid-connect/logout/backchannel-logout`
+    - Tab *Credentials*
+      - Copy the *Client Secret* and the *Client-ID* as we need them to configure the openDesk IdP.
+
+## openDesk IdP
+
+The following configuration is taking place in the Keycloak realm `opendesk`.
+
+- *Authentication* > *Create flow*
+  - *Name*: `auto-federate-flow`
+  - *Flow type*: `Basic flow`
+  - *Create*
+  - *Add execution*: Add `Detect existing broker user` and set it to `Required`
+  - *Add step*: `Automatically set existing user` and set it to `Required`
+
+- *Identity providers* > *User-defined* > *OpenID Connect 1.0*
+  - *Alias*: `auto-federate-idp` (used in our example)
+  - *Display Name*: A descriptive Name, in case you do not forcefully redirect the user to the IdP, that name is shown on the login screen for manual selection.
+  - *Use discovery endpoint*: `On` (default)
+  - *Discovery endpoint*: `https://idp.organization.tld/realms/fed-test-idp-realm/.well-known/openid-configuration` - this URL may look different if you do not use Keycloak or a different Keycloak version as IdP in your organization
+    - You will get an error if the IdP metadata cannot be auto-discovered.
+    - If everything is fine, you can review the discovered metadata for your IdP by clicking on *Show metadata*.
+  - *Client authentication*: `Client secret sent as post` (default)
+  - *Client ID*: Use the client ID you took from your organization's IdP config (`opendesk-federation-client` in this example)
+  - *Client Secret*: Use the secret you took from your organization's IdP config
+  - When completed with *Add*, you get to the detailed IdP configured that also needs some updates (you may need to open the *Advanced* section to access some settings)
+    - *Back-channel logout*: `On`
+    - *Disable user info*: `On`
+    - *First login flow override*: `auto-federate-flow`
+
+- In case you want to forcefully redirect all users to your organization's IdP (disabling login with local openDesk accounts):
+  - *Authentication* > `2fa-browser`
+    - Click on the cogwheel next to the *Identity Provider Re-director*
+      - *Alias*: `auto-federate-idp`
+      - *Default Identity Provider*: `auto-federate-idp`

docs/enhanced-configuration/matrix-federation.md

@@ -0,0 +1,60 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Matrix federation</h1>
+
+<!-- TOC -->
+* [Context](#context)
+* [Example configuration](#example-configuration)
+  * [Disable federation](#disable-federation)
+  * [Separate Matrix domain](#separate-matrix-domain)
+<!-- TOC -->
+
+The Element chat application and its server component Synapse are based on the Matrix protocol,
+that supports federation with other Matrix servers to communicate with the users with accounts on these servers.
+
+By default, you can chat with users who have an account within your openDesk installation and federate with other
+matrix-based servers.
+Federation support can be turned off.
+
+# Example configuration
+
+The following values are used in this example documentation.
+Please ensure when you come across such a value,
+even if it is part of a URL hostname or path, that you adapt it where needed to your setup:
+
+- `opendesk.domain.tld`: the mandatory `DOMAIN` setting for your deployment resulting in
+`https://chat.opendesk.domain.tld` for access to the Element chat.
+- `my_organization.tld`: an optional alternative domain used for mail and/or Matrix.
+It is also set to `opendesk.domain.tld` if not used.
+
+## Disable federation
+
+The following setting can turn off federation:
+
+```yaml
+functional:
+  externalServices:
+    matrix:
+      federation:
+        enabled: false
+```
+
+## Separate Matrix domain
+
+If you want to federate with other Matrix instances and use a separate Matrix domain, you need to provide a JSON file on
+the Matrix domain to use delegation. It is not part of your openDesk deployment.
+
+Domain path: `https://my_organization.tld/.well-known/matrix/server`
+
+Content:
+```JSON
+{
+    "m.server": "matrix-federation.opendesk.domain.tld:443"
+}
+```
+
+More detailed information can be found in Matrix/Synapse documentation:
+[Matrix Delegation](https://element-hq.github.io/synapse/latest/delegate.html)

docs/enhanced-configuration/self-signed-certificates.md

@@ -0,0 +1,107 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Self-signed certificate and custom Certificate Authority (CA)</h1>
+
+<!-- TOC -->
+* [Configuration](#configuration)
+  * [Option 1: Bring Your Own Certificate](#option-1-bring-your-own-certificate)
+  * [Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate](#option-2a-use-cert-managerio-with-auto-generated-namespace-based-root-certificate)
+  * [Option 2b: Use cert-manager.io with pre-defined/shared root-certificate](#option-2b-use-cert-managerio-with-pre-definedshared-root-certificate)
+<!-- TOC -->
+
+Deploying openDesk into an environment with custom public key infrastructure (PKI) that is usually not part of
+public certificate authority chains or deploying openDesk into a local cluster without ACME challenge.
+
+# Configuration
+
+There are two options to address the use case.
+
+## Option 1: Bring Your Own Certificate
+
+This option is useful, when you have your own PKI in your environment which is trusted by all clients that should
+access openDesk.
+
+1. Disable cert-manager.io certificate resource creation:
+
+    ```yaml
+    certificates:
+      enabled: false
+    ```
+
+1. Enable mount of self-signed certificates:
+
+    ```yaml
+    certificate:
+      selfSigned: true
+    ```
+
+1. Create a Kubernetes secret named `opendesk-certificates-tls` of type `kubernetes.io/tls` containing either a valid
+wildcard certificate or a certificate with [all required subdomains](../../helmfile/environments/default/global.yaml.gotmpl)
+set as SANs (Subject Alternative Name).
+
+1. Create a Kubernetes secret with name `opendesk-certificates-ca-tls` of type `kubernetes.io/tls` containing the custom
+CA certificate as X.509 encoded (`ca.crt`) and as jks trust store (`truststore.jks`).
+
+1. Create a Kubernetes secret with name `opendesk-certificates-keystore-jks` with key `password` and as value the jks
+trust store password.
+
+## Option 2a: Use cert-manager.io with auto-generated namespace based root-certificate
+
+This option is useful, when you do not have a trusted certificate available and can't fetch a certificate from
+Let’s Encrypt. It will result in a cert-manager managed root certificate in the namespace you deploy openDesk into.
+
+1. Create self-signed cert-manager.io Cluster Issuer:
+    ```yaml
+    apiVersion: "cert-manager.io/v1"
+    kind: "ClusterIssuer"
+    metadata:
+      name: "selfsigned-issuer"
+    spec:
+      selfSigned: {}
+    ```
+
+1. Enable mount and creation of self-signed certificates:
+    ```yaml
+    certificate:
+      issuerRef:
+        name: "selfsigned-issuer"
+      selfSigned: true
+    ```
+
+## Option 2b: Use cert-manager.io with pre-defined/shared root-certificate
+
+Use this approach if you like to use a pre-created CA root certificate that can be "shared" (as copy) between
+multiple namespaces in a cluster.
+
+1. Create self-signed cert-manager.io Cluster Issuer root certificate the same was as in *Option 2a*.
+
+1. Create the root certificate for the previously created CA, in the example it is placed into the namespace `cert-manager`.
+    ```yaml
+    apiVersion: cert-manager.io/v1
+    kind: Certificate
+    metadata:
+      name: opendesk-root
+      namespace: cert-manager
+    spec:
+      isCA: true
+      commonName: opendesk.eu
+      secretName: opendesk-root-cert-secret
+      subject:
+        organizations: [ "openDesk cluster root certificate organization" ]
+      privateKey:
+        algorithm: ECDSA
+        size: 256
+      issuerRef:
+        name: selfsigned-issuer
+        kind: ClusterIssuer
+        group: cert-manager.io
+    ```
+
+1. Copy this cert's secret into the/each namespace you want to make use of the cert.
+
+1. Create issuer in the/each namespace you want to make use of the cert.
+
+The latter two steps are part of the `env-start:` section within [`.gitlab-ci.yml`](../../.gitlab-ci.yml).

docs/enhanced-configuration/separate-mail-matrix-domain.md

@@ -0,0 +1,99 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Separate domains for mail and or Matrix </h1>
+
+<!-- TOC -->
+* [Context](#context)
+* [Example configuration](#example-configuration)
+  * [Mail domain](#mail-domain)
+  * [Matrix domain](#matrix-domain)
+    * [DNS](#dns)
+    * [Webserver](#webserver)
+      * [Content Security Policy](#content-security-policy)
+      * [.well-known](#well-known)
+<!-- TOC -->
+
+As communication over mail and chat can go beyond the borders of your openDesk installation, you may want to use different domains for the mail and/or Matrix.
+
+# Example configuration
+
+The following values are used in this example documentation. Please ensure when you come across such a value, even if it is part of a URL hostname or path, that you adapt it where needed to your setup:
+
+- `opendesk.domain.tld`: the mandatory `DOMAIN` setting for your deployment resulting in `https://mail.opendesk.domain.tld` to access emails and `https://chat.opendesk.domain.tld` to access the Element chat that is based on the Matrix protocol.
+- `my_organization.tld`: the alternative domain used for mail and/or Matrix.
+
+## Mail domain
+
+By default, all email addresses in openDesk are created based on the `DOMAIN` you specified for your deployment. In our example, the users have `<username>@opendesk.domain.tld` as their mail addresses. In case you prefer the users to send and receive emails with another domain, you can set that one using the optional `MAIL_DOMAIN` in the deployment:
+
+```yaml
+global:
+  mailDomain: "my_organization.tld"
+```
+
+or via environment variable
+
+```shell
+export MAIL_DOMAIN=my_organization.tld
+```
+
+Of course, this requires the domain's MX record to point to the mail host for your openDesk deployment. You can optionally add the SPF and DMARC records.
+
+| Record name                | Type | Value                                            |
+| -------------------------- | ---- | ------------------------------------------------ |
+| my_organization.tld        | MX   | `10 mail.opendesk.domain.tld` |
+| my_organization.tld        | TXT  | `v=spf1 +a +mx +a:mail.opendesk.domain.tld ~all` |
+| _dmarc.my_organization.tld | TXT  | `v=DMARC1; p=quarantine` |
+
+## Matrix domain
+
+Similar to the specific domain for email addresses, you may want to specify a domain that differs from your deployment's default `DOMAIN` to define your user's Matrix IDs. Use the `MATRIX_DOMAIN` to do so:
+
+```yaml
+global:
+  matrixDomain: "my_organization.tld"
+```
+
+or via environment variable
+
+```shell
+export MATRIX_DOMAIN=my_organization.tld
+```
+
+### DNS
+
+The following changes apply to the standard DNS:
+
+| Record name                      | Type | Value                                  | Comment                                                                                |
+| -------------------------------- | ---- | -------------------------------------- | -------------------------------------------------------------------------------------- |
+| _matrix._tcp.my_organization.tld | SRV  | `1 10 PORT matrix.opendesk.domain.tld` | `PORT` is your NodePort/LoadBalancer port of the `opendesk-synapse-federation` service |
+
+*Note:* `matrix.opendesk.domain.tld` in the "Value" column can also be the IP address synapse TLS port listens to.
+
+### Webserver
+
+#### Content Security Policy
+
+The `my_organization.tld` webserver should add `*.opendesk.domain.tld` to its CSP header.
+
+#### .well-known
+
+If you want to use other Matrix clients,
+e.g., Element Messenger for [iOS](https://apps.apple.com/de/app/element-messenger/id1083446067)
+or [Android](https://play.google.com/store/apps/details?id=im.vector.app),
+you need to create a JSON file with the following contents that is served from
+`https://my_organization.tld/.well-known/matrix/client`:
+
+```json
+{
+  "m.homeserver": {
+    "base_url": "https://matrix.opendesk.domain.tld"
+  }
+}
+```
+
+The above configuration ensures clients know where to find the Matrix protocol endpoint when users specify `my_organization.tld`
+as their homeserver.

docs/external-services.md

@@ -5,106 +5,106 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>External services</h1>
 
-This document will cover the additional configuration to use external services like databases, caches or buckets.
+This document will cover the additional configuration for external services like databases, caches, or buckets.
 
 <!-- TOC -->
 * [Database](#database)
-* [Objectstore](#objectstore)
+* [Object storage](#object-storage)
 * [Cache](#cache)
 <!-- TOC -->
 
 # Database
 
-When deploying this suite to production, you need to configure the applications to use your production grade database
+When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.
 
-| Component   | Name               | Type       | Parameter | Key                                      | Default                    |
+| Component    | Name               | Type       | Parameter | Key                                      | Default                    |
-|-------------|--------------------|------------|-----------|------------------------------------------|----------------------------|
+| ------------ | ------------------ | ---------- | --------- | ---------------------------------------- | -------------------------- |
-| Element     | Synapse            | PostgreSQL |           |                                          |                            |
+| Element      | Synapse            | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
+|              |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
-|             |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
+|              |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
-|             |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
+|              |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
-|             |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
+|              |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
-|             |                    |            | Password  | `databases.synapse.password`             |                            |
+|              |                    |            | Password  | `databases.synapse.password`             |                            |
-| Keycloak    | Keycloak           | PostgreSQL |           |                                          |                            |
+| Keycloak     | Keycloak           | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
+|              |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
-|             |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
+|              |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
+|              |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
-|             |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
+|              |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
-|             |                    |            | Password  | `databases.keycloak.password`            |                            |
+|              |                    |            | Password  | `databases.keycloak.password`            |                            |
-|             | Keycloak Extension | PostgreSQL |           |                                          |                            |
+|              | Keycloak Extension | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
+|              |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
-|             |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
+|              |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
-|             |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
+|              |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
-|             |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
+|              |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
-|             |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
+|              |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
-| UMS         | Notifications API  | PostgreSQL |           |                                          |                            |
+| UMS          | Notifications API  | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
+|              |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
-|             |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
+|              |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
-|             |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
+|              |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
-|             |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
+|              |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
-|             |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
+|              |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
-|             | Self Service       | PostgreSQL |           |                                          |                            |
+|              | Self Service       | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
+|              |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
-|             |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
+|              |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
-|             |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
+|              |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
-|             |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
+|              |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
-|             |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
+|              |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
-| Nextcloud   | Nextcloud          | MariaDB    |           |                                          |                            |
+| Nextcloud    | Nextcloud          | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
+|              |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
-|             |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
+|              |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
-|             |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
+|              |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
-|             |                    |            | Password  | `databases.nextcloud.password`           |                            |
+|              |                    |            | Password  | `databases.nextcloud.password`           |                            |
-| OpenProject | OpenProject        | PostgreSQL |           |                                          |                            |
+| OpenProject  | OpenProject        | PostgreSQL |           |                                          |                            |
-|             |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
+|              |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
-|             |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
+|              |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
-|             |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
+|              |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
-|             |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
+|              |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
-|             |                    |            | Password  | `databases.openproject.password`         |                            |
+|              |                    |            | Password  | `databases.openproject.password`         |                            |
-| OX Appsuite | OX Appsuite        | MariaDB    |           |                                          |                            |
+| OX App Suite | OX App Suite       | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.oxAppsuite.name`              | `CONFIGDB`                 |
+|              |                    |            | Name      | `databases.oxAppSuite.name`              | `CONFIGDB`                 |
-|             |                    |            | Host      | `databases.oxAppsuite.host`              | `mariadb`                  |
+|              |                    |            | Host      | `databases.oxAppSuite.host`              | `mariadb`                  |
-|             |                    |            | Username  | `databases.oxAppsuite.username`          | `root`                     |
+|              |                    |            | Username  | `databases.oxAppSuite.username`          | `root`                     |
-|             |                    |            | Password  | `databases.oxAppsuite.password`          |                            |
+|              |                    |            | Password  | `databases.oxAppSuite.password`          |                            |
-| XWiki       | XWiki              | MariaDB    |           |                                          |                            |
+| XWiki        | XWiki              | MariaDB    |           |                                          |                            |
-|             |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
+|              |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
-|             |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
+|              |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
-|             |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
+|              |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
-|             |                    |            | Password  | `databases.xwiki.password`               |                            |
+|              |                    |            | Password  | `databases.xwiki.password`               |                            |
 
-# Objectstore
+# Object storage
 
-When deploying this suite to production, you need to configure the applications to use your production grade objectstore
+When deploying this suite to production, you need to configure the applications to use your production-grade object
-service.
+storage service.
 
-| Component   | Name        | Parameter       | Key                                      | Default            |
+| Component   | Name        | Parameter       | Key                                      | Default            |
 |-------------|-------------|-----------------|------------------------------------------|--------------------|
-| OpenProject | OpenProject |                 |                                          |                    |
+| OpenProject | OpenProject |                 |                                          |                    |
-|             |             | Backend         | `objectstores.openproject.backend`       | `minio`            |
+|             |             | Backend         | `objectstores.openproject.backend` | `minio` |
-|             |             | Bucket          | `objectstores.openproject.bucket`        | `openproject`      |
+|             |             | Bucket          | `objectstores.openproject.bucket` | `openproject` |
-|             |             | Endpoint        | `objectstores.openproject.endpoint`      |                    |
+|             |             | Endpoint        | `objectstores.openproject.endpoint` |                    |
-|             |             | Provider        | `objectstores.openproject.provider`      | `AWS`              |
+|             |             | Provider        | `objectstores.openproject.provider` | `AWS` |
-|             |             | Region          | `objectstores.openproject.region`        |                    |
+|             |             | Region          | `objectstores.openproject.region` |                    |
-|             |             | Secret          | `objectstores.openproject.secret`        |                    |
+|             |             | Secret          | `objectstores.openproject.secret` |                    |
-|             |             | Username        | `objectstores.openproject.username`      | `openproject_user` |
+|             |             | Username        | `objectstores.openproject.username` | `openproject_user` |
-|             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |
+|             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |
 
 # Cache
 
-When deploying this suite to production, you need to configure the applications to use your production grade cache
+When deploying this suite to production, you need to configure the applications to use your production-grade cache
 service.
 
-| Component        | Name             | Type      | Parameter | Key                          | Default          |
+| Component        | Name             | Type      | Parameter | Key                          | Default          |
 |------------------|------------------|-----------|-----------|------------------------------|------------------|
-| Intercom Service | Intercom Service | Redis     |           |                              |                  |
+| Intercom Service | Intercom Service | Redis     |           |                              |                  |
-|                  |                  |           | Host      | `cache.intercomService.host` | `redis-headless` |
+|                  |                  |           | Host      | `cache.intercomService.host` | `redis-headless` |
-|                  |                  |           | Port      | `cache.intercomService.port` | `6379`           |
+|                  |                  |           | Port      | `cache.intercomService.port` | `6379` |
-| Nextcloud        | Nextcloud        | Redis     |           |                              |                  |
+| Nextcloud        | Nextcloud        | Redis     |           |                              |                  |
-|                  |                  |           | Host      | `cache.nextcloud.host`       | `redis-headless` |
+|                  |                  |           | Host      | `cache.nextcloud.host` | `redis-headless` |
-|                  |                  |           | Port      | `cache.nextcloud.port`       | `6379`           |
+|                  |                  |           | Port      | `cache.nextcloud.port` | `6379` |
-| OpenProject      | OpenProject      | Memcached |           |                              |                  |
+| OpenProject      | OpenProject      | Memcached |           |                              |                  |
-|                  |                  |           | Host      | `cache.openproject.host`     | `memcached`      |
+|                  |                  |           | Host      | `cache.openproject.host` | `memcached` |
-|                  |                  |           | Port      | `cache.openproject.port`     | `11211`          |
+|                  |                  |           | Port      | `cache.openproject.port` | `11211` |
-| UMS              | Self Service     | Memcached |           |                              |                  |
+| UMS              | Self Service     | Memcached |           |                              |                  |
-|                  |                  |           | Host      | `cache.umsSelfservice.host`  | `memcached`      |
+|                  |                  |           | Host      | `cache.umsSelfservice.host` | `memcached` |
-|                  |                  |           | Port      | `cache.umsSelfservice.port`  | `11211`          |
+|                  |                  |           | Port      | `cache.umsSelfservice.port` | `11211` |

docs/getting-started.md

@@ -3,13 +3,14 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 -->
 
-<h1>Getting stated</h1>
+<h1>Getting started</h1>
 
-This documentation should enable you to create your own evaluation instance of openDesk on your Kubernetes cluster.
+This documentation lets you create an openDesk evaluation instance on your Kubernetes cluster.
 
 <!-- TOC -->
 * [Requirements](#requirements)
 * [Customize environment](#customize-environment)
+  * [DNS](#dns)
   * [Domain](#domain)
     * [Apps](#apps)
   * [Private registries](#private-registries)
@@ -20,6 +21,9 @@ This documentation should enable you to create your own evaluation instance of o
     * [Container runtime](#container-runtime)
     * [Volumes](#volumes)
   * [Connectivity](#connectivity)
+    * [Ports](#ports)
+      * [Web-based user interface](#web-based-user-interface)
+      * [Mail clients](#mail-clients)
     * [Mail/SMTP configuration](#mailsmtp-configuration)
     * [TURN configuration](#turn-configuration)
     * [Certificate issuer](#certificate-issuer)
@@ -28,33 +32,47 @@ This documentation should enable you to create your own evaluation instance of o
   * [Install single app](#install-single-app)
   * [Install single release/chart](#install-single-releasechart)
 * [Access deployment](#access-deployment)
+  * [Using from external repository](#using-from-external-repository)
 * [Uninstall](#uninstall)
 <!-- TOC -->
 
-Thanks for looking into the openDesk Getting started guide. This documents covers essentials configuration steps to
+Thanks for looking into the openDesk Getting Started guide. This document covers essential configuration steps to
-deploy openDesk onto your kubernetes infrastructure.
+deploy openDesk onto your Kubernetes infrastructure.
 
 # Requirements
 
-Detailed system requirements are covered on [requirements](requirements.md) page.
+Detailed system requirements are covered on the [requirements](requirements.md) page.
 
 # Customize environment
 
-Before deploying openDesk, you have to configure the deployment to suit your environment.
+Before deploying openDesk, you must configure the deployment to fit your environment.
-To keep your deployment up to date, we recommend customizing in `dev`, `test` or `prod` and not in `default` environment
+To keep your deployment up to date, we recommend customizing in `dev`, `test`, or `prod` and not in `default` environment
 files.
 
 > All configuration options and their default values can be found in files at `helmfile/environments/default/`
 
-For the following guide, we will use `dev` as environment, where variables can be set in
+For the following guide, we will use `dev` as environment where variables can be set in
-`helmfile/environments/dev/values.yaml`.
+`helmfile/environments/dev/values.yaml.gotmpl`.
+
+## DNS
+
+The deployment is designed to deploy each application/service under a dedicated subdomain.
+For your convenience, we recommend creating a `*.domain.tld` A-Record to your cluster ingress controller; otherwise, you must create an A-Record for each subdomain.
+
+| Record name                   | Type | Value                                              | Additional information                                           |
+| ----------------------------- | ---- | -------------------------------------------------- | ---------------------------------------------------------------- |
+| *.domain.tld                  | A    | IPv4 address of your Ingress Controller            |                                                                  |
+| *.domain.tld                  | AAAA | IPv6 address of your Ingress Controller            |                                                                  |
+| mail.domain.tld               | A    | IPv4 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| mail.domain.tld               | AAAA | IPv6 address of your postfix NodePort/LoadBalancer | Optional mail should directly be delivered to openDesk's Postfix |
+| domain.tld                    | MX   | `10 mail.domain.tld`                               |                                                                  |
+| domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                       |
+| _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                         |
+| default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional DKIM settings                                           |
 
 ## Domain
 
-The deployment is designed to deploy each app under a subdomains. For your convenience, we recommend to create a
+A list of all subdomains can be found in `helmfile/environments/default/global.gotmpl`.
-`*.domain.tld` A-Record to your cluster ingress controller, otherwise you need to create an A-Record for each subdomain.
-
-A list of all subdomains can be found in `helmfile/environments/default/global.yaml`.
 
 All subdomains can be customized. For example, _Nextcloud_ can be changed to `files.domain.tld` in `dev` environment:
 
@@ -64,60 +82,46 @@ global:
     nextcloud: "files"
 ```
 
-The domain have to be set either via `dev` environment
+The domain has to be set either via `dev` environment
 
 ```yaml
 global:
-  domain: "my.open.desk"
+  domain: "domain.tld"
-istio:
-  domain: "istio.my.open.desk"
 ```
 
 or via environment variable
 
 ```shell
-export DOMAIN=my.open.desk
+export DOMAIN=domain.tld
-export ISTIO_DOMAIN=istio.my.open.desk
-```
-
-When you configure each subdomain individually, you can set `global.domain` and `istio.domain` to the same value.
-
-Istio is only used for Open-Xchange Appsuite 8, when you don't want to install it, you can disable Istio:
-
-```yaml
-istio:
-  enabled: false
-oxAppsuite:
-  enabled: false
 ```
 
 ### Apps
 
-All available apps and their default value can be found in `helmfile/environments/default/workplace.yaml`.
+All available apps and their default value are in `helmfile/environments/default/opendesk_main.gotmpl`.
 
-| Component                   | Name                                | Default | Description                    |
+| Component            | Name                        | Default | Description                    |
-|-----------------------------|-------------------------------------|---------|--------------------------------|
+| -------------------- | --------------------------- | ------- | ------------------------------ |
-| Certificates                | `certificates.enabled`              | `true`  | TLS certificates               |
+| Certificates         | `certificates.enabled`      | `true`  | TLS certificates               |
-| ClamAV (Distributed)        | `clamavDistributed.enabled`         | `false` | Antivirus engine               |
+| ClamAV (Distributed) | `clamavDistributed.enabled` | `false` | Antivirus engine               |
-| ClamAV (Simple)             | `clamavSimple.enabled`              | `true`  | Antivirus engine               |
+| ClamAV (Simple)      | `clamavSimple.enabled`      | `true`  | Antivirus engine               |
-| Collabora                   | `collabora.enabled`                 | `true`  | Weboffice                      |
+| Collabora            | `collabora.enabled`         | `true`  | Weboffice                      |
-| CryptPad                    | `cryptpad.enabled`                  | `true`  | Weboffice                      |
+| CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
-| Dovecot                     | `dovecot.enabled`                   | `true`  | Mail backend                   |
+| dkimpy               | `dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
-| Element                     | `element.enabled`                   | `true`  | Secure communications platform |
+| Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
-| Intercom Service            | `intercom.enabled`                  | `true`  | Cross service data exchange    |
+| Element              | `element.enabled`           | `true`  | Secure communications platform |
-| Jitsi                       | `jitsi.enabled`                     | `true`  | Videoconferencing              |
+| Home                 | `home.enabled`              | `true`  | Base domain portal redirect    |
-| MariaDB                     | `mariadb.enabled`                   | `true`  | Database                       |
+| Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
-| Memcached                   | `memcached.enabled`                 | `true`  | Cache Database                 |
+| MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
-| MinIO                       | `minio.enabled`                     | `true`  | Object Storage                 |
+| Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
-| Nextcloud                   | `nextcloud.enabled`                 | `true`  | File share                     |
+| MinIO                | `minio.enabled`             | `true`  | Object Storage                 |
-| OpenProject                 | `openproject.enabled`               | `true`  | Project management             |
+| Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
-| OX Appsuite                 | `oxAppsuite.enabled`                | `true`  | Groupware                      |
+| Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
-| Provisioning                | `oxConnector.enabled`               | `true`  | Backend provisioning           |
+| OpenProject          | `openproject.enabled`       | `true`  | Project management             |
-| Postfix                     | `postfix.enabled`                   | `true`  | MTA                            |
+| OX App Suite         | `oxAppSuite.enabled`        | `true`  | Groupware                      |
-| PostgreSQL                  | `postgresql.enabled`                | `true`  | Database                       |
+| Postfix              | `postfix.enabled`           | `true`  | MTA                            |
-| Redis                       | `redis.enabled`                     | `true`  | Cache Database                 |
+| PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
-| Univention Management Stack | `univentionManagementStack.enabled` | `true`  | Identity Management & Portal   |
+| Redis                | `redis.enabled`             | `true`  | Cache Database                 |
-| XWiki                       | `xwiki.enabled`                     | `true`  | Knowledgebase                  |
+| XWiki                | `xwiki.enabled`             | `true`  | Knowledge management           |
 
 Exemplary, Jitsi can be disabled like:
 
@@ -128,31 +132,40 @@ jitsi:
 
 ## Private registries
 
-By default Helm charts and container images are fetched from OCI registries. These registries can be found for most cases
+By default, Helm charts and container images are fetched from OCI registries. These registries can be found in most cases
 in the [openDesk/component section on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/components).
 
-For untouched upstream artefacts that do not belong to a functional component's core we use upstream registries
+For untouched upstream artifacts that do not belong to a functional component's core, we use upstream registries
 like Docker Hub.
 
-Doing a test deployment will most likely be fine with this setup. In case you want to deploy multiple times a day
+Doing a test deployment will be fine with this setup. In case you want to deploy multiple times a day
-and fetch from the same IP address you might run into rate limits at Docker Hub. In that case and in cases you
+and fetch from the same IP address, you might run into rate limits at Docker Hub. In that case and in cases you
-prefer the use of a private image registry anyway you can configure such for
+prefer the use of a private image registry, you can configure such for
 [your target environment](./../helmfile/environments/dev/values.yaml.gotmpl.sample) by setting
 - `global.imageRegistry` for a private image registry and
 - `global.helmRegistry` for a private Helm chart registry.
 
