feat(helmfile): Allow scheduling cpu intensive loads on dedicated pools

ci(userimport): Disable certificate verification for user import
chore(docs): Add duration in self-signed certificate example
2025-12-06 07:21:36 +01:00 · 2025-02-19 16:50:07 +01:00 · 2025-02-19 12:36:02 +00:00 · 2025-02-19 11:03:12 +01:00 · 2025-02-19 09:13:42 +01:00 · 2025-02-19 08:24:40 +01:00
171 changed files with 2390 additions and 998 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,9 @@
 helmfile/environments/dev/*.yaml.gotmpl
 helmfile/environments/test/*.yaml.gotmpl
 helmfile/environments/prod/*.yaml.gotmpl
+helmfile/environments/dev/*/
+helmfile/environments/test/*/
+helmfile/environments/prod/*/
 !helmfile/environments/dev/sample.yaml.gotmpl
 !helmfile/environments/test/sample.yaml.gotmpl
 !helmfile/environments/prod/sample.yaml.gotmpl
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -9,6 +9,12 @@ include:
      - "ci/common/lint.yml"
      - "ci/release-automation/semantic-release.yml"
  - local: "/.gitlab/generate/generate-docs.yml"
+  - local: "/.gitlab/renovate/renovate.yml"
+  - local: "/.gitlab/release/release-common.yml"
+  - local: "/.gitlab/release/release-generate-version.yml"
+  - local: "/.gitlab/release/release-semantic.yml"
+  - local: "/.gitlab/lint/lint-common.yml"
+  - local: "/.gitlab/lint/lint-reuse.yml"
  - project: "${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
    file: "gitlab/environments.yaml"
    ref: "main"
@@ -73,6 +79,12 @@ variables:
    options:
      - "yes"
      - "no"
+  OPENDESK_ENTERPRISE:
+    description: "Set to `true` if you want to deploy openDesk EE (but be sure you provide the required EE keys/tokens for the application)"
+    value: "false"
+    options:
+      - "true"
+      - "false"
  DEPLOY_ALL_COMPONENTS:
    description: "Enable all component deployment (overwrites 'no' setting on component level)."
    value: "no"
@@ -283,6 +295,18 @@ env-start:
        ca:
          secretName: opendesk-root-cert-secret
      EOF
+  after_script:
+    # Set credentials for openDesk Enterprise Registry
+    - |
+      if [ "${OPENDESK_ENTERPRISE}" = "true" ]; then
+        kubectl create secret \
+        --namespace "${NAMESPACE}" \
+        docker-registry enterprise-registry \
+        --docker-server "registry.opencode.de" \
+        --docker-username "${OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME}" \
+        --docker-password "${OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD}" \
+        --dry-run=client -o yaml | kubectl apply -f -
+      fi
  stage: "env"

 policies-deploy:
@@ -524,7 +548,8 @@ import-default-accounts:
        --admin_enable_fileshare True \
        --admin_enable_knowledgemanagement True \
        --admin_enable_projectmanagement True \
-        --create_admin_accounts True
+        --create_admin_accounts True \
+        --verify_certificate False

 run-tests:
  stage: "post-execute"
@@ -563,6 +588,7 @@ run-tests:
          \"screenshot_redirect_step\": \"yes\", \
          \"testset\": \"${TESTS_TESTSET}\", \
          \"testprofile\": \"Namespace\", \
+          \"OPENDESK_ENTERPRISE\": \"${OPENDESK_ENTERPRISE}\", \
          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\", \
          \"NUMBER_OF_THREADS\": \"${TESTS_NUMBER_OF_THREADS}\" \
        } \
@@ -634,110 +660,4 @@ avscan-start:
      - artifact: "dynamic-scans.yml"
        job: "avscan-prepare"
    strategy: "depend"
-
-# Overwrite shared settings
-.common-semantic-release:
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
-  tags: []
-
-conventional-commits-linter:
-  rules:
-    - if: >
-          $RUN_RENOVATE == "yes" ||
-          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
-          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
-      when: "never"
-    - when: "always"
-
-common-yaml-linter:
-  rules:
-    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
-      when: "never"
-    - when: "always"
-
-reuse-linter:
-  allow_failure: false
-  rules:
-    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
-      when: "never"
-    - when: "always"
-
-generate-release-version:
-  rules:
-    - if: >
-        $JOB_RELEASE_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
-        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
-      when: "on_success"
-
-release:
-  rules:
-    - if: >
-        $JOB_AVSCAN_ENABLED != 'false' &&
-        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
-        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
-      when: "on_success"
-  script:
-    - >
-      export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
-      "@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
-      grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
-    - |
-      if [ -z "${RELEASE_VERSION}" ]; then
-        echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
-      else
-        echo "RELEASE_VERSION=${RELEASE_VERSION}"
-      fi
-    - |
-      echo -e "\n[INFO] Writing data to helm value file..."
-      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
-      # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-      # SPDX-License-Identifier: Apache-2.0
-      ---
-      global:
-        systemInformation:
-          releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
-      ...
-      EOF
-    - |
-      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
-      {
-        "branches": ["main"],
-        "plugins": [
-          "@semantic-release/gitlab",
-          "@semantic-release/release-notes-generator",
-          "@semantic-release/changelog",
-          ["@semantic-release/git", {
-            "assets": [
-              "charts/**/Chart.yaml",
-              "CHANGELOG.md",
-              "charts/**/README.md",
-              "helmfile/environments/default/global.generated.yaml.gotmpl",
-              ".kyverno/kyverno-test.yaml",
-              "docs"
-            ],
-            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
-          }]
-        ]
-      }
-      EOF
-    - "semantic-release"
-  needs:
-    - "generate-docs"
-
-renovate:
-  rules:
-    - if: >
-        $RUN_RENOVATE == "yes"
-      when: "on_success"
-  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
-  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
-  variables:
-    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
-    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
-    # Increase the renovatebot log level on stdout
-    LOG_LEVEL: "DEBUG"
-  script:
-    - "renovate ${RENOVATE_EXTRA_FLAGS}"
-  stage: "renovate"
 ...
--- a/.gitlab/common/common.yml
+++ b/.gitlab/common/common.yml
@@ -2,8 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.1\
-    @sha256:f09e36a4ad4b3a3a9ed260d6f36293002e39866a877c0a6b1efa16a88b8fd107"
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.2\
+    @sha256:e33a6327b9c8f89f6e86d13804d5d81e9fdf6974a2f280874d6901067c22fd83"
  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.14\
    @sha256:34d2a96e5fc25155abd48fef4d335b131c71d8cbc00ad531df0cae9918b9f2ab"

--- a/.gitlab/lint/lint-common.yml
+++ b/.gitlab/lint/lint-common.yml
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024-2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 include:
@@ -8,4 +8,18 @@ include:
  extends: ".common"
  stage: "lint"

+common-yaml-linter:
+  rules:
+    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
+      when: "never"
+    - when: "always"
+
+conventional-commits-linter:
+  rules:
+    - if: >
+          $RUN_RENOVATE == "yes" ||
+          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
+          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
+      when: "never"
+    - when: "always"
 ...
--- a/.gitlab/lint/lint-reuse.yml
+++ b/.gitlab/lint/lint-reuse.yml
@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-License-Identifier: Apache-2.0
+---
+reuse-linter:
+  allow_failure: false
+  rules:
+    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
+      when: "never"
+    - when: "always"
+...
--- a/.gitlab/release/release-common.yml
+++ b/.gitlab/release/release-common.yml
@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+# Overwrite shared settings
+.common-semantic-release:
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
+  tags: []
+...
--- a/.gitlab/release/release-generate-version.yml
+++ b/.gitlab/release/release-generate-version.yml
@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+generate-release-version:
+  rules:
+    - if: >
+        $JOB_RELEASE_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
+      when: "on_success"
+...
--- a/.gitlab/release/release-semantic.yml
+++ b/.gitlab/release/release-semantic.yml
@@ -0,0 +1,63 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+release:
+  cache:
+    - key: "generate-docs-${CI_COMMIT_REF_SLUG}"
+      paths:
+        - "${CI_PROJECT_DIR}/docs"
+      policy: "pull"
+  rules:
+    - if: >
+        $JOB_AVSCAN_ENABLED != 'false' &&
+        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
+        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
+      when: "on_success"
+  script:
+    - >
+      export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
+      "@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
+      grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
+    - |
+      if [ -z "${RELEASE_VERSION}" ]; then
+        echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
+      else
+        echo "RELEASE_VERSION=${RELEASE_VERSION}"
+      fi
+    - |
+      echo -e "\n[INFO] Writing data to helm value file..."
+      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
+      # SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+      # SPDX-License-Identifier: Apache-2.0
+      ---
+      global:
+        systemInformation:
+          releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
+      ...
+      EOF
+    - |
+      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
+      {
+        "branches": ["main"],
+        "plugins": [
+          "@semantic-release/gitlab",
+          "@semantic-release/release-notes-generator",
+          "@semantic-release/changelog",
+          ["@semantic-release/git", {
+            "assets": [
+              "charts/**/Chart.yaml",
+              "CHANGELOG.md",
+              "charts/**/README.md",
+              "helmfile/environments/default/global.generated.yaml.gotmpl",
+              ".kyverno/kyverno-test.yaml",
+              "docs"
+            ],
+            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+          }]
+        ]
+      }
+      EOF
+    - "semantic-release"
+  needs:
+    - "generate-docs"
+...
--- a/.gitlab/renovate/renovate.yml
+++ b/.gitlab/renovate/renovate.yml
@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+renovate:
+  rules:
+    - if: >
+        $RUN_RENOVATE == "yes"
+      when: "on_success"
+  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
+  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
+  variables:
+    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
+    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
+    # Increase the renovatebot log level on stdout
+    LOG_LEVEL: "DEBUG"
+  script:
+    - "renovate ${RENOVATE_EXTRA_FLAGS}"
+  stage: "renovate"
+...
--- a/README-EE.md
+++ b/README-EE.md
@@ -0,0 +1,102 @@
+<!--
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+-->
+
+<h1>openDesk Enterprise Edition</h1>
+
+<!-- TOC -->
+* [Components](#components)
+* [Enabling the Enterprise deployment](#enabling-the-enterprise-deployment)
+* [Configuring the oD EE deployment for self-hosted installations](#configuring-the-od-ee-deployment-for-self-hosted-installations)
+  * [Registry access](#registry-access)
+  * [License keys](#license-keys)
+<!-- TOC -->
+
+openDesk Enterprise Edition is recommended for production use. It receives support and patches from ZenDiS and the suppliers of the components due to the included product subscriptions.
+
+The document refers to openDesk Community Edition as "oD CE" and for the openDesk Enterprise Edition it is "oD EE".
+
+Please contact [ZenDiS](mailto:opendesk@zendis.de) to get openDesk Enterprise, either as SaaS offering or for you on-premise installation.
+
+# Components
+
+The following components using the same codebase and artifacts for their Enterprise and Community offering:
+- Cryptpad
+- Jitsi
+- Nubus
+- OpenProject
+- XWiki
+
+The following components have - at least partially - Enterprise specific artifacts:
+
+- Collabora: Collabora Online image version `<major>.<minor>.<patch>.3` will be used once available, at the same time the Collabora Development Edition image will be updated to `<major>.<minor>.<patch>.2` for oD CE.
+- Element: Some artifacts providing additional functionality are only available in oD EE. For the shared artifacts we keep the ones in oD CE and oD EE in sync.
+- Nextcloud: Specific enterprise image based on the NC Enterprise package is build based on the same release version as used in oD CE.
+- OX AppSuite: oD CE and EE are using the same release version, in EE an enterprise-built container of the AppSuite's Core-Middleware is being integrated.
+- OX Dovecot Pro 3: Dovecot Pro provides support for S3 storage and this feature is used by default.
+
+# Enabling the Enterprise deployment
+
+To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value that does not evaluate to boolean *false* for [Helm flow control](https://helm.sh/docs/chart_template_guide/control_structures/#ifelse), e.g. `"true"`, `"yes"` or `"1"`:
+
+```shell
+OPENDESK_ENTERPRISE=true
+```
+
+# Configuring the oD EE deployment for self-hosted installations
+
+## Registry access
+
+With openDesk EE you get access to the related artifact registry owned by ZenDiS.
+
+Three steps are required to access the registry - for step #1 and #2 you can set some variables. You can to define a `<your_name_for_the_secret>` freely, like `enterprise-secret`, as long as it consistent in step #1 and #3.
+
+```shell
+NAMESPACE=<your_namespace>
+NAME_FOR_THE_SECRET=<your_name_for_the_secret>
+YOUR_ENTERPRISE_REGISTRY_USERNAME=<your_registry_credential_username>
+YOUR_ENTERPRISE_REGISTRY_PASSWORD=<your_registry_credential_password>
+```
+
+1. Add your registry credentials as secret to the namespace you want to deploy openDesk to. Do not forget to create the namespace if it does not exist yet (`kubectl create namespace ${NAMESPACE}`).
+
+```shell
+kubectl create secret --namespace "${NAMESPACE}" \
+  docker-registry "${NAME_FOR_THE_SECRET}" \
+  --docker-server "registry.opencode.de" \
+  --docker-username "${YOUR_ENTERPRISE_REGISTRY_USERNAME}" \
+  --docker-password "${YOUR_ENTERPRISE_REGISTRY_PASSWORD}" \
+  --dry-run=client -o yaml | kubectl apply -f -
+```
+
+2. Docker login to the registry to access Helm charts for local deployments:
+
+```shell
+docker login registry.opencode.de -u ${YOUR_ENTERPRISE_REGISTRY_USERNAME} -p ${YOUR_ENTERPRISE_REGISTRY_PASSWORD}
+```
+
+3. Reference the secret from step #1 in the deployment as well as the registry itself for `images` and `helm` charts:
+
+```yaml
+global:
+  imagePullSecrets:
+    - "<your_name_for_the_secret>"
+repositories:
+  image:
+    registryOpencodeDeEnterprise: "registry.opencode.de"
+  helm:
+    registryOpencodeDeEnterprise: "registry.opencode.de"
+```
+
+## License keys
+
+Some applications require license information for their Enterprise features to be enabled. With the aforementioned registry credentials you will also receive a file called `enterprise.yaml` containing the relevant license keys.
+
+Please place the file next your other `.yaml.gotmpl` file(s) that configure your deployment.
+
+Details regarding the scope/limitation of the component's licenses:
+
+- Nextcloud: Enterprise license to enable [Nextcloud Enterprise](https://nextcloud.com/de/enterprise/) specific features, can be used across multiple installations until the licensed number of users is reached.
+- OpenProject: Domain specific enterprise license to enable [OpenProject's Enterprise feature set](https://www.openproject.org/enterprise-edition/), domain matching can use regular expressions.
+- XWiki: Deployment specific enterprise license (key pair) to activate the [XWiki Pro](https://xwiki.com/en/offerings/products/xwiki-pro) apps.
--- a/README.md
+++ b/README.md
@@ -27,6 +27,8 @@ SPDX-License-Identifier: Apache-2.0
 openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the
 *Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH*.

