fix(openproject): New functional setting for guest login (see authentication.openProject.guestAccess.enabled in functional.yaml) and bump Helm chart to 5.2.0.

.gitignore

@@ -5,8 +5,8 @@
 .yamllint
 
 # Ignore changes to sample environments
-helmfile/environments/dev/values.yaml.gotmpl
-helmfile/environments/prod/values.yaml.gotmpl
+helmfile/environments/dev/*.yaml.gotmpl
+helmfile/environments/prod/*.yaml.gotmpl
 
 # Ignore in CI generated files
 .kyverno/opendesk.yaml
@@ -14,3 +14,10 @@ helmfile/environments/prod/values.yaml.gotmpl
 
 # Ignore editor backup files
 *~
+
+# Ignore ./log directory and *.log files
+logs
+*.log
+
+# Ignore backup files, e.g. created by the script that eases the local chart development
+*.bak

README.md

@@ -38,7 +38,7 @@ openDesk currently features the following functional main components:
 | Portal & IAM         | Nubus                       | Product Preview[^1]                                                                                            | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html)                                                    |
 | Project management   | OpenProject                 | [14.1.1](https://www.openproject.org/docs/release-notes/14-1-1/)                                               | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                                  |
 | Videoconferencing    | Jitsi                       | [2.0.9457](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9457)                          | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                                   |
-| Weboffice            | Collabora                   | [24.04.3.1.1](https://www.collaboraoffice.com/collabora-online-24-04-release-notes/)                           | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
+| Weboffice            | Collabora                   | [24.04.4.1.1](https://www.collaboraoffice.com/collabora-online-24-04-release-notes/)                           | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)               |
 
 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.

cspell.json

@@ -60,7 +60,14 @@
         "Nordeck",
         "Nubus",
         "Souveräne",
-        "Arbeitsplatz"
+        "Arbeitsplatz",
+        "commandline",
+        "helmfiles",
+        "SMTPS",
+        "IMAPS",
+        "xwiki",
+        "cryptpad",
+        "clamav"
     ],
     "ignoreWords": [],
     "import": []

dev/README.md

@@ -0,0 +1,35 @@
+<!--
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>Tools for local development<h1>
+
+* [charts-local.py](#charts-localpy)
+  * [Commandline parameter](#commandline-parameter)
+    * [`--branch`](#--branch)
+    * [`--revert`](#--revert)
+
+# charts-local.py
+
+This script helps you on cloning the platform development Helm charts and referencing them directly in the openDesk
+Helmfile deployment for comfortable local development and deployment. The charts will be cloned into a directory
+parallel to the `opendesk` repo that is named after the branch you are working in the `opendesk` repo with.
+
+The script will create `.bak` copies of the helmfiles that have been touched.
+
+Run the script with `-h` to get information about the script's parameter on commandline.
+
+## Commandline parameter
+
+### `--branch`
+
+Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
+does not exist yet. Otherwise it will switch to defined branch.
+
+If parameter is omitted the current branch of the `opendesk` repo will be used.
+
+### `--revert`
+
+Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
+scripts itself back to their original location.