 ```yaml
 global:
-  imageRegistry: "external-registry.souvap-univention.de/sovereign-workplace"
+  imageRegistry: "my_private_registry.domain.tld"
 ```
 
-alternatively you can use an environment variable:
+alternatively, you can use an environment variable:
 
 ```shell
-export PRIVATE_IMAGE_REGISTRY_URL=external-registry.souvap-univention.de/sovereign-workplace
+export PRIVATE_IMAGE_REGISTRY_URL=my_private_registry.domain.tld
 ```
 
-If authentication is required, you can reference imagePullSecrets as following:
+or control repository override fine-granular per registry:
+
+```yaml
+repositories:
+  image:
+    dockerHub: "my_private_registry.domain.tld/docker.io/"
+    registryOpencodeDe: "my_private_registry.domain.tld/registry.opencode.de/"
+```
+
+If authentication is required, you can reference `imagePullSecrets` as follows:
 
 ```yaml
 global:
@@ -166,7 +179,7 @@ global:
 
 Some apps, like Jitsi or Dovecot, require HTTP and external TCP connections.
 These apps create a Kubernetes service object.
-You can configure, whether `NodePort` (for on-premise), `LoadBalancer` (for cloud) or `ClusterIP` (to disable) should be
+You can configure whether `NodePort` (for on-premise), `LoadBalancer` (for cloud), or `ClusterIP` (to disable) should be
 used:
 
 ```yaml
@@ -185,27 +198,39 @@ cluster:
     domain: "acme.internal"
 ```
 
-If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via:
+If your cluster has not the default `10.0.0.0/8` CIDR configured, you need to provide the CIDR via the following:
 
 ```yaml
 cluster:
   networking:
-    cidr: "127.0.0.0/8"
+    cidr:
+      - "127.0.0.0/8"
+```
+
+If your load balancer / reverse proxy IPs are not already covered by the above `cidr` you need to
+explicitly configure the related IPs or IP ranges:
+
+```yaml
+cluster:
+  networking:
+    incomingCIDR:
+      - "172.16.0.0/12"
 ```
 
 ### Ingress
 
-By default, the `ingressClassName` is empty to choose your default ingress controller, you may want to customize it by
+By default, the `ingressClassName` is empty to select your default ingress controller. You may want to customize it by
-setting:
+setting the following attribute to the name of the currently only supported ingress controller `ingress-nginx` (see
+[requirements.md](./requirements.md)) for reference) within your deployment if that is not the cluster's default ingress.
 
 ```yaml
 ingress:
-  ingressClassName: "cilium"
+  ingressClassName: "name-of-my-nginx-ingress"
 ```
 
 ### Container runtime
 
-Some apps require specific configuration for container runtimes. You can set your container runtime like `cri-o`,
+Some apps require specific configurations for the container runtime. You can set your container runtime like `cri-o`,
 `containerd` or `docker` by:
 
 ```yaml
@@ -215,17 +240,7 @@ cluster:
 ```
 
 ### Volumes
-
+The **StorageClass** must be set by:
-When your cluster has a `ReadWriteMany` volume provisioner, you can benefit from distributed or scaling of apps. By
-default, only `ReadWriteOnce` is enabled. To enable `ReadWriteMany` you can set:
-
-```yaml
-cluster:
-  persistence:
-    readWriteMany: true
-```
-
-The **StorageClass** can be set by:
 
 ```yaml
 persistence:
@@ -234,11 +249,48 @@ persistence:
     RWO: "my-read-write-once-class"
 ```
 
+`RWX` is optional and requires that your cluster has a `ReadWriteMany` volume provisioner. If you can make use
+of it it benefits the distribution or scaling of apps. By default, only `ReadWriteOnce` is enabled.
+To enable `ReadWriteMany` you have to set:
+
+```yaml
+cluster:
+  persistence:
+    readWriteMany: true
+```
+
+
+
 ## Connectivity
 
+### Ports
+
+**Note:** If you use `NodePort` for service exposure, you must check your deployment for the actual ports.
+
+#### Web-based user interface
+
+To use the openDesk functionality with its web-based user interface, you need to expose the following ports publicly:
+
+| Component          | Description             |  Port | Type |
+| ------------------ | ----------------------- | ----: | ---: |
+| openDesk           | Kubernetes Ingress      |    80 |  TCP |
+| openDesk           | Kubernetes Ingress      |   443 |  TCP |
+| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
+
+#### Mail clients
+
+To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need public exposure:
+
+| Component          | Description             |  Port | Type |
+| ------------------ | ----------------------- | ----: | ---: |
+| Dovecot            | IMAPS                   |   993 |  TCP |
+|                    | POP3S                   |   995 |  TCP |
+| Postfix            | SMTP                    |    25 |  TCP |
+|                    | SMTPS                   |   587 |  TCP |
+
 ### Mail/SMTP configuration
 
-To use the full potential of the openDesk, you need to set up an SMTP Smarthost/Relay which allows to send emails from
+To use the full potential of the openDesk, you need to set up an SMTP relay that allows sending emails from
 the whole subdomain.
 
 ```yaml
@@ -248,9 +300,22 @@ smtp:
   password: "secret"
 ```
 
+Enabling DKIM signing of emails helps to reduce spam and increases trust.
+openDesk ships dkimpy-milter as Postfix milter for signing emails.
+
+```yaml
+dkimpy:
+  enable: true
+  dkim:
+    key:
+      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
+    selector: "default"
+    useED25519: true # when false, RSA is used
+```
+
 ### TURN configuration
 
-Some components (Jitsi, Element) use for direct communication a TURN server. You can configure your own TURN server with
+Some components (Jitsi, Element) use a TURN server for direct communication. You can configure your own TURN server with
 these options:
 
 ```yaml
@@ -267,9 +332,9 @@ turn:
 
 ### Certificate issuer
 
-As mentioned in [requirements](requirements.md#certificate-management) you can provide your own valid certificate. A TLS
+As mentioned in [requirements](requirements.md#certificate-management), you can provide your own valid certificate. A TLS
-secret with name `opendesk-certificates-tls` needs to be present in application namespace. For deployment, you can
+secret named `opendesk-certificates-tls` must be present in the application namespace. For deployment, you can
-disable `Certificate` resource creation by:
+turn off `Certificate` resource creation by:
 
 ```yaml
 certificates:
@@ -294,16 +359,16 @@ certificate:
 
 ## Password seed
 
-All secrets are generated from a single master password via Master Password (algorithm).
+All secrets are generated from a master password via [Master Password (algorithm)](https://en.wikipedia.org/wiki/Master_Password_(algorithm)).
-To prevent others from using your openDesk instance, we highly recommend setting an individual master password via:
+To prevent others from using your openDesk instance, you must set your individual master password via:
 
 ```shell
-export MASTER_PASSWORD="openDesk"
+export MASTER_PASSWORD="your_individual_master_password"
 ```
 
 ## Install
 
-After setting your environment specific values in `dev` environment, you can start deployment by:
+After setting your environment-specific values in `dev` environment, you can start deployment by:
 
 ```shell
 helmfile apply -e dev -n <NAMESPACE> [-l <label>] [--suppress-diff]
@@ -333,7 +398,7 @@ helmfile apply -e dev -n <NAMESPACE>
 
 ## Install single release/chart
 
-Instead of iteration through all services, you can also deploy a single release like mariadb by:
+Instead of iteration through all services, you can also deploy a single release like `mariadb` by:
 
 ```shell
 helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
@@ -341,32 +406,57 @@ helmfile apply -e dev -n <NAMESPACE> -l name=mariadb
 
 # Access deployment
 
-When all apps are successfully deployed and pod status' went to `Running` or `Succeeded`, you can navigate to
+When all apps are successfully deployed, and their Pod's status is `Running` or `Succeeded`, you can navigate to
 
 ```text
 https://portal.domain.tld
 ```
 
-If you change the subdomain of `univentionManagementStack`, you need to replace `portal`
+If you change the subdomain of `nubus`, you must replace `portal` with the specified subdomain.
-by your specified subdomain.
 
 **Credentials:**
 
-```shell
+openDesk deploys with the standard user account `Administrator`, which password you get retrieved as follows:
-# Replace with your namespace
-NAMESPACE=your-namespace
 
-# Get ConfigMap with credentials
+```shell
-kubectl -n ${NAMESPACE} get cm ums-stack-data-swp-data -o jsonpath='{.data.dev-test-users\.yaml}'
+# Set your namespace
+NAMESPACE=<your_namespace>
+
+# Get password for IAM "Administrator" account
+kubectl -n ${NAMESPACE} get secret ums-nubus-credentials -o jsonpath='{.data.administrator_password}' | base64 -d
 ```
 
-Renders you a two part ConfigMap where the `username` and `password` attributes in the `properties`
+Using the aforementioned account, you can either create new accounts manually or make use of the
-section provide you with the desired information to login with the two default user roles:
+[openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import/)
+script or container.
 
-| Username        | Password                                   | Description      |
+For example you get a `default` and `default-admin` account by running the following snippet, after settings the
-|-----------------|--------------------------------------------|------------------|
+appropriate values in the first three lines.
-| `default.user`  | `40615..............................e9e2f` | Application user |
+
-| `default.admin` | `bdbbb..............................04db6` | Administrator    |
+```shell
+ADMINISTRATOR_PASSWORD=<your_administrator_password_see_above>
+DOMAIN=<your_domain>
+DEFAULT_USERS_PASSWORD=<password_for_the_created_default_accounts>
+docker run --rm registry.opencode.de/bmi/opendesk/components/platform-development/images/user-import:3.0.0 \
+  ./user_import_udm_rest_api.py \
+    --import_domain ${DOMAIN} \
+    --udm_api_password ${ADMINISTRATOR_PASSWORD} \
+    --set_default_password ${DEFAULT_USERS_PASSWORD} \
+    --import_filename template.ods \
+    --create_admin_accounts True
+```
+
+## Using from external repository
+
+Referring to `./helmfile_generic.yaml.gotmpl` from an external
+directory or repository is possible. The `helmfile.yaml.gotmpl` that refers to
+`./helmfile_generic.yaml.gotmpl` may define custom environments. These custom
+environments may overwrite specific configuration values. These
+configuration values are:
+
+* `global.domain`
+* `global.helmRegistry`
+* `global.master_password`
 
 # Uninstall
 
@@ -376,8 +466,8 @@ You can uninstall the deployment by:
 helmfile destroy -n <NAMESPACE>
 ```
 
-> **Note**
+> **Note**<br>
-> Not all Jobs, PersistentVolumeClaims or Certificates are deleted; you have to delete them manually
+> Not all Jobs, PersistentVolumeClaims, or Certificates are deleted; you have to delete them manually
 
 **'Sledgehammer destroy'** - for fast development turn-around times (at your own risk):
 
@@ -394,5 +484,5 @@ kubectl delete pvc --all --namespace ${NAMESPACE};
 kubectl delete jobs --all --namespace ${NAMESPACE};
 ```
 
-> **Warning**
+> **Warning**<br>
 > Without specifying or empty `--namespace` flag, cluster-wide components get deleted!

docs/migrations.md

@@ -0,0 +1,485 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Updates & Upgrades</h1>
+
+<!-- TOC -->
+* [Disclaimer](#disclaimer)
+* [openDesk supported upgrade path](#opendesk-supported-upgrade-path)
+* [Releases upgrade details](#releases-upgrade-details)
+  * [From v1.0.0](#from-v100)
+    * [Pre-upgrade: Manual checks/steps](#pre-upgrade-manual-checkssteps)
+      * [Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
+      * [Helmfile Cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
+      * [Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
+      * [Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names](#helmfile-cleanup-streamlining-openxchange-and-oxappsuite-attribute-names)
+      * [Helmfile feature update: Dicts to define `customization.release`](#helmfile-feature-update-dicts-to-define-customizationrelease)
+      * [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
+      * [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
+      * [External requirements: Redis 7.4](#external-requirements-redis-74)
+  * [From v0.9.0](#from-v090)
+    * [Pre-upgrade: Manual steps](#pre-upgrade-manual-steps)
+      * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
+      * [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
+      * [Changed openDesk defaults: Matrix ID](#changed-opendesk-defaults-matrix-id)
+      * [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
+      * [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
+      * [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
+    * [Automated migrations](#automated-migrations)
+    * [Post-upgrade: Manual steps](#post-upgrade-manual-steps)
+      * [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
+      * [Optional Cleanup](#optional-cleanup)
+  * [From v0.8.1](#from-v081)
+    * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
+    * [Updated customizable template attributes](#updated-customizable-template-attributes)
+    * [`migrations` S3 bucket](#migrations-s3-bucket)
+* [Related components and artifacts](#related-components-and-artifacts)
+  * [Development](#development)
+<!-- TOC -->
+
+# Disclaimer
+
+With openDesk 1.0, we aim to offer hassle-free updates/upgrades.
+
+But openDesk requires a defined upgrade path that is described in the section [openDesk supported upgrade path](#opendesk-supported-upgrade-path).
+
+Some upgrades even require manual interaction, which are referenced in the aforementioned section and described further down this document.
+
+> **Known limitations:**<br>
+> We assume that the PV reclaim policy is set to `delete`, resulting in PVs getting deleted as soon as the related PVC was deleted; we will not address explicit deletion for PVs.
+
+# openDesk supported upgrade path
+
+When updating your openDesk installation you have to install the releases listed below in the sequential order from
+the lowest version number you are already on to the more current version you are looking to install.
+
+Explanation of the table's columns:
+- *Coming from*: Check the column for the release you are currently on.
+- *Mandatory release*: Defines which release(s) support the upgrade from your currently installed version.
+- *Automatic migration*: Summary of, or link to openDesk's automatic migration details.
+- *Manual activities*: Reference to required manual steps to upgrade your openDesk installation to the *Mandatory release*.
+
+| Coming from   | Mandatory (minimum) release | Automatic migration                                                                                                                                           | Manual activities             |
+| ------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
+| v0.9.0        | v1.x.x                      | [run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_2.py) | See [From v0.9.0](#from-v090) |
+| v0.8.1        | v0.9.0                      | Initializes migration system                                                                                                                                  | See [From v0.8.1](#from-v081) |
+| not supported | v0.8.1                      | First release that supporting updates                                                                                                                         |                               |
+
+# Releases upgrade details
+
+## From v1.0.0
+
+### Pre-upgrade: Manual checks/steps
+
+#### Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`
+
+In v1.0.0 the files in [`/helmfile/environments/default`](../helmfile/environments/default/) had mixed extensions,
+we have streamlined them to consistently use `*.yaml.gotmpl`.
+
+This change requires manual action likely in two situations:
+
+1. You are referencing our upstream files from the aforementioned directory, e.g. in your Argo CD deployment. Please update your references to use the filenames with the new extension.
+2. You have custom files containing configuration information that are named just `*.yaml`: Please rename them to `*.yaml.gotmpl`.
+
+#### Helmfile Cleanup: Prefixing certain app directories with `opendesk-`
+
+To make it more obvious that some elements from below the [`apps`](../helmfile/apps/) directory are completely
+provided by openDesk, we have prefixed these app directories with `opendesk-`.
+
+Affected are the following directories, here listed directly with the new prefix:
+
+- [`./helmfile/apps/opendesk-migrations-pre`](../helmfile/apps/opendesk-migrations-pre)
+- [`./helmfile/apps/opendesk-migrations-post`](../helmfile/apps/opendesk-migrations-post)
+- [`./helmfile/apps/opendesk-openproject-bootstrap`](../helmfile/apps/opendesk-openproject-bootstrap)
+
+The described changes most likely require manual action in the following situation:
+
+- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+
+#### Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services
+
+In v1.0.0 there was a directory `/helmfile/apps/services` that was intended to contain all the services an operator had to provide externally for production deployments.
+
+As some services that are actually part of openDesk snuck in there, so we had to split the directory into two separate ones:
+
+- [`./helmfile/apps/opendesk-services`](../helmfile/apps/opendesk-services)
+- [`./helmfile/apps/services-external`](../helmfile/apps/services-external)
+
+The described changes most likely require manual action in the following situation:
+
+- You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
+
+#### Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names
+
+We have updated some attribute names around Open-Xchange / OX App Suite to be consistent within our Helmfile
+deployment and to aligning with the actual brand names as well as with our rule of thumb for brand based
+attribute names[^1].
+
+In case you are using any of the customizations below (`WAS`), please update as shown (`NOW`):
+
+```
+WAS: oxAppsuite: ...
+NOW: oxAppSuite: ...
+```
+
+```
+WAS: cache.oxAppsuite: ...
+NOW: cache.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuite: ...
+NOW: charts.oxAppSuite: ...
+```
+
+```
+WAS: charts.openXchangeAppSuiteBootstrap: ...
+NOW: charts.oxAppSuiteBootstrap: ...
+```
+
+```
+WAS: customization.release.openXchange: ...
+NOW: customization.release.openxchange: ...
+```
+
+```
+WAS: customization.release.opendeskOpenXchangeBootstrap: ...
+NOW: customization.release.opendeskOpenxchangeBootstrap: ...
+```
+
+```
+WAS: databases.oxAppsuite: ...
+NOW: databases.oxAppSuite: ...
+```
+
+```
+WAS: ingress.parameters.openXchangeAppSuite: ...
+NOW: ingress.parameters.oxAppSuite: ...
+```
+
+```
+WAS: ingress.bodyTimeout.openXchangeAppSuite: ...
+NOW: ingress.bodyTimeout.oxAppSuite: ...
+```
+
+```
+WAS: migration.oxAppsuite: ...
+NOW: migration.oxAppSuite: ...
+```
+
+```
+WAS: secrets.oxAppsuite: ...
+NOW: secrets.oxAppSuite: ...
+```
+
+#### Helmfile feature update: Dicts to define `customization.release`
+
+If you make use of the `customization.release` option, you have to switch to a dictionary based definition of customization files e.g. from
+
+```yaml
+customization:
+  release:
+    collaboraOnline: "./my_custom_templating.yaml.gotmpl"
+```
+
+to
+
+```yaml
+customization:
+  release:
+    collaboraOnline:
+      file1: "./my_custom_templating.yaml.gotmpl"
+```
+
+You can freely choose the `file1` dictionary key used in the example above, but it should start with a letter.
+
+#### openDesk defaults (new): Enforce login
+
+Users accessing the openDesk portal are now automatically redirected to the login screen as a default.
+
+In case you want to keep the previous behavior you need to set the following `functional` flag:
+
+```yaml
+functional:
+  portal:
+    enforceLogin: false
+```
+
+#### openDesk defaults (changed): Jitsi room history enabled
+
+The default to store the Jitsi room history in the local storage of a user's browser has changed.
+
+It is now enabled and therefore stored by default.
+
+To preserve the 1.0.0 behavior of not storing the room history you have to explicitly configure it:
+
+```yaml
+functional:
+  dataProtection:
+    jitsiRoomHistory:
+      enabled: false
+```
+
+#### External requirements: Redis 7.4
+
+The update from openDesk 1.0.0 contains Redis 7.4.1, like the other openDesk bundled services the bundled Redis is as well not meant to be used in production.
+
+Please ensure for the Redis you are using that it is updated to at least 7.4 to support the requirement of OX App Suite.
+
+## From v0.9.0
+
+### Pre-upgrade: Manual steps
+
+#### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus
+
+> **Warning**<br>
+> The upgrade will fail if you do not address this section for your current deployment.
+
+The update will remove unnecessary OX-Profiles in Nubus, but it can not as long as these profiles are in use.
+
+So please ensure that only the following two supported profiles are assigned to your users:
+- `opendesk_standard`: "opendesk Standard"
+- `none`: "Login disabled"
+
+You can review and update other accounts as follows:
+- Login as IAM admin.
+- Open the user module.
+- Open the extended search by clicking the funnel (DE: "Trichter") icon next to the search input field.
+- Open the "Property" (DE: "Eigenschaft") list and select "OX Access" (DE: "OX-Berechtigung").
+- Enter an asterisk (*) in the input field next to the list.
+- Start the search by clicking once more on the funnel icon.
+- Sort the result list for the "OX Access" column.
+- Edit every user that has a value different to `opendesk_standard` or `none`:
+  - Open the user.
+  - Go to section "OX App Suite".
+  - Change the value in the dropdown "OX Access" to either:
+    - "openDesk Standard" if the user should be able to use the Groupware module or
+    - "Login disabled" if the user should not use the Groupware module.
+  - Update the user account with the green "SAVE" button at the top of the page.
+
+#### Configuration Cleanup: Updated `global.imagePullSecrets`
+
+Without using a custom registry, you can pull all the openDesk images without authentication.
+Thus defining not existing imagePullSecrets creates unnecessary errors, so we removed them.
+
+You can keep the current settings by setting the `external-registry` in your custom environment values:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "external-registry"
+```
+
+#### Changed openDesk defaults: Matrix ID
+
+Until 0.9.0 openDesk used the LDAP entryUUID of a user to generate the user's Matrix ID. Due to restrictions on the
+Matrix protocol, an update of a Matrix ID is not possible; therefore, it was technically convenient to use the UUID
+as it is immutable (see https://de.wikipedia.org/wiki/Universally_Unique_Identifier for more details on UUIDs.)
+
+From the user experience perspective, that was a flawed approach, so from openDesk 1.0 on, by default, the username which
+is also used for logging into openDesk is used to define the localpart of the Matrix ID.
+
+For existing installations: The changed setting only affects users who log in to Element for the first time. Existing
+user accounts will not be harmed. If you want existing users to get new Matrix IDs based on the new setting, you
+must update their external ID in Synapse and deactivate the old user afterward. The user will get a new
+Matrix account from scratch, losing the existing contacts, chats, and rooms.
+
+The following Admin API calls are helpful:
+- `GET /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` to get the user's existing external_id (auth_provider: "oidc")
+- `PUT /_synapse/admin/v2/users/@<entryuuid>:<matrixdomain>` to update user's external_id with JSON payload:
+  `{ "external_ids": [ { "auth_provider": "oidc", "external_id": "<old_id>+deprecated" } ] }`
+- `POST /_synapse/admin/v1/deactivate/@<entryuuid>:<matrixdomain>` to deactivate old user with JSON payload:
+  `{ "erase": true }`
+
+For more details, check the Admin API documentation:
+https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html
+
+You can enforce the old standard with the following setting:
+```yaml
+functional:
+ chat:
+   matrix:
+     profile:
+       useImmutableIdentifierForLocalpart: true
+```
+
+#### Changed openDesk defaults: File-share configurability
+
+Now, we provide some configurability regarding the sharing capabilities of the Nextcloud component.
+
+See the settings under `functional.filestore` in [functional.yaml](../helmfile/environments/default/functional.yaml).
+
+For the following settings, the default in openDesk 1.0 has changed, so you might want to update
+the settings for your deployment to keep its current behavior:
+
+```yaml
+functional:
+ filestore:
+   sharing:
+     external:
+       enabled: true
+       expiry:
+         activeByDefault: false
+```
+
+#### Changed openDesk defaults: Updated default subdomains in `global.hosts`
+
+We have streamlined the subdomain names in openDesk to be more user-friendly and to avoid the use of specific
+product names.
+
+This results in the following changes to the default subdomain naming:
+
+- **collabora**: `collabora` → `office`
+- **cryptpad**: `cryptpad` → `pad`
+- **minioApi**: `minio` → `objectstore`
+- **minioConsole**: `minio-console` → `objectstore-ui`
+- **nextcloud**: `fs` → `files`
+- **openproject**: `project` → `projects`
+
+Existing deployments should keep the old subdomains cause URL/link changes are not supported through all components.
+
+If you have not already defined the entire `global.hosts` dictionary in your custom environments values, please set it
+to the defaults that were used before the upgrade:
+
+```yaml
+global:
+  hosts:
+    collabora: "collabora"
+    cryptpad: "cryptpad"
+    element: "chat"
+    intercomService: "ics"
+    jitsi: "meet"
+    keycloak: "id"
+    matrixNeoBoardWidget: "matrix-neoboard-widget"
+    matrixNeoChoiceWidget: "matrix-neochoice-widget"
+    matrixNeoDateFixBot: "matrix-neodatefix-bot"
+    matrixNeoDateFixWidget: "matrix-neodatefix-widget"
+    minioApi: "minio"
+    minioConsole: "minio-console"
+    nextcloud: "fs"
+    openproject: "project"
+    openxchange: "webmail"
+    synapse: "matrix"
+    synapseFederation: "matrix-federation"
+    univentionManagementStack: "portal"
+    whiteboard: "whiteboard"
+    xwiki: "wiki"
+```
+
+In case you would like to update an existing deployment to the new hostnames, please check the following list:
+
+- Do this at your own risk.
+- Some of your user's bookmarks and links will stop working.
+- Portal links are getting updated automatically.
+- The update of the OpenProject <-> Nextcloud file integration needs to be updated manually as follows:
+  - Use an account with functional admin permissions on both components
+  - In OpenProject: *Administration* > *Files* > *External file storages* > Select `Nextcloud at [your_domain]`
+    - Edit *Details* - *General Information* - *Storage provider* and update the *hostname* to `files.<your_domain>`
+  - In Nextcloud: *Administration* > *OpenProject* > *OpenProject server*
+    - Update the *OpenProject host* to `projects.<your_domain>`
+
+#### Changed openDesk defaults: Dedicated group for access to the UDM REST API
+
+Prerequisite: You allow the use of the [IAM's API](https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html)
+with the following settings:
+
+```yaml
+functional:
+  externalServices:
+    nubus:
+      udmRestApi:
+        enabled: true
+```
+
+With 0.9.0, all members of the group "Domain Admins" could successfully authenticate with the API.
+
+With openDesk 1.0, we introduced a specific group for permission to use the API: `IAM API - Full Access`.
+
+The IAMs admin account `Administrator` is a member of this group by default, but no other user is.
+
+If you need other accounts to use the API, please assign them to the aforementioned group.
+
+### Automated migrations
+
+The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.
+
+The permissions required to execute the migrations can be found in the migration's Helm chart [`role.yaml'](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/v1.3.5/charts/opendesk-migrations/templates/role.yaml?ref_type=tags#L29)
+
+The actual actions are described as code comments in the related run module [`run_2.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_2.py).
+
+### Post-upgrade: Manual steps
+
+#### Configuration Improvement: Separate user permission for using Video Conference component
+
+With openDesk 1.0 the user permission for authenticated access to the Chat and Video Conference components was split into two separate permissions.
+
+Therefore the newly added *Video Conference* permission has to be added to users that should have continued access to the component.
+
+This can be done as IAM admin:
+- Open the *user* module.
+- Select all users that should get the permission for *Video Conference* using the select box left from the users entry.
+- In top bar of the user table click on *Edit*.
+- Select the *openDesk* section the the left-hand menu.
+- Check the check box for *Video Conference* and the directly below check box for *Overwrite*.
+- Click on the green *Save* button on top of the screen to apply the change.
+
+> **Hint**<br>
+> If you have a lot of users andd want to update (almost) all them, you can select all users by clicking the check box in the user's table header and then de-selecting the users you do not want to update.
+
+#### Optional Cleanup
+
+We do not execute possible cleanup steps as part of the migrations POST stage. So you might want to remove the no longer used PVCs after a successful upgrade:
+
+```shell
+NAMESPACE=<your_namespace>
+kubectl -n ${NAMESPACE} delete pvc shared-data-ums-ldap-server-0
+kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
+kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
+```
+
+## From v0.8.1
+
+### Updated `cluster.networking.cidr`
+
+- Action: `cluster.networking.cidr` is now an array (was a string until 0.8.1); please update your setup accordingly if you explicitly set this value.
+- Reference:[cluster.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/cluster.yaml)
+
+### Updated customizable template attributes
+
+- Action: Please update your custom deployment values according to the updated default value structure.
+- References:
+  - `functional.` prefix for `authentication.*`, `externalServices.*`, `admin.*` and `filestore.*`, see [functional.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/functional.yaml).
+  - `debug.` prefix for `cleanup.*`, see [debug.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/debug.yaml).
+  - `monitoring.` prefix for `prometheus.*` and `graphana.*`, see [monitoring.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/monitoring.yaml).
+  - `smtp.` prefix for `localpartNoReply`, see [smtp.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/smtp.yaml).
+
+### `migrations` S3 bucket
+
+- Action: For self-managed/external S3/object storages, please ensure you add a bucket `migrations` to your S3.
+- Reference: `objectstores.migrations` in [objectstores.yaml](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/main/helmfile/environments/default/objectstores.yaml)
+
+# Related components and artifacts
+
+openDesk comes with two upgrade steps as part of the deployment; they can be found in the folder [/helmfile/apps](../helmfile/apps/) as all other components:
+
+- `migrations-pre`: Is the very first app that gets deployed.
+- `migrations-post`: Is the last app that gets deployed.
+
+Both migrations must be deployed exclusively at their first/last position and not parallel with other components.
+
+The status of the upgrade migrations is tracked in the ConfigMap `migrations-status`, more details can be found in the [README.md of the related container image](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/README.md).
+
+## Development
+
+When a new upgrade migration is required, ensure to address the following list:
+
+- Update the generated release version file [`global.generated.yaml.gotmpl`](../helmfile/environments/default/global.generated.yaml.gotmpl) at least on the patch level to test the upgrade in your feature branch and trigger it in the `develop` branch after the feature branch was merged. During the release process, the value is overwritten by the release's version number.
+- You have to implement the migration logic as a runner script in the [`opendesk-migrations`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations) image. Please find more instructions in the linked repository.
+- You most likely have to update the [`opendesk-migrations` Helm chart](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations) within the `rules` section of the [`role.yaml`](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/templates/role.yaml) to provide the permissions required for the execution of your migration's logic.
+- You must set the runner's ID you want to execute in the [migrations.yaml.gotmpl](../helmfile/shared/migrations.yaml.gotmpl). See also the `migrations.*` section of [the Helm chart's README.md](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-migrations/-/blob/main/charts/opendesk-migrations/README.md).
+- Update the [`charts.yaml.gotmpl`](../helmfile/environments/default/charts.yaml.gotmpl) and [`images.yaml.gotmpl`](../helmfile/environments/default/images.yaml.gotmpl) to reflect the newer releases of the `opendesk-migrations` Helm chart and container image.
+
+[^1]: We do not follow a brand name's specific spelling when it comes to upper and lower case and only use new word
+uppercase when names consist of multiple, space divided words.

docs/monitoring.md

@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Monitoring</h1>
 
-This document will cover how you can enable observability with Prometheus based monitoring and Grafana dashboards, as
+This document will cover how you can enable observability with Prometheus-based monitoring and Grafana dashboards as
 well as the overall status of monitoring integration.
 
 <!-- TOC -->
@@ -19,39 +19,42 @@ well as the overall status of monitoring integration.
 
 # Technology
 
-We provide integration into the Prometheus based monitoring.
+We provide integration into the Prometheus-based monitoring.
 Together with
 [kube-prometheus-stack](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack) you
-easily leverage the full potential of open-source cloud-native observability stack.
+easily leverage the full potential of the open-source cloud-native observability stack.
 
 Before enabling the following options, you need to install the respective CRDs from the kube-prometheus-stack
-repository or prometheus operator.
+repository or Prometheus operator.
 
 # Defaults
 
 All configurable options and their defaults can be found in
-[`monitoring.yaml`](../helmfile/environments/default/monitoring.yaml).
+[`monitoring.yaml.gotmpl`](../helmfile/environments/default/monitoring.yaml.gotmpl).
 
 # Metrics
 
-To deploy podMonitor and serviceMonitor custom resources, enable it by:
+To deploy `podMonitor` and `serviceMonitor` custom resources, enable it by:
 