+For production use the [openDesk Enterprise Edition](./README-EE.md) is required.
+
 openDesk currently features the following functional main components:

 | Function             | Functional Component        | Component<br/>Version                                                                                | Upstream Documentation                                                                                                                |
@@ -37,7 +39,7 @@ openDesk currently features the following functional main components:
 | Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
 | Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)                       | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
 | Portal & IAM         | Nubus                       | [1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | [15.2.0](https://www.openproject.org/docs/release-notes/15-2-0/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Project management   | OpenProject                 | [15.2.1](https://www.openproject.org/docs/release-notes/15-2-1/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
 | Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
 | Weboffice            | Collabora                   | [24.04.9.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |

--- a/dev/README.md
+++ b/dev/README.md
@@ -7,30 +7,40 @@ SPDX-License-Identifier: Apache-2.0

 * [charts-local.py](#charts-localpy)
  * [Commandline parameter](#commandline-parameter)
-    * [`--branch`](#--branch)
+    * [`--match <your_string>`](#--match-your_string)
    * [`--revert`](#--revert)
+    * [`--branch` (deprecated)](#--branch-deprecated)

 # charts-local.py

-This script helps you on cloning the platform development Helm charts and referencing them directly in the openDesk
-Helmfile deployment for comfortable local test and development. The charts will be cloned into a directory
-parallel created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
-The name of the chart directory is derived from the branch name you are working with in this `opendesk` repo.
+This script helps you with cloning/pulling Helm charts and referencing them directly in the openDesk
+Helmfile deployment for comfortable local test and development. The charts will be cloned/pulled into a directory
+created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.

-The script will create `.bak` copies of the helmfiles that have been touched.
+The name of the directory containing the charts is based on the (currently) selected branch of the openDesk
+repo prefixed with `charts-`.
+
+The script will create `.bak` copies of the helmfiles that have been touched that can easily be reverted to
+using the `--revert` option.

 Run the script with `-h` to get information about the script's parameter on commandline.

 ## Commandline parameter

-### `--branch`
+### `--match <your_string>`
+
+Will only fetch repos or pull images for charts which name matches `<your_string>`.
+
+### `--revert`
+
+Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
+scripts itself back to their original location.
+
+### `--branch` (deprecated)

 Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
 does not exist yet. Otherwise it will switch to defined branch.

 If parameter is omitted the current branch of the `opendesk` repo will be used.

-### `--revert`
-
-Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
-scripts itself back to their original location.
+As this parameter was used rarely, we might remove the support in a later version.
--- a/dev/charts-local.py
+++ b/dev/charts-local.py
@@ -18,7 +18,6 @@ p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work
 p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
 p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
 p.add('--match', default='', help="Clone/pull only charts that contain the given string in their name.")
-p.add('--pull', default=False, action='store_true', help='Will also pull and unpack Helm charts that are not developed by product development.')
 p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
 options = p.parse_args()

@@ -78,13 +77,10 @@ def create_path_if_not_exists(path):
        Path(path).mkdir(parents=True, exist_ok=True)

 def clone_charts_locally(branch, charts):
-    charts_clone_path = script_path+'/../../chart-repo/'+branch.replace('/', '_')
-    charts_pull_path = script_path+'/../../chart-pull/'+branch.replace('/', '_')
+    charts_path = script_path+'/../../charts-'+branch.replace('/', '_')
    charts_dict = {}
    doublette_dict = {}
-    create_path_if_not_exists(charts_clone_path)
-    if options.pull:
-        create_path_if_not_exists(charts_pull_path)
+    create_path_if_not_exists(charts_path)

    for chart in charts['charts']:
        tag = charts['charts'][chart]['version']
@@ -92,41 +88,41 @@ def clone_charts_locally(branch, charts):
        registry = charts['charts'][chart]['registry']
        name = charts['charts'][chart]['name']
        logging.debug(f"Working on {chart} / tag {tag} / repo {repository}")
+        chart_local_path = charts_path+'/'+name
        if not options.match in name:
            logging.info(f"Chart name {name} does not match {options.match} - skipping...")
+            continue
        elif registry == '':
            logging.info("Empty registry definition - skipping...")
+            continue
+        if os.path.isdir(chart_local_path):
+            logging.debug(f"Found pre-existing {chart_local_path} skipping clone/pull, but will still reference chart in Helmfile...")
+            charts_dict[chart] = chart_local_path
+            continue
        elif 'opendesk/components/platform-development/charts' in repository:
            logging.info("Cloning the charts repo")
            git_url = options.git_hostname+':'+repository
-            chart_repo_path = charts_clone_path+'/'+charts['charts'][chart]['name']
            if git_url in doublette_dict:
                logging.debug(f"{chart} located at {git_url} is already checked out to {doublette_dict[git_url]}")
                charts_dict[chart] = doublette_dict[git_url]
            else:
-                if os.path.isdir(chart_repo_path):
-                    logging.debug(f"Already exists {chart_repo_path} leaving it unmodified")
-                else:
-                    logging.debug(f"Cloning into {chart_repo_path}")
-                    Repo.clone_from(git_url, chart_repo_path)
-                    chart_repo = Repo(path=chart_repo_path)
-                    chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
-                doublette_dict[git_url] = chart_repo_path
-                charts_dict[chart] = chart_repo_path
-        elif options.pull:
+                logging.debug(f"Cloning into {chart_local_path}")
+                Repo.clone_from(git_url, chart_local_path)
+                chart_repo = Repo(path=chart_local_path)
+                chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
+                doublette_dict[git_url] = chart_local_path
+                charts_dict[chart] = chart_local_path
+        else:
            logging.info("Pulling the chart")
-            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_pull_path}"
+            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_path}"
            logging.debug(f"CLI command: {helm_command}")
            try:
-                output = subprocess.check_output(helm_command, shell = True)
+                subprocess.check_output(helm_command, shell = True)
            except subprocess.CalledProcessError:
                sys.exit(f"! CLI command '{helm_command}' failed")
-        else:
-            logging.debug("Not a product development chart and `--pull` option not enabled - skipping...")
-
+            charts_dict[chart] = chart_local_path
    return charts_dict

-
 def grep_yaml(file):
    with open(file, 'r') as file:
        content = ''
@@ -156,7 +152,12 @@ def process_the_helmfiles(charts_dict, charts):
                    for chart_ident in charts_dict:
                        if '.Values.charts.'+chart_ident+'.name' in line:
                            logging.debug(f"found match with {chart_ident} in {line.strip()}")
-                            line = chart_def_prefix+charts_dict[chart_ident]+'/charts/'+charts['charts'][chart_ident]['name']+'" # replaced by local-dev script'+"\n"
+                            line = charts_dict[chart_ident]
+                            if os.path.isdir(line+'/charts/'+chart_ident):
+                                line += '/charts/'+charts['charts'][chart_ident]['name']
+                            elif not os.path.isdir(line):
+                                sys.exit(f"! Did not find directory to reference in Helmfile: '{line}'")
+                            line = chart_def_prefix+line+'" # replaced by local-dev script'+"\n"
                            child_helmfile_updated = True
                            break
                output.append(line)
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -168,7 +168,7 @@ While you will find all the details for the CLI tool in [the online documentatio

 `occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).

-You can run occ commands in the `opendesk-nextcloud-php` pod like this: `php /var/www/html/occ config:list`
+You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`

 ## OpenProject

--- a/docs/enhanced-configuration/self-signed-certificates.md
+++ b/docs/enhanced-configuration/self-signed-certificates.md
@@ -98,6 +98,8 @@ multiple namespaces in a cluster.
        name: selfsigned-issuer
        kind: ClusterIssuer
        group: cert-manager.io
+      duration: 87600h # 10y
+      renewBefore: 87599h
    ```

 1. Copy this cert's secret into the/each namespace you want to make use of the cert.
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -9,6 +9,9 @@ SPDX-License-Identifier: Apache-2.0
 * [Disclaimer](#disclaimer)
 * [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
 * [Manual checks/actions](#manual-checksactions)
+  * [From v1.1.1](#from-v111)
+    * [Pre-upgrade from v1.1.1](#pre-upgrade-from-v111)
+      * [Helmfile feature update: App settings wrapped in `apps.` element](#helmfile-feature-update-app-settings-wrapped-in-apps-element)
  * [From v1.1.0](#from-v110)
    * [Pre-upgrade from v1.1.0](#pre-upgrade-from-v110)
      * [Helmfile feature update: Component specific `storageClassName`](#helmfile-feature-update-component-specific-storageclassname)
@@ -86,6 +89,37 @@ When interested in more details about the automated migrations, please read sect

 Be sure you check all the sections for the releases your are going to update your current deployment from.

+## From v1.1.1
+
+### Pre-upgrade from v1.1.1
+
+#### Helmfile feature update: App settings wrapped in `apps.` element
+
+We require now [Helmfile v1.0.0-rc.8](https://github.com/helmfile/helmfile/releases/tag/v1.0.0-rc.8) for the deployment. This enables openDesk to lay the foundation for some significant cleanups where the information for the different apps especially on their `enabled` state is needed.
+
+Therefore it was required to introduce the `apps` level in [`opendesk_main.yaml.gotmpl`](../helmfile/environments/default/opendesk_main.yaml.gotmpl).
+
+If you have a deployment where you specify settings that can be found in the aforementioned file, usually to disable components or enable others, please ensure you insert the top-level attribute `apps` like shown in the following example:
+
+So a setting of:
+
+```
+certificates:
+  enabled: false
+notes:
+  enabled: true
+```
+
+needs to be changed to:
+
+```
+apps:
+  certificates:
+    enabled: false
+  notes:
+    enabled: true
+```
+
 ## From v1.1.0

 ### Pre-upgrade from v1.1.0
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -24,9 +24,10 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)

 - K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
- Ingress controller (Ingress NGINX)
+- Ingress controller (Ingress NGINX) == [4.11.x/1.11.x](https://github.com/kubernetes/ingress-nginx/releases) - tested with 1.11.1 up to 1.11.4
+  - **Note**: We are working on support for more recent versions, as issues have been reported with 1.12.x.
 - [Helm](https://helm.sh/) >= v3.9.0
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc5**
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc8**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
 - Volume provisioner supporting RWO (read-write-once)
 - Certificate handling with [cert-manager](https://cert-manager.io/)
--- a/docs/security-context.md
+++ b/docs/security-context.md
@@ -1,8 +1,7 @@
 <!--
-SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
-
 <h1>Kubernetes Security Context</h1>

 <!-- TOC -->
@@ -63,7 +62,7 @@ containerSecurityContext:
 ## privileged


-Privileged Pods disable most security mechanisms and must be disallowed.
+Privileged Pods eliminate most security mechanisms and must be disallowed.

 ```yaml
 containerSecurityContext:
@@ -93,7 +92,7 @@ containerSecurityContext:
 ## seccompProfile


-Seccomp profile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
+The seccompProfile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.

 ```yaml
 containerSecurityContext:
@@ -113,7 +112,7 @@ containerSecurityContext:
 ## readOnlyRootFilesystem