dev/charts-local.py

@@ -0,0 +1,176 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+
+import os.path
+import logging
+import yaml
+import sys
+import shutil
+import re
+import configargparse
+
+from pathlib import Path
+from git import Repo
+
+p = configargparse.ArgParser()
+p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work with. Will be created by the script if it does not exist yet.')
+p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
+p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
+p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
+options = p.parse_args()
+
+script_path = os.path.dirname(os.path.realpath(__file__))
+# some static definitions
+log_path = script_path+'/../logs'
+charts_yaml = script_path+'/../helmfile/environments/default/charts.yaml'
+base_repo_path = script_path+'/..'
+base_helmfile = base_repo_path+'/helmfile_generic.yaml'
+helmfile_backup_extension = '.bak'
+
+Path(log_path).mkdir(parents=True, exist_ok=True)
+
+logFormatter = logging.Formatter("%(asctime)s %(levelname)-5.5s %(message)s")
+rootLogger = logging.getLogger()
+rootLogger.setLevel(options.loglevel)
+
+fileHandler = logging.FileHandler("{0}/{1}.log".format(log_path, os.path.basename(__file__)))
+fileHandler.setFormatter(logFormatter)
+rootLogger.addHandler(fileHandler)
+
+consoleHandler = logging.StreamHandler()
+consoleHandler.setFormatter(logFormatter)
+rootLogger.addHandler(consoleHandler)
+
+logging.debug(f"Working with relative paths from script location: {script_path}")
+logging.debug(f"Log directory: {log_path}")
+logging.debug(f"charts.yaml  : {charts_yaml}")
+
+
+def create_or_switch_branch_base_repo():
+    base_repo = Repo(path=base_repo_path)
+    current_branch = base_repo.active_branch.name
+    if not options.branch:
+        branch = current_branch
+        logging.debug(f"No branch specified on commandline, working with current branch: {current_branch}")
+    else:
+        branch = options.branch
+        if branch in base_repo.branches:
+            if branch != current_branch:
+                logging.debug(f"Selected {branch} already exists, switching.")
+                # ToDo: Graceful handle: "Please commit your changes or stash them before you switch branches."
+                base_repo.git.switch(branch)
+            else:
+                logging.debug(f"Already on selected brach {branch}")
+        else:
+            logging.debug(f"Creating branch {branch} and switching")
+            base_repo.git.branch(branch)
+            base_repo.git.switch(branch)
+    return branch
+
+
+def clone_charts_locally(branch):
+    charts_clone_path = script_path+'/../../'+branch.replace('/', '_')
+    charts_dict = {}
+    remote_dict = {}
+    if os.path.isdir(charts_clone_path):
+        logging.warning(f"Path {charts_clone_path} already exists, will not clone any charts.")
+    else:
+        logging.debug(f"creating directory {charts_clone_path} to clone charts into")
+        Path(charts_clone_path).mkdir(parents=True, exist_ok=True)
+
+    with open(charts_yaml, 'r') as file:
+        charts = yaml.safe_load(file)
+    for chart in charts['charts']:
+        if 'opendesk/components/platform-development/charts' in charts['charts'][chart]['repository']:
+            tag = charts['charts'][chart]['version']
+            logging.debug(f"Working on {chart} / tag {tag}")
+            repository = charts['charts'][chart]['repository']
+            git_url = options.git_hostname+':'+repository
+            chart_repo_path = charts_clone_path+'/'+charts['charts'][chart]['name']
+            if git_url in remote_dict:
+                logging.debug(f"{chart} located at {git_url} is already checked out to {remote_dict[git_url]}")
+                charts_dict[chart] = remote_dict[git_url]
+            else:
+                if os.path.isdir(chart_repo_path):
+                    logging.debug(f"Already exists {chart_repo_path} leaving it unmodified")
+                else:
+                    logging.debug(f"Cloning into {chart_repo_path}")
+                    Repo.clone_from(git_url, chart_repo_path)
+                    chart_repo = Repo(path=chart_repo_path)
+                    chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
+                charts_dict[chart] = chart_repo_path
+                remote_dict[git_url] = chart_repo_path
+    return charts_dict
+
+
+def grep_yaml(file):
+    with open(file, 'r') as file:
+        content = ''
+        for line in file.readlines():
+            if not ': {{' in line and not '- {{' in line:
+                content += line
+    return yaml.safe_load(content)
+
+
+def get_child_helmfiles():
+    child_helmfiles = []
+    root_helmfile = grep_yaml(base_helmfile)
+    for entry in root_helmfile['helmfiles']:
+        child_helmfiles.append(base_repo_path+'/'+entry['path'])
+    return child_helmfiles
+
+
+def process_the_helmfiles(charts_dict):
+    chart_def_prefix = '    chart: "'
+    name_def_prefix = '  - name: "'
+    child_helmfiles = get_child_helmfiles()
+    for child_helmfile in child_helmfiles:
+        child_helmfile_updated = False
+        output = []
+        with open(child_helmfile, 'r') as file:
+            for line in file:
+                if chart_def_prefix in line:
+                    for chart_ident in charts_dict:
+                        if '.Values.charts.'+chart_ident+'.name' in line:
+                            logging.debug(f"found match with {chart_ident} in {line.strip()}")
+                            if name_def_prefix not in line_memory:
+                                sys.exit(f"Script requires `name` definition before the actual `chart` definition. Not the case for '{chart_ident}'")
+                            else:
+                                name = re.search(rf"^{name_def_prefix}(.+)\"", line_memory).group(1)
+                            line = chart_def_prefix+charts_dict[chart_ident]+'/charts/'+name+'" # replaced by local-dev script'+"\n"
+                            child_helmfile_updated = True
+                            break
+                output.append(line)
+                line_memory = line
+        if child_helmfile_updated:
+            child_helmfile_backup = child_helmfile+helmfile_backup_extension
+            logging.debug(f"Updated {child_helmfile}")
+            if os.path.isfile(child_helmfile_backup):
+                logging.debug("backup {child_helmfile_backup} already exists, will not create a new one.")
+            else:
+                logging.debug(f"creating backup {child_helmfile_backup}.")
+                shutil.copy2(child_helmfile, child_helmfile_backup)
+            with open(child_helmfile, 'w') as file:
+                file.writelines(output)
+
+
+def revert_the_helmfiles():
+    child_helmfiles = get_child_helmfiles()
+    for child_helmfile in child_helmfiles:
+        child_helmfile_backup = child_helmfile+helmfile_backup_extension
+        if os.path.isfile(child_helmfile_backup):
+            logging.debug(f"Reverting {child_helmfile} from backup {child_helmfile_backup}")
+            os.rename(child_helmfile_backup, child_helmfile)
+        else:
+            logging.debug(f"Did not found the backup file {child_helmfile_backup}")
+
+##
+## Main program
+##
+if options.revert:
+    revert_the_helmfiles()
+else:
+    branch = create_or_switch_branch_base_repo()
+    charts_dict = clone_charts_locally(branch)
+    process_the_helmfiles(charts_dict)