 ```yaml
 prometheus:
-  serviceMonitors:
+  serviceMonitors:
-    enabled: true
+    enabled: true
-  podMonitors:
+  podMonitors:
-    enabled: true
+    enabled: true
 ```
 
 # Alerts
 
-Some helm-charts provide a default set of prometheusRules for alerting, enable it by:
+openDesk ships with a set of Prometheus alerting rules that are specific to the operation of openDesk.
+Some of these are created by our partners while others are defined in [opendesk-alerts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts).
+
+All alert rules are deployed as [PrometheusRule](https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PrometheusRule) and can be enabled like this:
 
 ```yaml
 prometheus:
-  prometheusRules:
+  prometheusRules:
-    enabled: true
+    enabled: true
 ```
 
 # Dashboards for Grafana
@@ -60,13 +63,13 @@ To deploy optional ConfigMaps with Grafana dashboards, enable it by:
 
 ```yaml
 grafana:
-  dashboards:
+  dashboards:
-    enabled: true
+    enabled: true
 ```
 
 # Components
 
-| Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
+| Component | Metrics (pod- or serviceMonitor)  | Alerts (prometheusRule) | Dashboard (Grafana) |
 |:----------|-----------------------------------|-------------------------|---------------------|
-| Collabora | :white_check_mark:                | :white_check_mark:      | :white_check_mark:  |
+| Collabora | :white_check_mark:                | :white_check_mark:      | :white_check_mark:  |
-| Nextcloud | :white_check_mark:                | :x:                     | :x:                 |
+| Nextcloud | :white_check_mark:                | :x:                     | :x:                 |

docs/requirements.md

@@ -2,9 +2,10 @@
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Requirements</h1>
 
-This section covers the internal system requirements as well as external service requirements for productive use.
+This section covers the internal system requirements and external service requirements for productive use.
 
 <!-- TOC -->
 * [tl;dr](#tldr)
@@ -18,32 +19,32 @@ This section covers the internal system requirements as well as external service
 <!-- TOC -->
 
 # tl;dr
-openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s) cluster.
 
-- K8s cluster >= 1.24, [CNCF Certified Kubernetes Distro](https://www.cncf.io/certification/software-conformance/)
+openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s) cluster.
+
+- K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
-- Ingress controller (supported are nginx-ingress, HAProxy)
+- Ingress controller (Ingress NGINX)
 - [Helm](https://helm.sh/) >= v3.9.0
-- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v0.157.0**
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc5**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
 - Volume provisioner supporting RWO (read-write-once)
 - Certificate handling with [cert-manager](https://cert-manager.io/)
-- [Istio](https://istio.io/) is currently required to deploy and operate OX AppSuite8
 
 # Hardware
 
 The following minimal requirements are thought for initial evaluation deployment:
 
-| Spec | Value                                                |
+| Spec | Value                                                 |
-|------|------------------------------------------------------|
+| ---- | ----------------------------------------------------- |
-| CPU  | 8 Cores of x64 or x86 CPU (ARM is not supported yet) |
+| CPU  | 12 Cores of x64 or x86 CPU (ARM is not supported yet) |
-| RAM  | 16 GB, recommended 32 GB                             |
+| RAM  | 32 GB, more recommended                               |
-| Disk | HDD or SSD, >10 GB                                   |
+| Disk | HDD or SSD, >10 GB                                    |
 
 # Kubernetes
 
 Any self-hosted or managed K8s cluster >= 1.24 listed in
-[CNCF Certified Kubernetes Distros](https://www.cncf.io/certification/software-conformance/) should be supported.
+[CNCF Certified Kubernetes distributions](https://www.cncf.io/certification/software-conformance/) should be supported.
 
 The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/kubespray) based clusters.
 
@@ -51,55 +52,54 @@ The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/
 
 # Ingress controller
 
-The deployment is intended to use only over HTTPS via a configured FQDN, therefor it is required to have a proper
+The deployment is intended to be used only over HTTPS via a configured FQDN, therefore it is required to have a proper
 configured ingress controller deployed.
 
-**Maintained controllers:**
+**Supported controllers:**
-- [NGINX Ingress Controller](https://github.com/nginxinc/kubernetes-ingress)
-- [HAProxy Kubernetes Ingress Controller](https://github.com/haproxytech/kubernetes-ingress)
-
-**Community Supported:**
 - [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx)
 
-When you want to use Open-Xchange Appsuite 8, you need to deploy and configure additionally [Istio](https://istio.io/)
+> **Note**<br>
+> The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/). If you have feedback on that topic, please share it with us.
 
 # Volume provisioner
 
-Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment a local- or hostPath-
+Initial evaluation deployment requires a `ReadWriteOnce` volume provisioner. For local deployment, a local- or hostPath-
 provisioner is sufficient.
 
-> **Note:** Some components requiring a `ReadWriteMany` volume provisioner for distributed mode or scaling.
+> **Note**<br>
+> Some components require a `ReadWriteMany` volume provisioner for distributed mode or scaling.
 
 # Certificate management
 
 This deployment leverages [cert-manager](https://cert-manager.io/) to generate valid certificates. This is **optional**,
 but a secret containing a valid TLS certificate is required.
 
-Only `Certificate` resources will be deployed, the `cert-manager` including its CRD must be installed prior to this or
+Only `Certificate` resources will be deployed; the `cert-manager`, including its CRD must be installed before this or
-openDesk certificate management disabled.
+openDesk certificate management switched off.
 
 # External services
 
-Evaluation the openDesk deployment does not require any external service to start, but features may be limited.
+For the development and evaluation of openDesk, we bundle some services. Be aware that for production
+deployments, you need to make use of your own production-grade services; see the
+[external-services.md](./external-services.md) for configuration details.
 
-
+| Group    | Type                | Version | Tested against        |
-| Group    | Type                | Version | Tested against        |
+| -------- | ------------------- | ------- | --------------------- |
-|----------|---------------------|---------|-----------------------|
+| Cache    | Memcached           | `1.6.x` | Memcached             |
-| Cache    | Memached            | `1.6.x` | Memached              |
+|          | Redis               | `7.x.x` | Redis                 |
-|          | Redis               | `7.x.x` | Redis                 |
+| Database | MariaDB             | `10.x` | MariaDB               |
-| Database | MariaDB             | `10.x`  | MariaDB               |
+|          | PostgreSQL          | `15.x` | PostgreSQL            |
-|          | PostgreSQL          | `15.x`  | PostgreSQL            |
+| Mail     | Mail Transfer Agent |         | Postfix               |
-| Mail     | Mail Transfer Agent |         | Postfix               |
+|          | PKI/CI (S/MIME)     |         |                       |
-|          | PKI/CI (SMIME)      |         |                       |
+| Security | AntiVirus/ICAP      |         | ClamAV                |
-| Security | AntiVirus/ICAP      |         | ClamAV                |
+| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
-| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
+|          | K8s ReadWriteMany   |         | Ceph / NFS            |
-|          | K8s ReadWriteMany   |         | Ceph / NFS            |
+|          | Object Storage      |         | MinIO                 |
-|          | Object Storage      |         | MinIO                 |
+| Voice    | TURN                |         | Coturn                |
-| Voice    | TURN                |         | Coturn                |
 
 # Deployment
 
-The deployment of each individual component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
+The deployment of each component is [Helm](https://helm.sh/) based. The 35+ Helm charts are configured and
 templated via [Helmfile](https://helmfile.readthedocs.io/en/latest/) to provide a streamlined deployment experience.
 
-Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare desired against deployed state.
+Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare the desired against the deployed state.

docs/scaling.md

@@ -5,53 +5,19 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Scaling</h1>
 
-This document should cover the abilities to scale apps.
+This document covers the ability to scale applications.
 
-<!-- TOC -->
+# Horizontal scalability
-* [Replicas](#replicas)
-<!-- TOC -->
 
-# Replicas
+We are working on generating this document automatically based on the file
+[`replicas.yaml.gotmpl`](../helmfile/environments/default/replicas.yaml.gotmpl) that contains necessary annotations.
+In the meantime, this file can be used to check the components scaling support/capabilities.
 
-The Replicas can be increased of almost any component, but is only effective for high-availability or load-balancing for
+# Upstream information
-apps with a check-mark in `Scaling (effective)` column.
 
-Verified positive effects are marke with a check-mark in `Scaling (verified)` column, apps which are not yet tested are
+While scaling services horizontally is the ideal solution, information about vertical scaling is helpful
-marked with a gear.
+when defining the application's resources, see [`resources.yaml.gotmpl`](../helmfile/environments/default/resources.yaml.gotmpl) for references.
 
+Please find below links to the application's upstream resources about scaling:
 
-| Component        | Name                                     | Scaling (effective) | Scaling (verified) |
+- [OpenProject system requirements](https://www.openproject.org/docs/installation-and-operations/system-requirements/)
-|------------------|------------------------------------------|:-------------------:|:------------------:|
-| ClamAV           | `replicas.clamav`                        | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.clamd`                         | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.freshclam`                     |         :x:         |        :x:         |
-|                  | `replicas.icap`                          | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.milter`                        | :white_check_mark:  | :white_check_mark: |
-| Collabora        | `replicas.collabora`                     | :white_check_mark:  |       :gear:       |
-| CryptPad         | `replicas.cryptpad`                      | :white_check_mark:  |       :gear:       |
-| Dovecot          | `replicas.dovecot`                       |         :x:         |       :gear:       |
-| Element          | `replicas.element`                       | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.matrixNeoBoardWidget`          | :white_check_mark:  |       :gear:       |
-|                  | `replicas.matrixNeoChoiceWidget`         | :white_check_mark:  |       :gear:       |
-|                  | `replicas.matrixNeoDateFixBot`           | :white_check_mark:  |       :gear:       |
-|                  | `replicas.matrixNeoDateFixWidget`        | :white_check_mark:  |       :gear:       |
-|                  | `replicas.matrixUserVerificationService` | :white_check_mark:  |       :gear:       |
-|                  | `replicas.synapse`                       |         :x:         |       :gear:       |
-|                  | `replicas.synapseWeb`                    | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.wellKnown`                     | :white_check_mark:  | :white_check_mark: |
-| Intercom Service | `replicas.intercomService`               | :white_check_mark:  |       :gear:       |
-| Jitsi            | `replicas.jibri`                         | :white_check_mark:  |       :gear:       |
-|                  | `replicas.jicofo`                        | :white_check_mark:  |       :gear:       |
-|                  | `replicas.jitsi `                        | :white_check_mark:  |       :gear:       |
-|                  | `replicas.jitsiKeycloakAdapter`          | :white_check_mark:  |       :gear:       |
-|                  | `replicas.jvb `                          |         :x:         |        :x:         |
-| Keycloak         | `replicas.keycloak`                      | :white_check_mark:  |       :gear:       |
-| Memcached        | `replicas.memcached`                     |       :gear:        |       :gear:       |
-| Minio            | `replicas.minioDistributed`              | :white_check_mark:  | :white_check_mark: |
-| Nextcloud        | `replicas.nextcloudApache2`              | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.nextcloudExporter`             | :white_check_mark:  | :white_check_mark: |
-|                  | `replicas.nextcloudPHP`                  | :white_check_mark:  | :white_check_mark: |
-| OpenProject      | `replicas.openproject`                   | :white_check_mark:  | :white_check_mark: |
-| Postfix          | `replicas.postfix`                       |         :x:         |       :gear:       |
-| Redis            | `replicas.redis`                         |       :gear:        |       :gear:       |
-| XWiki            | `replicas.xwiki`                         |         :x:         |       :gear:       |

docs/security-context.md

@@ -2,8 +2,10 @@
 SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
+
 <h1>Kubernetes Security Context</h1>
 
+<!-- TOC -->
 * [Container Security Context](#container-security-context)
   * [allowPrivilegeEscalation](#allowprivilegeescalation)
   * [capabilities](#capabilities)
@@ -14,6 +16,7 @@ SPDX-License-Identifier: Apache-2.0
   * [readOnlyRootFilesystem](#readonlyrootfilesystem)
   * [runAsNonRoot](#runasnonroot)
 * [Status quo](#status-quo)
+<!-- TOC -->
 
 # Container Security Context
 
@@ -158,7 +161,6 @@ This list gives you an overview of templated security settings and if they compl
 | **element**/opendesk-synapse | :white_check_mark: | no | no | yes | yes | 10991 | 10991 | yes | yes |
 | **element**/opendesk-synapse-web | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/opendesk-well-known | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
-| **intercom-service**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **jitsi**/jitsi | :white_check_mark: | no | no | yes | yes | 1993 | 1993 | yes | yes |
 | **jitsi**/jitsi/jitsi/jibri | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no ["SYS_ADMIN"] |
 | **jitsi**/jitsi/jitsi/jicofo | :x: | no | no | no | no | 0 | 0 | yes | no |
@@ -170,6 +172,7 @@ This list gives you an overview of templated security settings and if they compl
 | **nextcloud**/opendesk-nextcloud/apache2 | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/php | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **open-xchange**/dovecot | :x: | no | n/a | yes | n/a | n/a | n/a | yes | no ["CHOWN","DAC_OVERRIDE","KILL","NET_BIND_SERVICE","SETGID","SETUID","SYS_CHROOT"] |
 | **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-imageconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
@@ -182,7 +185,7 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **provisioning**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **open-xchange**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
 | **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
 | **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
@@ -195,32 +198,19 @@ This list gives you an overview of templated security settings and if they compl
 | **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
 | **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **univention-management-stack**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-guardian-authorization-api | :x: | no | no | no | yes | 1000 | 1000 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-guardian-management-api | :x: | no | no | no | yes | 1000 | 1000 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-guardian-management-ui | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/ldap-notifier | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
-| **univention-management-stack**/ums-keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-ldap-notifier | :x: | no | no | no | no | 0 | 0 | yes | yes |
+| **univention-management-stack**/ums/stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
-| **univention-management-stack**/ums-ldap-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/stack-gateway | :x: | no | no | no | yes | 1001 | 0 | yes | yes |
-| **univention-management-stack**/ums-notifications-api | :x: | no | no | no | no | 1000 | 1000 | yes | yes |
+| **univention-management-stack**/ums/umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-open-policy-agent | :x: | no | no | no | yes | 1000 | 1000 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **univention-management-stack**/ums/umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-portal-frontend | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-portal-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-provisioning/dispatcher | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-provisioning/events-and-consumer-api | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums-provisioning/udm-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
-| **univention-management-stack**/ums-stack-data-ums | :x: | no | no | no | no | 0 | 0 | yes | yes |
-| **univention-management-stack**/ums-stack-gateway | :x: | no | no | no | yes | 1001 | 1001 | yes | yes |
-| **univention-management-stack**/ums-store-dav | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-udm-rest-api | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums-umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |
 
 

docs/security.md

@@ -15,37 +15,37 @@ This document should cover the current status of security measurements.
 
 # Helm Chart Trust Chain
 
-Helm charts are signed and validated against GPG keys which can be found in `helmfile/files/gpg-pubkeys`.
+Helm charts are signed and validated against GPG keys in `helmfile/files/gpg-pubkeys`.
 
-For more details on Chart validation please visit: https://helm.sh/docs/topics/provenance/
+For more details on Chart validation, please visit: https://helm.sh/docs/topics/provenance/
 
 All charts except the ones mentioned below are verifiable:
 
-| Repository        | Verifiable |
+| Repository        | Verifiable |
 |-------------------|:----------:|
-| open-xchange-repo |     no     |
+| open-xchange-repo |     no     |
 
 # Kubernetes Security Enforcements
 
-This list gives you an overview of default security settings and if they comply with security standards:
+This list gives you an overview of default security settings and whether they comply with security standards:
 
 ⟶ Visit our generated detailed [Security Context](./security-context.md) overview.
 
 # NetworkPolicies
 
-Kubernetes NetworkPolicies are an important measure to secure your kubernetes apps and clusters.
+Kubernetes NetworkPolicies are an essential measure to secure your Kubernetes apps and clusters.
 When applied, they restrict the traffic to your services.
-This protects other deployments in your cluster or other services in your deployment to get compromised when one
+This protects other deployments in your cluster or other services in your deployment from getting compromised when one
 component is compromised.
 
 We ship a default set of Otterize ClientIntents via
 [Otterize intents operator](https://github.com/otterize/intents-operator) which translates intent-based access control
-(IBAC) into kubernetes native NetworkPolicies.
+(IBAC) into Kubernetes native NetworkPolicies.
 
 This requires the Otterize intents operator to be installed.
 
 ```yaml
 security:
-  otterizeIntents:
+  otterizeIntents:
-    enabled: true
+    enabled: true
 ```

docs/theming.md

@@ -5,53 +5,26 @@ SPDX-License-Identifier: Apache-2.0
 
 <h1>Theming</h1>
 
-This document will cover the theming and customization of your openDesk deployment.
+This document covers the theming options for an openDesk deployment.
 
 <!-- TOC -->
-* [Strings and texts](#strings-and-texts)
+* [Settings](#settings)
-* [Colors](#colors)
+* [Known limitations](#known-limitations)
-  * [Images and Logos](#images-and-logos)
-* [Known limits](#known-limits)
 <!-- TOC -->
 
-# Strings and texts
+# Settings
 
-The deployment name can be changed by:
+All default settings can be found in the [`theme.gotmpl`](../helmfile/environments/default/theme.gotmpl). Most of the components adhere to these settings.
 
-```yaml
+Please review the default configuration that is applied to understand your customization options.
-theme:
-  texts:
-    productName: "openDesk Cloud"
-```
 
-# Colors
+You can just update the files in:
+- [helmfile/files/theme](../helmfile/files/theme): To change logos, favicons etc.
+- [helmfile/files/portal-tiles](../helmfile/files/portal-tiles): To change the icons in the portal.
 
-The primary color and their derivates with lesser opacity be customized by:
+# Known limitations
-
-```yaml
-theme:
-  colors:
-    primary: "#5e27dd"
-    primary65: "#9673e9"
-    primary35: "#c7b3f3"
-    primary15: "#e7dffa"
-```
-
-## Images and Logos
-
-You can customize the logo and favicon by providing SVG or icon as inline value:
-
-```yaml
-theme:
-  imagery:
-    logoHeaderSvg: '<?xml version="1.0" encoding="UTF-8"?>...</svg>'
-    logoHeaderSvgWhite: '<?xml version="1.0" encoding="UTF-8"?>...</svg>'
-    logoPortalBackgroundSvg: '<?xml version="1.0" encoding="UTF-8"?>...</svg>'
-    faviconIco: "..."
-```
-
-# Known limits
 
 Not all applications support theming. Known exceptions are:
-  - OpenProject
+- OpenProject, comes with a build in openDesk theming that can be modified in the Enterprise version's OpenProject web interface.
-  - Jitsi
+- The portal background logo can (currently) only be set on initial deployment.
+- Portal and Keycloak screen styles must be applied in the [`portalStylesheets.css`](../helmfile/files/theme/portalStylesheet.css).

docs/workflow.md

@@ -1,10 +1,12 @@
 <!--
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
 
 <h1>Technical development and release workflow</h1>
 
+<!-- TOC -->
 * [Scope](#scope)
 * [Roles and responsibilities](#roles-and-responsibilities)
 * [Deployment automation](#deployment-automation)
@@ -21,13 +23,14 @@ SPDX-License-Identifier: Apache-2.0
       * [Branch workflows](#branch-workflows)
         * [`main`](#main)
         * [`develop`](#develop)
-        * [`docu`](#docu)
+        * [`docs`](#docs)
-        * [`mntn`](#mntn)
+        * [`fix`](#fix)
         * [`feat`](#feat)
       * [Branch names](#branch-names)
       * [Commit messages / Conventional Commits](#commit-messages--conventional-commits)
       * [Verified commits](#verified-commits)
 * [Footnotes](#footnotes)
+<!-- TOC -->
 
 # Scope
 
@@ -45,7 +48,7 @@ The following section should provide a high-level view of the involved parties i
 - **Open source product suppliers**
   - Focus areas
     - Development of upstream products
-    - Development of integrational functionality relevant to openDesk and others
+    - Development of integrative functionality relevant to openDesk and others
     - Providing source code and the artifacts required to install openDesk to Open CoDE
   - Hand over to _openDesk platform development_
     - Helm charts
@@ -62,7 +65,7 @@ The following section should provide a high-level view of the involved parties i
 - **Operator**
   - Focus areas
     - Providing production-grade required services (e.g. persistence layer) to operate openDesk
-    - Rollout, operate, and support openDesk
+    - Rollout, operate and support openDesk
     - Further develop the deployment automation to meet extended operational requirements, ideally providing these developments upstream to openDesk platform development to adopt them into the standard
   - The operator can either use a self-operated Kubernetes cluster to deploy openDesk or make use of managed Kubernetes offerings of a **Cloud Provider**.
 
@@ -70,52 +73,53 @@ The following section should provide a high-level view of the involved parties i
 
 The openDesk deployment automation is the core outcome of the platform development process.
 
-The openDesk platform development team created and maintains the deployment automation to allow interested parties to deploy openDesk into their cloud infrastructure with a low entry barrier. The core technology for the automation are [Helm charts](https://helm.sh/) which are orchestrated using [Helmfile](https://github.com/helmfile/helmfile). Of course this deployment is also used in the everyday work by the suppliers and the platform team.
+The openDesk platform development team created and maintains the deployment automation to allow interested parties to deploy openDesk into their cloud infrastructure with a low entry barrier. The core technology for the automation is [Helm](https://helm.sh/), which is orchestrated using [Helmfile](https://github.com/helmfile/helmfile). Of course, this deployment is also used by the suppliers and the platform team in everyday work.
 
-Please find the deployment automation including the relevant documentation here: https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace
+Please find the deployment automation, including its documentation, in the following project: https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk
 
-The automation supports Gitlab CI/CD execution as well as local execution triggering the Helmfile deployment for the whole platform or single applications.
+The automation supports Gitlab CI/CD and local execution, triggering the Helmfile deployment for the whole platform or single applications.
 
 ## openDesk technical component classes
 
 The below rendering in class diagram notation shows the three component classes openDesk consists of. In each of these:
-- the first section below the name of the class shows the required **characteristics** of each component of the given class, and
+- the first section below the name of the class shows the required **characteristics** of each component of the given class and
-- the second section shows the **methods** like linting that have to be applied to artifacts of that class.
+- the second section shows the **methods** like linting that must be applied to that class's artifacts.
 
-**Note:** The methods prefixed with '-' are not yet available in `gitlab-config` you will learn about them later.
+> **Note**<br>
+> The methods prefixed with '-' are not yet available in `gitlab-config`. You will learn about them later.
 