-Containers should have an immutable file systems, so that attackers could not modify application code or download malicious code.
+Containers should have an immutable file systems, so that attackers can not modify application code or download malicious code.

 ```yaml
 containerSecurityContext:
@@ -133,10 +132,10 @@ containerSecurityContext:
 # Status quo


-openDesk aims to achieve that all security relevant settings are explicitly templated and comply with security recommendations.
+openDesk aims to ensure that all security relevant settings are explicitly templated and comply with security recommendations.


-The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are also properly templated by the given Helm charts.
+The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are properly templated by the Helm charts.


 This list gives you an overview of templated security settings and if they comply with security standards:
@@ -144,11 +143,11 @@ This list gives you an overview of templated security settings and if they compl

 - **yes**: Value is set to `true`
 - **no**: Value is set to `false`
- - **n/a**: No explicitly templated in openDesk and default is used.
+ - **n/a**: Not explicitly templated in openDesk; default is used.

 | process | status | allowPrivilegeEscalation | privileged | readOnlyRootFilesystem | runAsNonRoot | runAsUser | runAsGroup | seccompProfile | capabilities |
 | ------- | ------ | ------------------------ | ---------- | ---------------------- | ------------ | --------- | ---------- | -------------- | ------------ |
-| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT","MKNOD"] |
+| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","FOWNER","SYS_CHROOT"] |
 | **cryptpad**/cryptpad | :x: | no | no | no | yes | 4001 | 4001 | yes | yes |
 | **element**/matrix-neoboard-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/matrix-neochoice-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
@@ -164,14 +163,41 @@ This list gives you an overview of templated security settings and if they compl
 | **jitsi**/jitsi | :white_check_mark: | no | no | yes | yes | 1993 | 1993 | yes | yes |
 | **jitsi**/jitsi/jitsi/jibri | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no ["SYS_ADMIN"] |
 | **jitsi**/jitsi/jitsi/jicofo | :x: | no | no | no | no | 0 | 0 | yes | no |
+| **jitsi**/jitsi/jitsi/jigasi | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/jvb | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/prosody | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/web | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/patchJVB | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 65532 | 65532 | yes | yes |
-| **nextcloud**/opendesk-nextcloud/apache2 | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 101 | 101 | yes | yes |
+| **nextcloud**/opendesk-nextcloud/aio | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
-| **nextcloud**/opendesk-nextcloud/php | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
+| **notes**/impress/backend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **notes**/impress/frontend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **notes**/impress/yProvider | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **nubus**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/intercom-service/provisioning | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/keycloak | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/authorizationApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/managementApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/managementUi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusGuardian/openPolicyAgent | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusKeycloakBootstrap | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusKeycloakExtensions/handler | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusKeycloakExtensions/proxy | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusLdapNotifier | :x: | no | n/a | yes | yes | 101 | 102 | yes | yes |
+| **nubus**/ums/nubusNotificationsApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusPortalConsumer | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusPortalFrontend | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusPortalServer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusProvisioning | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusProvisioning/nats | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusSelfServiceConsumer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusStackDataUms | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUdmListener | :x: | no | n/a | yes | yes | 102 | 65534 | yes | yes |
+| **nubus**/ums/nubusUdmRestApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUmcGateway | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusUmcServer | :x: | no | n/a | yes | no | 0 | 0 | yes | yes |
 | **open-xchange**/dovecot | :x: | no | n/a | yes | n/a | n/a | n/a | yes | no ["CHOWN","DAC_OVERRIDE","KILL","NET_BIND_SERVICE","SETGID","SETUID","SYS_CHROOT"] |
 | **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
@@ -183,34 +209,26 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/appsuite/guard-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/nextcloud-integration-ui | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **open-xchange**/opendesk-open-xchange-bootstrap | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-migrations-post**/opendesk-migrations-post | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-migrations-pre**/opendesk-migrations-pre | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
+| **opendesk-services**/opendesk-static-files | :x: | no | n/a | yes | yes | 101 | 101 | yes | yes |
 | **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **open-xchange**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
-| **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/minio | :x: | no | no | no | yes | 1000 | 0 | yes | yes |
-| **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
-| **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **univention-management-stack**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **univention-management-stack**/ums/ldap-notifier | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
-| **univention-management-stack**/ums/portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
-| **univention-management-stack**/ums/stack-gateway | :x: | no | no | no | yes | 1001 | 0 | yes | yes |
-| **univention-management-stack**/ums/umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **univention-management-stack**/ums/umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
+| **services-external**/cassandra | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
+| **services-external**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services-external**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/minio | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/opendesk-dkimpy-milter | :x: | yes | no | yes | yes | 1000 | 1000 | yes | no |
+| **services-external**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
+| **services-external**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services-external**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |


--- a/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"

  # Collabora Controller - Enterprise Only
  # Source: https://github.com/CollaboraOnline/online
@@ -20,7 +20,7 @@ repositories:
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"

 releases:
  - name: "collabora-online"
@@ -28,18 +28,24 @@ releases:
    version: "{{ .Values.charts.collabora.version }}"
    values:
      - "values.yaml.gotmpl"
-      {{ range .Values.customization.release.collaboraOnline }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.collaboraOnline }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.collabora.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.collabora.enabled }}
  - name: "collabora-controller"
    chart: "collabora-controller-repo/{{ .Values.charts.collaboraController.name }}"
    version: "{{ .Values.charts.collaboraController.version }}"
    values:
-      {{ range .Values.customization.release.collaboraController }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-coco-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.collaboraController }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.collaboraController.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.collaboraController.enabled }}

 commonLabels:
  deployStage: "050-components"
--- a/helmfile/apps/collabora/helmfile.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
+++ b/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
@@ -0,0 +1,63 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+controller:
+  enableHashmapParallelization: true
+  ingressUrl: "https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
+  namespacedRole: true
+  # CoolController uses `app.kubernetes.io/name` label to find deployment resource
+  # openDesk uses `fullnameOverride` in Collabora Deployment that updates `metadata.name` not the `app.kubernetes.io/name`
+  # Therefore we use the default of `collabora-online` for the `resourceName`
+  resourceName: "collabora-online"
+  statsInterval: 2000
+  watchNamespace: {{ (.Values.apps.collabora.namespace | default .Release.Namespace | quote) }}
+
+  documentMigrator:
+    enabled: true
+    coolMemoryUtilization: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}
+    coolMemoryLimit: {{ .Values.resources.collabora.limits.memory }}
+
+  leaderElection:
+    enabled: {{ if gt .Values.replicas.collaboraController 1 }}true{{ else }}false{{ end }}
+
+image:
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collaboraController.registry }}/{{ .Values.images.collaboraController.repository }}"
+  tag: {{ .Values.images.collaboraController.tag | quote }}
+imagePullSecrets:
+  {{- range .Values.global.imagePullSecrets }}
+  - name: {{ . | quote }}
+  {{- end }}
+
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  className: {{ .Values.ingress.ingressClassName | quote }}
+  hosts:
+    - host: "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
+      paths:
+        - path: "/controller"
+          pathType: "Prefix"
+
+podAnnotations: {}
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+    - ALL
+  privileged: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsGroup: 2000
+  runAsUser: 1000
+  seccompProfile:
+    type: "RuntimeDefault"
+  seLinuxOptions:
+
+replicaCount: {{ .Values.replicas.collaboraController }}
+
+resources:
+  {{ .Values.resources.collaboraController | toYaml | nindent 2 }}
+
+...
--- a/helmfile/apps/collabora/values-enterprise.yaml.gotmpl
+++ b/helmfile/apps/collabora/values-enterprise.yaml.gotmpl
@@ -0,0 +1,15 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
+autoscaling:
+  enabled: {{ .Values.apps.collaboraController.enabled }}
+  minReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.maxReplicas }}
+  targetMemoryUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}
+  targetCPUUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetCPUUtilizationPercentage }}
+  scaleDownDisabled: {{ .Values.enterpriseFeatures.collabora.autoscaling.scaleDownDisabled }}
+...
--- a/helmfile/apps/collabora/values.yaml.gotmpl
+++ b/helmfile/apps/collabora/values.yaml.gotmpl
@@ -27,7 +27,7 @@ collabora:
    {{- else }}
    --o:logging.anonymize.anonymize_user_data=true
    {{- end }}
-    {{- if .Values.collaboraController.enabled }}
+    {{- if .Values.apps.collaboraController.enabled }}
    --o:indirection_endpoint.url=https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/routeToken
    --o:monitors.monitor[0]=wss://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/ws
    --o:monitors.monitor[0][@retryInterval]=5
@@ -49,7 +49,7 @@ imagePullSecrets:

 ingress:
  annotations:
-    {{- if .Values.collaboraController.enabled }}
+    {{- if .Values.apps.collaboraController.enabled }}
    nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_RouteToken"
    {{- else }}
    nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
--- a/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"

 releases:
  - name: "cryptpad"
@@ -18,10 +18,10 @@ releases:
    version: "{{ .Values.charts.cryptpad.version }}"
    values:
      - "values.yaml.gotmpl"
-      {{ range .Values.customization.release.cryptpad }}
+      {{- range .Values.customization.release.cryptpad }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.cryptpad.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.cryptpad.enabled }}

 commonLabels:
  deployStage: "050-components"
--- a/helmfile/apps/cryptpad/helmfile.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/element/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/element/helmfile-child.yaml.gotmpl
@@ -10,35 +10,35 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
  - name: "element-well-known-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.elementWellKnown.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
  - name: "synapse-web-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseWeb.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
  - name: "synapse-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapse.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
  - name: "synapse-create-account-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseCreateAccount.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"

  # openDesk Matrix Widgets
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
@@ -48,35 +48,35 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
  - name: "matrix-neoboard-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neochoice-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neodatefix-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
  - name: "matrix-neodatefix-bot-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"

  # openDesk Enterprise Repositories

@@ -88,28 +88,28 @@ repositories:
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
  - name: "synapse-adminbot-web-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseAdminbotWeb.verify }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
  - name: "synapse-groupsync-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseGroupsync.verify }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
  - name: "synapse-pipe-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapsePipe.verify }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"

 releases:
  - name: "opendesk-element"
@@ -117,10 +117,10 @@ releases:
    version: "{{ .Values.charts.element.version }}"
    values:
      - "values-element.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskElement }}
+      {{- range .Values.customization.release.opendeskElement }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.element.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-well-known"
@@ -128,10 +128,10 @@ releases:
    version: "{{ .Values.charts.elementWellKnown.version }}"
    values:
      - "values-well-known.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskWellKnown }}
+      {{- range .Values.customization.release.opendeskWellKnown }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.element.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-synapse-web"
@@ -139,10 +139,10 @@ releases:
    version: "{{ .Values.charts.synapseWeb.version }}"
    values:
      - "values-synapse-web.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskSynapseWeb }}
+      {{- range .Values.customization.release.opendeskSynapseWeb }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.element.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-synapse"
@@ -150,10 +150,10 @@ releases:
    version: "{{ .Values.charts.synapse.version }}"
    values:
      - "values-synapse.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskSynapse }}
+      {{- range .Values.customization.release.opendeskSynapse }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.element.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-matrix-user-verification-service-bootstrap"
@@ -161,7 +161,10 @@ releases:
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
      - "values-matrix-user-verification-service-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixUserVerificationServiceBootstrap }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "opendesk-matrix-user-verification-service"
@@ -169,7 +172,10 @@ releases:
    version: "{{ .Values.charts.matrixUserVerificationService.version }}"
    values:
      - "values-matrix-user-verification-service.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixUserVerificationService }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neoboard-widget"
@@ -177,15 +183,21 @@ releases:
    version: "{{ .Values.charts.matrixNeoboardWidget.version }}"
    values:
      - "values-matrix-neoboard-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeoboardWidget }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neochoice-widget"
-    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiseWidget.name }}"
-    version: "{{ .Values.charts.matrixNeochoiseWidget.version }}"
+    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiceWidget.name }}"
+    version: "{{ .Values.charts.matrixNeochoiceWidget.version }}"
    values:
      - "values-matrix-neochoice-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeochoiceWidget }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neodatefix-widget"
@@ -193,7 +205,10 @@ releases:
    version: "{{ .Values.charts.matrixNeodatefixWidget.version }}"
    values:
      - "values-matrix-neodatefix-widget.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeodatefixWidget }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neodatefix-bot-bootstrap"
@@ -201,7 +216,10 @@ releases:
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