dev/requirements.txt

@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+
+configargparse
+pyyaml
+GitPython

docs/getting-started.md

@@ -21,6 +21,9 @@ This documentation should enable you to create your own evaluation instance of o
     * [Container runtime](#container-runtime)
     * [Volumes](#volumes)
   * [Connectivity](#connectivity)
+    * [Ports](#ports)
+      * [Web based user interface](#web-based-user-interface)
+      * [Mail clients](#mail-clients)
     * [Mail/SMTP configuration](#mailsmtp-configuration)
     * [TURN configuration](#turn-configuration)
     * [Certificate issuer](#certificate-issuer)
@@ -29,6 +32,7 @@ This documentation should enable you to create your own evaluation instance of o
   * [Install single app](#install-single-app)
   * [Install single release/chart](#install-single-releasechart)
 * [Access deployment](#access-deployment)
+  * [Using from external repository](#using-from-external-repository)
 * [Uninstall](#uninstall)
 <!-- TOC -->
 
@@ -97,7 +101,7 @@ export DOMAIN=domain.tld
 All available apps and their default value can be found in `helmfile/environments/default/workplace.yaml`.
 
 | Component                   | Name                                | Default | Description                    |
-|-----------------------------|-------------------------------------|---------|--------------------------------|
+| --------------------------- | ----------------------------------- | ------- | ------------------------------ |
 | Certificates                | `certificates.enabled`              | `true`  | TLS certificates               |
 | ClamAV (Distributed)        | `clamavDistributed.enabled`         | `false` | Antivirus engine               |
 | ClamAV (Simple)             | `clamavSimple.enabled`              | `true`  | Antivirus engine               |
@@ -118,7 +122,7 @@ All available apps and their default value can be found in `helmfile/environment
 | PostgreSQL                  | `postgresql.enabled`                | `true`  | Database                       |
 | Redis                       | `redis.enabled`                     | `true`  | Cache Database                 |
 | Univention Management Stack | `univentionManagementStack.enabled` | `true`  | Identity Management & Portal   |
-| XWiki                       | `xwiki.enabled`                     | `true`  | Knowledgebase                  |
+| XWiki                       | `xwiki.enabled`                     | `true`  | Knowledge management           |
 
 Exemplary, Jitsi can be disabled like:
 
@@ -237,9 +241,32 @@ persistence:
 
 ## Connectivity
 
+### Ports
+
+**Note:** If you use `NodePort` for service exposure, you need to check your deployment for the actual ports.
+
+#### Web based user interface
+
+To use the openDesk functionality with its web based user interface you need to publicly expose the following ports:
+
+| Component          | Description             |  Port | Type |
+| ------------------ | ----------------------- | ----: | ---: |
+| Jitsi Video Bridge | ICE Port for video data | 10000 |  UDP |
+
+#### Mail clients
+
+To connect with mail clients like [Thunderbird](https://www.thunderbird.net/), the following ports need public exposure:
+
+| Component          | Description             |  Port | Type |
+| ------------------ | ----------------------- | ----: | ---: |
+| Dovecot            | IMAPS                   |   993 |  TCP |
+|                    | POP3S                   |   995 |  TCP |
+| Postfix            | SMTP                    |    25 |  TCP |
+|                    | SMTPS                   |   587 |  TCP |
+
 ### Mail/SMTP configuration
 