 ```mermaid
 classDiagram
-    Images <|-- Helm_charts
+ Images <|-- Helm_charts
-    Images <|-- Helmfile_based_deployment_automation
+ Images <|-- Helmfile_based_deployment_automation
-    Helm_charts <|-- Helmfile_based_deployment_automation
+ Helm_charts <|-- Helmfile_based_deployment_automation
-    class Images{
+ class Images{
-        SBOM
+ SBOM
-        SBOM signature
+ SBOM signature
-        Image signature
+ Image signature
-        reuseLint()
+ reuseLint()
-        CVE analysis()
+ CVE analysis()
-        hadolint()
+ hadolint()
-        Malware scan()
+ Malware scan()
-    }
+ }
-    class Helm_charts{
+ class Helm_charts{
-        HelmDocs
+ HelmDocs
-        Helm chart signature
+ Helm chart signature
-        reuseLint()
+ reuseLint()
-        KubeLinter()
+ KubeLinter()
-        YamlLint()
+ YamlLint()
-        -Kubescape()
+ -Kubescape()
-    }
+ }
-    class Helmfile_based_deployment_automation{
+ class Helmfile_based_deployment_automation{
-        reuseLint()
+ reuseLint()
-        YamlLint()
+ YamlLint()
-        -markdownlint()
+ -markdownlint()
-    }
+ }
 ```
 
 ## Functional vs. service components
 
-The focus of openDesk is to provide an integrated functional productivity platform based on the functional components (products) of the involved suppliers. These functional components usually rely on certain service components, e.g. database services for persistence. When running openDesk in production the operator is responsible for providing these services production grade. For evaluation and development purposes the openDesk deployment automation includes these services.
+The focus of openDesk is to provide an integrated functional productivity platform based on the involved suppliers' functional components (products). These functional components usually rely on specific service components, e.g. database services for persistence. When running openDesk in production, the operator is responsible for providing these services in production-grade. For evaluation and development purposes, the openDesk deployment automation includes these services.
 
 Find the list of functional and service components in the [deployment automation's components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/blob/main/docs/components.md).
 
@@ -123,9 +127,9 @@ Find the list of functional and service components in the [deployment automation
 
 The openDesk platform consolidates the technical components from various origins:
 
-1) Supplier - for functional components: Provide their upstream product including sometimes openDesk-specific builds or extensions and also the deployment of the product (Helm charts).
+1) *Supplier* for functional components: Provide their upstream product, sometimes including openDesk-specific builds or extensions and product deployment (Helm charts).
-2) 3rd party upstream - for service components: The platform development tries to use as many as possible community upstream components for the services they have to provide within openDesk.
+2) *Third-party upstream* for service components: The platform development team tries to use as many community upstream components as possible for the services they have to provide within openDesk.
-3) Platform development - filling the gap: Some suppliers might not provide Helm charts or images for their product that fit the needs of openDesk and some 3rd party upstream components are not built to fit into openDesk. In these cases, the platform development team creates their own Helm charts and images.
+3) Platform development* filling the gap: Some suppliers might not provide Helm charts or images for their products that fit the needs of openDesk, and some third-party upstream components are not built to fit into openDesk. In these cases, the platform development team creates its own Helm charts and images.
 
 ## Reference CI for creating Images and Helm charts (gitlab-config)
 
@@ -139,22 +143,25 @@ As a standard, the openDesk platform development team uses [reuse.software](http
 
 openDesk uses Apache 2.0 as the license for their work. A typical reuse copyright and license header looks like this:
 ```
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ```
-As the way to mark the license header as a comment differs between the various filetypes, please find matching examples for the types all across the [deployment automation repository](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace).
+The way to mark the license header as a comment differs between the various file types. Please find matching examples for all types across the [deployment automation repository](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace).
+
+> **Note**<br>
+> If an `SPDX-FileCopyrightText` already exists, do not replace but add an additional line based on the above example.
 
 ## Development workflow
 
 ### Disclaimer
 
-openDesk consists only of community products, so there is no SLA to receive service updates or backports of critical security fixes. This has two consequences:
+openDesk consists only of community products, so there is no SLA to receive service updates or backport of critical security fixes. This has two consequences:
-- In production scenarios, you should replace the community versions of the functional components with supported, SLA-backend paid versions.
+- In production scenarios, you should replace the community versions of the functional components with supported, SLA-backed paid versions.
-- openDesk aims to always update to the latest available releases of the community components and we therefore have rolling technical releases.
+- openDesk aims to update the community components' latest available releases continually; therefore, we have rolling technical releases.
 
 ### Workflow
 
-This chapter describes the development workflow of the deployment automation. The suppliers have their development processes and workflows. While we aim to update always to the most recent community version(s) available, openDesk also sponsors development done by the suppliers. As the openDesk team has to take a closer look at these sponsored features, they are referred to as *supplier deliverables* within the platform development workflow.
+This chapter describes the deployment automation's development workflow. The suppliers have their own development processes and workflows. While we aim to always update to the most recent community version(s) available, openDesk also sponsors the development done by the suppliers. As the openDesk team has to take a closer look at these sponsored features, they are referred to as *supplier deliverables* within the platform development workflow.
 
 #### Branching concept
 
@@ -162,102 +169,108 @@ The picture below uses Gitflow notation to give an overview of the different typ
 
 The basic facts for the flow are:
 - When the `develop` branch is merged into `main` a technical release is created (except when the merge commit(s) are of type `chore` or `docs`)
-- Changes that will be applied to openDesk have to branch off from `develop`, we call these branches *feature* branches.
+- Changes that will be applied to openDesk have to branch off from `develop`; we call these branches *feature* branches.
   - Developers can create sub-branches from their feature branch(es) as needed.
 - When a *feature* branch gets pushed a Merge Request in `Draft` state is automatically created.
 - We know three types of *feature* branches:
-  - `docu`: Doing just documentation changes
+  - `docs`: Doing just documentation changes
-  - `mntn`: Maintenance of the openDesk software components and minor configurational changes
+  - `fix`: Maintenance of the openDesk software components and minor configurational changes
   - `feat`: All changes that do not fall into the two categories above, especially
     - supplier deliverables and
     - configurational changes that have a significant impact on openDesk users or require migrations[^1]
 - The *QG* entries in the workflow refer to quality gates that are explained in more detail later
-- All merges into `develop` or `main` require two approvals from the platform development team[^2]. The approvers have to ensure that the defined quality gates have been passed successfully.
+- All merges into `develop` or `main` require two approvals from the platform development team[^2]. The approvers must ensure that the defined quality gates have been passed successfully.
 
 ```mermaid
 gitGraph
-    commit id: "QA 'nightly main'"
+ commit id: "QA 'nightly main'"
-    commit id: " "
+ commit id: " "
-    branch "develop"
+ branch "develop"
-    checkout "develop"
+ checkout "develop"
-    commit id: "QA 'nightly develop'"
+ commit id: "QA 'nightly develop'"
-    commit id: "  "
+ commit id: "  "
-    branch "docu"
+ branch "docs"
-    checkout "docu"
+ checkout "docs"
-    commit id: "Documentation commits" type: HIGHLIGHT
+ commit id: "Documentation commits" type: HIGHLIGHT
-    checkout "develop"
+ checkout "develop"
-    merge "docu"
+ merge "docs"
-    checkout "main"
+ checkout "main"
-    merge "develop" tag: "No release"
+ merge "develop" tag: "No release"
-    checkout "develop"
+ checkout "develop"
-    commit id: "   "
+ commit id: "   "
-    branch "mntn"
+ branch "fix"
-    checkout "mntn"
+ checkout "fix"
-    commit id: "Maintenance commits" type: HIGHLIGHT
+ commit id: "Maintenance commits" type: HIGHLIGHT
-    commit id: "QG 'mntn'" type: REVERSE
+ commit id: "QG 'fix'" type: REVERSE
-    checkout "develop"
+ checkout "develop"
-    merge "mntn"
+ merge "fix"
-    commit id: "QA 'release merge'" type: REVERSE
+ commit id: "QA 'release merge'" type: REVERSE
-    checkout "main"
+ checkout "main"
-    merge "develop" tag: "Patch or minor release"
+ merge "develop" tag: "Patch or minor release"
-    checkout "develop"
+ checkout "develop"
-    commit id: "    "
+ commit id: "    "
-    branch "feat"
+ branch "feat"
-    checkout "feat"
+ checkout "feat"
-    commit id: "Feature commits" type: HIGHLIGHT
+ commit id: "Feature commits" type: HIGHLIGHT
-    commit id: "QG 'feat'" type: REVERSE
+ commit id: "QG 'feat'" type: REVERSE
-    commit id: "Manual Feature QA" type: REVERSE
+ commit id: "Manual Feature QA" type: REVERSE
-    commit id: "Develop Tests"
+ commit id: "Develop Tests"
-    commit id: "Documentation"
+ commit id: "Documentation"
-    checkout "develop"
+ checkout "develop"
-    merge "feat"
+ merge "feat"
-    commit id: "QA 'release merge' " type: REVERSE
+ commit id: "QA 'release merge' " type: REVERSE
-    checkout "main"
+ checkout "main"
-    merge "develop" tag: "Minor or major release"
+ merge "develop" tag: "Minor or major release"
-    checkout "develop"
+ checkout "develop"
-    checkout "main"
+ checkout "main"
-    commit id: "     "
+ commit id: "     "
-    commit id: "Manual Functional Release Activities" type: HIGHLIGHT
+ commit id: "Manual Functional Release Activities" type: HIGHLIGHT
-    commit id: "      "
+ commit id: "      "
 ```
 
 #### Standard Quality Gate (SQG)
 
 The Standard Quality Gate addresses quality assurance steps that should be executed within each of the mentioned quality gates in the workflow.
 
+1. Linting
+   - Blocking
+     - Licensing: [reuse](https://github.com/fsfe/reuse-tool)
+     - openDesk specific: Especially `images.yaml.gotmpl` and `charts.yaml.gotmpl`, find more details in [development.md](./development.md).
+   - Non-Blocking
+     - Security: [Kyverno policy check](../.kyverno) addressing some IT-Grundschutz requirements
+     - Formal: Yaml
 1. Deploy the full openDesk stack from scratch:
    - All deployment steps must be successful (green)
    - All tests from the end-to-end test set must be successful
-2. Update deployment[^3] of the full openDesk stack and apply the quality measures from the step #1:
+1. Update deployment[^3] of the full openDesk stack and apply the quality measures from the step #1:
    - Deploy the current merge target baseline (`develop` or `main`)
    - Update deploy from your QA branch into the instance from the previous step
-3. No showstopper found regarding
+1. No showstopper found regarding
    - SBOM compliance[^4]
    - Malware check
    - CVE check[^5]
    - Kubescape scan[^5]
-   - Kyverno policy check (also covering some basic requirements from IT-Grundschutz)[^5]
 
-Steps #1 and #2 from above are executed as GitLab CI and therefore documented within GitLab.
+Steps #1 to #3 from above are executed as GitLab CI and documented within GitLab.
 
-Step #3 is focussed on security and was not fully implemented yet. Its main objective is to check for regressions. That step is just the second step of a security check and monitoring chain as shown below. While some checks can be executed against the static artefacts (e.g. container images) other might require an up-and-running instance. These are especially located in the third step below which is not yet implemented.
+Step #4 is focused on security and has not been fully implemented yet. Its main objective is to check for regressions. That step is just the second step of a security check and monitoring chain, as shown below. While some checks can be executed against static artifacts (e.g., container images), others might require an up-and-running instance. These are especially located in the third step below, which has not yet been implemented.
 
 ```mermaid
 flowchart TD
-    A[<u><b>Container image</b></u>
+ A[<u><b>Container image</b></u>
-    checks during build time
+ checks during build time
-    e.g. based on openDesk
+ e.g. based on openDesk
-    reference implementation 'gitlab-config'.
+ reference implementation 'gitlab-config'.
-    >> Can the artefact be integrated? <<
+ >> Can the artifact be integrated? <<
-    ] -->|integrate Artefacts| B[<u><b>Deployment automation</b></u> SQG
+ ] -->|integrate artifacts| B[<u><b>Deployment automation</b></u> SQG
-    based on GitLab CI during
+ based on GitLab CI, during
-    technical release process.
+ technical release process.
-    >> Can the platform be released? <<
+ >> Can the platform be released? <<
-    ]
+ ]
-    B-->|release| C[<u><b>openDesk release</b></u> monitoring
+ B-->|release| C[<u><b>openDesk release</b></u> monitoring
-    on a regular e.g. daily or live basis.
+ on a regular e.g. daily or live basis.
-    >> Do we need to fix something? <<
+ >> Do we need to fix something? <<
-    ]
+ ]
 ```
 
 #### Branch workflows
@@ -267,115 +280,98 @@ This section will explain the workflow for each branch (type) based on the Gitfl
 ##### `main`
 
 - `QA 'nightly main'`: Execute the SQG based on the most recent release. The upgrade test environment should be a long-standing environment that only gets built from scratch with the previous technical release when something breaks the environment.
-- Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release) which itself is based on the [Semantic Versioning (SemVer) notation](https://semver.org) to automatically create technical releases on the merge points.
+Merge points: We are using the [Semantic Release convention](https://github.com/semantic-release/semantic-release), which is based on the [Semantic Versioning (SemVer) notation](https://semver.org), to automatically create technical releases on the merge points.
-  - "No release": When a merge from `develop` includes only changes from `docu` branches the merge into `main` will only consist of `docs` or `chore` commits. No new release will be generated by that merge.
+  - "No release": When a merge from `develop` includes only changes from `docs` branches, the merge into `main` will only consist of `docs` or `chore` commits. That merge will generate no new release.
-  - "Patch or minor release": When changes from `mntn` branches get merged these might contain `fix` or `feat` commits causing a new technical release to be built with an updated version on Patch or Minor level.
+  - "Patch or minor release": When changes from `fix` branches get merged, these might contain `fix` or `feat` commits, causing a new technical release to be built with an updated version on the Patch or Minor level.
-  - "Minor or major release": When changes from `feat` branches get merged these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on Minor or Major level.
+  - "Minor or major release": When changes from `feat` branches get merged, these might contain `feat` commits even with breaking changes, causing a technical release to be built with an updated version on the Minor or Major level.
 - "Manual Functional Release Activities": Technical releases are loosely coupled to functional releases. The additional activities for a functional release select an existing technical release as a basis to generate the artifacts required for a functional release, for example:
   - Conduct additional manual explorative and regression tests.
   - Perform checks like IT Grundschutz, Accessibility, or Data Protection.
 
 ##### `develop`
 
-- `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based in this case on the head revision of the `develop` branch.
+- `QA 'nightly develop'`: Follows the same approach as `QA 'nightly main'` - execute the SQG based on the head revision of the `develop` branch.
 - `QA 'release merge'`: The Merge Request for this merge has to be created manually by members of the platform development team. It should document:
   - That the SQG was successfully executed upon the to-be merged state - it could be done explicitly or based on a `QA 'nightly develop'`
-  - In case of `mntn` changes that usually how no test automation: Changes have been verified by a member of the platform development team.
+  - In case of `fix` changes that usually have no test automation, Changes have been verified by a member of the platform development team.
-  - That the changes have been reviewed by at least two members of the platform development team giving their approval on the Merge Request.
+  - That the changes have been reviewed by at least two members of the platform development team, giving their approval on the Merge Request.
-- Merge points (from `docu`, `mntn`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.
+- Merge points (from `docs`, `fix`, and `feat` branches): No additional activity on these merge points as the QA is ensured before the merge in the just-named branch types.
 
-##### `docu`
+##### `docs`
 
-Branches of type `docu` only contain the commits themselves and have to adhere to the workflow basic fact that:
+Branches of type `docs` only contain the commits themselves and have to adhere to the workflow basic fact that: All merges into `develop` or `main` require two approvals from the platform development team.
-> All merges into `develop` or `main` require two approvals from the platform development team.
 
-##### `mntn`
+##### `fix`
 
-Besides the actual changes being committed in an `mntn` branch there is only the:
+Besides the actual changes being committed in an `fix` branch, there is only the:
-- `QG 'mntn'`: In addition to validating the actual change the owner of the branch has to ensure the successful execution of the SQG.
+- `QG 'fix'`: Besides validating the actual change, the branch's owner has to ensure the successful execution of the SQG.
 
 ##### `feat`
 
 This branch type requires the most activities on top of the actual development:
-- `QG 'feat'`: The owner of the branch has to validate the implemented functionality and has to ensure the SQG is passed successfully.
+- `QG 'feat'`: The branch owner has to validate the implemented functionality and ensure the SQG is passed successfully.
 - `Manual Feature QA`:
-  - This is the actual interface between the platform development workflow and the supplier work package workflow.
+  - This is the interface between the platform development workflow and the supplier work package workflow.
   - The openDesk QA team validates the change, ideally based on the acceptance criteria defined in the supplier's work package definition.
-    - If improvements are needed QA passes on the feedback to the developer/supplier.
+    - QA passes on the feedback to the developer/supplier if improvements are needed.
-    - If the QA was successful test cases for the testautomation of the feature are defined.
+    - Test cases for the feature's test automation are defined if the QA was successful.
     - QA should also evaluate if there is a need for end-user documentation of the feature.
 - `Develop Test`: The test cases are implemented by the openDesk platform development and added to the openDesk end-to-end test suite.
-- `Documentation`: When required the documentation team has to update the end-user documentation.
+- `Documentation`: When required, the documentation team has to update the end-user documentation.
 
 #### Branch names
 
-Branches created from the `develop` branch have to adhere to the following notation: `<party[-developer]>/<type>/<component>/<details>`:
+Branches created from the `develop` branch have to adhere to the following notation: `<responsible_developer>/<type>_<details>`:
 
-- `<party[-developer]>`: An identifier for the developing party optionally plus the name of the developer or team working on that branch. The following two-letter shorthand notations should be used for the owner:
+- `<responsible_developer>`: Something that makes you identifiable as the owner of the branch, e.g. the first letter of your first name followed by your family name.
-  - Suppliers
+- `<type>`: From the list of branch types explained above:
-    - `co`: Collabora
+  - `docs`
-    - `cp`: CryptPad
+  - `fix`
-    - `el`: Element
-    - `nc`: Nextcloud
-    - `nd`: Nordeck
-    - `op`: OpenProject
-    - `ox`: Open-Xchange
-    - `uv`: Univention
-    - `xw`: XWiki
-  - Other
-    - `pd`: (openDesk) Platform Development
-    - `xx`: Other, not one of the parties mentioned before
-
-- `<type>`: Based on the branch types described in this document valid values for type are
-  - `docu`
-  - `mntn`
   - `feat`
-
+- `<details>`: A very short note about what is going to happen in the branch and ideally what component is affected from the following list of components:
-- `<component>`: Valid components are
   - `helmfile`
   - `ci`
-  - `cross-functional`
   - `docs`
   - `collabora`
   - `cryptpad`
   - `element`
   - `jitsi`
   - `nextcloud`
+  - `nubus`
   - `open-xchange`
   - `openproject`
   - `services`
-  - `univention-management-stack`
   - `xwiki`
 
-- `<details>`: A very short note about what is going to happen in the branch
+Example: `tmueller/fix_jitsi_theming`.
 
-Example: `pd-tom/fix/open-xchange/bump_to_8.76`.
+> **Note**<br>
-
+> The above naming convention has yet to be enforced, but please ensure you use it.
-**Note**: The above naming convention is not enforced yet, but please ensure you make use of it.
 
 #### Commit messages / Conventional Commits
 
 Commit messages must adhere to the [Conventional Commit standard](https://www.conventionalcommits.org/en/v1.0.0/#summary). Commits that do not adhere to the standard get rejected by either [Gitlab push rules](https://docs.gitlab.com/ee/user/project/repository/push_rules.html) or the CI.
 
 ```text
-<type>(<scope>): [path/to/issue#1] <short summary>
+<type>(<scope>): [path/to/issue#1] <short summary>.
-  │       │              │                │
+ │       │              │                │
-  │       │              |                └─> Summary in present tense, sentence case, with no period at the end
+ │       │              |                └─> Summary in present tense, sentence case, with no period at the end
-  │       │              |
+ │       │              |
-  │       │              └─> Issue reference (optional)
+ │       │              └─> Issue reference (optional)
-  │       │
+ │       │
-  │       └─> Commit Scope: helmfile, docs, collabora, intercom-service, ...
+ │       └─> Commit Scope: helmfile, docs, collabora, nextcloud, open-xchange, etc.
-  │
+ │
-  └─> Commit Type: chore, ci, docs, feat, fix
+ └─> Commit Type: chore, ci, docs, feat, fix
 ```
 
-Example: `fix(univention-management-stack): Update standard session timeout of openDesk realm in Keycloak`
+Example: `fix(open-xchange): Bump to 8.26 to heal issue with functional mailbox provisioning.`
 
-**Beware**: The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.
+> **Note**<br>
+> The commit messages are an essential part of the [technical releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) as the release's notes are generated from the messages.
 
 #### Verified commits
 
-We only allow verified commits, please read on about the options you have to make your commits verified:
+We only allow verified commits; please read on about the options you have to make your commits verified:
 - https://docs.gitlab.com/ee/user/project/repository/ssh_signed_commits/
 - https://docs.gitlab.com/ee/user/project/repository/gpg_signed_commits/
 - https://docs.gitlab.com/ee/user/project/repository/x509_signed_commits/
@@ -384,10 +380,10 @@ We only allow verified commits, please read on about the options you have to mak
 
 [^1]: Migrations are in general not supported before openDesk hits [technical release](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases) v1.0.0
 
-[^2]: These approval rules are not available in the Gitlab Free Tier which is one of the main reasons why the deployment automation is not developed on Open CoDE.
+[2]: These approval rules are not available in the Gitlab Free Tier, which is one of the main reasons why deployment automation is not developed on Open CoDE.
 
 [^3]: As long as migrations/upgrade paths are not provided - see also footnote #1 - this step is optional.
 
-[^4]: The SBOM process is currently executed asynchronously to the development process and tests the most current technical release from main. The process is not fully automated yet.
+[^4]: The SBOM process is executed asynchronously with the development process and tests the most current technical release from the `main` branch. The process still needs to be fully automated.
 
-[^5]: The quality gate is not yet implemented especially when it comes to identifying regressions.
+[^5]: The quality gate needs to be implemented primarily when identifying regressions.

helmfile.yaml

@@ -1,51 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-#
-# Advanced Configuration: Nested States
-#
-helmfiles:
-  # Path to the helmfile state file being processed BEFORE releases in this state file
-  - path: "helmfile/apps/services/helmfile.yaml"
-  - path: "helmfile/apps/univention-management-stack/helmfile.yaml"
-  - path: "helmfile/apps/intercom-service/helmfile.yaml"
-  - path: "helmfile/apps/open-xchange/helmfile.yaml"
-  - path: "helmfile/apps/nextcloud/helmfile.yaml"
-  - path: "helmfile/apps/collabora/helmfile.yaml"
-  - path: "helmfile/apps/jitsi/helmfile.yaml"
-  - path: "helmfile/apps/element/helmfile.yaml"
-  - path: "helmfile/apps/openproject/helmfile.yaml"
-  - path: "helmfile/apps/xwiki/helmfile.yaml"
-  - path: "helmfile/apps/provisioning/helmfile.yaml"
-  - path: "helmfile/apps/openproject-bootstrap/helmfile.yaml"
-
-missingFileHandler: "Error"
-
-# Environment is defined here and in helmfile/bases/environments.yaml
-# This is a temporary solution to solve issue with different (relative) paths required when
-# - Installing all releases from root via helmfile apply
-# - Installing a single release from root via helmfile apply -f helmfile/apps/<app>/helmfile.yaml
-# - Installing a single release from app directory via helmfile apply
-# Issue: https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues/2
-
-environments:
-  default:
-    values:
-      - "helmfile/environments/default/*.gotmpl"
-      - "helmfile/environments/default/*.yaml"
-  dev:
-    values:
-      - "helmfile/environments/default/*.gotmpl"
-      - "helmfile/environments/default/*.yaml"
-      - "helmfile/environments/dev/values.yaml.gotmpl"
-  test:
-    values:
-      - "helmfile/environments/default/*.gotmpl"
-      - "helmfile/environments/default/*.yaml"
-      - "helmfile/environments/test/values.yaml.gotmpl"
-  prod:
-    values:
-      - "helmfile/environments/default/*.gotmpl"
-      - "helmfile/environments/default/*.yaml"
-      - "helmfile/environments/prod/values.yaml.gotmpl"
-...

helmfile.yaml.gotmpl

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+environments:
+  dev:
+    values:
+      - "helmfile/environments/dev/*.yaml.gotmpl"
+  test:
+    values:
+      - "helmfile/environments/test/*.yaml.gotmpl"
+  prod:
+    values:
+      - "helmfile/environments/prod/*.yaml.gotmpl"
+---
+# yamllint disable
+helmfiles:
+  - path: "./helmfile_generic.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+# {{/*
+#
+#   Use this format from a remote repository
+#
+#   - path: "git::https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git@helmfile_generic.yaml.gotmpl?ref=v0.7.1"
+#     values:
+#       - {{ toYaml .Values | nindent 8 }}
+# */}}
+...

helmfile/apps/collabora/helmfile-child.yaml.gotmpl

@@ -1,9 +1,6 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
-bases:
-  - "../../bases/environments.yaml"
----
 repositories:
   # Collabora Online
   # Source: https://github.com/CollaboraOnline/online
@@ -13,8 +10,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/\
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
-      {{ .Values.charts.collabora.repository }}"
 
 releases:
   - name: "collabora-online"
@@ -22,9 +18,12 @@ releases:
     version: "{{ .Values.charts.collabora.version }}"
     values:
       - "values.yaml.gotmpl"
+      {{ range .Values.customization.release.collaboraOnline }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.collabora.enabled }}
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "collabora"
 ...

helmfile/apps/collabora/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/collabora/values.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -7,24 +8,22 @@ autoscaling:
   enabled: false
 
 collabora:
-  extra_params: "--o:ssl.enable=false --o:ssl.termination=true"
+  extra_params: >
+    --o:ssl.enable=false
+    --o:ssl.termination=true
+    --o:fetch_update_check=0
+    --o:remote_font_config.url=https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/richdocuments/settings/fonts.json
+    --o:net.proto={{ if eq .Values.cluster.networking.ipFamilies "DualStack" }}all{{ else }}{{ .Values.cluster.networking.ipFamilies }}{{ end }}
+
   username: "collabora-internal-admin"
   password: {{ .Values.secrets.collabora.adminPassword | quote }}
   aliasgroups:
-    - host: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}:443"
+    - host: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
 
 fullnameOverride: "collabora"
 
-grafana:
-  dashboards:
-    enabled: {{ .Values.grafana.dashboards.enabled }}
-    labels:
-      {{- toYaml .Values.grafana.dashboards.labels | nindent 6 }}
-    annotations:
-      {{- toYaml .Values.grafana.dashboards.annotations | nindent 6 }}
-
 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
   tag: {{ .Values.images.collabora.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
@@ -37,9 +36,9 @@ ingress:
   annotations:
     # Ingress NGINX
     nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.collabora }}"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}"
     nginx.ingress.kubernetes.io/server-snippet: |
       # block admin and metrics endpoint from outside by default
       location /cool/getMetrics { deny all; return 403; }
@@ -48,21 +47,21 @@ ingress:
     # NGINX
     nginx.org/websocket-services: "collabora"
     nginx.org/lb-method: "hash $arg_WOPISrc consistent"
-    nginx.org/proxy-read-timeout: "600"
+    nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
-    nginx.org/proxy-send-timeout: "600"
+    nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
-    nginx.org/client-max-body-size: "0"
+    nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.collabora }}"
     nginx.org/server-snippets: |
       # block admin and metrics endpoint from outside by default
       location /cool/getMetrics { deny all; return 403; }
       location /cool/adminws/ { deny all; return 403; }
       location /browser/dist/admin/admin.html { deny all; return 403; }
     # HAProxy
-    haproxy.org/timeout-tunnel: "3600s"
+    haproxy.org/timeout-tunnel: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
     haproxy.org/backend-config-snippet: |
        balance url_param WOPISrc check_post
        hash-type consistent
     # HAProxy - Community: https://haproxy-ingress.github.io/
-    haproxy-ingress.github.io/timeout-tunnel: "3600s"
+    haproxy-ingress.github.io/timeout-tunnel: "{{ .Values.ingress.parameters.bodyTimeout.collabora }}s"
     haproxy-ingress.github.io/balance-algorithm: "url_param WOPISrc check_post"
     haproxy-ingress.github.io/config-backend: |
       hash-type consistent
@@ -71,6 +70,9 @@ ingress:
       acl admin_url path_beg /cool/adminws/
       acl admin_url path_beg /browser/dist/admin/admin.html
       http-request deny if admin_url
+   {{- with .Values.annotations.collabora.ingress }}
+   {{ . | toYaml | nindent 4 }}
+   {{- end }}
   enabled: {{ .Values.ingress.enabled }}
   className: {{ .Values.ingress.ingressClassName | quote }}
   hosts:
@@ -83,18 +85,21 @@ ingress:
       hosts:
         - "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
 