      - "values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeodatefixBotBootstrap }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  - name: "matrix-neodatefix-bot"
@@ -209,7 +227,10 @@ releases:
    version: "{{ .Values.charts.matrixNeodatefixBot.version }}"
    values:
      - "values-matrix-neodatefix-bot.yaml.gotmpl"
-    installed: {{ .Values.element.enabled }}
+      {{- range .Values.customization.release.matrixNeodatefixBot }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.element.enabled }}
    timeout: 900

  # openDesk Enterprise Releases
@@ -217,70 +238,77 @@ releases:
    chart: "synapse-admin-repo/{{ .Values.charts.synapseAdmin.name }}"
    version: "{{ .Values.charts.synapseAdmin.version }}"
    values:
-      {{ range .Values.customization.release.opendeskSynapseAdmin }}
+      - "values-synapse-admin.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAdmin }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-adminbot-bootstrap"
    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
-      {{ range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
+      - "values-synapse-adminbot-bootstrap.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-adminbot-pipe"
    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
    version: "{{ .Values.charts.synapsePipe.version }}"
    values:
-      {{ range .Values.customization.release.opendeskSynapseAdminbotPipe }}
+      - "values-synapse-adminbot-pipe.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAdminbotPipe }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-adminbot-web"
    chart: "synapse-adminbot-web-repo/{{ .Values.charts.synapseAdminbotWeb.name }}"
    version: "{{ .Values.charts.synapseAdminbotWeb.version }}"
    values:
-      {{ range .Values.customization.release.opendeskSynapseAdminbotWeb }}
+      - "values-synapse-adminbot-web.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAdminbotWeb }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-auditbot-bootstrap"
    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
-      {{ range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
+      - "values-synapse-auditbot-bootstrap.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-auditbot-pipe"
    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
    version: "{{ .Values.charts.synapsePipe.version }}"
    values:
-      {{ range .Values.customization.release.opendeskSynapseAuditbotPipe }}
+      - "values-synapse-auditbot-pipe.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseAuditbotPipe }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.elementAdmin.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.elementAdmin.enabled }}
    timeout: 900

  - name: "opendesk-synapse-groupsync"
    chart: "synapse-groupsync-repo/{{ .Values.charts.synapseGroupsync.name }}"
    version: "{{ .Values.charts.synapseGroupsync.version }}"
    values:
-      {{ range .Values.customization.release.opendeskSynapseGroupsync }}
+      - "values-synapse-groupsync.yaml.gotmpl"
+      {{- range .Values.customization.release.opendeskSynapseGroupsync }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.elementGroupsync.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.elementGroupsync.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/element/helmfile.yaml.gotmpl
+++ b/helmfile/apps/element/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/element/values-element.yaml.gotmpl
+++ b/helmfile/apps/element/values-element.yaml.gotmpl
@@ -4,6 +4,18 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+affinity:
+  podAntiAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+    - weight: 100
+      podAffinityTerm:
+        labelSelector:
+          matchExpressions:
+          - key: app.kubernetes.io/instance
+            operator: In
+            values:
+            - jitsi
+        topologyKey: kubernetes.io/hostname
 configuration:
  endToEndEncryption: true
  additionalConfiguration:
--- a/helmfile/apps/element/values-synapse-admin.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-admin.yaml.gotmpl
@@ -0,0 +1,87 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  adminBot:
+    backupPhrase: {{ .Values.secrets.matrixAdminBot.backupPassphrase | quote }}
+    #name: "adminbot"
+    #secretName: "matrix-adminbot-account"
+    #secretKey: "access_token"
+  auditBot:
+    backupPhrase: {{ .Values.secrets.matrixAuditBot.backupPassphrase | quote }}
+    #name: "auditbot"
+  database:
+    host: {{ .Values.databases.synapse.host | quote }}
+    port: {{ .Values.databases.synapse.port }}
+    name: {{ .Values.databases.synapse.name | quote }}
+    user: {{ .Values.databases.synapse.username | quote }}
+    password:
+      value: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
+    requireAuth: {{ .Values.databases.synapse.requireAuth }}
+    channelBinding: {{ .Values.databases.synapse.channelBinding | quote }}
+    connectTimeout: {{ .Values.databases.synapse.connectTimeout }}
+    clientEncoding: {{ .Values.databases.synapse.clientEncoding | quote }}
+    keepalives: {{ .Values.databases.synapse.keepalives }}
+    keepalivesIdle: {{ .Values.databases.synapse.keepalivesIdle }}
+    keepalivesInterval: {{ .Values.databases.synapse.keepalivesInterval }}
+    keepalivesCount: {{ .Values.databases.synapse.keepalivesCount }}
+    replication: {{ .Values.databases.synapse.replication }}
+    gssencmode: {{ .Values.databases.synapse.gssencmode | quote }}
+    sslmode: {{ .Values.databases.synapse.sslmode | quote }}
+    sslcompression: {{ .Values.databases.synapse.sslcompression }}
+    sslMinProtocolVersion: {{ .Values.databases.synapse.sslMinProtocolVersion | quote }}
+    connectionPoolMin: {{ .Values.databases.synapse.connectionPoolMin }}
+    connectionPoolMax: {{ .Values.databases.synapse.connectionPoolMax }}
+  # Settings regarding homeserver.
+  homeserver:
+    # -- URL of synapse deployment. As default the url of synapse will be used.
+    #baseUrl: ""
+    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
+  ldap:
+    base: {{ .Values.ldap.baseDn | quote }}
+    bind_dn: "uid=ldapsearch_element,cn=users,{{ .Values.ldap.baseDn }}"
+    bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
+    filter: "(memberOf=cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }})"
+    uri: {{ printf "ldap://%s:389" .Values.ldap.host | quote }}
+cron:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSyncAdmins.registry | quote }}
+    repository: {{ .Values.images.elementSyncAdmins.repository | quote }}
+    tag: {{ .Values.images.elementSyncAdmins.tag | quote }}
+    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+#fullnameOverride: "opendesk-synapse-admin"
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSynapseAdmin.registry | quote }}
+  repository: {{ .Values.images.elementSynapseAdmin.repository | quote }}
+  tag: {{ .Values.images.elementSynapseAdmin.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  tls:
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+{{- if .Values.certificate.selfSigned }}
+extraEnvVars:
+  - name: "NODE_EXTRA_CA_CERTS"
+    value: "/etc/ssl/certs/ca-certificates.crt"
+extraVolumes:
+  - name: "trusted-cert-secret-volume"
+    secret:
+      secretName: "opendesk-certificates-ca-tls"
+      items:
+        - key: "ca.crt"
+          path: "ca-certificates.crt"
+extraVolumeMounts:
+  - name: "trusted-cert-secret-volume"
+    mountPath: "/etc/ssl/certs/ca-certificates.crt"
+    subPath: "ca-certificates.crt"
+{{- end }}
+...
--- a/helmfile/apps/element/values-synapse-adminbot-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-adminbot-bootstrap.yaml.gotmpl
@@ -0,0 +1,33 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  username: "adminbot"
+  pod: "opendesk-synapse-0"
+  secretName: "matrix-adminbot-account"
+  password: {{ .Values.secrets.matrixAdminBot.password | quote }}
+  pipeConfig:
+    enabled: true
+    type: "admin"
+    secretName: "matrix-adminbot-config"
+    asToken: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
+    hsToken: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
+    serviceUrl: "http://opendesk-synapse-web:8008"
+    backupPassphrase: {{ .Values.secrets.matrixAdminBot.backupPassphrase | quote }}
+    homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
+image:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
+  url: {{ .Values.images.synapseCreateUser.repository | quote }}
+  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+fullnameOverride: "matrix-adminbot-bootstrap"
+...
--- a/helmfile/apps/element/values-synapse-adminbot-pipe.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-adminbot-pipe.yaml.gotmpl
@@ -0,0 +1,21 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  secretName: "matrix-adminbot-config"
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
+  url: {{ .Values.images.elementPipe.repository | quote }}
+  tag: {{ .Values.images.elementPipe.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+fullnameOverride: "opendesk-synapse-adminbot-pipe"
+...
--- a/helmfile/apps/element/values-synapse-adminbot-web.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-adminbot-web.yaml.gotmpl
@@ -0,0 +1,25 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  homeserver:
+    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementAdminBot.registry | quote }}
+  repository: {{ .Values.images.elementAdminBot.repository | quote }}
+  tag: {{ .Values.images.elementAdminBot.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+ingress:
+  enabled: {{ .Values.ingress.enabled }}
+  tls:
+    secretName: {{ .Values.ingress.tls.secretName | quote }}
+...
--- a/helmfile/apps/element/values-synapse-auditbot-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-auditbot-bootstrap.yaml.gotmpl
@@ -0,0 +1,33 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  username: "auditbot"
+  pod: "opendesk-synapse-0"
+  secretName: "matrix-auditbot-account"
+  password: {{ .Values.secrets.matrixAuditBot.password | quote }}
+  pipeConfig:
+    enabled: true
+    type: "admin"
+    secretName: "matrix-auditbot-config"
+    asToken: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
+    hsToken: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
+    serviceUrl: "http://opendesk-synapse-web:8008"
+    backupPassphrase: {{ .Values.secrets.matrixAuditBot.backupPassphrase | quote }}
+    homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
+image:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
+  url: {{ .Values.images.synapseCreateUser.repository | quote }}
+  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+fullnameOverride: "matrix-auditbot-bootstrap"
+...
--- a/helmfile/apps/element/values-synapse-auditbot-pipe.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-auditbot-pipe.yaml.gotmpl
@@ -0,0 +1,21 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  secretName: "matrix-auditbot-config"
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
+  url: {{ .Values.images.elementPipe.repository | quote }}
+  tag: {{ .Values.images.elementPipe.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+fullnameOverride: "opendesk-synapse-auditbot-pipe"
+...
--- a/helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl
@@ -0,0 +1,56 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+global:
+  domain: {{ .Values.global.domain | quote }}
+  hosts:
+    {{ .Values.global.hosts | toYaml | nindent 4 }}
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+configuration:
+  asToken: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
+  dryRun: false
+  hsToken: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
+  id: "gps"
+  homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
+  registrationSharedSecret: {{ .Values.secrets.synapse.registrationSharedSecret | quote }}
+  runOnce: false
+  username: "groupsyncbot"
+  ldap:
+    attributes:
+      name: "description"
+      uid: "uid"
+    base: {{ .Values.ldap.baseDn | quote }}
+    bind_dn: "uid=ldapsearch_element,cn=users,{{ .Values.ldap.baseDn }}"
+    bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
+    check_interval_seconds: 60
+    type: mapped-ldap
+    uri: "ldap://ums-ldap-server:389"
+  spaces:
+    - groups:
+        - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
+          powerLevel: 50
+        - externalId: "cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}"
+      id: "c3122e32-4e05-4bf8-8a5d-66679076ed36"
+      name: "openDesk"
+      subspaces:
+        - groups:
+            - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
+              powerLevel: 50
+          id: "e7889d96-5baa-4e21-be6e-12c66b2e9565"
+          name: "openDesk Element Admins"
+  provisionerDefaultRooms:
+    - id: "c3122e32-4e05-4bf8-8a5d-66679076ed36"
+      properties:
+        name: "openDesk"
+  # Name of group sync service (default opendesk-synapse-groupsync)
+  groupSyncService: "opendesk-synapse-groupsync"
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementGroupsync.registry | quote }}
+  url: {{ .Values.images.elementGroupsync.repository | quote }}
+  tag: {{ .Values.images.elementGroupsync.tag | quote }}
+  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+...
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -4,6 +4,18 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+affinity:
+  podAntiAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+    - weight: 100
+      podAffinityTerm:
+        labelSelector:
+          matchExpressions:
+          - key: app.kubernetes.io/instance
+            operator: In
+            values:
+            - jitsi
+        topologyKey: kubernetes.io/hostname
 configuration:
  additionalConfiguration:
    user_directory:
@@ -69,6 +81,60 @@ configuration:
              regex: "@.*"
        url: null
        sender_localpart: ox-appsuite
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{- if .Values.apps.elementAdmin.enabled }}
+      - as_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
+        id: "element-adminbot-pipe"
+        namespaces:
+          rooms:
+            - exclusive: false
+              regex: "!.*:{{ .Values.global.domain }}"
+          users:
+            - exclusive: false
+              regex: "@.*:.*"
+            - exclusive: true
+              regex: "@adminbot:{{ .Values.global.domain }}"
+        de.sorunome.msc2409.push_ephemeral: true
+        org.matrix.msc3202: true
+        url: "http://opendesk-synapse-adminbot-pipe:9995"
+        rate_limited: false
+        sender_localpart: "adminbot-sendernotinuse"
+      - as_token: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
+        id: "element-auditbot-pipe"
+        namespaces:
+          rooms:
+            - exclusive: false
+              regex: "!.*:{{ .Values.global.domain }}"
+          users:
+            - exclusive: false
+              regex: "@.*:.*"
+            - exclusive: true
+              regex: "@auditbot:{{ .Values.global.domain }}"
+        de.sorunome.msc2409.push_ephemeral: true
+        org.matrix.msc3202: true
+        url: "http://opendesk-synapse-auditbot-pipe:9995"
+        rate_limited: false
+        sender_localpart: "auditbot-sendernotinuse"
+      {{- end }}
+      {{- if .Values.apps.elementGroupsync.enabled }}
+      - as_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
+        hs_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
+        id: "gps"
+        namespaces:
+          rooms:
+            - exclusive: false
+              regex: "!.*:{{ .Values.global.domain }}"
+          users:
+            - exclusive: false
+              regex: '@.*:{{ .Values.global.domain }}'
+        url: "http://opendesk-synapse-groupsync:10010"
+        rate_limited: false
+        sender_localpart: "groupsyncbot"
+      {{- end }}
+    registrationSharedSecret: {{ .Values.secrets.synapse.registrationSharedSecret | quote }}
+    {{- end }}

    presence:
      enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
@@ -78,7 +144,7 @@ configuration:

    smtp:
      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
-      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
      port: 25
      tls: false
      starttls: false
--- a/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"

 releases:
  - name: "jitsi"
@@ -18,10 +18,10 @@ releases:
    version: "{{ .Values.charts.jitsi.version }}"
    values:
      - "values-jitsi.yaml.gotmpl"
-      {{ range .Values.customization.release.jitsi }}
+      {{- range .Values.customization.release.jitsi }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.jitsi.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.jitsi.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/jitsi/helmfile.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -4,6 +4,30 @@ SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG Ze
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
+affinity:
+  podAntiAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 50
+        podAffinityTerm:
+          labelSelector:
+            matchExpressions:
+              - key: app.kubernetes.io/instance
+                operator: In
+                values:
+                  - opendesk-synapse
+          topologyKey: kubernetes.io/hostname
+  {{- with .Values.cluster.computeNodeLabel }}
+  nodeAffinity:
+    preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 100
+        preference:
+          matchExpressions:
+            - key: {{ .key }}
+              operator: In
+              values:
+                - {{ .value }}
+  {{- end }}
+
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
@@ -85,7 +109,7 @@ jitsi:
        - secretName: {{ .Values.ingress.tls.secretName | quote }}
          hosts:
            - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
-    extraConfigJs:
+    extraConfig:
      doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
    extraEnvs:
      TURN_ENABLE: "1"
@@ -103,6 +127,29 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 50
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                  - key: app.kubernetes.io/instance
+                    operator: In
+                    values:
+                      - opendesk-synapse
+              topologyKey: kubernetes.io/hostname
+      {{- with .Values.cluster.computeNodeLabel }}
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            preference:
+              matchExpressions:
+                - key: {{ .key }}
+                  operator: In
+                  values:
+                    - {{ .value }}
+      {{- end }}
  prosody:
    image:
      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
@@ -152,6 +199,29 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.prosody | toYaml | nindent 8 }}
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 50
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                  - key: app.kubernetes.io/instance
+                    operator: In
+                    values:
+                      - opendesk-synapse
+              topologyKey: kubernetes.io/hostname
+      {{- with .Values.cluster.computeNodeLabel }}
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            preference:
+              matchExpressions:
+                - key: {{ .key }}
+                  operator: In
+                  values:
+                    - {{ .value }}
+      {{- end }}
  jicofo:
    replicaCount: {{ .Values.replicas.jicofo }}
    image:
@@ -175,6 +245,81 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 50
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                  - key: app.kubernetes.io/instance
+                    operator: In
+                    values:
+                      - opendesk-synapse
+              topologyKey: kubernetes.io/hostname
+      {{- with .Values.cluster.computeNodeLabel }}
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            preference:
+              matchExpressions:
+                - key: {{ .key }}
+                  operator: In
+                  values:
+                    - {{ .value }}
+      {{- end }}
+  jigasi:
+    replicaCount: {{ .Values.replicas.jigasi }}
+    enabled: {{ .Values.sip.jigasi.enabled }}
+    image:
+      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jigasi.registry }}/{{ .Values.images.jigasi.repository }}"
+      tag: {{ .Values.images.jigasi.tag | quote }}
+      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+    extraEnvs:
+      JIGASI_SIP_PASSWORD: {{ .Values.sip.jigasi.password | quote }}
+      JIGASI_SIP_PORT: {{ .Values.sip.jigasi.port | quote }}
+      JIGASI_SIP_SERVER: {{ .Values.sip.jigasi.server | quote }}
+      JIGASI_SIP_TRANSPORT: {{ .Values.sip.jigasi.transport | quote }}
+      JIGASI_SIP_URI: {{ .Values.sip.jigasi.uri | quote }}
+    xmpp:
+      password: {{ .Values.secrets.jitsi.jigasiXmppPassword | quote }}
+    resources:
+      {{ .Values.resources.jigasi | toYaml | nindent 6 }}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities: {}
+      privileged: false
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
+      seccompProfile:
+        type: "RuntimeDefault"
+      seLinuxOptions:
+        {{ .Values.seLinuxOptions.jigasi | toYaml | nindent 8 }}
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 50
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                  - key: app.kubernetes.io/instance
+                    operator: In
+                    values:
+                      - opendesk-synapse
+              topologyKey: kubernetes.io/hostname
+      {{- with .Values.cluster.computeNodeLabel }}
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            preference:
+              matchExpressions:
+                - key: {{ .key }}
+                  operator: In
+                  values:
+                    - {{ .value }}
+      {{- end }}
  jvb:
    replicaCount: {{ .Values.replicas.jvb }}
    # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
@@ -190,7 +335,7 @@ jitsi:
    resources:
      {{ .Values.resources.jvb | toYaml | nindent 6 }}
    service:
-      type: {{ .Values.cluster.service.type | quote }}
+      type: {{ coalesce .Values.service.type.jitsiVideoBridge .Values.cluster.service.type | quote }}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: {}
@@ -200,6 +345,29 @@ jitsi:
      runAsNonRoot: false
      runAsUser: 0
      seccompProfile:
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 50
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                  - key: app.kubernetes.io/instance
+                    operator: In
+                    values:
+                      - opendesk-synapse
+              topologyKey: kubernetes.io/hostname
+      {{- with .Values.cluster.computeNodeLabel }}
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            preference:
+              matchExpressions:
+                - key: {{ .key }}
+                  operator: In
+                  values:
+                    - {{ .value }}
+      {{- end }}
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jvb | toYaml | nindent 8 }}
--- a/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
@@ -10,14 +10,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
  - name: "nextcloud-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.nextcloud.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"

 releases:
  - name: "opendesk-nextcloud-management"
@@ -25,24 +25,30 @@ releases:
    version: "{{ .Values.charts.nextcloudManagement.version }}"
    values:
      - "values-nextcloud-mgmt.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskNextcloudManagement }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-nextcloud-mgmt-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.opendeskNextcloudManagement }}
      - {{ . }}
-      {{ end }}
+      {{- end }}
    waitForJobs: true
    wait: true
-    installed: {{ .Values.nextcloud.enabled }}
+    installed: {{ .Values.apps.nextcloud.enabled }}
    timeout: 900
  - name: "opendesk-nextcloud"
    chart: "nextcloud-repo/{{ .Values.charts.nextcloud.name }}"
    version: "{{ .Values.charts.nextcloud.version }}"
    values:
      - "values-nextcloud.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskNextcloud }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-nextcloud-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.opendeskNextcloud }}
      - {{ . }}
-      {{ end }}
+      {{- end }}
    needs:
      - "opendesk-nextcloud-management"
-    installed: {{ .Values.nextcloud.enabled }}
+    installed: {{ .Values.apps.nextcloud.enabled }}

 commonLabels:
  deployStage: "050-components"
--- a/helmfile/apps/nextcloud/helmfile.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/nextcloud/values-nextcloud-enterprise.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-enterprise.yaml.gotmpl
@@ -0,0 +1,9 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+aio:
+  image:
+    registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
+...
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt-enterprise.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt-enterprise.yaml.gotmpl
@@ -0,0 +1,12 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
+configuration:
+  enterprise:
+    subscriptionKey: {{ if .Values.enterpriseKeys.nextcloud.subscriptionKey }}{{ .Values.enterpriseKeys.nextcloud.subscriptionKey | quote }}{{ end }}
+    subscriptionData: {{ if .Values.enterpriseKeys.nextcloud.subscriptionData}}{{ .Values.enterpriseKeys.nextcloud.subscriptionData | quote }}{{ end }}
+...
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -31,9 +31,9 @@ configuration:
    host: {{ .Values.antivirus.icap.host | quote }}
    port: {{ .Values.antivirus.icap.port | quote }}
    {{- else }}
-    {{- if .Values.clamavDistributed.enabled }}
+    {{- if .Values.apps.clamavDistributed.enabled }}
    host: "clamav-icap"
-    {{- else if .Values.clamavSimple.enabled }}
+    {{- else if .Values.apps.clamavSimple.enabled }}
    host: "clamav-simple"
    {{- end }}
    port: 1344
@@ -55,13 +55,13 @@ configuration:
      contacts:
        enabled: false
      cryptpad:
-        enabled: {{ .Values.cryptpad.enabled }}
+        enabled: {{ .Values.apps.cryptpad.enabled }}
      filesZip:
        enabled: true
      groupfolders:
        enabled: true
      integrationOpenproject:
-        enabled: {{ .Values.openproject.enabled }}
+        enabled: {{ .Values.apps.openproject.enabled }}
      spreed:
        enabled: true
    circles:
@@ -147,7 +147,7 @@ configuration:
        value: ""
      password:
        value: ""
-    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
    port: 25
    fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
    mailDomain: "{{ .Values.global.domain }}"
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -102,6 +102,9 @@ aio:
      {{ .Values.seLinuxOptions.nextcloud | toYaml | nindent 6 }}
  cron:
    successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
+    resources:
+      {{ .Values.resources.nextcloudCron | toYaml | nindent 6 }}
+
  debug:
    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
  {{- if .Values.certificate.selfSigned }}
--- a/helmfile/apps/notes/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/notes/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"

 releases:
  - name: "impress"
@@ -19,10 +19,10 @@ releases:
    wait: true
    values:
      - "values.yaml.gotmpl"
-      {{ range .Values.customization.release.notes }}
+      {{- range .Values.customization.release.notes }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.notes.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.notes.enabled }}
    timeout: 1800

 commonLabels:
--- a/helmfile/apps/notes/helmfile.yaml.gotmpl
+++ b/helmfile/apps/notes/helmfile.yaml.gotmpl
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url:
-      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
+      "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
  # Intercom Service
  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
  - name: "intercom-service-repo"
@@ -19,7 +19,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
  # openDesk Keycloak Bootstrap Chart
  - name: "opendesk-keycloak-bootstrap-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
@@ -27,7 +27,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
  # NGINX S3 Gateway Chart
  - name: "nginx-s3-gateway-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
@@ -35,7 +35,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"

 releases:
  # Univention Management Stack Umbrella Chart
@@ -44,10 +44,10 @@ releases:
    version: "{{ .Values.charts.nubus.version }}"
    values:
      - "values-nubus.yaml.gotmpl"
-      {{ range .Values.customization.release.ums }}
+      {{- range .Values.customization.release.ums }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.nubus.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.nubus.enabled }}
    timeout: 900
  # Intercom-Service
  - name: "intercom-service"
@@ -55,10 +55,10 @@ releases:
    version: "{{ .Values.charts.intercomService.version }}"
    values:
      - "values-intercom-service.yaml.gotmpl"
-      {{ range .Values.customization.release.intercomService }}
+      {{- range .Values.customization.release.intercomService }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.nubus.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.nubus.enabled }}

  # openDesk Keycloak Bootstrap Chart
  - name: "opendesk-keycloak-bootstrap"
@@ -66,12 +66,12 @@ releases:
    version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
    values:
      - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskKeycloakBootstrap }}
+      {{- range .Values.customization.release.opendeskKeycloakBootstrap }}
      - {{ . }}
-      {{ end }}
+      {{- end }}
    needs:
      - "ums"
-    installed: {{ .Values.nubus.enabled }}
+    installed: {{ .Values.apps.nubus.enabled }}
    timeout: 900

  # NGINX S3 Gateway (when cluster minio is not used)
@@ -80,10 +80,10 @@ releases:
    version: "{{ .Values.charts.nginxS3Gateway.version }}"
    values:
      - "values-nginx-s3-gateway.yaml.gotmpl"
-      {{ range .Values.customization.release.nginxS3Gateway }}
+      {{- range .Values.customization.release.nginxS3Gateway }}
      - {{ . }}
-      {{ end }}
-    installed: {{ not .Values.minio.enabled }}
+      {{- end }}
+    installed: {{ not .Values.apps.minio.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/nubus/helmfile.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -42,6 +42,12 @@ global:
        repository: {{ .Values.images.nubusOpendeskExtension.repository }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
        tag: {{ .Values.images.nubusOpendeskExtension.tag }}
+    - name: "opendesk-a2g-mapper"
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpendeskExtensionA2gMapper.registry | quote }}
+        repository: {{ .Values.images.nubusOpendeskExtensionA2gMapper.repository }}
+        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+        tag: {{ .Values.images.nubusOpendeskExtensionA2gMapper.tag }}

  # -- Allows to configure the system extensions to load. This is intended for
  # internal usage, prefer to use `global.extensions` for user configured
@@ -119,7 +125,7 @@ global:

 ingress:
  # temporary fix
-  {{- if not .Values.minio.enabled }}
+  {{- if not .Values.apps.minio.enabled }}
  enabled: false
  {{- end }}
  certManager:
@@ -377,6 +383,7 @@ nubusGuardian:
      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 nubusNotificationsApi:
+  enabled: false
  additionalAnnotations:
    intents.otterize.com/service-name: "ums-notifications-api"
  containerSecurityContext:
@@ -515,6 +522,7 @@ nubusKeycloakExtensions:
    connection:
      host: {{ .Values.databases.keycloakExtension.host | quote }}
      port: {{ .Values.databases.keycloakExtension.port | quote }}
+      ssl: {{ .Values.databases.keycloakExtension.ssl | quote }}
    auth:
      database: {{ .Values.databases.keycloakExtension.name | quote }}
      username: {{ .Values.databases.keycloakExtension.username | quote }}
@@ -524,7 +532,7 @@ nubusKeycloakExtensions:
          password: "umcKeycloakExtensionsDatabasePassword"
  smtp:
    connection:
-      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
      port: 25
      ssl: false
      starttls: false
@@ -537,6 +545,7 @@ nubusKeycloakExtensions:
          password: "umcKeycloakExtensionsSmtpPassword"
  handler:
    appConfig:
+      newDeviceLoginNotificationEnable: {{ if .Values.functional.authentication.newDeviceLoginNotification.enabled }}"True"{{ else }}"False"{{ end }}
      logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
      newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
@@ -736,6 +745,7 @@ nubusUdmRestApi:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
  ingress:
+    enabled: {{ .Values.functional.externalServices.nubus.udmRestApi.enabled }}
    certManager:
      enabled: false
    tls:
@@ -1095,15 +1105,18 @@ nubusStackDataUms:
    umcMemcachedUsername: ""
    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
    umcHtmlTitle: "Portal - {{ .Values.theme.texts.productName }}"
-    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
    smtpPort: 25
    smtpUser: ""
    smtpStartTls: false
    ldapBase: {{ .Values.ldap.baseDn }}
  templateContext:
-    initialPasswordDefaultAdmin: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote }}
-    initialPasswordDefaultUser: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote }}
    initialPasswordAdministrator: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote }}
+    apps: {{ .Values.apps | toYaml | nindent 6 }}
+    opendeskEnterprise: {{ env "OPENDESK_ENTERPRISE" }}
+    opendeskAdminAttributes: true
+    opendeskGroupAttributes: true
+    opendeskUserAttributes: true
    portalEnforceLogin: {{ .Values.functional.portal.enforceLogin }}
    portalHeaderLogo: {{ toYaml .Values.theme.imagery.logoHeaderSvgB64 | quote }}
    portalTiles: {{ toYaml .Values.theme.imagery.portalTiles | nindent 6 }}
@@ -1116,9 +1129,9 @@ nubusStackDataUms:
    portalNotesLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.notes .Values.global.domain }}
    portalTitleDE: "Portal - {{ .Values.theme.texts.productName }}"
    portalTitleEN: "Portal - {{ .Values.theme.texts.productName }}"
+    portalLinkLegalNotice: {{ .Values.functional.portal.linkLegalNotice }}
+    portalLinkPrivacyStatement: {{ .Values.functional.portal.linkPrivacyStatement }}
    oxDefaultContext: "1"
-    componentEnabled:
-      notes: {{ .Values.notes.enabled }}
    ldapSearchUsers:
      {{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
      - username: {{ printf "ldapsearch_%s" $username | quote }}
@@ -1151,12 +1164,18 @@ nubusStackDataUms:
    portaltileGroupNotes:
      - 'cn=managed-by-attribute-Notes,cn=groups,{{ .Values.ldap.baseDn }}'
    systemInformation:
-      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
+      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}{{ if eq (env "OPENDESK_ENTERPRISE") "true" }}-ee{{ end }}"
      {{- if .Values.functional.admin.portal.deploymentTimestamp.enabled }}
      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
      {{- else }}
      deployDate: false
      {{- end }}
+    # executes a list of UDM commands as step `03-custom-initializer.yaml` of the opendesk-nubus customization
+    # Ref. https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/tree/main/udm/udm-data-loader
+    udmCustomInitializer: []
+    # executes a list of UDM commands as step `97-custom-finalizer.yaml` of the opendesk-nubus customization
+    # Ref. https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/tree/main/udm/udm-data-loader
+    udmCustomFinalizer: []

 nubusUmcServer:
  additionalAnnotations:
--- a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -22,31 +22,42 @@ cleanup:

 config:
  clientAccessRestrictions:
+    {{- if .Values.apps.element.enabled }}
    matrix:
      client: "opendesk-matrix"
      scope: "opendesk-matrix-scope"
      role: "opendesk-matrix-access-control"
      group: "managed-by-attribute-Livecollaboration"
+    {{- end }}
+    {{- if .Values.apps.jitsi.enabled }}
    jitsi:
      client: "opendesk-jitsi"
      scope: "opendesk-jitsi-scope"
      role: "opendesk-jitsi-access-control"
      group: "managed-by-attribute-Videoconference"
+    {{- end }}
+    {{- if .Values.apps.xwiki.enabled }}
    xwiki:
      client: "opendesk-xwiki"
      scope: "opendesk-xwiki-scope"
      role: "opendesk-xwiki-access-control"
      group: "managed-by-attribute-Knowledgemanagement"
+    {{- end }}
+    {{- if .Values.apps.openproject.enabled }}
    openproject:
      client: "opendesk-openproject"
      scope: "opendesk-openproject-scope"
      role: "opendesk-openproject-access-control"
      group: "managed-by-attribute-Projectmanagement"
+    {{- end }}
+    {{- if .Values.apps.nextcloud.enabled }}
    nextcloud:
      client: "opendesk-nextcloud"
      scope: "opendesk-nextcloud-scope"
      role: "opendesk-nextcloud-access-control"
      group: "managed-by-attribute-Fileshare"
+    {{- end }}
+    {{- if .Values.apps.oxAppSuite.enabled }}
    oxAppSuite:
      client: "opendesk-oxappsuite"
      scope: "opendesk-oxappsuite-scope"
@@ -57,7 +68,8 @@ config:
      scope: "opendesk-dovecot-scope"
      role: "opendesk-dovecot-access-control"
      group: "managed-by-attribute-Groupware"
-    {{- if .Values.notes.enabled }}
+    {{- end }}
+    {{- if .Values.apps.notes.enabled }}
    notes:
      client: "opendesk-notes"
      scope: "opendesk-notes-scope"
@@ -65,8 +77,6 @@ config:
      group: "managed-by-attribute-Notes"
    {{- end }}

-  componentEnabled:
-    notes: {{ .Values.notes.enabled }}
  custom:
    clientScopes:
      {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
@@ -88,13 +98,14 @@ config:
  twoFactorSettings:
    additionalGroups: {{ .Values.functional.authentication.twoFactor.groups }}
  precreateGroups: [ 'Domain Admins', 'Domain Users', '2fa-users', 'IAM API - Full Access',
-                     'managed-by-attribute-Fileshare', 'managed-by-attribute-FileshareAdmin',
-                     'managed-by-attribute-Knowledgemanagement', 'managed-by-attribute-KnowledgemanagementAdmin',
-                     'managed-by-attribute-Livecollaboration', 'managed-by-attribute-LivecollaborationAdmin',
-                     'managed-by-attribute-Projectmanagement', 'managed-by-attribute-ProjectmanagementAdmin',
-                     'managed-by-attribute-Videoconference',
-                     'managed-by-attribute-Groupware',
-                     'managed-by-attribute-Notes' ]
+                     {{ if .Values.apps.nextcloud.enabled }}'managed-by-attribute-Fileshare', 'managed-by-attribute-FileshareAdmin',{{ end }}
+                     {{ if .Values.apps.xwiki.enabled }}'managed-by-attribute-Knowledgemanagement', 'managed-by-attribute-KnowledgemanagementAdmin',{{ end }}
+                     {{ if .Values.apps.element.enabled }}'managed-by-attribute-Livecollaboration', 'managed-by-attribute-LivecollaborationAdmin',{{ end }}
+                     {{ if .Values.apps.openproject.enabled }}'managed-by-attribute-Projectmanagement', 'managed-by-attribute-ProjectmanagementAdmin',{{ end }}
+                     {{ if .Values.apps.jitsi.enabled }}'managed-by-attribute-Videoconference',{{ end }}
+                     {{ if .Values.apps.oxAppSuite.enabled }}'managed-by-attribute-Groupware',{{ end }}
+                     {{ if .Values.apps.notes.enabled }}'managed-by-attribute-Notes',{{ end }}
+                      ]

  opendesk:
    # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
@@ -105,6 +116,7 @@ config:
        protocol: "openid-connect"
      - name: "write_contacts"
        protocol: "openid-connect"
+      {{ if .Values.apps.openproject.enabled }}
      - name: "opendesk-openproject-scope"
        description: "Scope for the claims required by openDesk's OpenProject instance."
        protocol: "openid-connect"
@@ -178,6 +190,8 @@ config:
              access.token.claim: true
              claim.name: "family_name"
              jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.jitsi.enabled }}
      - name: "opendesk-jitsi-scope"
        description: "Scope for the claims required by openDesk's Jitsi instance."
        protocol: "openid-connect"
@@ -225,6 +239,8 @@ config:
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.nextcloud.enabled }}
      - name: "opendesk-nextcloud-scope"
        description: "Scope for the claims required by openDesk's Nextcloud instance."
        protocol: "openid-connect"
@@ -274,6 +290,8 @@ config:
              access.token.claim: true
              claim.name: "context"
              jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.element.enabled }}
      - name: "opendesk-matrix-scope"
        description: "Scope for the claims required by openDesk's Matrix instance."
        protocol: "openid-connect"
@@ -321,6 +339,8 @@ config:
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.xwiki.enabled }}
      - name: "opendesk-xwiki-scope"
        description: "Scope for the claims required by openDesk's XWiki instance."
        protocol: "openid-connect"
@@ -368,6 +388,8 @@ config:
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
+      {{ end }}
+      {{ if .Values.apps.oxAppSuite.enabled }}
      - name: "opendesk-dovecot-scope"
        description: "Scope for the claims required by openDesk's Dovecot instance."
        protocol: "openid-connect"
@@ -431,7 +453,8 @@ config:
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
-{{ if .Values.notes.enabled }}
+      {{ end }}
+      {{ if .Values.apps.notes.enabled }}
      - name: "opendesk-notes-scope"
        description: "Scope for the claims required by openDesk's Notes instance."
        protocol: "openid-connect"
@@ -472,7 +495,7 @@ config:
              access.token.claim: true
              claim.name: "family_name"
              jsonType.label: "String"
-{{ end }}
+      {{ end }}
    clients:
      - name: "opendesk-intercom"
        clientId: "opendesk-intercom"
@@ -522,7 +545,7 @@ config:
              jsonType.label: "String"
        defaultClientScopes:
          - "offline_access"
-{{ if .Values.notes.enabled }}
+      {{ if .Values.apps.notes.enabled }}
      - name: "opendesk-notes"
        clientId: "opendesk-notes"
        protocol: "openid-connect"
@@ -560,7 +583,8 @@ config:
          user.info.response.signature.alg: "RS256"
        defaultClientScopes:
          - "opendesk-notes-scope"
-{{ end }}
+      {{ end }}
+      {{ if .Values.apps.oxAppSuite.enabled }}
      - name: "opendesk-dovecot"
        clientId: "opendesk-dovecot"
        protocol: "openid-connect"
@@ -574,6 +598,28 @@ config:
          backchannel.logout.session.required: false
        defaultClientScopes:
          - "opendesk-dovecot-scope"
+      - name: "opendesk-oxappsuite"
+        clientId: "opendesk-oxappsuite"
+        protocol: "openid-connect"
+        clientAuthenticatorType: "client-secret"
+        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
+        redirectUris:
+          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
+          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+        consentRequired: false
+        frontchannelLogout: false
+        publicClient: false
+        authorizationServicesEnabled: false
+        attributes:
+          backchannel.logout.session.required: true
+          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
+          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
+        defaultClientScopes:
+          - "opendesk-oxappsuite-scope"
+          - "read_contacts"
+          - "write_contacts"
+      {{ end }}
+      {{ if .Values.apps.jitsi.enabled }}
      - name: "opendesk-jitsi"
        clientId: "opendesk-jitsi"
        protocol: "openid-connect"
@@ -587,6 +633,8 @@ config:
        authorizationServicesEnabled: false
        defaultClientScopes:
          - "opendesk-jitsi-scope"
+      {{ end }}
+      {{ if .Values.apps.element.enabled }}
      - name: "opendesk-matrix"
        clientId: "opendesk-matrix"
        protocol: "openid-connect"
@@ -609,6 +657,8 @@ config:
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-matrix-scope"
+      {{ end }}
+      {{ if .Values.apps.nextcloud.enabled }}
      - name: "opendesk-nextcloud"
        clientId: "opendesk-nextcloud"
        protocol: "openid-connect"
@@ -629,6 +679,8 @@ config:
          - "opendesk-nextcloud-scope"
          - "read_contacts"
          - "write_contacts"
+      {{ end }}
+      {{ if .Values.apps.openproject.enabled }}
      - name: "opendesk-openproject"
        clientId: "opendesk-openproject"
        protocol: "openid-connect"
@@ -648,26 +700,8 @@ config:
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-openproject-scope"
-      - name: "opendesk-oxappsuite"
-        clientId: "opendesk-oxappsuite"
-        protocol: "openid-connect"
-        clientAuthenticatorType: "client-secret"
-        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
-        redirectUris:
-          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
-          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        consentRequired: false
-        frontchannelLogout: false
-        publicClient: false
-        authorizationServicesEnabled: false
-        attributes:
-          backchannel.logout.session.required: true
-          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
-          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
-        defaultClientScopes:
-          - "opendesk-oxappsuite-scope"
-          - "read_contacts"
-          - "write_contacts"
+      {{ end }}
+      {{ if .Values.apps.xwiki.enabled }}
      - name: "opendesk-xwiki"
        clientId: "opendesk-xwiki"
        protocol: "openid-connect"
@@ -686,6 +720,7 @@ config:
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-xwiki-scope"
+      {{ end }}

 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
@@ -7,19 +7,31 @@ repositories:
  - name: "dovecot-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.dovecot.verify }}
+    oci: true
+  {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+  {{- else }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+  {{- end }}

  # Open-Xchange
  - name: "open-xchange-repo"
    keyring: "../../files/gpg-pubkeys/open-xchange-com.gpg"
    verify: {{ .Values.charts.oxAppSuite.verify }}
+    oci: true
+  {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
+    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+  {{- else }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+  {{- end }}

  # openDesk Open-Xchange Bootstrap
  # Source:
@@ -30,14 +42,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"

  # OX Connector
  - name: "ox-connector-repo"
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"

 releases:
  - name: "dovecot"
@@ -45,10 +57,13 @@ releases:
    version: "{{ .Values.charts.dovecot.version }}"
    values:
      - "values-dovecot.yaml.gotmpl"
-      {{ range .Values.customization.release.dovecot }}
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-dovecot-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.dovecot }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.dovecot.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.dovecot.enabled }}
    timeout: 900

  - name: "open-xchange"
@@ -56,11 +71,14 @@ releases:
    version: "{{ .Values.charts.oxAppSuite.version }}"
    values:
      - "values-openxchange.yaml.gotmpl"
-      - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
-      {{ range .Values.customization.release.openxchange }}
+      - "values-openxchange-contact-picker.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "values-openxchange-enterprise.yaml.gotmpl"
+      {{- end }}
+      {{- range .Values.customization.release.openxchange }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.oxAppSuite.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.oxAppSuite.enabled }}
    timeout: 900

  - name: "opendesk-open-xchange-bootstrap"
@@ -68,10 +86,10 @@ releases:
    version: "{{ .Values.charts.oxAppSuiteBootstrap.version }}"
    values:
      - "values-openxchange-bootstrap.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskOpenxchangeBootstrap }}
+      {{- range .Values.customization.release.opendeskOpenxchangeBootstrap }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.oxAppSuite.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.oxAppSuite.enabled }}
    timeout: 900

  - name: "ox-connector"
@@ -79,10 +97,10 @@ releases:
    version: "{{ .Values.charts.oxConnector.version }}"
    values:
      - "values-oxconnector.yaml.gotmpl"
-      {{ range .Values.customization.release.oxConnector }}
+      {{- range .Values.customization.release.oxConnector }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.oxAppSuite.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.oxAppSuite.enabled }}
    needs:
      - "open-xchange"

--- a/helmfile/apps/open-xchange/helmfile.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
@@ -0,0 +1,45 @@
+{{/*
+SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+image:
+  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.dovecot.registry | quote }}
+  repository: {{ .Values.images.dovecot.repository | quote }}
+  tag: {{ .Values.images.dovecot.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+imageInitCassandra:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandra.registry | quote }}
+  repository: {{ .Values.images.cassandra.repository | quote }}
+  tag: {{ .Values.images.cassandra.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+imagePullSecrets:
+  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
+
+dovecot:
+  dictmap:
+    enabled: true
+    host: {{ .Values.databases.dovecotDictmap.host | quote }}
+    port: {{ .Values.databases.dovecotDictmap.port }}
+    username: {{ .Values.databases.dovecotDictmap.username | quote }}
+    password: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
+    keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
+  sharedMailboxes:
+    enabled: false
+    host: {{ .Values.databases.dovecotACL.host | quote }}
+    port: {{ .Values.databases.dovecotACL.port }}
+    username: {{ .Values.databases.dovecotACL.username | quote }}
+    password: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
+    keyspace: {{ .Values.databases.dovecotACL.name | quote }}
+  objectStorage:
+    encryption:
+      privateKey:
+        value: {{ env "DOVECOT_CRYPT_PRIVATE_KEY" | quote }}
+      publicKey:
+        value: {{ env "DOVECOT_CRYPT_PUBLIC_KEY" | quote }}
+    fqdn: {{ .Values.objectstores.dovecot.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
+    username: {{ .Values.objectstores.dovecot.username | quote }}
+    password: {{ .Values.secrets.minio.dovecotUser | quote }}
+...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -23,8 +23,8 @@ dovecot:
    enabled: true
    host: {{ .Values.ldap.host | quote }}
    port: 389
-    base: "dc=swp-ldap,dc=internal"
-    dn: "uid=ldapsearch_dovecot,cn=users,dc=swp-ldap,dc=internal"
+    base: "{{ .Values.ldap.baseDn }}"
+    dn: "uid=ldapsearch_dovecot,cn=users,{{ .Values.ldap.baseDn }}"
    password: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
  oidc:
    enabled: true
@@ -34,11 +34,10 @@ dovecot:
    introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
    usernameAttribute: "opendesk_username"
  loginTrustedNetworks: {{ join " " .Values.cluster.networking.cidr | quote }}
-
  submission:
    enabled: true
    ssl: "no"
-    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
+    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"

 certificate:
  secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -105,10 +104,10 @@ persistence:
 resources:
  {{ .Values.resources.dovecot | toYaml | nindent 2 }}

-{{- if or (eq .Values.cluster.service.type "NodePort") (eq .Values.cluster.service.type "LoadBalancer") }}
+{{- if or (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "NodePort") (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "LoadBalancer") }}
 service:
  external:
    enabled: true
-    type: {{ .Values.cluster.service.type | quote }}
+    type: {{ coalesce .Values.service.type.dovecot .Values.cluster.service.type | quote }}
 {{- end }}
 ...
--- a/helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl
@@ -25,7 +25,7 @@ appsuite:
          auth:
            type: "adminDN"
            adminDN:
-              dn: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
+              dn: "uid=ldapsearch_ox,cn=users,{{ .Values.ldap.baseDn }}"
              password: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}

    uiSettings:
--- a/helmfile/apps/open-xchange/values-openxchange-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-enterprise.yaml.gotmpl
@@ -0,0 +1,19 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+appsuite:
+  plugins-ui:
+    enabled: false
+  core-mw:
+    global:
+      extras:
+        monitoring:
+          enabled: true
+    image:
+      registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
+    update:
+      image:
+        registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
+...
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -13,10 +13,14 @@ global:
  mysql:
    host: {{ .Values.databases.oxAppSuite.host | quote }}
    database: {{ .Values.databases.oxAppSuite.name | quote }}
+    readHost: {{ .Values.databases.oxAppSuite.readHost | quote }}
+    readDatabase: {{ .Values.databases.oxAppSuite.name | quote }}
    auth:
      user: {{ .Values.databases.oxAppSuite.username | quote }}