-To use the full potential of the openDesk, you need to set up an SMTP relay which allows to send emails from
+To use the full potential of the openDesk, you need to set up an SMTP relay which allows sending emails from
 the whole subdomain.
 
 ```yaml

docs/requirements.md

@@ -22,7 +22,7 @@ openDesk is a Kubernetes only solution and requires an existing Kubernetes (K8s)
 
 - K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
-- Ingress controller (supported are nginx-ingress, HAProxy)
+- Ingress controller (nginx-ingress)
 - [Helm](https://helm.sh/) >= v3.9.0
 - [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v0.157.0**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
@@ -53,10 +53,11 @@ The deployment is tested against [kubespray](https://github.com/kubernetes-sigs/
 The deployment is intended to use only over HTTPS via a configured FQDN, therefor it is required to have a proper
 configured ingress controller deployed.
 
-**Maintained controllers:**
+**Supported controllers:**
 - [NGINX Ingress Controller](https://github.com/nginxinc/kubernetes-ingress)
-- [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx)
-- [HAProxy Kubernetes Ingress Controller](https://github.com/haproxytech/kubernetes-ingress)
+
+Note: The platform development team is evaluating the use of [Gateway API](https://gateway-api.sigs.k8s.io/).
+If you have feedback on that topic, please share it with us.
 
 # Volume provisioner
 
@@ -75,7 +76,9 @@ openDesk certificate management disabled.
 
 # External services
 
-Evaluation the openDesk deployment does not require any external service to start, but features may be limited.
+For development and evaluation of openDesk we bundle some service to start with. Be aware that for production
+deployments you need to make use of your own production grade services, see the
+[external-services.md](./external-services.md) for configuration details.
 
 | Group    | Type                | Version | Tested against        |
 | -------- | ------------------- | ------- | --------------------- |

helmfile.yaml

@@ -5,13 +5,13 @@
 environments:
   dev:
     values:
-      - "helmfile/environments/dev/values.yaml.gotmpl"
+      - "helmfile/environments/dev/*.yaml.gotmpl"
   test:
     values:
-      - "helmfile/environments/test/values.yaml.gotmpl"
+      - "helmfile/environments/test/*.yaml.gotmpl"
   prod:
     values:
-      - "helmfile/environments/prod/values.yaml.gotmpl"
+      - "helmfile/environments/prod/*.yaml.gotmpl"
 ---
 # yamllint disable
 helmfiles:

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -407,9 +407,9 @@ appsuite:
         ca: ""
     resources:
       {{ .Values.resources.openxchangeCoreUIMiddleware | toYaml | nindent 6 }}
-      updater:
+    updater:
       resources:
-        {{ .Values.resources.openxchangeCoreUIMiddlewareUpdater | toYaml | nindent 6 }}
+        {{ .Values.resources.openxchangeCoreUIMiddlewareUpdater | toYaml | nindent 8 }}
     securityContext:
       allowPrivilegeEscalation: false
       capabilities:

helmfile/apps/openproject/values.yaml.gotmpl

@@ -30,7 +30,9 @@ environment:
   OPENPROJECT_LOGIN__REQUIRED: "true"
   OPENPROJECT_USER__DEFAULT__TIMEZONE: "Europe/Berlin"
   OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
+  {{ if not .Values.authentication.openProject.guestAccess.enabled }}
   OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"
+  {{- end }}
   OPENPROJECT_PER__PAGE__OPTIONS: "20, 50, 100, 200"
   OPENPROJECT_EMAIL__DELIVERY__METHOD: "smtp"
   OPENPROJECT_SMTP__AUTHENTICATION: "plain"

helmfile/apps/univention-management-stack/values-umbrella.yaml.gotmpl

@@ -674,7 +674,7 @@ stack-data-swp:
 
   stackDataSwp:
     udmApiPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
-    {{- if .Values.portal.enableDeploymentInformation }}
+    {{- if .Values.admin.portal.deploymentInformation.enabled }}
     systemInformation:
       deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
       releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
@@ -1202,18 +1202,17 @@ keycloak-extensions:
       imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
     imagePullSecrets: {{ .Values.global.imagePullSecrets }}
     ingress:
-      annotations:
-        nginx.org/proxy-buffer-size: "8k"
-        nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
       paths:
         {{- if .Values.debug.enabled }}
         - pathType: "Prefix"
-          path: "/admin"
+          path: "/admin/"
         {{- end }}
         - pathType: "Prefix"
-          path: "/realms"
+          path: "/realms/"
         - pathType: "Prefix"
-          path: "/resources"
+          path: "/js/"
+        - pathType: "Prefix"
+          path: "/resources/"
         - pathType: "Prefix"
           path: "/fingerprintjs"
         - pathType: "Exact"

helmfile/bases/environments.yaml

@@ -10,15 +10,15 @@ environments:
     values:
       - "../../environments/default/*.gotmpl"
       - "../../environments/default/*.yaml"
-      - "../../environments/dev/values.yaml.gotmpl"
+      - "../../environments/dev/*.yaml.gotmpl"
   test:
     values:
       - "../../environments/default/*.gotmpl"
       - "../../environments/default/*.yaml"
-      - "../../environments/test/values.yaml.gotmpl"
+      - "../../environments/test/*.yaml.gotmpl"
   prod:
     values:
       - "../../environments/default/*.gotmpl"
       - "../../environments/default/*.yaml"
-      - "../../environments/prod/values.yaml.gotmpl"
+      - "../../environments/prod/*.yaml.gotmpl"
 ...

helmfile/environments/default/charts.yaml

@@ -46,7 +46,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/collabora/charts-mirror"
     name: "collabora-online"
-    version: "1.1.16"
+    version: "1.1.17"
     verify: true
   cryptpad:
     # providerCategory: "Supplier"
@@ -252,7 +252,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
     name: "openproject"
-    version: "5.1.4"
+    version: "5.2.0"
     verify: true
   openprojectBootstrap:
     # providerCategory: "Platform"

helmfile/environments/default/functional.yaml

@@ -7,17 +7,26 @@ authentication:
     # Note: Removing a group from the list will not disable 2FA for the removed group.
     groups:
       - "Domain Admins"
+  openProject:
+    guestAccess:
+      # If enabled links pointing to OpenProject no longer redirect to SSO/Keycloak login but show the
+      # OpenDesk login screen, where SSO users can click on "Keycloak" to access the SSO login, but guest
+      # users can authenticate with their own credentials.
+      enabled: false
 
 externalServices:
   nubus:
     udmRestApi:
-      # Set to 'true' if you don't want to make the UDM REST API from the Nubus stack externally available
+      # Enable to make the UDM REST API from the Nubus stack externally available.
       enabled: false
   matrix:
     federation:
+      # Disable to not support Matrix federation with your installation.
       enabled: true
 
-portal:
-  # Display deployment release and date in portal for admins.
-  enableDeploymentInformation: true
+admin:
+  portal:
+    deploymentInformation:
+      # Disable to not provide and update openDesk release version and deployment timestamp for admins in the portal.
+      enabled: true
 ...

helmfile/environments/default/images.yaml

@@ -20,7 +20,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "24.04.3.1.1@sha256:c1aa824227ea2b09ddef2ca3561a80282cda61c649b1bbdbbfa343e5a513a5a9"
+    tag: "24.04.4.1.1@sha256:8de43029e5994f503e5dc57f62bb3961a2c9d1e3b5362ecb314e33ff898b24fe"
   cryptpad:
     # providerCategory: "Supplier"
     # providerResponsible: "XWiki"
@@ -121,7 +121,7 @@ images:
     # upstreamRepository: "bitnami/kubectl"
     registry: "registry-1.docker.io"
     repository: "bitnami/kubectl"
-    tag: "1.30.1@sha256:8087ef69a8bf8c88ca3a0f36f75f91c281810f6181698f0c35c3318922bd2ab7"
+    tag: "1.30.2@sha256:3ec696e5ce1b79f78eb0eac1fed4ef20fa6584662cdf3c7ad933b0b03b9ce3f6"
   jvb:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -279,7 +279,7 @@ images:
     # upstreamRepository: "library/postgres"
     registry: "registry-1.docker.io"
     repository: "library/postgres"
-    tag: "16@sha256:1bf73ccae25238fa555100080042f0b2f9be08eb757e200fe6afc1fc413a1b3c"
+    tag: "16.3-alpine3.20@sha256:f18f3c509f481e4ddf167c108d11ecb07faca78b5e2204a702a379dee1d84f86"
   openxchangeBootstrap:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"