+podAnnotations:
+  {{ .Values.annotations.collabora.pod | toYaml | nindent 2 }}
+
 podSecurityContext:
   fsGroup: 100
 
 prometheus:
   servicemonitor:
-    enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
+    enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
     labels:
-      {{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
+      {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
   rules:
-    enabled: {{ .Values.prometheus.prometheusRules.enabled }}
+    enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
     additionalLabels:
-      {{- toYaml .Values.prometheus.prometheusRules.labels | nindent 6 }}
+      {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 6 }}
 
 replicaCount: {{ .Values.replicas.collabora }}
 
@@ -115,18 +120,11 @@ securityContext:
       - "ALL"
     add:
       - "CHOWN"
-      - "DAC_OVERRIDE"
       - "FOWNER"
-      - "FSETID"
-      - "KILL"
-      - "SETGID"
-      - "SETUID"
-      - "SETPCAP"
-      - "NET_BIND_SERVICE"
-      - "NET_RAW"
       - "SYS_CHROOT"
-      - "MKNOD"
+
-  seLinuxOptions: {{ .Values.seLinuxOptions.collabora }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.collabora | toYaml | nindent 4 }}
 serviceAccount:
   create: true
 ...

helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl

@@ -1,9 +1,6 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
-bases:
-  - "../../bases/environments.yaml"
----
 repositories:
   # CryptPad
   # Source: https://github.com/cryptpad/helm
@@ -21,9 +18,12 @@ releases:
     version: "{{ .Values.charts.cryptpad.version }}"
     values:
       - "values.yaml.gotmpl"
+      {{ range .Values.customization.release.cryptpad }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.cryptpad.enabled }}
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "cryptpad"
 ...

helmfile/apps/cryptpad/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/cryptpad/values.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/README.md or
 # https://github.com/cryptpad/helm/blob/main/charts/cryptpad/values.yaml
@@ -23,7 +26,7 @@ enableEmbedding: true
 fullnameOverride: "cryptpad"
 
 image:
-  repository: "{{ .Values.global.imageRegistry | default .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
   tag: {{ .Values.images.cryptpad.tag | quote }}
   pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
@@ -36,6 +39,9 @@ ingress:
   enabled: {{ .Values.ingress.enabled }}
   annotations:
     nginx.org/websocket-services: "cryptpad"
+   {{- with .Values.annotations.cryptpad.ingress }}
+   {{ . | toYaml | nindent 4 }}
+   {{- end }}
   className: {{ .Values.ingress.ingressClassName | quote }}
   hosts:
     - host: "{{ .Values.global.hosts.cryptpad }}.{{ .Values.global.domain }}"
@@ -50,6 +56,9 @@ ingress:
 persistence:
   enabled: false
 
+podAnnotations:
+  {{ .Values.annotations.jitsiKeycloakAdapter.pod | toYaml | nindent 2 }}
+
 podSecurityContext:
   fsGroup: 4001
 
@@ -70,7 +79,8 @@ securityContext:
   runAsNonRoot: true
   runAsUser: 4001
   runAsGroup: 4001
-  seLinuxOptions: {{ .Values.seLinuxOptions.cryptpad }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.cryptpad | toYaml | nindent 4 }}
 
 serviceAccount:
   create: true

helmfile/apps/element/helmfile-child.yaml.gotmpl

@@ -1,9 +1,6 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
-bases:
-  - "../../bases/environments.yaml"
----
 repositories:
   # openDesk Element
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
@@ -51,8 +48,7 @@ repositories:
     username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
     password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
     oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/\
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
-      {{ .Values.charts.matrixUserVerificationService.repository }}"
   - name: "matrix-neoboard-widget-repo"
     keyring: "../../files/gpg-pubkeys/opencode.gpg"
     verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
@@ -82,13 +78,54 @@ repositories:
     oci: true
     url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
 
+  # openDesk Enterprise Repositories
+
+  # openDesk Element
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
+  - name: "synapse-admin-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseAdmin.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
+  - name: "synapse-adminbot-web-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseAdminbotWeb.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
+  - name: "synapse-groupsync-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapseGroupsync.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
+  - name: "synapse-pipe-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.synapsePipe.verify }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
 
 releases:
+  # During upgrade 1.0.0 -> 1.1.0 the chart 'opendesk-element' has been moved to 'opendesk-element-web'
   - name: "opendesk-element"
     chart: "element-repo/{{ .Values.charts.element.name }}"
     version: "{{ .Values.charts.element.version }}"
+    installed: false
+
+  - name: "opendesk-element-web"
+    chart: "element-repo/{{ .Values.charts.elementWeb.name }}"
+    version: "{{ .Values.charts.elementWeb.version }}"
     values:
       - "values-element.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskElement }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
@@ -97,6 +134,9 @@ releases:
     version: "{{ .Values.charts.elementWellKnown.version }}"
     values:
       - "values-well-known.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskWellKnown }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
@@ -105,6 +145,9 @@ releases:
     version: "{{ .Values.charts.synapseWeb.version }}"
     values:
       - "values-synapse-web.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskSynapseWeb }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
@@ -113,6 +156,9 @@ releases:
     version: "{{ .Values.charts.synapse.version }}"
     values:
       - "values-synapse.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskSynapse }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
@@ -172,7 +218,78 @@ releases:
     installed: {{ .Values.element.enabled }}
     timeout: 900
 
+  # openDesk Enterprise Releases
+  - name: "opendesk-synapse-admin"
+    chart: "synapse-admin-repo/{{ .Values.charts.synapseAdmin.name }}"
+    version: "{{ .Values.charts.synapseAdmin.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdmin }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-pipe"
+    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
+    version: "{{ .Values.charts.synapsePipe.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdminbotPipe }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-adminbot-web"
+    chart: "synapse-adminbot-web-repo/{{ .Values.charts.synapseAdminbotWeb.name }}"
+    version: "{{ .Values.charts.synapseAdminbotWeb.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAdminbotWeb }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-auditbot-bootstrap"
+    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
+    version: "{{ .Values.charts.synapseCreateAccount.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-auditbot-pipe"
+    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
+    version: "{{ .Values.charts.synapsePipe.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseAuditbotPipe }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementAdmin.enabled }}
+    timeout: 900
+
+  - name: "opendesk-synapse-groupsync"
+    chart: "synapse-groupsync-repo/{{ .Values.charts.synapseGroupsync.name }}"
+    version: "{{ .Values.charts.synapseGroupsync.version }}"
+    values:
+      {{ range .Values.customization.release.opendeskSynapseGroupsync }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.elementGroupsync.enabled }}
+    timeout: 900
+
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "element"
 ...

helmfile/apps/element/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/element/values-element.yaml.gotmpl

@@ -1,23 +1,24 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
-  endToEndEncryption: false
+  endToEndEncryption: true
   additionalConfiguration:
-    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
+    logout_redirect_url: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout?client_id=opendesk-matrix&post_logout_redirect_uri=https%3A%2F%2F{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
 
     "net.nordeck.element_web.module.opendesk":
       config:
         banner:
           ics_navigation_json_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/navigation.json"
           ics_silent_url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/silent"
-          portal_logo_svg_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
+          portal_logo_svg_url: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
-          portal_url: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/"
+          portal_url: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/"
         custom_css_variables:
+          --cpd-color-bg-action-primary-rest: {{ .Values.theme.colors.primary | quote }}
           --cpd-color-text-action-accent: {{ .Values.theme.colors.primary | quote }}
-        widget_types:
-          - jitsi
-          - net.nordeck
 
     "net.nordeck.element_web.module.widget_lifecycle":
       widget_permissions:
@@ -43,6 +44,8 @@ configuration:
             - org.matrix.msc3819.send.to_device:net.nordeck.whiteboard.connection_signaling
             - org.matrix.msc3819.receive.to_device:net.nordeck.whiteboard.connection_signaling
             - town.robin.msc3846.turn_servers
+            - org.matrix.msc4039.upload_file
+            - org.matrix.msc4039.download_file
         "https://{{ .Values.global.hosts.matrixNeoChoiceWidget }}.{{ .Values.global.domain }}/*":
           preload_approved: true
           capabilities_approved:
@@ -110,7 +113,8 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.element }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.element | toYaml | nindent 4 }}
 
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -121,7 +125,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.element.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.element.registry | quote }}
   repository: {{ .Values.images.element.repository | quote }}
   tag: {{ .Values.images.element.tag | quote }}
 
@@ -132,6 +136,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.element.ingress | toYaml | nindent 4 }}
+
+podAnnotations:
+  {{ .Values.annotations.element.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -142,6 +151,14 @@ replicaCount: {{ .Values.replicas.element }}
 resources:
   {{ .Values.resources.element | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.element.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.element.serviceAccount | toYaml | nindent 4 }}
+
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 

helmfile/apps/element/values-matrix-neoboard-widget.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -14,7 +17,8 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoBoardWidget }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.matrixNeoBoardWidget | toYaml | nindent 4 }}
 
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -25,7 +29,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoBoardWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoBoardWidget.registry | quote }}
   repository: {{ .Values.images.matrixNeoBoardWidget.repository | quote }}
   tag: {{ .Values.images.matrixNeoBoardWidget.tag | quote }}
 
@@ -36,6 +40,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -48,4 +54,7 @@ resources:
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 
+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...

helmfile/apps/element/values-matrix-neochoice-widget.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -14,7 +17,8 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoChoiceWidget }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.matrixNeoChoiceWidget | toYaml | nindent 4 }}
 
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -25,7 +29,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoChoiceWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoChoiceWidget.registry | quote }}
   repository: {{ .Values.images.matrixNeoChoiceWidget.repository | quote }}
   tag: {{ .Values.images.matrixNeoChoiceWidget.tag | quote }}
 
@@ -36,6 +40,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -48,4 +54,7 @@ theme:
 resources:
   {{ .Values.resources.matrixNeoChoiceWidget | toYaml | nindent 2 }}
 
+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...

helmfile/apps/element/values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl

@@ -1,9 +1,12 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 
 configuration:
   username: "meetings-bot"
@@ -16,13 +19,15 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
   url: {{ .Values.images.synapseCreateUser.repository | quote }}
   tag: {{ .Values.images.synapseCreateUser.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 fullnameOverride: "matrix-neodatefix-bot-bootstrap"
 
+podAnnotations: {}
+
 securityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -35,6 +40,7 @@ securityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.synapseCreateUser }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}
 
 ...

helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -11,8 +14,8 @@ global:
 configuration:
   bot:
     username: "meetings-bot"
-    displayname: "Terminplaner Bot"
+    display name: "Terminplaner Bot"
-  openxchangeBaseUrl: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
+  openxchangeBaseUrl: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
   strings:
     breakoutSessionWidgetName: "Breakoutsessions"
     calendarRoomName: "Terminplaner"
@@ -35,7 +38,8 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoDateFixBot }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.matrixNeoDateFixBot | toYaml | nindent 4 }}
 
 extraEnvVars:
   - name: "ACCESS_TOKEN"
@@ -43,12 +47,26 @@ extraEnvVars:
       secretKeyRef:
         name: "matrix-neodatefix-bot-account"
         key: "access_token"
-  - name: "ENABLE_CRYPTO"
+{{- if .Values.certificate.selfSigned }}
-    value: "false"
+  - name: "NODE_EXTRA_CA_CERTS"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixBot.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoDateFixBot.registry | quote }}
   repository: {{ .Values.images.matrixNeoDateFixBot.repository | quote }}
   tag: {{ .Values.images.matrixNeoDateFixBot.tag | quote }}
 
@@ -59,13 +77,15 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
-livenessProbe:
+liveness sample:
   enabled: true
 
 persistence:
   size: {{ .Values.persistence.size.matrixNeoDateFixBot | quote }}
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101

helmfile/apps/element/values-matrix-neodatefix-widget.yaml.gotmpl

@@ -1,9 +1,13 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   bot:
     username: "meetings-bot"
+    homeserver: {{ .Values.global.matrixDomain | default .Values.global.domain }}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -18,7 +22,8 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoDateFixWidget }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.matrixNeoDateFixWidget | toYaml | nindent 4 }}
 
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -29,7 +34,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixWidget.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixNeoDateFixWidget.registry | quote }}
   repository: {{ .Values.images.matrixNeoDateFixWidget.repository | quote }}
   tag: {{ .Values.images.matrixNeoDateFixWidget.tag | quote }}
 
@@ -40,6 +45,8 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations: {}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -52,4 +59,7 @@ resources:
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 
+nginx:
+  ipv4Only: {{ if eq .Values.cluster.networking.ipFamilies "IPv4" }}true{{ else }}false{{ end }}
+
 ...

helmfile/apps/element/values-matrix-user-verification-service-bootstrap.yaml.gotmpl

@@ -1,9 +1,12 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
+  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 
 configuration:
   username: "uvs"
@@ -16,13 +19,15 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
   url: {{ .Values.images.synapseCreateUser.repository | quote }}
   tag: {{ .Values.images.synapseCreateUser.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 fullnameOverride: "opendesk-matrix-user-verification-service-bootstrap"
 
+podAnnotations: {}
+
 securityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -35,5 +40,6 @@ securityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.synapseCreateUser }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}
 ...

helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Center for Digital Sovereignty of Public Administration (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Federal Ministry of the Interior and Community, PG ZenDiS "Project group for the development of ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -14,7 +17,8 @@ containerSecurityContext:
   runAsUser: 0
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.matrixUserVerificationService }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.matrixUserVerificationService | toYaml | nindent 4 }}
 
 extraEnvVars:
   - name: "UVS_ACCESS_TOKEN"
@@ -34,10 +38,13 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.matrixUserVerificationService.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.matrixUserVerificationService.registry | quote }}
   repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
   tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}
 
+podAnnotations:
+  {{ .Values.annotations.matrixUserVerificationService.pod | toYaml | nindent 2 }}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -47,4 +54,12 @@ replicaCount: {{ .Values.replicas.matrixUserVerificationService }}
 resources:
   {{ .Values.resources.matrixUserVerificationService | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.matrixUserVerificationService.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.matrixUserVerificationService.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/element/values-synapse-web.yaml.gotmpl

@@ -1,6 +1,11 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
+clusterDomain: {{ .Values.cluster.networking.domain }}
+
 containerSecurityContext:
   allowPrivilegeEscalation: false
   capabilities:
@@ -14,10 +19,12 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.synapseWeb }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.synapseWeb | toYaml | nindent 4 }}
 
 global:
   domain: {{ .Values.global.domain | quote }}
+  clusterDomain: {{ .Values.cluster.networking.domain | quote }}
   hosts:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
@@ -25,11 +32,21 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapseWeb.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseWeb.registry | quote }}
   repository: {{ .Values.images.synapseWeb.repository | quote }}
   tag: {{ .Values.images.synapseWeb.tag | quote }}
 
 ingress:
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.element }}"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}"
+    nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.element }}"
+    nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}s"
+    nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.element }}s"
+    {{- with .Values.annotations.synapseWeb.ingress }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
   host: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
   enabled: {{ .Values.ingress.enabled }}
   ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
@@ -37,6 +54,9 @@ ingress:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
 
+podAnnotations:
+  {{ .Values.annotations.synapseWeb.pod | toYaml | nindent 2 }}
+
 podSecurityContext:
   enabled: true
   fsGroup: 101
@@ -46,4 +66,12 @@ replicaCount: {{ .Values.replicas.synapseWeb }}
 resources:
   {{ .Values.resources.synapseWeb | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.synapseWeb.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.synapseWeb.serviceAccount | toYaml | nindent 4 }}
+
 ...

helmfile/apps/element/values-synapse.yaml.gotmpl

@@ -1,5 +1,8 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   additionalConfiguration:
@@ -11,8 +14,8 @@ configuration:
         - "m.space.parent"
         - "net.nordeck.meetings.metadata"
         - "m.room.power_levels"
-    # When a user logs into Element a parallel request is done through Intercom Service to allow Synapse API
+    # To allow intercom service logins for the users and also allow proper testautomation we want to raise the
-    # interaction, to avoid (temporary) blocking of the user for followup logins we want to raise the limits.
+    # ratelimit in a reasonable manner.
     # https://matrix-org.github.io/synapse/v1.59/usage/configuration/config_documentation.html#ratelimiting
     rc_login:
       account:
@@ -24,11 +27,29 @@ configuration:
 
   database:
     host: {{ .Values.databases.synapse.host | quote }}
+    port: {{ .Values.databases.synapse.port }}
     name: {{ .Values.databases.synapse.name | quote }}
     user: {{ .Values.databases.synapse.username | quote }}
-    password: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    password:
+      value: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    requireAuth: {{ .Values.databases.synapse.requireAuth }}
+    channelBinding: {{ .Values.databases.synapse.channelBinding | quote }}
+    connectTimeout: {{ .Values.databases.synapse.connectTimeout }}
+    clientEncoding: {{ .Values.databases.synapse.clientEncoding | quote }}
+    keepalives: {{ .Values.databases.synapse.keepalives }}
+    keepalivesIdle: {{ .Values.databases.synapse.keepalivesIdle }}
+    keepalivesInterval: {{ .Values.databases.synapse.keepalivesInterval }}
+    keepalivesCount: {{ .Values.databases.synapse.keepalivesCount }}
+    replication: {{ .Values.databases.synapse.replication }}
+    gssencmode: {{ .Values.databases.synapse.gssencmode | quote }}
+    sslmode: {{ .Values.databases.synapse.sslmode | quote }}
+    sslcompression: {{ .Values.databases.synapse.sslcompression }}
+    sslMinProtocolVersion: {{ .Values.databases.synapse.sslMinProtocolVersion | quote }}
+    connectionPoolMin: {{ .Values.databases.synapse.connectionPoolMin }}
+    connectionPoolMax: {{ .Values.databases.synapse.connectionPoolMax }}
 
   homeserver:
+    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
     appServiceConfigs:
       - as_token: {{ .Values.secrets.intercom.synapseAsToken | quote }}
         hs_token: {{ .Values.secrets.intercom.synapseAsToken | quote }}
@@ -39,11 +60,39 @@ configuration:
               regex: "@.*"
         url: null
         sender_localpart: intercom-service
+      - as_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.oxAppSuite.synapseAsToken | quote }}
+        id: ox-appsuite
+        namespaces:
+          users:
+            - exclusive: false
+              regex: "@.*"
+        url: null
+        sender_localpart: ox-appsuite
+
+    presence:
+      enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
+
+    profile:
+      allowUsersToUpdateDisplayname: {{ .Values.functional.chat.matrix.profile.allowUsersToUpdateDisplayname }}
+
+    smtp:
+      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      port: 25
+      tls: false
+      starttls: false
+      username: ""
+      password: ""
 
     oidc:
       clientId: "opendesk-matrix"
       clientSecret: {{ .Values.secrets.keycloak.clientSecret.matrix | quote }}
       issuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+      matrixIdLocalpart: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
+      scopes:
+        - "openid"
+        - "opendesk-matrix-scope"
 
     turn:
       sharedSecret: {{ .Values.turn.credentials | quote }}
@@ -62,7 +111,7 @@ configuration:
       enabled: true
       image:
         imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-        registry: {{ .Values.global.imageRegistry | default .Values.images.synapseGuestModule.registry | quote }}
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapseGuestModule.registry | quote }}
         repository: {{ .Values.images.synapseGuestModule.repository | quote }}
         tag: {{ .Values.images.synapseGuestModule.tag | quote }}
 
@@ -79,7 +128,41 @@ containerSecurityContext:
   runAsGroup: 10991
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.synapse }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.synapse | toYaml | nindent 4 }}
+
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "REQUESTS_CA_BUNDLE"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  - name: "SSL_CERT_FILE"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  - name: "SSL_CERT_DIR"
+    value: "/etc/ssl/certs"
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
+federation:
+  enabled: {{ .Values.functional.externalServices.matrix.federation.enabled }}
+  ingress:
+    host: "{{ .Values.global.hosts.synapseFederation }}.{{ .Values.global.domain }}"
+    enabled: {{ .Values.ingress.enabled }}
+    ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+    annotations:
+      {{ .Values.annotations.synapse.ingress | toYaml | nindent 6 }}
 
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -90,7 +173,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.synapse.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.synapse.registry | quote }}
   repository: {{ .Values.images.synapse.repository | quote }}
   tag: {{ .Values.images.synapse.tag | quote }}
 
@@ -98,6 +181,9 @@ persistence:
   size: {{ .Values.persistence.size.synapse | quote }}
   storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 
+podAnnotations:
+  {{ .Values.annotations.synapse.pod | toYaml | nindent 2 }}
+
 podSecurityContext:
   enabled: true
   fsGroup: 10991
@@ -111,4 +197,14 @@ replicaCount: {{ .Values.replicas.synapse }}
 resources:
   {{ .Values.resources.synapse | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.synapse.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.synapse.serviceAccount | toYaml | nindent 4 }}
+
+tls:
+  secretName: {{ if .Values.global.matrixDomain }}"opendesk-certificates-synapse-tls"{{ else }}"opendesk-certificates-tls"{{ end }}
 ...

helmfile/apps/element/values-well-known.yaml.gotmpl

@@ -1,9 +1,12 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+{{/*
-# SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
 ---
 configuration:
   e2ee:
-    forceDisable: true
+    forceDisable: false
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -18,7 +21,8 @@ containerSecurityContext:
   runAsUser: 101
   seccompProfile:
     type: "RuntimeDefault"
-  seLinuxOptions: {{ .Values.seLinuxOptions.wellKnown }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.wellKnown | toYaml | nindent 4 }}
 
 global:
   domain: {{ .Values.global.domain | quote }}
@@ -29,7 +33,7 @@ global:
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.wellKnown.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.wellKnown.registry | quote }}
   repository: {{ .Values.images.wellKnown.repository | quote }}
   tag: {{ .Values.images.wellKnown.tag | quote }}
 
@@ -40,6 +44,11 @@ ingress:
   tls:
     enabled: {{ .Values.ingress.tls.enabled }}
     secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    {{ .Values.annotations.elementWellKnown.ingress | toYaml | nindent 4 }}
+
+podAnnotations:
+  {{ .Values.annotations.elementWellKnown.pod | toYaml | nindent 2 }}
 
 podSecurityContext:
   enabled: true
@@ -50,4 +59,11 @@ replicaCount: {{ .Values.replicas.wellKnown }}
 resources:
   {{ .Values.resources.wellKnown | toYaml | nindent 2 }}
 
+service:
+  annotations:
+    {{ .Values.annotations.elementWellKnown.service | toYaml | nindent 4 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.elementWellKnown.serviceAccount | toYaml | nindent 4 }}
 ...

helmfile/apps/intercom-service/helmfile.yaml

@@ -1,29 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-repositories:
-  # Intercom Service
-  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
-  - name: "intercom-service-repo"
-    keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
-    verify: {{ .Values.charts.intercomService.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
-
-releases:
-  - name: "intercom-service"
-    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
-    version: "{{ .Values.charts.intercomService.version }}"
-    values:
-      - "values.yaml.gotmpl"
-    installed: {{ .Values.intercom.enabled }}
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "intercom-service"
-...

helmfile/apps/intercom-service/values.yaml.gotmpl

@@ -1,79 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-containerSecurityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop:
-      - "ALL"
-  enabled: true
-  privileged: false
-  runAsUser: 1000
-  runAsGroup: 1000
-  seccompProfile:
-    type: "RuntimeDefault"
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-  seLinuxOptions: {{ .Values.seLinuxOptions.intercom }}
-
-global:
-  domain: {{ .Values.global.domain | quote }}
-  hosts:
-    {{ .Values.global.hosts | toYaml | nindent 4 }}
-  imagePullSecrets:
-    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-
-ics:
-  secret: {{ .Values.secrets.intercom.secret | quote }}
-  issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
-  originRegex: "{{ .Values.istio.domain }}|{{ .Values.global.domain }}"
-  keycloak:
-    realm: {{ .Values.platform.realm | quote }}
-  default:
-    domain: {{ .Values.global.domain | quote }}
-  oidc:
-    id: "opendesk-intercom"
-    secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
-  matrix:
-    asSecret: {{ .Values.secrets.intercom.synapseAsToken | quote }}
-    subdomain: {{ .Values.global.hosts.synapse | quote }}
-    serverName: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
-  nordeck:
-    subdomain: {{ .Values.global.hosts.matrixNeoDateFixBot | quote }}
-  portal:
-    apiKey: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-  redis:
-    host: {{ .Values.cache.intercomService.host | quote }}
-    port: {{ .Values.cache.intercomService.port }}
-    password: {{ .Values.cache.intercomService.password | default .Values.secrets.redis.password | quote }}
-  openxchange:
-    oci: true
-    url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
-    audience: "opendesk-oxappsuite"
-  nextcloud:
-    audience: "opendesk-nextcloud"
-image:
-  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.intercom.registry | quote }}
-  repository: {{ .Values.images.intercom.repository | quote }}
-  tag: {{ .Values.images.intercom.tag | quote }}
-
-ingress:
-  host: "{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
-  enabled: {{ .Values.ingress.enabled }}
-  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
-  tls:
-    enabled: {{ .Values.ingress.tls.enabled }}
-    secretName: {{ .Values.ingress.tls.secretName | quote }}
-
-podSecurityContext:
-  enabled: true
-  fsGroup: 1000
-  fsGroupChangePolicy: "Always"
-
-replicaCount: {{ .Values.replicas.intercomService }}
-
-resources:
-  {{ .Values.resources.intercomService | toYaml | nindent 2 }}
-
-...

helmfile/apps/jitsi/helmfile-child.yaml.gotmpl

@@ -1,9 +1,6 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
-bases:
-  - "../../bases/environments.yaml"
----
 repositories:
   # openDesk Jitsi
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-jitsi
@@ -21,10 +18,13 @@ releases:
     version: "{{ .Values.charts.jitsi.version }}"
     values:
       - "values-jitsi.yaml.gotmpl"
+      {{ range .Values.customization.release.jitsi }}
+      - {{ . }}
+      {{ end }}
     installed: {{ .Values.jitsi.enabled }}
     timeout: 900
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "jitsi"
 ...

helmfile/apps/jitsi/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/jitsi/values-jitsi.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -9,6 +10,7 @@ global:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations: {}
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -23,19 +25,40 @@ containerSecurityContext:
   runAsUser: 1993
   runAsGroup: 1993
   runAsNonRoot: true
-  seLinuxOptions: {{ .Values.seLinuxOptions.jitsiKeycloakAdapter }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.jitsiKeycloakAdapter | toYaml | nindent 4 }}
+
+
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "DENO_CERT"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
 
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
 
 image:
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiKeycloakAdapter.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsiKeycloakAdapter.registry | quote }}
   repository: {{ .Values.images.jitsiKeycloakAdapter.repository | quote }}
   tag: {{ .Values.images.jitsiKeycloakAdapter.tag | quote }}
 
 settings:
-  jwtAppSecret: {{ .Values.secrets.jitsi.jwtAppSecret | quote }}
+  jwtAppSecret:
+    value: {{ .Values.secrets.jitsi.jwtAppSecret | quote }}
   keycloakRealm: {{ .Values.platform.realm | quote }}
   keycloakClientId: "opendesk-jitsi"
 