      password: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
      rootPassword: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
+      readUser: {{ .Values.databases.oxAppSuite.readUser | default .Values.databases.oxAppSuite.username | quote }}
+      readPassword: {{ .Values.databases.oxAppSuite.readPassword | default .Values.databases.oxAppSuite.password | quote}}

 nextcloud-integration-ui:
  image:
@@ -276,7 +280,7 @@ appsuite:
      com.openexchange.conference.element.enabled: "true"
      com.openexchange.conference.element.meetingHostUrl: http://matrix-neodatefix-bot
      com.openexchange.conference.element.matrixLoginUrl: http://opendesk-synapse-web:8008/_matrix/client/v3/login
-      com.openexchange.conference.element.matrixUuidClaimName: opendesk_useruuid
+      com.openexchange.conference.element.matrixUuidClaimName: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
      # GDPR
      com.openexchange.gdpr.dataexport.enabled: "false"
      com.openexchange.gdpr.dataexport.active: "false"
@@ -330,8 +334,8 @@ appsuite:
      /opt/open-xchange/etc/system.properties:
        SERVER_NAME: "oxserver"
      /opt/open-xchange/etc/ldapauth.properties:
-        java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/dc=swp-ldap,dc=internal"
-        bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
+        java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/{{ .Values.ldap.baseDn }}"
+        bindDN: "uid=ldapsearch_ox,cn=users,{{ .Values.ldap.baseDn }}"
        bindDNPassword: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}
        bindOnly: "false"
      /opt/open-xchange/etc/antivirus.properties:
@@ -340,9 +344,9 @@ appsuite:
        com.openexchange.antivirus.server: {{ .Values.antivirus.icap.host | quote }}
        com.openexchange.antivirus.port: {{ .Values.antivirus.icap.port | quote }}
        {{- else }}
-        {{- if .Values.clamavDistributed.enabled }}
+        {{- if .Values.apps.clamavDistributed.enabled }}
        com.openexchange.antivirus.server: "clamav-icap"
-        {{- else if .Values.clamavSimple.enabled }}
+        {{- else if .Values.apps.clamavSimple.enabled }}
        com.openexchange.antivirus.server: "clamav-simple"
        {{- end }}
        com.openexchange.antivirus.port: "1344"
--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -73,29 +73,21 @@ podAnnotations: {}

 replicaCount: {{ .Values.replicas.oxConnector }}

+podSecurityContext:
+  fsGroup: 1000
+
 securityContext:
+  privileged: false
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - "ALL"
-    add:
-      - "CHOWN"
-      - "DAC_OVERRIDE"
-      - "FOWNER"
-      - "FSETID"
-      - "KILL"
-      - "SETGID"
-      - "SETUID"
-      - "SETPCAP"
-      - "NET_BIND_SERVICE"
-      - "SYS_CHROOT"
-  privileged: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
  seccompProfile:
    type: "RuntimeDefault"
-  runAsUser: 0
-  runAsGroup: 0
-  runAsNonRoot: false
-  readOnlyRootFilesystem: false
  seLinuxOptions:
    {{ .Values.seLinuxOptions.oxConnector | toYaml | nindent 4 }}

--- a/helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl
@@ -4,27 +4,27 @@
 repositories:
  # openDesk Migrations
  # Source:
-  - name: "openproject-migrations-repo"
+  - name: "opendesk-migrations-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.migrations.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"

 releases:
  - name: "opendesk-migrations-post"
-    chart: "openproject-migrations-repo/{{ .Values.charts.migrations.name }}"
+    chart: "opendesk-migrations-repo/{{ .Values.charts.migrations.name }}"
    version: "{{ .Values.charts.migrations.version }}"
    wait: true
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
-      {{ range .Values.customization.release.migrationsPost }}
+      {{- range .Values.customization.release.migrationsPost }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.migrations.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.migrations.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/opendesk-migrations-post/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-post/helmfile.yaml.gotmpl
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"

 releases:
  - name: "opendesk-migrations-pre"
@@ -21,10 +21,10 @@ releases:
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
-      {{ range .Values.customization.release.migrationsPre }}
+      {{- range .Values.customization.release.migrationsPre }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.migrations.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.migrations.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/opendesk-migrations-pre/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-pre/helmfile.yaml.gotmpl
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"

 releases:
  - name: "opendesk-openproject-bootstrap"
@@ -20,10 +20,10 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskOpenprojectBootstrap }}
+      {{- range .Values.customization.release.opendeskOpenprojectBootstrap }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.openproject.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.openproject.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/opendesk-openproject-bootstrap/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/opendesk-services/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"

  # openDesk Home
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
@@ -20,7 +20,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"

  # openDesk Certificates
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
@@ -30,7 +30,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"

    # openDesk Alerts
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts
@@ -40,7 +40,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"

    # openDesk Grafana Dashboards
    # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards
@@ -50,7 +50,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"

    # openDesk Static Files
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-static-files
@@ -60,7 +60,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskStaticFiles.registry }}/{{ .Values.charts.opendeskStaticFiles.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskStaticFiles.registry }}/{{ .Values.charts.opendeskStaticFiles.repository }}"

 releases:
  - name: "opendesk-otterize"
@@ -68,9 +68,9 @@ releases:
    version: "{{ .Values.charts.otterize.version }}"
    values:
      - "values-otterize.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskOtterize }}
+      {{- range .Values.customization.release.opendeskOtterize }}
      - {{ . }}
-      {{ end }}
+      {{- end }}
    installed: {{ .Values.security.otterizeIntents.enabled }}
    timeout: 900

@@ -79,20 +79,20 @@ releases:
    version: "{{ .Values.charts.home.version }}"
    values:
      - "values-home.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskHome }}
+      {{- range .Values.customization.release.opendeskHome }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.home.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.home.enabled }}

  - name: "opendesk-certificates"
    chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
    version: "{{ .Values.charts.certificates.version }}"
    values:
      - "values-certificates.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskCertificates }}
+      {{- range .Values.customization.release.opendeskCertificates }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.certificates.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.certificates.enabled }}
    timeout: 900

  - name: "opendesk-alerts"
@@ -100,9 +100,9 @@ releases:
    version: "{{ .Values.charts.opendeskAlerts.version }}"
    values:
      - "values-opendesk-alerts.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskAlerts}}
+      {{- range .Values.customization.release.opendeskAlerts }}
      - {{ . }}
-      {{ end }}
+      {{- end }}
    installed: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
    timeout: 900

@@ -111,7 +111,9 @@ releases:
    version: "{{ .Values.charts.opendeskDashboards.version }}"
    values:
      - "values-opendesk-dashboards.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskDashboards | default "additionalValues: false" }}
+      {{- range .Values.customization.release.opendeskDashboards }}
+      - {{ . }}
+      {{- end }}
    installed: {{ .Values.monitoring.grafana.dashboards.enabled }}
    timeout: 900

@@ -120,8 +122,10 @@ releases:
    version: "{{ .Values.charts.opendeskStaticFiles.version }}"
    values:
      - "values-opendesk-static-files.yaml.gotmpl"
-      - {{ .Values.customization.release.opendeskStaticFiles | default "additionalValues: false" }}
-    installed: {{ .Values.staticFiles.enabled }}
+      {{- range .Values.customization.release.opendeskStaticFiles }}
+      - {{ . }}
+      {{- end }}
+    installed: {{ .Values.apps.staticFiles.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/opendesk-services/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
@@ -7,13 +7,13 @@ SPDX-License-Identifier: Apache-2.0
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
-    {{- if .Values.collabora.enabled }}
+    {{- if .Values.apps.collabora.enabled }}
    collabora: {{ .Values.global.hosts.collabora }}
    {{- end }}
-    {{- if .Values.cryptpad.enabled }}
+    {{- if .Values.apps.cryptpad.enabled }}
    cryptpad: {{ .Values.global.hosts.cryptpad }}
    {{- end }}
-    {{- if .Values.element.enabled }}
+    {{- if .Values.apps.element.enabled }}
    element: {{ .Values.global.hosts.element }}
    matrixNeoBoardWidget: {{ .Values.global.hosts.matrixNeoBoardWidget }}
    matrixNeoChoiceWidget: {{ .Values.global.hosts.matrixNeoChoiceWidget }}
@@ -23,30 +23,30 @@ global:
    synapseFederation: {{ .Values.global.hosts.synapseFederation }}
    whiteboard: {{ .Values.global.hosts.whiteboard }}
    {{- end }}
-    {{- if .Values.nubus.enabled }}
+    {{- if .Values.apps.nubus.enabled }}
    intercomService: {{ .Values.global.hosts.intercomService }}
    {{- end }}
-    {{- if .Values.jitsi.enabled }}
+    {{- if .Values.apps.jitsi.enabled }}
    jitsi: {{ .Values.global.hosts.jitsi }}
    {{- end }}
-    {{- if .Values.minio.enabled }}
+    {{- if .Values.apps.minio.enabled }}
    minioApi: {{ .Values.global.hosts.minioApi }}
    minioConsole: {{ .Values.global.hosts.minioConsole }}
    {{- end }}
-    {{- if .Values.nextcloud.enabled }}
+    {{- if .Values.apps.nextcloud.enabled }}
    nextcloud: {{ .Values.global.hosts.nextcloud }}
    {{- end }}
-    {{- if .Values.openproject.enabled }}
+    {{- if .Values.apps.openproject.enabled }}
    openproject: {{ .Values.global.hosts.openproject }}
    {{- end }}
-    {{- if .Values.oxAppSuite.enabled }}
+    {{- if .Values.apps.oxAppSuite.enabled }}
    openxchange: {{ .Values.global.hosts.openxchange }}
    {{- end }}
-    {{- if .Values.nubus.enabled }}
+    {{- if .Values.apps.nubus.enabled }}
    keycloak: {{ .Values.global.hosts.keycloak }}
    nubus: {{ .Values.global.hosts.nubus }}
    {{- end }}
-    {{- if .Values.xwiki.enabled }}
+    {{- if .Values.apps.xwiki.enabled }}
    xwiki: {{ .Values.global.hosts.xwiki }}
    {{- end }}

--- a/helmfile/apps/opendesk-services/values-opendesk-alerts.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-opendesk-alerts.yaml.gotmpl
@@ -10,43 +10,43 @@ additionalLabels:

 config:
  collabora:
-    enable: {{ .Values.collabora.enabled }}
+    enable: {{ .Values.apps.collabora.enabled }}
    selectors:
-      namespace: {{ .Values.collabora.namespace | quote }}
+      namespace: {{ .Values.apps.collabora.namespace | quote }}
  matrix:
-    enable: {{ .Values.element.enabled }}
+    enable: {{ .Values.apps.element.enabled }}
    selectors:
-      namespace: {{ .Values.element.namespace | quote }}
+      namespace: {{ .Values.apps.element.namespace | quote }}
  diagrams:
-    enable: {{ .Values.cryptpad.enabled }}
+    enable: {{ .Values.apps.cryptpad.enabled }}
    selectors:
-      namespace: {{ .Values.cryptpad.namespace | quote }}
+      namespace: {{ .Values.apps.cryptpad.namespace | quote }}
  nextcloud:
-    enable: {{ .Values.nextcloud.enabled }}
+    enable: {{ .Values.apps.nextcloud.enabled }}
    selectors:
-      namespace: {{ .Values.nextcloud.namespace | quote }}
+      namespace: {{ .Values.apps.nextcloud.namespace | quote }}
  openXChange:
-    enable: {{ .Values.oxAppSuite.enabled }}
+    enable: {{ .Values.apps.oxAppSuite.enabled }}
    selectors:
-      namespace: {{ .Values.oxAppSuite.namespace | quote }}
+      namespace: {{ .Values.apps.oxAppSuite.namespace | quote }}
  xwiki:
-    enable: {{ .Values.xwiki.enabled }}
+    enable: {{ .Values.apps.xwiki.enabled }}
    selectors:
-      namespace: {{ .Values.xwiki.namespace | quote }}
+      namespace: {{ .Values.apps.xwiki.namespace | quote }}
  nubus:
-    enable: {{ .Values.nubus.enabled }}
+    enable: {{ .Values.apps.nubus.enabled }}
    selectors:
-      namespace: {{ .Values.nubus.namespace | quote }}
+      namespace: {{ .Values.apps.nubus.namespace | quote }}
  openProject:
-    enable: {{ .Values.openproject.enabled }}
+    enable: {{ .Values.apps.openproject.enabled }}
    selectors:
-      namespace: {{ .Values.openproject.namespace | quote }}
+      namespace: {{ .Values.apps.openproject.namespace | quote }}
  jitsi:
-    enable: {{ .Values.jitsi.enabled }}
+    enable: {{ .Values.apps.jitsi.enabled }}
    selectors:
-      namespace: {{ .Values.jitsi.namespace | quote }}
+      namespace: {{ .Values.apps.jitsi.namespace | quote }}
  collabora:
-    enable: {{ .Values.collabora.enabled }}
+    enable: {{ .Values.apps.collabora.enabled }}
    selectors:
-      namespace: {{ .Values.collabora.namespace | quote }}
+      namespace: {{ .Values.apps.collabora.namespace | quote }}

--- a/helmfile/apps/opendesk-services/values-opendesk-dashboards.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-opendesk-dashboards.yaml.gotmpl
@@ -12,43 +12,43 @@ additionalLabels:
 config:
  apps:
    collabora:
-      enable: {{ .Values.collabora.enabled }}
+      enable: {{ .Values.apps.collabora.enabled }}
      selectors:
-        namespace: {{ .Values.collabora.namespace | quote }}
+        namespace: {{ .Values.apps.collabora.namespace | quote }}
    matrixElement:
-      enable: {{ .Values.element.enabled }}
+      enable: {{ .Values.apps.element.enabled }}
      selectors:
-        namespace: {{ .Values.element.namespace | quote }}
+        namespace: {{ .Values.apps.element.namespace | quote }}
    diagrams:
-      enable: {{ .Values.cryptpad.enabled }}
+      enable: {{ .Values.apps.cryptpad.enabled }}
      selectors:
-        namespace: {{ .Values.cryptpad.namespace | quote }}
+        namespace: {{ .Values.apps.cryptpad.namespace | quote }}
    nextcloud:
-      enable: {{ .Values.nextcloud.enabled }}
+      enable: {{ .Values.apps.nextcloud.enabled }}
      selectors:
-        namespace: {{ .Values.nextcloud.namespace | quote }}
+        namespace: {{ .Values.apps.nextcloud.namespace | quote }}
    openxchange:
-      enable: {{ .Values.oxAppSuite.enabled }}
+      enable: {{ .Values.apps.oxAppSuite.enabled }}
      selectors:
-        namespace: {{ .Values.oxAppSuite.namespace | quote }}
+        namespace: {{ .Values.apps.oxAppSuite.namespace | quote }}
    xwiki:
-      enable: {{ .Values.xwiki.enabled }}
+      enable: {{ .Values.apps.xwiki.enabled }}
      selectors:
-        namespace: {{ .Values.xwiki.namespace | quote }}
+        namespace: {{ .Values.apps.xwiki.namespace | quote }}
    nubus:
-      enable: {{ .Values.nubus.enabled }}
+      enable: {{ .Values.apps.nubus.enabled }}
      selectors:
-        namespace: {{ .Values.nubus.namespace | quote }}
+        namespace: {{ .Values.apps.nubus.namespace | quote }}
    openproject:
-      enable: {{ .Values.openproject.enabled }}
+      enable: {{ .Values.apps.openproject.enabled }}
      selectors:
-        namespace: {{ .Values.openproject.namespace | quote }}
+        namespace: {{ .Values.apps.openproject.namespace | quote }}
    jitsi:
-      enable: {{ .Values.jitsi.enabled }}
+      enable: {{ .Values.apps.jitsi.enabled }}
      selectors:
-        namespace: {{ .Values.jitsi.namespace | quote }}
+        namespace: {{ .Values.apps.jitsi.namespace | quote }}
    collabora:
-      enable: {{ .Values.collabora.enabled }}
+      enable: {{ .Values.apps.collabora.enabled }}
      selectors:
-        namespace: {{ .Values.collabora.namespace | quote }}
+        namespace: {{ .Values.apps.collabora.namespace | quote }}
 ...
--- a/helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl
@@ -10,47 +10,47 @@ global:

 apps:
  clamavDistributed:
-    enabled: {{ .Values.clamavDistributed.enabled }}
+    enabled: {{ .Values.apps.clamavDistributed.enabled }}
  clamavSimple:
-    enabled: {{ .Values.clamavSimple.enabled }}
+    enabled: {{ .Values.apps.clamavSimple.enabled }}
  collabora:
-    enabled: {{ .Values.collabora.enabled }}
+    enabled: {{ .Values.apps.collabora.enabled }}
  cryptpad:
-    enabled: {{ .Values.cryptpad.enabled }}
+    enabled: {{ .Values.apps.cryptpad.enabled }}
  dkimpy:
-    enabled: {{ .Values.dkimpy.enabled }}
+    enabled: {{ .Values.apps.dkimpy.enabled }}
  dovecot:
-    enabled: {{ .Values.dovecot.enabled }}
+    enabled: {{ .Values.apps.dovecot.enabled }}
  element:
-    enabled: {{ .Values.element.enabled }}
+    enabled: {{ .Values.apps.element.enabled }}
  jitsi:
-    enabled: {{ .Values.jitsi.enabled }}
+    enabled: {{ .Values.apps.jitsi.enabled }}
  mariadb:
-    enabled: {{ .Values.mariadb.enabled }}
+    enabled: {{ .Values.apps.mariadb.enabled }}
  memcached:
-    enabled: {{ .Values.memcached.enabled }}
+    enabled: {{ .Values.apps.memcached.enabled }}
  migrations:
-    enabled: {{ .Values.migrations.enabled }}
+    enabled: {{ .Values.apps.migrations.enabled }}
  minio:
-    enabled: {{ .Values.minio.enabled }}