@@ -47,10 +70,15 @@ jitsi:
   web:
     replicaCount: {{ .Values.replicas.jitsi }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
       tag: {{ .Values.images.jitsi.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     ingress:
       enabled: {{ .Values.ingress.enabled }}
+      annotations:
+        {{- with .Values.annotations.jitsi.ingress }}
+        {{ . | toYaml | nindent 8 }}
+        {{- end }}
       ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
       hosts:
         - host: "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
@@ -60,6 +88,8 @@ jitsi:
         - secretName: {{ .Values.ingress.tls.secretName | quote }}
           hosts:
             - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
+    extraConfigJs:
+      doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
     extraEnvs:
       TURN_ENABLE: "1"
     resources:
@@ -67,7 +97,6 @@ jitsi:
     securityContext:
       allowPrivilegeEscalation: false
       capabilities: {}
-      enabled: true
       privileged: false
       readOnlyRootFilesystem: false
       runAsGroup: 0
@@ -75,11 +104,15 @@ jitsi:
       runAsUser: 0
       seccompProfile:
         type: "RuntimeDefault"
-      seLinuxOptions: {{ .Values.seLinuxOptions.jitsi }}
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.jitsi.pod | toYaml | nindent 6 }}
   prosody:
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
       tag: {{ .Values.images.prosody.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     imagePullSecrets:
     {{- range .Values.global.imagePullSecrets }}
       - name: {{ . | quote }}
@@ -115,7 +148,6 @@ jitsi:
     securityContext:
       allowPrivilegeEscalation: false
       capabilities: {}
-      enabled: true
       privileged: false
       readOnlyRootFilesystem: false
       runAsGroup: 0
@@ -123,12 +155,16 @@ jitsi:
       runAsUser: 0
       seccompProfile:
         type: "RuntimeDefault"
-      seLinuxOptions: {{ .Values.seLinuxOptions.prosody }}
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.prosody | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.prosody.pod | toYaml | nindent 6 }}
   jicofo:
     replicaCount: {{ .Values.replicas.jicofo }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
       tag: {{ .Values.images.jicofo.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     xmpp:
       password: {{ .Values.secrets.jitsi.jicofoAuthPassword | quote }}
       componentSecret: {{ .Values.secrets.jitsi.jicofoComponentPassword | quote }}
@@ -137,7 +173,6 @@ jitsi:
     securityContext:
       allowPrivilegeEscalation: false
       capabilities: {}
-      enabled: true
       privileged: false
       readOnlyRootFilesystem: false
       runAsGroup: 0
@@ -145,12 +180,20 @@ jitsi:
       runAsUser: 0
       seccompProfile:
         type: "RuntimeDefault"
-      seLinuxOptions: {{ .Values.seLinuxOptions.jicofo }}
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.jicofo.pod | toYaml | nindent 6 }}
   jvb:
     replicaCount: {{ .Values.replicas.jvb }}
+    # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
+    # upstream charts v1.4.0 a value for `publicIPs` is required. We set a dummy value as we anyway update it
+    # later with the `patchJVB` job.
+    publicIPs: [ 0.0.0.0 ]
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
       tag: {{ .Values.images.jvb.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     xmpp:
       password: {{ .Values.secrets.jitsi.jvbAuthPassword | quote }}
     resources:
@@ -160,7 +203,6 @@ jitsi:
     securityContext:
       allowPrivilegeEscalation: false
       capabilities: {}
-      enabled: true
       privileged: false
       readOnlyRootFilesystem: false
       runAsGroup: 0
@@ -168,12 +210,16 @@ jitsi:
       runAsUser: 0
       seccompProfile:
         type: "RuntimeDefault"
-      seLinuxOptions: {{ .Values.seLinuxOptions.jvb }}
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.jvb | toYaml | nindent 8 }}
+    podAnnotations:
+      {{ .Values.annotations.jvb.pod | toYaml | nindent 6 }}
   jibri:
     replicaCount: {{ .Values.replicas.jibri }}
     image:
-      repository: "{{ .Values.global.imageRegistry | default .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
       tag: {{ .Values.images.jibri.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     recorder:
       password: {{ .Values.secrets.jitsi.jibriRecorderPassword | quote }}
     xmpp:
@@ -184,10 +230,16 @@ jitsi:
       # Chart does not allow to template more
       capabilities:
         add: ["SYS_ADMIN"]
+    podAnnotations:
+      {{ .Values.annotations.jibri.pod | toYaml | nindent 6 }}
   imagePullSecrets:
   {{- range .Values.global.imagePullSecrets }}
     - name: {{ . | quote }}
   {{- end }}
+  serviceAccount:
+    annotations:
+      {{ .Values.annotations.jitsi.serviceAccount | toYaml | nindent 6 }}
+
 
 patchJVB:
   configuration:
@@ -206,14 +258,23 @@ patchJVB:
     runAsNonRoot: true
     seccompProfile:
       type: "RuntimeDefault"
-    seLinuxOptions: {{ .Values.seLinuxOptions.jitsiPatchJVB }}
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.jitsiPatchJVB | toYaml | nindent 6 }}
   image:
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiPatchJVB.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.jitsiPatchJVB.registry | quote }}
     repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
     tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
+
+podAnnotations:
+  {{ .Values.annotations.cryptpad.pod | toYaml | nindent 2 }}
+
 replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}
 
 resources:
   {{ .Values.resources.jitsiKeycloakAdapter | toYaml | nindent 2 }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.jitsiPatchJVB.serviceAccount | toYaml | nindent 4 }}
 ...

helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl

@@ -1,9 +1,6 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
-bases:
-  - "../../bases/environments.yaml"
----
 repositories:
   # Nextcloud
   # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-nextcloud
@@ -28,6 +25,9 @@ releases:
     version: "{{ .Values.charts.nextcloudManagement.version }}"
     values:
       - "values-nextcloud-mgmt.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskNextcloudManagement }}
+      - {{ . }}
+      {{ end }}
     waitForJobs: true
     wait: true
     installed: {{ .Values.nextcloud.enabled }}
@@ -37,11 +37,14 @@ releases:
     version: "{{ .Values.charts.nextcloud.version }}"
     values:
       - "values-nextcloud.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskNextcloud }}
+      - {{ . }}
+      {{ end }}
     needs:
       - "opendesk-nextcloud-management"
     installed: {{ .Values.nextcloud.enabled }}
 
 commonLabels:
-  deploy-stage: "component-1"
+  deployStage: "050-components"
   component: "nextcloud"
 ...

helmfile/apps/nextcloud/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -9,50 +10,80 @@ global:
     {{ .Values.global.hosts | toYaml | nindent 4 }}
   imagePullSecrets:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-  istioDomain: {{ .Values.istio.domain }}
 
 additionalAnnotations:
   intents.otterize.com/service-name: "opendesk-nextcloud-php"
+  {{- with .Values.annotations.nextcloudManagement.all }}
+  {{ . | toYaml | nindent 2}}
+  {{- end }}
+
+serviceAccount:
+  annotations:
+    {{ .Values.annotations.nextcloudManagement.serviceAccount | toYaml | nindent 4 }}
 
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
 
 configuration:
   administrator:
-    username: "nextcloud"
+    # The admin user is (currently) required to bootstrap the OpenProject <> Nextcloud integration.
-    password: {{ .Values.secrets.nextcloud.adminPassword | quote }}
+    enabled: true
+    username:
+      value: "nextcloud"
+    password:
+      value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
   antivirus:
+    {{- if .Values.antivirus.icap.host }}
+    host: {{ .Values.antivirus.icap.host | quote }}
+    port: {{ .Values.antivirus.icap.port | quote }}
+    {{- else }}
     {{- if .Values.clamavDistributed.enabled }}
     host: "clamav-icap"
     {{- else if .Values.clamavSimple.enabled }}
     host: "clamav-simple"
     {{- end }}
+    port: 1344
+    {{- end }}
   cache:
     auth:
       enabled: true
       username:
-        value: "default"
+        value: {{ .Values.cache.nextcloud.username }}
       password:
         value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
     host: {{ .Values.cache.nextcloud.host | quote }}
     port: {{ .Values.cache.nextcloud.port | quote }}
+    tls: {{ .Values.cache.nextcloud.tls }}
+  collabora:
+    # internalWopiUrl: ""
+    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
   database:
     host: {{ .Values.databases.nextcloud.host | quote }}
     port: {{ .Values.databases.nextcloud.port | quote }}
+    name: {{ .Values.databases.nextcloud.name | quote }}
     auth:
       username:
-        value: "nextcloud_user"
+        value: {{ .Values.databases.nextcloud.username | quote }}
       password:
         value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
   ldap:
     host: {{ .Values.ldap.host | quote }}
-    password: {{ .Values.secrets.univentionManagementStack.ldapSearch.nextcloud | quote }}
+    password:
+      value: {{ .Values.secrets.nubus.ldapSearch.nextcloud | quote }}
+    adminGroupName: "managed-by-attribute-FileshareAdmin"
   objectstore:
     auth:
       accessKey:
-        value: "nextcloud_user"
+        value: {{ .Values.objectstores.nextcloud.username | quote }}
       secretKey:
-        value: {{ .Values.secrets.minio.nextcloudUser | quote }}
+        value: {{ .Values.objectstores.nextcloud.secretKey | default .Values.secrets.minio.nextcloudUser | quote }}
+    bucket: {{ .Values.objectstores.nextcloud.bucket | quote }}
+    host: {{ .Values.objectstores.nextcloud.endpoint | quote }}
+    region: {{ .Values.objectstores.nextcloud.region | quote }}
+    storageClass: {{ .Values.objectstores.nextcloud.storageClass | quote }}
+    port: {{ .Values.objectstores.nextcloud.port | quote }}
+    pathStyle: {{ .Values.objectstores.nextcloud.pathStyle | quote }}
+    useSSL: {{ .Values.objectstores.nextcloud.useSSL | quote }}
   oidc:
     username:
       value: "opendesk-nextcloud"
@@ -63,14 +94,38 @@ configuration:
       value: "opendesk_username"
     password:
       value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  sharing:
+    allowLinks: {{ .Values.functional.filestore.sharing.external.enabled }}
+    allowMailNotification: {{ .Values.functional.filestore.sharing.external.enabled }}
+    allowPublicUpload: {{ .Values.functional.filestore.sharing.external.enabled }}
+    enforceLinksPassword: {{ .Values.functional.filestore.sharing.external.enforcePasswords }}
+    enforcePasswordProtection: {{ .Values.functional.filestore.sharing.external.enforcePasswords }}
+    defaultInternalExpireEnabled: {{ .Values.functional.filestore.sharing.internal.expiry.activeByDefault }}
+    defaultInternalExpireEnforced: {{ .Values.functional.filestore.sharing.internal.expiry.enforced }}
+    defaultInternalExpireDays: {{ .Values.functional.filestore.sharing.internal.expiry.defaultDays | quote }}
+    defaultExternalExpireEnabled: {{ .Values.functional.filestore.sharing.external.expiry.activeByDefault }}
+    defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
+    defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
+    sendPasswordMail: {{ .Values.functional.filestore.sharing.external.sendPasswordMail | quote }}
   smtp:
     auth:
+      enabled: false
       username:
-        value: {{ .Values.smtp.username | quote }}
+        value: ""
       password:
-        value: {{ .Values.smtp.password | quote }}
+        value: ""
-    host: {{ .Values.smtp.host | quote }}
+    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
-    port: {{ .Values.smtp.port | quote }}
+    port: 25
+    fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
+    mailDomain: "{{ .Values.global.domain }}"
+    security: ""
+    skipVerifyPeer: true
+  quota:
+    default: "{{ .Values.functional.filestore.quota.default }} GB"
+    retentionObligation:
+      trashbin: {{ .Values.functional.filestore.nextcloud.retentionObligation.trashbin | quote }}
+      versions: {{ .Values.functional.filestore.nextcloud.retentionObligation.versions | quote }}
+
   serverinfo:
     token: {{ .Values.secrets.nextcloud.metricsToken | quote }}
 
@@ -81,27 +136,48 @@ containerSecurityContext:
       - "ALL"
   enabled: true
   privileged: false
-  runAsUser: 65532
+  runAsUser: 101
-  runAsGroup: 65532
+  runAsGroup: 101
   seccompProfile:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: false
   runAsNonRoot: true
-  seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudManagement }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.nextcloudManagement | toYaml | nindent 4 }}
+podSecurityContext:
+  fsGroup: 101
 
 debug:
-  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"1"{{ end }}
+  loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
+  bootstrap: {{ .Values.debug.enabled }}
+
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "FS_IMPORT_CA_CERTIFICATES"
+    value: "true"
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudManagement.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
-  repository: "{{ .Values.images.nextcloudManagement.repository }}"
+  repository: {{ .Values.images.nextcloud.repository | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-  tag: {{ .Values.images.nextcloudManagement.tag | quote }}
+  tag: {{ .Values.images.nextcloud.tag | quote }}
 
 theme:
   {{ .Values.theme | toYaml | nindent 2 }}
 
 resources:
-  {{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
+  {{ .Values.resources.nextcloud | toYaml | nindent 4 }}
 
 ...

helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl

@@ -1,4 +1,5 @@
 {{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -10,6 +11,7 @@ global:
 exporter:
   enabled: true
   configuration:
+    server: "http://opendesk-nextcloud-aio"
     token:
       value: {{ .Values.secrets.nextcloud.metricsToken | quote }}
   containerSecurityContext:
@@ -25,46 +27,59 @@ exporter:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
     runAsNonRoot: true
-    seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudExporter }}
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.nextcloudExporter | toYaml | nindent 6 }}
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudExporter.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloudExporter.registry | quote }}
     repository: "{{ .Values.images.nextcloudExporter.repository }}"
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     tag: {{ .Values.images.nextcloudExporter.tag | quote }}
+  podAnnotations: {}
   prometheus:
     serviceMonitor:
-      enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
+      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
       labels:
-        {{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 8 }}
+        {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
     prometheusRule:
-      enabled: {{ .Values.prometheus.prometheusRules.enabled }}
+      enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
       additionalLabels:
-        {{- toYaml .Values.prometheus.prometheusRules.labels | nindent 8 }}
+        {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
-  replicas: {{ .Values.replicas.nextcloudExporter }}
+  replicaCount: {{ .Values.replicas.nextcloudExporter }}
   resources:
     {{ .Values.resources.nextcloudExporter | toYaml | nindent 4 }}
 
-php:
+aio:
   additionalAnnotations:
-    intents.otterize.com/service-name: "opendesk-nextcloud-php"
+    intents.otterize.com/service-name: "opendesk-nextcloud"
+    {{- with .Values.annotations.nextcloud.all }}
+    {{ . | toYaml | nindent 4 }}
+    {{- end }}
+
+  serviceAccount:
+    annotations:
+      {{ .Values.annotations.nextcloud.serviceAccount | toYaml | nindent 6 }}
+
   configuration:
     cache:
       auth:
         enabled: true
         username:
-          value: "default"
+          value: {{ .Values.cache.nextcloud.username }}
         password:
           value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
       host: {{ .Values.cache.nextcloud.host | quote }}
       port: {{ .Values.cache.nextcloud.port | quote }}
+      tls: {{ .Values.cache.nextcloud.tls }}
     database:
       host: {{ .Values.databases.nextcloud.host | quote }}
       port: {{ .Values.databases.nextcloud.port | quote }}
+      name: {{ .Values.databases.nextcloud.name | quote }}
       auth:
         username:
-          value: "nextcloud_user"
+          value: {{ .Values.databases.nextcloud.username | quote }}
         password:
           value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
+    trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
   containerSecurityContext:
     allowPrivilegeEscalation: false
     capabilities:
@@ -72,65 +87,72 @@ php:
         - "ALL"
     enabled: true
     privileged: false
-    runAsUser: 65532
+    runAsUser: 101
-    runAsGroup: 65532
+    runAsGroup: 101
     seccompProfile:
       type: "RuntimeDefault"
     readOnlyRootFilesystem: true
     runAsNonRoot: true
-    seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudPHP }}
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.nextcloud | toYaml | nindent 6 }}
   cron:
     successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
   debug:
-    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"1"{{ end }}
+    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
+  {{- if .Values.certificate.selfSigned }}
+  extraEnvVars:
+    - name: "FS_IMPORT_CA_CERTIFICATES"
+      value: "true"
+  {{- end }}
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+  extraVolumeMounts:
+    - name: "trusted-cert-secret-volume"
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+  {{- end }}
   image:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudPHP.registry | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
-    repository: "{{ .Values.images.nextcloudPHP.repository }}"
+    repository: {{ .Values.images.nextcloud.repository | quote }}
     imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
-    tag: {{ .Values.images.nextcloudPHP.tag | quote }}
+    tag: {{ .Values.images.nextcloud.tag | quote }}
-  prometheus:
-    serviceMonitor:
-      enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
-      labels:
-        {{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 8 }}
-    prometheusRule:
-      enabled: {{ .Values.prometheus.prometheusRules.enabled }}
-      additionalLabels:
-        {{- toYaml .Values.prometheus.prometheusRules.labels | nindent 8 }}
-  replicas: {{ .Values.replicas.nextcloudPHP }}
-  resources:
-    {{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
-
-apache2:
-  configuration:
-    php:
-      host: "opendesk-nextcloud-php.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}"
-  containerSecurityContext:
-    allowPrivilegeEscalation: false
-    capabilities:
-      drop:
-        - "ALL"
-    enabled: true
-    privileged: false
-    runAsUser: 65532
-    runAsGroup: 65532
-    seccompProfile:
-      type: "RuntimeDefault"
-    readOnlyRootFilesystem: true
-    runAsNonRoot: true
-    seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudApache2 }}
   ingress:
     enabled: {{ .Values.ingress.enabled }}
+    annotations:
+      nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.nextcloud }}"
+      nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}"
+      nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}"
+      nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.nextcloud }}"
+      nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}s"
+      nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.nextcloud }}s"
+      {{- with .Values.annotations.nextcloud.ingress }}
+        {{ . | toYaml | nindent 8 }}
+      {{- end }}
     ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
     host: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
     tls:
       secretName: {{ .Values.ingress.tls.secretName | quote }}
-  image:
+  podAnnotations:
-    registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudApache2.registry | quote }}
+    {{ .Values.annotations.nextcloud.podAnnotations | toYaml | nindent 6 }}
-    repository: {{ .Values.images.nextcloudApache2.repository | quote }}
+  podSecurityContext:
-    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    fsGroup: 101
-    tag: {{ .Values.images.nextcloudApache2.tag | quote }}
+  prometheus:
-  replicas: {{ .Values.replicas.nextcloudApache2 }}
+    serviceMonitor:
+      enabled: {{ .Values.monitoring.prometheus.serviceMonitors.enabled }}
+      labels:
+        {{ .Values.monitoring.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
+    prometheusRule:
+      enabled: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
+      additionalLabels:
+        {{ .Values.monitoring.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
+  replicaCount: {{ .Values.replicas.nextcloud }}
   resources:
-    {{ .Values.resources.nextcloudApache2 | toYaml | nindent 4 }}
+    {{ .Values.resources.nextcloud | toYaml | nindent 4 }}
+
 ...

helmfile/apps/nubus/helmfile-child.yaml.gotmpl

@@ -0,0 +1,94 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # Univention Management Stack Umbrella Chart
+  - name: "nubus"
+    keyring: "../../files/gpg-pubkeys/univention-de.gpg"
+    verify: {{ .Values.charts.nubus.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url:
+      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
+  # Intercom Service
+  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
+  - name: "intercom-service-repo"
+    keyring: "../../files/gpg-pubkeys/univention-de.gpg"
+    verify: {{ .Values.charts.intercomService.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+  # openDesk Keycloak Bootstrap Chart
+  - name: "opendesk-keycloak-bootstrap-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+  # NGINX S3 Gateway Chart
+  - name: "nginx-s3-gateway-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.nginxS3Gateway.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
+
+releases:
+  # Univention Management Stack Umbrella Chart
+  - name: "ums"
+    chart: "nubus/{{ .Values.charts.nubus.name }}"
+    version: "{{ .Values.charts.nubus.version }}"
+    values:
+      - "values-nubus.yaml.gotmpl"
+      - "values-opendesk-customization.yaml.gotmpl"
+      - "values-opendesk-images.yaml.gotmpl"
+      {{ range .Values.customization.release.ums }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.nubus.enabled }}
+    timeout: 900
+  # Intercom-Service
+  - name: "intercom-service"
+    chart: "intercom-service-repo/{{ .Values.charts.intercomService.name }}"
+    version: "{{ .Values.charts.intercomService.version }}"
+    values:
+      - "values-intercom-service.yaml.gotmpl"
+      {{ range .Values.customization.release.intercomService }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.nubus.enabled }}
+
+  # openDesk Keycloak Bootstrap Chart
+  - name: "opendesk-keycloak-bootstrap"
+    chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.opendeskKeycloakBootstrap.name }}"
+    version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
+    values:
+      - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskKeycloakBootstrap }}
+      - {{ . }}
+      {{ end }}
+    needs:
+      - "ums"
+    installed: {{ .Values.nubus.enabled }}
+    timeout: 900
+
+  # NGINX S3 Gateway (when cluster minio is not used)
+  - name: "nubus"
+    chart: "nginx-s3-gateway-repo/{{ .Values.charts.nginxS3Gateway.name }}"
+    version: "{{ .Values.charts.nginxS3Gateway.version }}"
+    values:
+      - "values-nginx-s3-gateway.yaml.gotmpl"
+      {{ range .Values.customization.release.nginxS3Gateway }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ not .Values.minio.enabled }}
+    timeout: 900
+
+commonLabels:
+  deployStage: "050-components"
+  component: "nubus"
+...

helmfile/apps/nubus/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...

helmfile/apps/nubus/values-intercom-service.yaml.gotmpl

@@ -0,0 +1,144 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  enabled: true
+  privileged: false
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: "RuntimeDefault"
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.intercom | toYaml | nindent 4 }}
+
+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
+extraEnvVars:
+  - name: "REDIS_USER"
+    value: {{ .Values.cache.intercomService.username }}
+  {{- if .Values.certificate.selfSigned }}
+  - name: "NODE_EXTRA_CA_CERTS"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+  {{- end }}
+
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+ics:
+  secret: {{ .Values.secrets.intercom.secret | quote }}
+  issuerBaseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+  originRegex: "{{ .Values.global.domain }}"
+  userUniqueMapper: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"entryuuid"{{ else }}"phoenixusername"{{ end }}
+  keycloak:
+    realm: {{ .Values.platform.realm | quote }}
+  default:
+    domain: {{ .Values.global.domain | quote }}
+  oidc:
+    id: "opendesk-intercom"
+    secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
+  matrix:
+    asSecret: {{ .Values.secrets.intercom.synapseAsToken | quote }}
+    subdomain: {{ .Values.global.hosts.synapse | quote }}
+    serverName: "{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}"
+  nordeck:
+    subdomain: {{ .Values.global.hosts.matrixNeoDateFixBot | quote }}
+  portal:
+    apiKey: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  redis:
+    host: {{ .Values.cache.intercomService.host | quote }}
+    port: {{ .Values.cache.intercomService.port }}
+    password: {{ .Values.cache.intercomService.password | default .Values.secrets.redis.password | quote }}
+  openxchange:
+    oci: true
+    url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
+    audience: "opendesk-oxappsuite"
+  nextcloud:
+    origin: {{ .Values.global.hosts.nextcloud | quote }}
+    subdomain: {{ .Values.global.hosts.nextcloud | quote }}
+    audience: "opendesk-nextcloud"
+image:
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.intercom.registry | quote }}
+  repository: {{ .Values.images.intercom.repository | quote }}
+  tag: {{ .Values.images.intercom.tag | quote }}
+
+ingress:
+  host: "{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
+  enabled: {{ .Values.ingress.enabled }}
+  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+  tls:
+    enabled: {{ .Values.ingress.tls.enabled }}
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+podAnnotations: {}
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 1000
+  fsGroupChangePolicy: "Always"
+
+provisioning:
+  enabled: true
+  config:
+    nubusBaseUrl: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}"
+    keycloak:
+      url: "http://ums-keycloak:8080/realms/{{ .Values.platform.realm }}/"
+      username: "kcadmin"
+      realm: {{ .Values.platform.realm | quote }}
+      connection:
+        host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
+        baseUrl: "http://ums-keycloak:8080"
+      credentialSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        key: "admin_password"
+    ics_client:
+      clientSecret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
+      credentialSecret:
+        key: "ics_secret"
+  image:
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository | quote }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag | quote }}
+  provisioningImage:
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakBootstrap.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloakBootstrap.repository | quote }}
+    tag: {{ .Values.images.nubusKeycloakBootstrap.tag | quote }}
+  securityContext:
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.intercom | toYaml | nindent 6 }}
+
+replicaCount: {{ .Values.replicas.intercomService }}
+
+resources:
+  {{ .Values.resources.intercomService | toYaml | nindent 2 }}
+
+...

helmfile/apps/nubus/values-nginx-s3-gateway.yaml.gotmpl

@@ -0,0 +1,39 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nginxS3Gateway.registry | quote }}
+  repository: {{ .Values.images.nginxS3Gateway.repository | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  tag: {{ .Values.images.nginxS3Gateway.tag | quote }}
+
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+  host: "{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: "/portal-assets/icons/$2/$3"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+  path: "/univention/(portal|selfservice)/icons/(logos|entries)/(.*)$"
+  tls:
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+configuration:
+  bucket: {{ .Values.objectstores.nubus.bucket | quote }}
+  endpoint: {{ .Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+  port: 443
+  region: {{ .Values.objectstores.nubus.region | quote }}
+  style: "path"
+  credentials:
+    accessKey:
+      value: {{ .Values.objectstores.nubus.username | quote }}
+    secretKey:
+      value: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+
+resources:
+  {{ .Values.resources.nginxS3Gateway | toYaml | nindent 2 }}
+
+replicaCount: {{ .Values.replicas.nginxS3Gateway }}
+...

helmfile/apps/nubus/values-nubus.yaml.gotmpl

@@ -0,0 +1,598 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  nubusDeployment: true
+  ldap:
+    baseDn: {{ .Values.ldap.baseDn | quote }}
+    domainName: {{ .Values.global.domain | quote }}
+    auth:
+      cnAdmin:
+        password: {{ .Values.secrets.nubus.ldapSecret | quote }}
+  domain: {{ .Values.global.domain | quote }}
+  subDomains:
+    portal: {{ .Values.global.hosts.nubus | quote }}
+    keycloak: {{ .Values.global.hosts.keycloak | quote }}
+  ingressClass: {{ .Values.ingress.ingressClassName | default "nginx" | quote }}
+  certManagerIssuer: {{ .Values.certificate.issuerRef.name | quote }}
+  nubusMasterPassword: {{ env "MASTER_PASSWORD" | default "sovereign-workplace" | quote }}
+  keycloak:
+    realm: {{ .Values.platform.realm | quote }}
+  objectStorage:
+    bucket: {{ .Values.objectstores.nubus.bucket | quote }}
+    connection:
+      host: "minio"
+      port: "9000"
+      protocol: "http"
+
+  # -- Extensions to load. Add entries to load additional extensions into Nubus.
+  extensions:
+    - name: "ox"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOxExtension.registry | quote }}
+        repository: {{ .Values.images.nubusOxExtension.repository }}
+        tag: {{ .Values.images.nubusOxExtension.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+    - name: "opendesk"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpendeskExtension.registry | quote }}
+        repository: {{ .Values.images.nubusOpendeskExtension.repository }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        tag: {{ .Values.images.nubusOpendeskExtension.tag }}
+
+  # -- Allows to configure the system extensions to load. This is intended for
+  # internal usage, prefer to use `global.extensions` for user configured
+  # extensions.
+  systemExtensions:
+    - name: "portal"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalExtension.registry | quote }}
+        repository: {{ .Values.images.nubusPortalExtension.repository }}
+        tag: {{ .Values.images.nubusPortalExtension.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+  configUcr:
+    directory:
+      manager:
+        rest:
+          authorized-groups:
+            domain-admins: __DELETE_KEY__
+            iam-api-full-access: "cn=IAM API - Full Access,cn=groups,{{ .Values.ldap.baseDn }}"
+        web:
+          modules:
+            users:
+              user:
+                add:
+                  default: "cn=openDesk User,cn=templates,cn=univention,{{ .Values.ldap.baseDn }}"
+                properties:
+                  description:
+                    syntax: "TextArea"
+                  firstname:
+                    required: "true"
+                  mailPrimaryAddress:
+                    required: "true"
+                  username:
+                    syntax: "uid"
+                search:
+                  autosearch: "True"
+                wizard:
+                  property:
+                    invite:
+                      default: "True"
+                    overridePWLength:
+                      default: "False"
+                      visible: "False"
+                    pwdChangeNextLogin:
+                      default: "True"
+                      visible: "False"
+            wizard:
+              disabled: "No"
+
+    ucs:
+      web:
+        theme: "light"
+
+    umc:
+      cookie-banner:
+        show: "false"
+      login:
+        password-complexity-message:
+          de: "Das Passwort muss mindestens 8 Zeichen lang sein und darf keine Zahlenabfolge oder ganze Worte enthalten, wie  '1234Test'."
+          en: "Password must be at least 8 characters long and cannot include a number series or regular words, like '1234Test'."
+      module:
+        udm:
+          oxmail:
+            oxcontext:
+              disabled: "True"
+          portals:
+            all:
+              disabled: "True"
+      self-service:
+        account-registration:
+          usertemplate: __DELETE_KEY__
+        passwordreset:
+          token_validity_period: 172800
+          blacklist:
+            groups: __DELETE_KEY__
+
+ingress:
+  # temporary fix
+  {{- if not .Values.minio.enabled }}
+  enabled: false
+  {{- end }}
+  certManager:
+    enabled: false
+  tls:
+    enabled: {{ .Values.ingress.tls.enabled }}
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+# Nubus bundled services
+postgresql:
+  enabled: false
+  provisioning:
+    enabled: false
+
+minio:
+  enabled: false
+
+# Nubus services which use customer supplied services
+keycloak:
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-crt-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+    - name: "trusted-cert-jks-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "truststore.jks"
+            path: "truststore.jks"
+  extraVolumeMounts:
+    - name: "trusted-cert-crt-secret-volume"
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+    - name: "trusted-cert-jks-secret-volume"
+      mountPath: "/etc/ssl/certs/truststore.jks"
+      subPath: "truststore.jks"
+  extraEnvVars:
+    - name: "KC_HTTPS_TRUST_STORE_FILE"
+      value: "/etc/ssl/certs/truststore.jks"
+    - name: "KC_HTTPS_TRUST_STORE_PASSWORD"
+      value: {{ .Values.secrets.certificates.password | quote }}
+    - name: "KC_HTTPS_TRUST_STORE_TYPE"
+      value: "jks"
+  {{- end }}
+  keycloak:
+    auth:
+      username: "kcadmin"
+      existingSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        keyMapping:
+          adminPassword: "admin_password"
+  postgresql:
+    connection:
+      host: {{ .Values.databases.keycloak.host | quote }}
+      port: {{ .Values.databases.keycloak.port | quote }}
+    auth:
+      username: {{ .Values.databases.keycloak.username | quote }}
+      database: {{ .Values.databases.keycloak.name | quote }}
+      existingSecret:
+        name: "ums-keycloak-postgresql-opendesk-credentials"
+        keyMapping:
+          password: keycloakDatabasePassword
+  config:
+    exposeAdminConsole: {{ .Values.debug.enabled }}
+    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
+
+nubusGuardian:
+  provisioning:
+    enabled: false
+    config:
+      nubusBaseUrl: {{ printf "https://%s.%s" .Values.global.hosts.nubus .Values.global.domain }}
+      keycloak:
+        realm: {{ .Values.platform.realm | quote }}
+        username: "kcadmin"
+        connection:
+          host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
+          baseUrl: "http://ums-keycloak:8080"
+        credentialSecret:
+          name: "ums-opendesk-keycloak-credentials"
+          key: "admin_password"
+      managementApi:
+        credentialSecret:
+          name: "ums-opendesk-guardian-client-secret"
+          key: "managementApiClientSecret"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+  postgresql:
+    connection:
+      host: {{ .Values.databases.umsGuardianManagementApi.host | quote }}
+      port: {{ .Values.databases.umsGuardianManagementApi.port | quote }}
+    auth:
+      username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
+      database: {{ .Values.databases.umsGuardianManagementApi.name | quote }}
+      credentialSecret:
+        name: "ums-guardian-postgresql-opendesk-credentials"
+        key: "guardianDatabasePassword"
+
+nubusNotificationsApi:
+  postgresql:
+    connection:
+      host: {{ .Values.databases.umsNotificationsApi.host | quote }}
+      port: {{ .Values.databases.umsNotificationsApi.port | quote }}
+    auth:
+      username: {{ .Values.databases.umsNotificationsApi.username | quote }}
+      database: {{ .Values.databases.umsNotificationsApi.name | quote }}
+      existingSecret:
+        name: "ums-notifications-api-postgresql-opendesk-credentials"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusPortalFrontend:
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName }}
+
+nubusKeycloakExtensions:
+  keycloak:
+    auth:
+      username: "kcadmin"
+      existingSecret:
+        name: "ums-opendesk-keycloak-credentials"
+        keyMapping:
+          adminPassword: "admin_password"
+  proxy:
+    ingress:
+      paths:
+        {{- if .Values.debug.enabled }}
+        - pathType: "Prefix"
+          path: "/admin/"
+        {{- end }}
+        - pathType: "Prefix"
+          path: "/realms/"
+        - pathType: "Prefix"
+          path: "/js/"
+        - pathType: "Prefix"
+          path: "/resources/"
+        - pathType: "Prefix"
+          path: "/fingerprintjs"
+      certManager:
+        enabled: false
+      tls:
+        enabled: {{ .Values.ingress.tls.enabled }}
+        secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+  postgresql:
+    connection:
+      host: {{ .Values.databases.keycloakExtension.host | quote }}
+      port: {{ .Values.databases.keycloakExtension.port | quote }}
+    auth:
+      database: {{ .Values.databases.keycloakExtension.name | quote }}
+      username: {{ .Values.databases.keycloakExtension.username | quote }}
+      existingSecret:
+        name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
+        keyMapping:
+          password: "umcKeycloakExtensionsDatabasePassword"
+  smtp:
+    connection:
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      port: 25
+      ssl: false
+      starttls: false
+    auth:
+      enabled: false
+      username: ""
+      existingSecret:
+        name: "ums-keycloak-extensions-smtp-opendesk-credentials"
+        keyMapping:
+          password: "umcKeycloakExtensionsSmtpPassword"
+  handler:
+    appConfig:
+      logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
+      newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
+      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
+
+nubusPortalListener:
+  enabled: false
+
+nubusPortalConsumer:
+  enabled: true
+  portalConsumer:
+    logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"INFO"{{ end }}
+    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
+    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
+  provisioningApi:
+    auth:
+      username: "portal-consumer"
+      password: {{ .Values.secrets.nubus.portalConsumer.provisioningApiPassword | quote }}
+      # TODO: Workaround for a small bug introduced during the secrets refactoring.
+      # The fix will be part of a future Nubus release and the two lines can then be deleted.
+      existingSecret:
+        name: "ums-portal-consumer-credentials"
+  objectStorage:
+    auth:
+      accessKey: {{ .Values.objectstores.nubus.username | quote }}
+      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+
+nubusPortalServer:
+  objectStorage:
+    auth:
+      accessKey: {{ .Values.objectstores.nubus.username | quote }}
+      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+  portalServer:
+    objectStorageEndpoint: {{ printf "https://%s" (.Values.objectstores.nubus.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
+    objectStorageBucket: {{ .Values.objectstores.nubus.bucket | quote }}
+    objectStorageCredentialSecret:
+      name: "ums-portal-server-minio-opendesk-credentials"
+      accessKeyKey: "access-key-id"
+      secretKeyKey: "secret-key-id"
+    centralNavigation:
+      enabled: true
+      authenticatorSecretName: "ums-opendesk-portal-server-central-navigation"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusUdmRestApi:
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusProvisioning:
+  enabled: true
+  ldap:
+    auth:
+      password: {{ .Values.secrets.nubus.ldapSecret | quote }}
+  nats:
+    auth:
+      adminPassword: {{ .Values.secrets.nats.natsAdminPassword | quote }}
+  api:
+    auth:
+      adminPassword: {{ .Values.secrets.nubus.provisioning.api.adminPassword | quote }}
+      prefillPassword: {{ .Values.secrets.nubus.provisioning.api.prefillPassword | quote}}
+      udmTransformerPassword: {{ .Values.secrets.nubus.provisioning.api.udmTransformerPassword | quote}}
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.api.natsPassword | quote}}
+
+  dispatcher:
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.dispatcherNatsPassword | quote}}
+
+  prefill:
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.prefillNatsPassword | quote}}
+
+  udmTransformer:
+    nats:
+      auth:
+        password: {{ .Values.secrets.nubus.provisioning.udmTransformerNatsPassword | quote}}
+
+  registerConsumers:
+    createUsers:
+      oxConsumer:
+        existingSecret:
+          name: ums-provisioning-ox-credentials
+          keyMapping:
+            password: "ox-connector.json"
+
+nubusUdmListener:
+  enabled: true
+
+nubusSelfServiceListener:
+  enabled: false
+
+nubusSelfServiceConsumer:
+  enabled: true
+  provisioningApi:
+    auth:
+      password: {{ .Values.secrets.nubus.selfserviceConsumer.provisioningApiPassword | quote}}
+
+# Nubus services
+nubusStackDataUms:
+  additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
+    argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
+  stackDataContext:
+    umcPostgresqlHostname: {{ .Values.databases.umsSelfservice.host | quote }}
+    umcPostgresqlUsername: {{ .Values.databases.umsSelfservice.username | quote }}
+    umcMemcachedHostname: {{ .Values.cache.umsSelfservice.host | quote }}
+    umcMemcachedUsername: ""
+    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
+    umcHtmlTitle: "openDesk Portal"
+    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    smtpPort: 25
+    smtpUser: ""
+    smtpStartTls: false
+    ldapBase: {{ .Values.ldap.baseDn }}
+  templateContext:
+    initialPasswordDefaultAdmin: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote }}
+    initialPasswordDefaultUser: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote }}
+    initialPasswordAdministrator: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote }}
+    portalEnforceLogin: {{ .Values.functional.portal.enforceLogin }}
+    portalHeaderLogo: {{ toYaml .Values.theme.imagery.logoHeaderSvgB64 | quote }}
+    portalTiles: {{ toYaml .Values.theme.imagery.portalTiles | nindent 6 }}
+    portalRealtimeCollaborationLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.element .Values.global.domain }}
+    portalRealtimeVideoconferenceLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.jitsi .Values.global.domain }}
+    portalManagementProjectLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openproject .Values.global.domain }}
+    portalManagementKnowledgeLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.xwiki .Values.global.domain }}
+    portalGroupwareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
+    portalFileshareLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.nextcloud .Values.global.domain }}
+    portalTitleDE: "openDesk Portal"
+    portalTitleEN: "openDesk Portal"
+    oxDefaultContext: "1"
+    ldapSearchUsers:
+      {{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
+      - username: {{ printf "ldapsearch_%s" $username | quote }}
+        password: {{ $password | quote }}
+        lastname: "LDAP-Search-User"
+      {{- end }}
+    ldapSystemUsers: []
+    portaltileGroupUserStandard:
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupUserAdmin:
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Support,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupUserAll:
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupGroupware:
+      - 'cn=managed-by-attribute-Groupware,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupFileshare:
+      - 'cn=managed-by-attribute-Fileshare,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementProject:
+      - 'cn=managed-by-attribute-Projectmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementKnowledge:
+      - 'cn=managed-by-attribute-Knowledgemanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupManagementLearn:
+      - 'cn=managed-by-attribute-Learnmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupLiveCollaboration:
+      - 'cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}'
+    portaltileGroupVideoconference:
+      - 'cn=managed-by-attribute-Videoconference,cn=groups,{{ .Values.ldap.baseDn }}'
+    systemInformation:
+      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
+      {{- if .Values.functional.admin.portal.deploymentTimestamp.enabled }}
+      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
+      {{- else }}
+      deployDate: false
+      {{- end }}
+  # In openDesk the external memcache does not expect a username to be set. Overwriting
+  # the default username of `selfservice` is part of the customizing:
+  nubusUmcServer:
+    memcached:
+      auth:
+        username: ""
+
+nubusUmcServer:
+  postgresql:
+    bundled: false
+    connection:
+      host: {{ .Values.databases.umsSelfservice.host | quote }}
+      port: {{ .Values.databases.umsSelfservice.port | quote }}
+    auth:
+      username: {{ .Values.databases.umsSelfservice.username | quote }}
+      database: {{ .Values.databases.umsSelfservice.name | quote }}
+      existingSecret:
+        name: "ums-umc-server-postgresql-opendesk-credentials"
+        keyMapping:
+          password: "umcServerDatabasePassword"
+  memcached:
+    bundled: false
+    server: {{ .Values.cache.umsSelfservice.host | quote }}
+    auth:
+      existingSecret:
+        name: "ums-umc-server-memcached-opendesk-credentials"
+        keyMapping:
+          memcached-password: "umcServerMemcachedPassword"
+  smtp:
+    existingSecret:
+      name: "ums-umc-server-smtp-credentials-custom"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusUmcGateway:
+  umcGateway:
+    umcHtmlTitle: "openDesk Portal"
+  ingress:
+    certManager:
+      enabled: false
+    tls:
+      enabled: {{ .Values.ingress.tls.enabled }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+
+nubusKeycloakBootstrap:
+  additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
+  keycloak:
+    auth:
+      username: "kcadmin"
+      existingSecret:
+        name: "ums-opendesk-keycloak-credentials"
+  bootstrap:
+    ldapMappers:
+      - ldapAndUserModelAttributeName: "opendeskProjectmanagementAdmin"
+      - ldapAndUserModelAttributeName: "oxContextIDNum"
+    twoFactorAuthentication:
+      enabled: true
+      group: "2fa-users"
+  ldap:
+    auth:
+      bindDn: {{ printf "uid=ldapsearch_keycloak,cn=users,%s" .Values.ldap.baseDn }}
+      existingSecret:
+        name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
+
+# Credential secrets for accessing customer supplied services
+extraSecrets:
+  - name: "ums-opendesk-portal-server-central-navigation"
+    stringData:
+      authenticator.secret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
+  - name: "ums-opendesk-guardian-client-secret"
+    stringData:
+      managementApiClientSecret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
+  - name: "ums-opendesk-keycloak-credentials"
+    stringData:
+      admin_password: {{ .Values.secrets.keycloak.adminPassword | quote }}
+  - name: "ums-keycloak-postgresql-opendesk-credentials"
+    stringData:
+      keycloakDatabasePassword: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
+  - name: "ums-guardian-postgresql-opendesk-credentials"
+    stringData:
+      guardianDatabasePassword: {{ .Values.databases.umsGuardianManagementApi.password | default .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
+  - name: "ums-notifications-api-postgresql-opendesk-credentials"
+    stringData:
+      password: {{ .Values.databases.umsNotificationsApi.password | default .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
+  - name: "ums-umc-server-postgresql-opendesk-credentials"
+    stringData:
+      umcServerDatabasePassword: {{ .Values.databases.umsSelfservice.password | default .Values.secrets.postgresql.umsSelfserviceUser | quote }}
+  - name: "ums-umc-server-memcached-opendesk-credentials"
+    stringData:
+      umcServerMemcachedPassword: ""
+  - name: "ums-keycloak-extensions-postgresql-opendesk-credentials"
+    stringData:
+      umcKeycloakExtensionsDatabasePassword: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
+  - name: "ums-keycloak-extensions-smtp-opendesk-credentials"
+    stringData:
+      umcKeycloakExtensionsSmtpPassword: ""
+  - name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
+    stringData:
+      password: {{ .Values.secrets.nubus.ldapSearch.keycloak | quote }}
+  - name: "ums-portal-server-minio-opendesk-credentials"
+    stringData:
+      access-key-id: {{ .Values.objectstores.nubus.username | quote }}
+      secret-key-id: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
+  - name: "ums-umc-server-smtp-credentials-custom"
+    stringData:
+      password: ""
+  - name: "ums-provisioning-ox-credentials"
+    stringData:
+      ox-connector.json: "{ \"name\": \"ox-connector\", \"realms_topics\": [{\"realm\": \"udm\", \"topic\": \"oxmail/oxcontext\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/accessprofile\"}, {\"realm\": \"udm\", \"topic\": \"users/user\"}, {\"realm\": \"udm\", \"topic\": \"oxresources/oxresources\"}, {\"realm\": \"udm\", \"topic\": \"groups/group\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/functional_account\"}], \"request_prefill\": true, \"password\": \"{{ .Values.secrets.oxConnector.provisioningApiPassword }}\" }"

helmfile/apps/nubus/values-opendesk-customization.yaml.gotmpl

@@ -0,0 +1,722 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+keycloak:
+  enabled: true
+  ingress:
+    enabled: false
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: false
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsKeycloak | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-keycloak"
+  replicaCount: {{ .Values.replicas.keycloak }}
+  resources:
+    {{ .Values.resources.umsKeycloak | toYaml | nindent 4 }}
+
+nubusGuardian:
+  authorizationApi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-guardian-authorization-api"
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    replicaCount: {{ .Values.replicas.umsGuardianAuthorizationApi }}
+    resources:
+      {{ .Values.resources.umsGuardianAuthorizationApi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianAuthorizationApi | toYaml | nindent 8 }}
+  managementApi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-guardian-management-api"
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    replicaCount: {{ .Values.replicas.umsGuardianManagementApi }}
+    resources:
+      {{ .Values.resources.umsGuardianManagementApi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianManagementApi | toYaml | nindent 8 }}
+  managementUi:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-guardian-management-ui"
+    replicaCount: {{ .Values.replicas.umsGuardianManagementUi }}
+    resources:
+      {{ .Values.resources.umsGuardianManagementUi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsGuardianManagementUi | toYaml | nindent 8 }}
+  openPolicyAgent:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    podSecurityContext:
+      fsGroup: 1000
+      fsGroupChangePolicy: "Always"
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-ums-open-policy-agent"
+    replicaCount: {{ .Values.replicas.umsGuardianOpenPolicyAgent }}
+    resources:
+      {{ .Values.resources.umsOpenPolicyAgent | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsGuardianOpenPolicyAgent | toYaml | nindent 8 }}
+  provisioning:
+    # Using openDesk keycloak provisioning
+    enabled: false
+
+nubusNotificationsApi:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-notifications-api"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsNotificationsApi | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    create: true
+  replicaCount: {{ .Values.replicas.umsNotificationsApi }}
+  resources:
+    {{ .Values.resources.umsNotificationsApi | toYaml | nindent 4 }}
+
+nubusUmcServer:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-umc-server"
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  containerSecurityContextInit:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  containerSecurityContextSssd:
+    enabled: true
+    allowPrivilegeEscalation: true
+    capabilities:
+      drop:
+        - "ALL"
+      add:
+        - "DAC_OVERRIDE"
+        - "SETGID"
+        - "AUDIT_WRITE"
+        - "SETUID"
+        - "CHOWN"
+        - "SETPCAP"
+        - "FOWNER"
+        - "FSETID"
+        - "KILL"
+        - "MKNOD"
+        - "NET_BIND_SERVICE"
+        - "SYS_CHROOT"
+    runAsUser: 0
+    runAsGroup: 0
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: false
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  proxy:
+    replicaCount: {{ .Values.replicas.umsUmcServerProxy }}
+  replicaCount: {{ .Values.replicas.umsUmcServer }}
+
+  resources:
+    {{ .Values.resources.umsUmcServer | toYaml | nindent 4 }}
+  selfService:
+    passwordresetEmailBody: |
+        Sehr geehrte Benutzerin, sehr geehrter Benutzer,
+
+        Ihr Benutzername für {domainname} lautet: {username}
+
+        Sie erhalten diese Nachricht, da Sie Ihr Passwort zurücksetzen möchten oder weil Ihr Benutzer neu im System angelegt wurde.
+
+        Klicken Sie bitte auf den folgenden Link, um Ihr Passwort zu setzen:
+        https://{fqdn}/univention/portal/#/selfservice/newpassword/?token={token}&username={username}
+
+        Der genannte Link ist nur 48 Stunden gültig, danach fordern Sie ihn bitte erneut an unter:
+        https://{fqdn}/univention/portal/#/selfservice/passwordforgotten
+
+        Mit freundlichen Grüßen
+        Ihr {domainname} Passwort-Service
+
+nubusKeycloakExtensions:
+  enabled: true
+  handler:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    replicaCount: {{ .Values.replicas.umsKeycloakExtensionsHandler }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-keycloak-extensions-handler"
+    resources:
+      {{ .Values.resources.umsKeycloakExtensionHandler | toYaml | nindent 6 }}
+    securityContext:
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler | toYaml | nindent 8 }}
+  proxy:
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    replicaCount: {{ .Values.replicas.umsKeycloakExtensionsProxy }}
+    podAnnotations:
+      intents.otterize.com/service-name: "ums-keycloak-extensions-proxy"
+    resources:
+      {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 6 }}
+    securityContext:
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler | toYaml | nindent 8 }}
+
+nubusPortalConsumer:
+  portalConsumer:
+    image:
+      pullSecrets:
+        {{- range .Values.global.imagePullSecrets }}
+        - name: {{ . | quote }}
+        {{- end }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-portal-consumer"
+  replicaCount: {{ .Values.replicas.umsPortalConsumer }}
+  resources:
+    {{ .Values.resources.umsPortalConsumer | toYaml | nindent 4 }}
+  resourcesWaitForDependency:
+    {{ .Values.resources.umsPortalConsumerDependencies | toYaml | nindent 4 }}
+  persistence:
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.portalConsumer | quote }}
+  securityContext:
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalConsumer | toYaml | nindent 6 }}
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+          - key: "ca.crt"
+            path: "cacert.pem"
+  extraVolumeMounts:
+    - name: "trusted-cert-secret-volume"
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+  waitForDependency:
+    extraVolumeMounts:
+      - name: "trusted-cert-secret-volume"
+        readOnly: true
+        mountPath: "/etc/ssl/certs/ca-certificates.crt"
+        subPath: "ca-certificates.crt"
+      - name: "trusted-cert-secret-volume"
+        readOnly: true
+        mountPath: "/usr/local/lib/python3.7/dist-packages/certifi/cacert.pem"
+        subPath: "cacert.pem"
+    extraEnvVars:
+      - name: "REQUESTS_CA_BUNDLE"
+        value: "/etc/ssl/certs/ca-certificates.crt"
+      - name: "DEFAULT_CA_BUNDLE_PATH"
+        value: "/etc/ssl/certs/ca-certificates.crt"
+      - name: "SSL_CERT_FILE"
+        value: "/etc/ssl/certs/ca-certificates.crt"
+  {{- end }}
+
+nubusUdmListener:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 102
+    runAsGroup: 65534
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUdmListener | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUdmListener }}
+  resources:
+    {{ .Values.resources.umsUdmListener | toYaml | nindent 4 }}
+
+nubusPortalServer:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-portal-server"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalServer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    create: true
+  replicaCount: {{ .Values.replicas.umsPortalServer }}
+  resources:
+    {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
+  {{- if .Values.certificate.selfSigned }}
+  extraVolumes:
+    - name: "trusted-cert-crt-secret-volume"
+      secret:
+        secretName: "opendesk-certificates-ca-tls"
+        items:
+          - key: "ca.crt"
+            path: "ca-certificates.crt"
+          - key: "ca.crt"
+            path: "cacert.pem"
+  extraVolumeMounts:
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/etc/ssl/certs/ca-certificates.crt"
+      subPath: "ca-certificates.crt"
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/usr/local/lib/python3.7/dist-packages/certifi/cacert.pem"
+      subPath: "cacert.pem"
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/usr/lib/python3/dist-packages/botocore/cacert.pem"
+      subPath: "cacert.pem"
+    - name: "trusted-cert-crt-secret-volume"
+      readOnly: true
+      mountPath: "/usr/lib/python3/dist-packages/certifi/cacert.pem"
+      subPath: "cacert.pem"
+  {{- end }}
+
+nubusLdapNotifier:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 101
+    runAsGroup: 102
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsLdapNotifier | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-ldap-notifier"
+  replicaCount: {{ .Values.replicas.umsLdapNotifier }}
+  resources:
+    {{ .Values.resources.umsLdapNotifier | toYaml | nindent 4 }}
+
+nubusLdapServer:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  highAvailabilityMode: false
+  replicaCountPrimary: 1
+  replicaCountSecondary: 0 # {{ .Values.replicas.umsLdapServerSecondary }}
+  replicaCountProxy: 0 # {{ .Values.replicas.umsLdapServerProxy }}
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-ldap-server"
+  serviceAccount:
+    create: true
+  initResources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
+  resources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
+  persistence:
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.ldapServerData | quote }}
+  extraVolumes:
+    - name: "migration-scripts"
+      secret:
+        secretName: "ums-ldap-server-migration"
+        defaultMode: 0555
+  extraVolumeMounts:
+    - name: "migration-scripts"
+      mountPath: "/entrypoint.d/30-purge.sh"
+      subPath: "30-purge.sh"
+    - name: "migration-scripts"
+      mountPath: "/entrypoint.d/95-slapadd-24-ldiff.sh"
+      subPath: "95-slapadd-24-ldif.sh"
+  extraSecrets:
+    - name: "ums-ldap-server-migration"
+      stringData:
+        30-purge.sh: |
+          #!/usr/bin/env bash
+          me=$(basename "$0")
+          echo "- Running ${me}"
+          if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
+            echo "- Cleaning up /var/lib/univention-ldap."
+            cd /var/lib/univention-ldap
+            rm -rf internal
+            rm -rf ldap
+            ls -l
+          else
+            echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
+          fi
+        95-slapadd-24-ldif.sh: |
+          #!/usr/bin/env bash
+          me=$(basename "$0")
+          echo "- Running ${me}"
+          ls -l /var/lib/univention-ldap
+          if [ -f /var/lib/univention-ldap/ldap-24-export.ldif ]; then
+            echo "- slapadd-ing /var/lib/univention-ldap/ldap-24-export.ldif"
+            ls -l /var/lib/univention-ldap/
+            rm -rf /var/lib/univention-ldap/ldap
+            rm -rf /var/lib/univention-ldap/internal
+            echo "- deleted /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
+            ls -l /var/lib/univention-ldap/
+            mkdir /var/lib/univention-ldap/ldap
+            mkdir /var/lib/univention-ldap/internal
+            echo "- created /var/lib/univention-ldap/ldap and /var/lib/univention-ldap/internal"
+            ls -l /var/lib/univention-ldap/
+            /usr/sbin/slapadd -v -l /var/lib/univention-ldap/ldap-24-export.ldif
+            echo "- slapadd executed"
+            ls -l /var/lib/univention-ldap/
+            mv /var/lib/univention-ldap/ldap-24-export.ldif /var/lib/univention-ldap/ldap-24-export.ldif-imported
+            echo "- import file renamed"
+            ls -l /var/lib/univention-ldap/
+          else
+            echo "- File /var/lib/univention-ldap/ldap-24-export.ldif not found."
+          fi
+nubusPortalFrontend:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-portal-frontend"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsPortalFrontend | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    create: true
+  replicaCount: {{ .Values.replicas.umsPortalFrontend }}
+  resources:
+    {{ .Values.resources.umsPortalFrontend | toYaml | nindent 4 }}
+  portalFrontend:
+    branding:
+      css: {{ .Values.theme.styles.portalCss | toJson }}
+      # Requires .ico, .svg does not work.
+      favicon: {{ .Values.theme.imagery.faviconIcoB64 | toJson }}
+      # The actual `logo` is set in customizing image, the logo down here is for for waiting spinner.
+      logo: {{ .Values.theme.imagery.portalWaitingSpinnerSvgB64 | toJson }}
+      backgroundImage: {{ .Values.theme.imagery.portalLogoBackgroundSvgB64 | toJson }}
+
+nubusStackDataUms:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsStackDataUms | toYaml | nindent 6 }}
+  pullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-stack-data-ums"
+  resources:
+    {{ .Values.resources.umsStackDataUms | toYaml | nindent 4 }}
+
+nubusSelfServiceConsumer:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsSelfserviceConsumer | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-selfservice-listener"
+  resources:
+    {{ .Values.resources.umsSelfserviceConsumer | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsSelfserviceConsumer }}
+
+nubusUdmRestApi:
+  additionalAnnotations:
+    intents.otterize.com/service-name: "ums-udm-rest-api"
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUdmRestApi | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  serviceAccount:
+    annotations:
+      intended.usage: "compliance"
+  resources:
+    {{ .Values.resources.umsUdmRestApi | toYaml | nindent 4 }}
+  initResources:
+    {{ .Values.resources.umsUdmRestApiInit | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUdmRestApi }}
+
+nubusUmcGateway:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsUmcGateway | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount: {{ .Values.replicas.umsUmcGateway }}
+  resources:
+    {{ .Values.resources.umsUmcGateway | toYaml | nindent 4 }}
+
+nubusKeycloakBootstrap:
+  containerSecurityContext:
+    enabled: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    readOnlyRootFilesystem: false
+    runAsGroup: 1000
+    runAsNonRoot: true
+    runAsUser: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsKeycloakBootstrap | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  podAnnotations:
+    intents.otterize.com/service-name: "ums-keycloak-bootstrap"
+  serviceAccount:
+    annotations:
+      intended.usage: "compliance"
+  resources:
+    {{ .Values.resources.umsKeycloakBootstrap | toYaml | nindent 4 }}
+
+nubusProvisioning:
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - "ALL"
+    enabled: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    seccompProfile:
+      type: "RuntimeDefault"
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    seLinuxOptions:
+      {{ .Values.seLinuxOptions.umsProvisioning | toYaml | nindent 6 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+  replicaCount:
+    dispatcher: {{ .Values.replicas.umsProvisioningDispatcher }}
+    udmTransformer: {{ .Values.replicas.umsProvisioningUdmTransformer }}
+    prefill: {{ .Values.replicas.umsProvisioningPrefill }}
+    api: {{ .Values.replicas.umsProvisioningApi }}
+
+  serviceAccount:
+    create: true
+  nats:
+    config:
+      cluster:
+        replicas: {{ .Values.replicas.umsProvisioningNats }}
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - "ALL"
+      enabled: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      seccompProfile:
+        type: "RuntimeDefault"
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.umsProvisioningNats | toYaml | nindent 8 }}
+    imagePullSecrets:
+      {{ .Values.global.imagePullSecrets | toYaml | nindent 6 }}
+    persistence:
+      size: {{ .Values.persistence.size.nubus.provisioningNats }}
+    resources:
+      {{ .Values.resources.umsProvisioningNats | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-nats"
+    serviceAccount:
+      create: true
+  api:
+    resources:
+      {{ .Values.resources.umsProvisioningApi | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-api"
+  dispatcher:
+    resources:
+      {{ .Values.resources.umsProvisioningDispatcher | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-dispatcher"
+  prefill:
+    resources:
+      {{ .Values.resources.umsProvisioningPrefill | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-prefill"
+  registerConsumers:
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-register-consumers"
+  udmTransformer:
+    resources:
+      {{ .Values.resources.umsProvisioningUdmTransformer | toYaml | nindent 6 }}
+    additionalAnnotations:
+      intents.otterize.com/service-name: "ums-provisioning-udm-transformer"
+  resources:
+    registerConsumers:
+      {{ .Values.resources.umsProvisioningRegisterConsumers | toYaml | nindent 6 }}

helmfile/apps/nubus/values-opendesk-images.yaml.gotmpl

@@ -0,0 +1,260 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+keycloak:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloak.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloak.repository }}
+    tag: {{ .Values.images.nubusKeycloak.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusKeycloakBootstrap:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakBootstrap.registry | quote }}
+    repository: {{ .Values.images.nubusKeycloakBootstrap.repository }}
+    tag: {{ .Values.images.nubusKeycloakBootstrap.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusKeycloakExtensions:
+    handler:
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionHandler.registry | quote }}
+        repository: {{ .Values.images.nubusKeycloakExtensionHandler.repository }}
+        tag: {{ .Values.images.nubusKeycloakExtensionHandler.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+    proxy:
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusKeycloakExtensionProxy.registry | quote }}
+        repository: {{ .Values.images.nubusKeycloakExtensionProxy.repository }}
+        tag: {{ .Values.images.nubusKeycloakExtensionProxy.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusLdapNotifier:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapNotifier.registry | quote }}
+    repository: {{ .Values.images.nubusLdapNotifier.repository }}
+    tag: {{ .Values.images.nubusLdapNotifier.tag }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusLdapServer:
+  ldapServer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServer.registry | quote }}
+      repository: {{ .Values.images.nubusLdapServer.repository }}
+      tag: {{ .Values.images.nubusLdapServer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  dhInitcontainer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusLdapServerDhInitContainer.registry | quote }}
+      repository: {{ .Values.images.nubusLdapServerDhInitContainer.repository }}
+      tag: {{ .Values.images.nubusLdapServerDhInitContainer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusNotificationsApi:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusNotificationsApi.registry | quote }}
+    repository: {{ .Values.images.nubusNotificationsApi.repository }}
+    tag: {{ .Values.images.nubusNotificationsApi.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalFrontend:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalFrontend.registry | quote }}
+    repository: {{ .Values.images.nubusPortalFrontend.repository }}
+    tag: {{ .Values.images.nubusPortalFrontend.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalConsumer:
+  portalConsumer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalConsumer.registry | quote }}
+      repository: {{ .Values.images.nubusPortalConsumer.repository }}
+      tag: {{ .Values.images.nubusPortalConsumer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusPortalServer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalServer.registry | quote }}
+    repository: {{ .Values.images.nubusPortalServer.repository }}
+    tag: {{ .Values.images.nubusPortalServer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusProvisioning:
+  api:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningEventsAndConsumerApi.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
+      tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  dispatcher:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningDispatcher.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningDispatcher.repository }}
+      tag: {{ .Values.images.nubusProvisioningDispatcher.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  udmTransformer:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningUdmTransformer.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningUdmTransformer.repository }}
+      tag: {{ .Values.images.nubusProvisioningUdmTransformer.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  prefill:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningPrefill.registry | quote }}
+      repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
+      tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  registerConsumers:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  nats:
+    nats:
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNats.registry | quote }}
+        repository: {{ .Values.images.nubusNats.repository }}
+        tag: {{ .Values.images.nubusNats.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    reloader:
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsReloader.registry | quote }}
+        repository: {{ .Values.images.nubusNatsReloader.repository }}
+        tag: {{ .Values.images.nubusNatsReloader.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    natsBox:
+      image:
+        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsBox.registry | quote }}
+        repository: {{ .Values.images.nubusNatsBox.repository }}
+        tag: {{ .Values.images.nubusNatsBox.tag }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusProvisioningEventsAndConsumerApi:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningEventsAndConsumerApi.registry | quote }}
+    repository: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.repository }}
+    tag: {{ .Values.images.nubusProvisioningEventsAndConsumerApi.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusProvisioningPrefill:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningPrefill.registry | quote }}
+    repository: {{ .Values.images.nubusProvisioningPrefill.repository }}
+    tag: {{ .Values.images.nubusProvisioningPrefill.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUdmListener:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusProvisioningUdmListener.registry | quote }}
+    repository: {{ .Values.images.nubusProvisioningUdmListener.repository }}
+    tag: {{ .Values.images.nubusProvisioningUdmListener.tag }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusSelfServiceConsumer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusSelfServiceConsumer.registry | quote }}
+    repository: {{ .Values.images.nubusSelfServiceConsumer.repository }}
+    tag: {{ .Values.images.nubusSelfServiceConsumer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  waitForDependency:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+      repository: {{ .Values.images.nubusWaitForDependency.repository }}
+      tag: {{ .Values.images.nubusWaitForDependency.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUdmRestApi:
+  udmRestApi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUdmRestApi.registry | quote }}
+      repository: {{ .Values.images.nubusUdmRestApi.repository }}
+      tag: {{ .Values.images.nubusUdmRestApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUmcGateway:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUmcGateway.registry | quote }}
+    repository: {{ .Values.images.nubusUmcGateway.repository }}
+    tag: {{ .Values.images.nubusUmcGateway.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusUmcServer:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusUmcServer.registry | quote }}
+    repository: {{ .Values.images.nubusUmcServer.repository }}
+    tag: {{ .Values.images.nubusUmcServer.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  proxy:
+    image:
+      registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusUmcServerProxy.registry | quote }}
+      repository: {{ .Values.images.nubusUmcServerProxy.repository }}
+      tag: {{ .Values.images.nubusUmcServerProxy.tag }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusWaitForDependency:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusWaitForDependency.registry | quote }}
+    repository: {{ .Values.images.nubusWaitForDependency.repository }}
+    tag: {{ .Values.images.nubusWaitForDependency.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+
+nubusGuardian:
+  provisioning:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianProvisioning.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianProvisioning.repository }}
+      tag: {{ .Values.images.nubusGuardianProvisioning.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  authorizationApi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianAuthorizationApi.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianAuthorizationApi.repository }}
+      tag: {{ .Values.images.nubusGuardianAuthorizationApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  managementApi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianManagementApi.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianManagementApi.repository }}
+      tag: {{ .Values.images.nubusGuardianManagementApi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  managementUi:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusGuardianManagementUi.registry | quote }}
+      repository: {{ .Values.images.nubusGuardianManagementUi.repository }}
+      tag: {{ .Values.images.nubusGuardianManagementUi.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+  openPolicyAgent:
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpenPolicyAgent.registry | quote }}
+      repository: {{ .Values.images.nubusOpenPolicyAgent.repository }}
+      tag: {{ .Values.images.nubusOpenPolicyAgent.tag }}
+      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+nubusStackDataUms:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusDataLoader.registry | quote }}
+    repository: {{ .Values.images.nubusDataLoader.repository }}
+    tag: {{ .Values.images.nubusDataLoader.tag }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl

@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
@@ -11,16 +11,24 @@ global:
     {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 
 image:
-  registry: {{ .Values.global.imageRegistry | default .Values.images.opendeskKeycloakBootstrap.registry | quote }}
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.opendeskKeycloakBootstrap.registry | quote }}
   repository: {{ .Values.images.opendeskKeycloakBootstrap.repository | quote }}
   tag: {{ .Values.images.opendeskKeycloakBootstrap.tag | quote }}
   imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 
 cleanup:
-  deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
+  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
-  keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
+  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 
 config:
+  custom:
+    clientScopes:
+      {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
+    clients:
+      {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
+  managed:
+    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
+    clients: [ 'opendesk-intercom', 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
   keycloak:
     adminUser: "kcadmin"
     adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
@@ -28,13 +36,20 @@ config:
     intraCluster:
       enabled: true
       internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
-  custom:
+  twoFactorSettings:
+    additionalGroups: {{ .Values.functional.authentication.twoFactor.groups }}
+  opendesk:
+    # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
+    # to LDAP group membership to ensure a user cannot access an application without the required
+    # group membership.
+    # ToDo: Ensure all applications verify the token's signature to ensure it is not tampered.
     clientScopes:
       - name: "read_contacts"
         protocol: "openid-connect"
       - name: "write_contacts"
         protocol: "openid-connect"
-      - name: "opendesk"
+      - name: "opendesk-openproject-scope"
+        description: "Scope for the claims required by openDesk's OpenProject instance."
         protocol: "openid-connect"
         protocolMappers:
           - name: "opendesk_useruuid"
@@ -59,6 +74,306 @@ config:
               access.token.claim: true
               claim.name: "opendesk_username"
               jsonType.label: "String"
+          - name: "opendeskProjectmanagementAdmin"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "opendeskProjectmanagementAdmin"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "openproject_admin"
+              jsonType.label: "String"
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+          - name: "given name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "firstName"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "given_name"
+              jsonType.label: "String"
+          - name: "family name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "lastName"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "family_name"
+              jsonType.label: "String"
+      - name: "opendesk-jitsi-scope"
+        description: "Scope for the claims required by openDesk's Jitsi instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+          - name: "full name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-full-name-mapper"
+            consentRequired: false
+            config:
+              id.token.claim: true
+              introspection.token.claim: true
+              access.token.claim: true
+              userinfo.token.claim: true
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+      - name: "opendesk-nextcloud-scope"
+        description: "Scope for the claims required by openDesk's Nextcloud instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+          - name: "context"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "oxContextIDNum"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "context"
+              jsonType.label: "String"
+      - name: "opendesk-matrix-scope"
+        description: "Scope for the claims required by openDesk's Matrix instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+          - name: "full name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-full-name-mapper"
+            consentRequired: false
+            config:
+              id.token.claim: true
+              introspection.token.claim: true
+              access.token.claim: true
+              userinfo.token.claim: true
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+      - name: "opendesk-xwiki-scope"
+        description: "Scope for the claims required by openDesk's XWiki instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+          - name: "full name"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-full-name-mapper"
+            consentRequired: false
+            config:
+              id.token.claim: true
+              introspection.token.claim: true
+              access.token.claim: true
+              userinfo.token.claim: true
+          - name: "email"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              introspection.token.claim: true
+              userinfo.token.claim: true
+              user.attribute: "email"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "email"
+              jsonType.label: "String"
+      - name: "opendesk-dovecot-scope"
+        description: "Scope for the claims required by openDesk's Dovecot instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
+      - name: "opendesk-oxappsuite-scope"
+        description: "Scope for the claims required by openDesk's OX Appuite instance."
+        protocol: "openid-connect"
+        protocolMappers:
+          - name: "context"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "oxContextIDNum"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "context"
+              jsonType.label: "String"
+          - name: "opendesk_useruuid"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "entryUUID"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_useruuid"
+              jsonType.label: "String"
+          - name: "opendesk_username"
+            protocol: "openid-connect"
+            protocolMapper: "oidc-usermodel-attribute-mapper"
+            consentRequired: false
+            config:
+              userinfo.token.claim: true
+              user.attribute: "uid"
+              id.token.claim: true
+              access.token.claim: true
+              claim.name: "opendesk_username"
+              jsonType.label: "String"
     clients:
       - name: "opendesk-dovecot"
         clientId: "opendesk-dovecot"
@@ -72,62 +387,7 @@ config:
         attributes:
           backchannel.logout.session.required: false
         defaultClientScopes:
-          - "opendesk"
+          - "opendesk-dovecot-scope"
-      - name: "opendesk-intercom"
-        clientId: "opendesk-intercom"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.intercom | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/callback"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.revoke.offline.tokens: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
-        protocolMappers:
-          - name: "intercom-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "opendesk-intercom"
-              id.token.claim: false
-              access.token.claim: true
-          # temporary additional claim while entryuuid is a hardcoded attribute in IntercomService and we cannot set
-          # it to `opendesk_useruuid` standard claim. For reference:
-          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/app.js#L89
-          - name: "entryuuid_temp"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "entryUUID"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "entryuuid"
-              jsonType.label: "String"
-          # temporary additional claim while phoenixusername is a hardcoded attribute in IntercomService and we cannot
-          # set it to `opendesk_username` standard claim. For reference:
-          # https://github.com/univention/intercom-service/blob/cd819b6ced6433e532e74a8878943d05412c1416/intercom/routes/navigation.js#L27
-          - name: "phoenixusername_temp"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "phoenixusername"
-              jsonType.label: "String"
-        defaultClientScopes:
-          - "opendesk"
-          - "offline_access"
       - name: "opendesk-jitsi"
         clientId: "opendesk-jitsi"
         protocol: "openid-connect"
@@ -140,8 +400,7 @@ config:
         fullScopeAllowed: true
         authorizationServicesEnabled: false
         defaultClientScopes:
-          - "opendesk"
+          - "opendesk-jitsi-scope"
-          - "profile"
       - name: "opendesk-matrix"
         clientId: "opendesk-matrix"
         protocol: "openid-connect"
@@ -150,7 +409,7 @@ config:
         redirectUris:
           - "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*"
           - "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         standardFlowEnabled: true
         directAccessGrantsEnabled: true
         serviceAccountsEnabled: true
@@ -161,26 +420,9 @@ config:
         attributes:
           backchannel.logout.session.required: true
           backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
-          - "opendesk"
+          - "opendesk-matrix-scope"
-        optionalClientScopes:
-          - "email"
-          - "profile"
-        # This is a temporary OIDC client for matrix, as the OIDC logout still uses "matrix" as client ID. Unless that
-        # is solved and also is able to use "opendesk-matrix" we keep that dummy client that
-      - name: "matrix"
-        clientId: "matrix"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        standardFlowEnabled: true
-        directAccessGrantsEnabled: true
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
       - name: "opendesk-nextcloud"
         clientId: "opendesk-nextcloud"
         protocol: "openid-connect"
@@ -188,30 +430,17 @@ config:
         secret: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
         redirectUris:
           - "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         consentRequired: false
         frontchannelLogout: false
         publicClient: false
         authorizationServicesEnabled: false
         attributes:
           backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/index.php/apps/user_oidc/backchannel-logout/opendesk"
+          backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/user_oidc/backchannel-logout/opendesk"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        protocolMappers:
-          - name: "context"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "oxContextIDNum"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "context"
-              jsonType.label: "String"
         defaultClientScopes:
-          - "opendesk"
+          - "opendesk-nextcloud-scope"
-          - "email"
           - "read_contacts"
           - "write_contacts"
       - name: "opendesk-openproject"
@@ -221,7 +450,7 @@ config:
         secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
         redirectUris:
           - "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         consentRequired: false
         frontchannelLogout: false
         publicClient: false
@@ -230,53 +459,27 @@ config:
         attributes:
           backchannel.logout.session.required: true
           backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        protocolMappers:
-          - name: "opendeskProjectmanagementAdmin"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "opendeskProjectmanagementAdmin"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "openproject_admin"
-              jsonType.label: "String"
         defaultClientScopes:
-          - "opendesk"
+          - "opendesk-openproject-scope"
-          - "email"
-          - "profile"
       - name: "opendesk-oxappsuite"
         clientId: "opendesk-oxappsuite"
         protocol: "openid-connect"
         clientAuthenticatorType: "client-secret"
         secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
         redirectUris:
-          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/*"
+          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         consentRequired: false
         frontchannelLogout: false
         publicClient: false
         authorizationServicesEnabled: false
         attributes:
           backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/ajax/oidc/backchannel_logout"
+          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        protocolMappers:
-          - name: "context"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "oxContextIDNum"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "context"
-              jsonType.label: "String"
         defaultClientScopes:
-          - "opendesk"
+          - "opendesk-oxappsuite-scope"
           - "read_contacts"
           - "write_contacts"
       - name: "opendesk-xwiki"
@@ -286,303 +489,17 @@ config:
         secret: {{ .Values.secrets.keycloak.clientSecret.xwiki | quote }}
         redirectUris:
           - "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         consentRequired: false
         frontchannelLogout: false
         publicClient: false
         authorizationServicesEnabled: false
         attributes:
           backchannel.logout.session.required: false
-          backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/NOT_YET_IMPLEMENTED_DONT_FORGET_TO_DISABLE_FCL_WHEN_BCL_IS_ACTIVATED/backchannel-logout"
+          backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/oidc/authenticator/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
         defaultClientScopes:
-          - "opendesk"
+          - "opendesk-xwiki-scope"
-          - "address"
-          - "email"
-          - "profile"
-      - name: "guardian-management-api"
-        clientId: "guardian-management-api"
-        rootUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
-        fullScopeAllowed: true
-        protocolMappers:
-          - name: "Client Host"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usersessionmodel-note-mapper"
-            consentRequired: false
-            config:
-              user.session.note: "clientHost"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "clientHost"
-              jsonType.label: "String"
-          - name: "Client ID"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usersessionmodel-note-mapper"
-            consentRequired: false
-            config:
-              user.session.note: "client_id"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "client_id"
-              jsonType.label: "String"
-          - name: "guardian-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              userinfo.token.claim: false
-              id.token.claim: false
-              access.token.claim: true
-          - name: "audiencemap"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian-cli"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-          - name: "dn"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: false
-              user.attribute: "LDAP_ENTRY_DN"
-              id.token.claim: false
-              access.token.claim: true
-              claim.name: "dn"
-              jsonType.label: "String"
-          - name: "username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "username"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "preferred_username"
-              jsonType.label: "String"
-          - name: "uid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "uid"
-              jsonType.label: "String"
-          - name: "email"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "email"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "email"
-              jsonType.label: "String"
-          - name: "Client IP Address"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usersessionmodel-note-mapper"
-            consentRequired: false
-            config:
-              user.session.note: "clientAddress"
-              userinfo.token.claim: true
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "clientAddress"
-              jsonType.label: "String"
-      - name: "guardian-scripts"
-        clientId: "guardian-scripts"
-        description: ""
-        rootUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-        adminUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-        surrogateAuthRequired: false
-        enabled: true
-        alwaysDisplayInConsole: false
-        clientAuthenticatorType: "client-secret"
-        redirectUris:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
-        webOrigins:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
-        bearerOnly: false
-        consentRequired: false
-        standardFlowEnabled: true
-        implicitFlowEnabled: false
-        directAccessGrantsEnabled: true
-        serviceAccountsEnabled: false
-        publicClient: true
-        frontchannelLogout: false
-        protocol: "openid-connect"
-        fullScopeAllowed: true
-        protocolMappers:
-          - name: "email"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "email"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "email"
-              jsonType.label: "String"
-          - name: "guardian-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              id.token.claim: false
-              access.token.claim: true
-              userinfo.token.claim: false
-          - name: "username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "username"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "preferred_username"
-              jsonType.label: "String"
-          - name: "uid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "uid"
-              jsonType.label: "String"
-          - name: "audiencemap"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian-scripts"
-              id.token.claim: true
-              access.token.claim: true
-              userinfo.token.claim: true
-          - name: "dn"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              aggregate.attrs: false
-              multivalued: false
-              userinfo.token.claim: false
-              user.attribute: "LDAP_ENTRY_DN"
-              id.token.claim: false
-              access.token.claim: true
-              claim.name: "dn"
-              jsonType.label: "String"
-        defaultClientScopes:
-          - "opendesk"
-          - "web-origins"
-          - "acr"
-          - "roles"
-          - "profile"
-          - "email"
-        optionalClientScopes:
-          - "address"
-          - "phone"
-          - "offline_access"
-          - "microprofile-jwt"
-      - name: "guardian-ui"
-        clientId: "guardian-ui"
-        rootUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-        baseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
-        clientAuthenticatorType: "client-secret"
-        redirectUris:
-          - "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
-        standardFlowEnabled: true
-        publicClient: true
-        protocol: "openid-connect"
-        fullScopeAllowed: true
-        protocolMappers:
-          - name: "uid"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "uid"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "uid"
-              jsonType.label: "String"
-          - name: "username"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "username"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "preferred_username"
-              jsonType.label: "String"
-          - name: "dn"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-attribute-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: "false"
-              user.attribute: "LDAP_ENTRY_DN"
-              id.token.claim: false
-              access.token.claim: true
-              claim.name: "dn"
-              jsonType.label: "String"
-          - name: "audiencemap"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian-ui"
-              id.token.claim: true
-              access.token.claim: true
-              userinfo.token.claim: true
-          - name: "email"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-usermodel-property-mapper"
-            consentRequired: false
-            config:
-              userinfo.token.claim: true
-              user.attribute: "email"
-              id.token.claim: true
-              access.token.claim: true
-              claim.name: "email"
-              jsonType.label: "String"
-          - name: "guardian-audience"
-            protocol: "openid-connect"
-            protocolMapper: "oidc-audience-mapper"
-            consentRequired: false
-            config:
-              included.client.audience: "guardian"
-              id.token.claim: false
-              access.token.claim: true
-              userinfo.token.claim: false
 
 containerSecurityContext:
   allowPrivilegeEscalation: false
@@ -597,7 +514,12 @@ containerSecurityContext:
     type: "RuntimeDefault"
   readOnlyRootFilesystem: true
   runAsNonRoot: true
-  seLinuxOptions: {{ .Values.seLinuxOptions.opendeskKeycloakBootstrap }}
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.opendeskKeycloakBootstrap | toYaml | nindent 4 }}
+
+additionalAnnotations:
+    argocd.argoproj.io/hook: "Sync"
+    argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
 
 podAnnotations:
   intents.otterize.com/service-name: "ums-keycloak-bootstrap"
@@ -610,4 +532,18 @@ podSecurityContext:
 resources:
   {{ .Values.resources.opendeskKeycloakBootstrap | toYaml | nindent 2 }}
 
+{{- if .Values.certificate.selfSigned }}
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+
 ...

helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl

@@ -0,0 +1,92 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+repositories:
+  # openDesk Dovecot
+  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dovecot
+  - name: "dovecot-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.dovecot.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+
+  # Open-Xchange
+  - name: "open-xchange-repo"
+    keyring: "../../files/gpg-pubkeys/open-xchange-com.gpg"
+    verify: {{ .Values.charts.oxAppSuite.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+
+  # openDesk Open-Xchange Bootstrap
+  # Source:
+  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-open-xchange-bootstrap
+  - name: "open-xchange-bootstrap-repo"
+    keyring: "../../files/gpg-pubkeys/opencode.gpg"
+    verify: {{ .Values.charts.oxAppSuiteBootstrap.verify }}
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
+
+  # OX Connector
+  - name: "ox-connector-repo"
+    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    oci: true
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
+
+releases:
+  - name: "dovecot"
+    chart: "dovecot-repo/{{ .Values.charts.dovecot.name }}"
+    version: "{{ .Values.charts.dovecot.version }}"
+    values:
+      - "values-dovecot.yaml.gotmpl"
+      {{ range .Values.customization.release.dovecot }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.dovecot.enabled }}
+    timeout: 900
+
+  - name: "open-xchange"
+    chart: "open-xchange-repo/{{ .Values.charts.oxAppSuite.name }}"
+    version: "{{ .Values.charts.oxAppSuite.version }}"
+    values:
+      - "values-openxchange.yaml.gotmpl"
+      - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
+      {{ range .Values.customization.release.openxchange }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
+    timeout: 900
+
+  - name: "opendesk-open-xchange-bootstrap"
+    chart: "open-xchange-bootstrap-repo/{{ .Values.charts.oxAppSuiteBootstrap.name }}"
+    version: "{{ .Values.charts.oxAppSuiteBootstrap.version }}"
+    values:
+      - "values-openxchange-bootstrap.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskOpenxchangeBootstrap }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
+    timeout: 900
+
+  - name: "ox-connector"
+    chart: "ox-connector-repo/{{ .Values.charts.oxConnector.name }}"
+    version: "{{ .Values.charts.oxConnector.version }}"
+    values:
+      - "values-oxconnector.yaml.gotmpl"
+      {{ range .Values.customization.release.oxConnector }}
+      - {{ . }}
+      {{ end }}
+    installed: {{ .Values.oxAppSuite.enabled }}
+    needs:
+      - "open-xchange"
+
+commonLabels:
+  deployStage: "050-components"
+  component: "open-xchange"
+...

helmfile/apps/open-xchange/helmfile.yaml

@@ -1,65 +0,0 @@
-# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
-# SPDX-License-Identifier: Apache-2.0
----
-bases:
-  - "../../bases/environments.yaml"
----
-repositories:
-  # openDesk Dovecot
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-dovecot
-  - name: "dovecot-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.dovecot.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
-
-  # Open-Xchange
-  - name: "open-xchange-repo"
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
-
-  # openDesk Open-Xchange Bootstrap
-  # Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-open-xchange-bootstrap
-  - name: "open-xchange-bootstrap-repo"
-    keyring: "../../files/gpg-pubkeys/opencode.gpg"
-    verify: {{ .Values.charts.openXchangeAppSuiteBootstrap.verify }}
-    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
-    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
-      {{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
-
-releases:
-  - name: "dovecot"
-    chart: "dovecot-repo/{{ .Values.charts.dovecot.name }}"
-    version: "{{ .Values.charts.dovecot.version }}"
-    values:
-      - "values-dovecot.yaml.gotmpl"
-    installed: {{ .Values.dovecot.enabled }}
-    timeout: 900
-
-  - name: "open-xchange"
-    chart: "open-xchange-repo/{{ .Values.charts.openXchangeAppSuite.name }}"
-    version: "{{ .Values.charts.openXchangeAppSuite.version }}"
-    values:
-      - "values-openxchange.yaml.gotmpl"
-      - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
-    installed: {{ .Values.oxAppsuite.enabled }}
-    timeout: 900
-
-  - name: "opendesk-open-xchange-bootstrap"
-    chart: "open-xchange-bootstrap-repo/{{ .Values.charts.openXchangeAppSuiteBootstrap.name }}"
-    version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
-    values:
-      - "values-openxchange-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.oxAppsuite.enabled }}
-    timeout: 900
-
-commonLabels:
-  deploy-stage: "component-1"
-  component: "open-xchange"
-...

helmfile/apps/open-xchange/helmfile.yaml.gotmpl

@@ -0,0 +1,12 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+bases:
+  - "../../bases/environments.yaml"
+---
+helmfiles:
+  - path: "./helmfile-child.yaml.gotmpl"
+    values:
+      - {{ toYaml .Values | nindent 8 }}
+...