+    enabled: {{ .Values.apps.minio.enabled }}
  nextcloud:
-    enabled: {{ .Values.nextcloud.enabled }}
+    enabled: {{ .Values.apps.nextcloud.enabled }}
  notes:
-    enabled: {{ .Values.notes.enabled }}
+    enabled: {{ .Values.apps.notes.enabled }}
  nubus:
-    enabled: {{ .Values.nubus.enabled }}
+    enabled: {{ .Values.apps.nubus.enabled }}
  openproject:
-    enabled: {{ .Values.openproject.enabled }}
+    enabled: {{ .Values.apps.openproject.enabled }}
  oxAppsuite:
-    enabled: {{ .Values.oxAppSuite.enabled }}
+    enabled: {{ .Values.apps.oxAppSuite.enabled }}
  postfix:
-    enabled: {{ .Values.postfix.enabled }}
+    enabled: {{ .Values.apps.postfix.enabled }}
  postgresql:
-    enabled: {{ .Values.postgresql.enabled }}
+    enabled: {{ .Values.apps.postgresql.enabled }}
  redis:
-    enabled: {{ .Values.redis.enabled }}
+    enabled: {{ .Values.apps.redis.enabled }}
  xwiki:
-    enabled: {{ .Values.xwiki.enabled }}
+    enabled: {{ .Values.apps.xwiki.enabled }}

 ingressController:
  {{ .Values.security.ingressController | toYaml | nindent 2 }}
--- a/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"

 releases:
  - name: "openproject"
@@ -20,10 +20,10 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
-      {{ range .Values.customization.release.openproject }}
+      {{- range .Values.customization.release.openproject }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.openproject.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.openproject.enabled }}
    timeout: 1800

 commonLabels:
--- a/helmfile/apps/openproject/helmfile.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -38,6 +38,9 @@ dbInit:
    {{ .Values.resources.openprojectDbInit | toYaml | nindent 4 }}

 environment:
+  {{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.openproject.token }}
+  OPENPROJECT_ENTERPRISE__TOKEN: {{ .Values.enterpriseKeys.openproject.token | quote }}
+  {{- end }}
 # For more details and more options see
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
  OPENPROJECT_APP__TITLE: "Projekte - {{ .Values.theme.texts.productName }}"
@@ -53,8 +56,8 @@ environment:
  OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.nubus.ldapSearch.openproject | quote }}
  OPENPROJECT_SEED_LDAP_OPENDESK_SECURITY: "plain_ldap"
-  OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,dc=swp-ldap,dc=internal"
-  OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "dc=swp-ldap,dc=internal"
+  OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,{{ .Values.ldap.baseDn }}"
+  OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "{{ .Values.ldap.baseDn }}"
  OPENPROJECT_SEED_LDAP_OPENDESK_FILTER:
    "(&(objectClass=opendeskProjectmanagementUser)(opendeskProjectmanagementEnabled=TRUE))"
  OPENPROJECT_SEED_LDAP_OPENDESK_SYNC__USERS: "true"
@@ -63,7 +66,7 @@ environment:
  OPENPROJECT_SEED_LDAP_OPENDESK_LASTNAME__MAPPING: "sn"
  OPENPROJECT_SEED_LDAP_OPENDESK_MAIL__MAPPING: "mailPrimaryAddress"
  OPENPROJECT_SEED_LDAP_OPENDESK_ADMIN__MAPPING: "opendeskProjectmanagementAdmin"
-  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_BASE: "dc=swp-ldap,dc=internal"
+  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_BASE: "{{ .Values.ldap.baseDn }}"
  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_FILTER:
    "(&(objectClass=opendeskProjectmanagementGroup)(opendeskProjectmanagementEnabled=TRUE))"
  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_SYNC__USERS: "true"
@@ -77,7 +80,7 @@ environment:
  OPENPROJECT_SMTP__PASSWORD: ""
  OPENPROJECT_SMTP__PORT: 25
  OPENPROJECT_SMTP__SSL: "false" # (default=false)
-  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
  OPENPROJECT_SMTP__AUTHENTICATION: "none"
  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "false"
  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "none"
--- a/helmfile/apps/services-external/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/services-external/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"

  # openDesk MariaDB
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
@@ -20,7 +20,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"

  # openDesk dkimpy-milter
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter
@@ -30,7 +30,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"

  # openDesk Postfix
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
@@ -40,7 +40,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"

  # openDesk ClamAV
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
@@ -50,14 +50,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
  - name: "clamav-simple-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.clamavSimple.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"

  # VMWare Bitnami
  # Source: https://github.com/bitnami/charts/
@@ -67,21 +67,21 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
  - name: "redis-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.redis.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
  - name: "minio-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.minio.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"

  # openDesk Enterprise
  # Cassandra
@@ -92,7 +92,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"

 releases:
  - name: "redis"
@@ -100,10 +100,10 @@ releases:
    version: "{{ .Values.charts.redis.version }}"
    values:
      - "values-redis.yaml.gotmpl"
-      {{ range .Values.customization.release.redis }}
+      {{- range .Values.customization.release.redis }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.redis.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.redis.enabled }}
    timeout: 900

  - name: "memcached"
@@ -111,10 +111,10 @@ releases:
    version: "{{ .Values.charts.memcached.version }}"
    values:
      - "values-memcached.yaml.gotmpl"
-      {{ range .Values.customization.release.memcached }}
+      {{- range .Values.customization.release.memcached }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.memcached.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.memcached.enabled }}
    timeout: 900

  - name: "postgresql"
@@ -122,10 +122,10 @@ releases:
    version: "{{ .Values.charts.postgresql.version }}"
    values:
      - "values-postgresql.yaml.gotmpl"
-      {{ range .Values.customization.release.postgresql }}
+      {{- range .Values.customization.release.postgresql }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.postgresql.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.postgresql.enabled }}
    timeout: 900

  - name: "mariadb"
@@ -133,10 +133,10 @@ releases:
    version: "{{ .Values.charts.mariadb.version }}"
    values:
      - "values-mariadb.yaml.gotmpl"
-      {{ range .Values.customization.release.mariadb }}
+      {{- range .Values.customization.release.mariadb }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.mariadb.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.mariadb.enabled }}
    timeout: 900

  - name: "postfix"
@@ -144,10 +144,10 @@ releases:
    version: "{{ .Values.charts.postfix.version }}"
    values:
      - "values-postfix.yaml.gotmpl"
-      {{ range .Values.customization.release.postfix }}
+      {{- range .Values.customization.release.postfix }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.postfix.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.postfix.enabled }}
    timeout: 900

  - name: "opendesk-dkimpy-milter"
@@ -155,10 +155,10 @@ releases:
    version: "{{ .Values.charts.dkimpy.version }}"
    values:
      - "values-dkimpy.yaml.gotmpl"
-      {{ range .Values.customization.release.opendeskDkimpyMilter }}
+      {{- range .Values.customization.release.opendeskDkimpyMilter }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.dkimpy.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.dkimpy.enabled }}
    timeout: 900

  - name: "clamav"
@@ -166,10 +166,10 @@ releases:
    version: "{{ .Values.charts.clamav.version }}"
    values:
      - "values-clamav-distributed.yaml.gotmpl"
-      {{ range .Values.customization.release.clamav }}
+      {{- range .Values.customization.release.clamav }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.clamavDistributed.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.clamavDistributed.enabled }}
    timeout: 900

  - name: "clamav-simple"
@@ -177,10 +177,10 @@ releases:
    version: "{{ .Values.charts.clamavSimple.version }}"
    values:
      - "values-clamav-simple.yaml.gotmpl"
-      {{ range .Values.customization.release.clamavSimple }}
+      {{- range .Values.customization.release.clamavSimple }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.clamavSimple.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.clamavSimple.enabled }}
    timeout: 900

  - name: "minio"
@@ -188,10 +188,10 @@ releases:
    version: "{{ .Values.charts.minio.version }}"
    values:
      - "values-minio.yaml.gotmpl"
-      {{ range .Values.customization.release.minio }}
+      {{- range .Values.customization.release.minio }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.minio.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.minio.enabled }}
    timeout: 900

  # openDesk Enterprise Releases
@@ -199,10 +199,11 @@ releases:
    chart: "cassandra-repo/{{ .Values.charts.cassandra.name }}"
    version: "{{ .Values.charts.cassandra.version }}"
    values:
-      {{ range .Values.customization.release.cassandra }}
+      - "values-cassandra.yaml.gotmpl"
+      {{- range .Values.customization.release.cassandra }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.cassandra.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.cassandra.enabled }}
    timeout: 900

 commonLabels:
--- a/helmfile/apps/services-external/helmfile.yaml.gotmpl
+++ b/helmfile/apps/services-external/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/services-external/values-cassandra.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-cassandra.yaml.gotmpl
@@ -0,0 +1,102 @@
+{{/*
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-License-Identifier: Apache-2.0
+*/}}
+---
+containerSecurityContext:
+  enabled: true
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - "ALL"
+  privileged: false
+  readOnlyRootFilesystem: true
+  runAsGroup: 1001
+  runAsNonRoot: true
+  runAsUser: 1001
+  seccompProfile:
+    type: "RuntimeDefault"
+  seLinuxOptions:
+    {{ .Values.seLinuxOptions.cassandra | toYaml | nindent 4 }}
+
+dbUser:
+  user: "root"
+  password: {{ .Values.secrets.cassandra.rootPassword | quote }}
+
+global:
+  imagePullSecrets:
+    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
+
+image:
+  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandra.registry | quote }}
+  repository: {{ .Values.images.cassandra.repository | quote }}
+  tag: {{ .Values.images.cassandra.tag | quote }}
+  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+initDB:
+  initUserData.cql: >
+    CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
+    CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.username | quote }};
+    ALTER ROLE {{ .Values.databases.dovecotDictmap.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotDictmapUser "''" | squote }} AND LOGIN = true;
+    GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotDictmap.name | quote }} TO {{ .Values.databases.dovecotDictmap.username | quote }};
+    CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotACL.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
+    CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotACL.username | quote }};
+    ALTER ROLE {{ .Values.databases.dovecotACL.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotACLUser "''" | squote }} AND LOGIN = true;
+    GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotACL.name | quote }} TO {{ .Values.databases.dovecotACL.username | quote }};
+
+# Will print a warning if unset but is automatically calculated:
+jvm:
+  maxHeapSize: ""
+  newHeapSize: ""
+
+livenessProbe:
+  enabled: true
+  initialDelaySeconds: 60
+  periodSeconds: 30
+  timeoutSeconds: 30
+  successThreshold: 1
+  failureThreshold: 5
+
+metrics:
+  enabled: false
+  image:
+    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandraExporter.registry | quote }}
+    repository: {{ .Values.images.cassandraExporter.repository | quote }}
+    tag: {{ .Values.images.cassandraExporter.tag | quote }}
+    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
+persistence:
+  commitLogsize: {{ .Values.persistence.storages.cassandra.commitLogsize | quote }}
+  size: {{ .Values.persistence.storages.cassandra.size | quote }}
+  storageClass: {{ coalesce .Values.persistence.storages.cassandra.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+
+podAnnotations: {}
+
+podSecurityContext:
+  enabled: true
+  fsGroup: 1001
+  fsGroupChangePolicy: "Always"
+  supplementalGroups: []
+  sysctls: []
+
+readinessProbe:
+  enabled: true
+  initialDelaySeconds: 60
+  periodSeconds: 10
+  timeoutSeconds: 30
+  successThreshold: 1
+  failureThreshold: 5
+
+replicaCount: {{ .Values.replicas.cassandra }}
+
+resources:
+  {{ .Values.resources.cassandra | toYaml | nindent 2 }}
+
+startupProbe:
+  enabled: false
+  initialDelaySeconds: 0
+  periodSeconds: 10
+  timeoutSeconds: 5
+  successThreshold: 1
+  failureThreshold: 60
+...
--- a/helmfile/apps/services-external/values-minio.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-minio.yaml.gotmpl
@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -116,6 +116,11 @@ provisioning:
    - name: {{ .Values.objectstores.nubus.bucket | quote }}
      versioning: "Suspended"
      withLock: false
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    - name: {{ .Values.objectstores.dovecot.bucket | quote }}
+      versioning: "Suspended"
+      withLock: false
+    {{- end }}
  policies:
    - name: "migrations-bucket-policy"
      statements:
@@ -177,6 +182,20 @@ provisioning:
          effect: "Allow"
          actions:
            - "s3:*"
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    - name: "dovecot-bucket-policy"
+      statements:
+        - resources:
+            - "arn:aws:s3:::dovecot"
+          effect: "Allow"
+          actions:
+            - "s3:*"
+        - resources:
+            - "arn:aws:s3:::dovecot/*"
+          effect: "Allow"
+          actions:
+            - "s3:*"
+    {{- end }}
  users:
    - username: {{ .Values.objectstores.migrations.username | quote }}
      password: {{ .Values.secrets.minio.migrationsUser | quote }}
@@ -208,6 +227,14 @@ provisioning:
      policies:
        - "ums-bucket-policy"
      setPolicies: true
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    - username: {{ .Values.objectstores.dovecot.username | quote }}
+      password: {{ .Values.secrets.minio.dovecotUser | quote }}
+      disabled: false
+      policies:
+        - "dovecot-bucket-policy"
+      setPolicies: true
+    {{- end }}
  resources:
    {{ .Values.resources.minio | toYaml | nindent 4 }}

--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -52,7 +52,7 @@ postfix:
    - fileName: "sasl_passwd.map"
      content:
        - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
-  {{- if .Values.dkimpy.enabled }}
+  {{- if .Values.apps.dkimpy.enabled }}
  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
  {{- end }}
  rspamdHost: ""
@@ -71,9 +71,9 @@ postfix:
  {{- if .Values.antivirus.milter.host }}
  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
  {{- else }}
-  {{- if .Values.clamavDistributed.enabled }}
+  {{- if .Values.apps.clamavDistributed.enabled }}
  smtpdMilters: "inet:clamav-milter:7357"
-  {{- else if .Values.clamavSimple.enabled }}
+  {{- else if .Values.apps.clamavSimple.enabled }}
  smtpdMilters: "inet:clamav-simple:7357"
  {{- end }}
  {{- end }}
@@ -87,10 +87,10 @@ replicaCount: {{ .Values.replicas.postfix }}
 resources:
  {{ .Values.resources.postfix | toYaml | nindent 2 }}

-{{- if or (eq .Values.cluster.service.type "NodePort") (eq .Values.cluster.service.type "LoadBalancer") }}
+{{- if or (eq (coalesce .Values.service.type.postfix .Values.cluster.service.type) "NodePort") (eq (coalesce .Values.service.type.postfix .Values.cluster.service.type) "LoadBalancer") }}
 service:
  external:
    enabled: true
-    type: {{ .Values.cluster.service.type | quote }}
+    type: {{ coalesce .Values.service.type.postfix .Values.cluster.service.type | quote }}
 {{- end }}
 ...
--- a/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
@@ -10,8 +10,8 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
-    
+    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
+
 releases:
  - name: "xwiki"
    chart: "xwiki-repo/{{ .Values.charts.xwiki.name }}"
@@ -19,10 +19,10 @@ releases:
    wait: true
    values:
      - "values.yaml.gotmpl"
-      {{ range .Values.customization.release.xwiki }}
+      {{- range .Values.customization.release.xwiki }}
      - {{ . }}
-      {{ end }}
-    installed: {{ .Values.xwiki.enabled }}
+      {{- end }}
+    installed: {{ .Values.apps.xwiki.enabled }}
    timeout: 1800

 commonLabels:
--- a/helmfile/apps/xwiki/helmfile.yaml.gotmpl
+++ b/helmfile/apps/xwiki/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml"
+  - "../../bases/environments.yaml.gotmpl"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/xwiki/values.yaml.gotmpl
+++ b/helmfile/apps/xwiki/values.yaml.gotmpl
@@ -17,12 +17,15 @@ image:
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 imagePullSecrets: {{ .Values.global.imagePullSecrets }}

-{{- if .Values.certificate.selfSigned }}
 javaOpts:
+  {{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense .Values.enterpriseKeys.xwiki.proApplicationslicense }}
+  - "-Dlicenses={{ .Values.enterpriseKeys.xwiki.opendeskEnterpriseLicense }},{{ .Values.enterpriseKeys.xwiki.proApplicationslicense }}"
+  {{- end }}
+  {{- if .Values.certificate.selfSigned }}
  - "-Djavax.net.ssl.trustStore=/etc/ssl/certs/truststore.jks"
  - "-Djavax.net.ssl.trustStoreType=jks"
  - {{ printf "%s=%s" "-Djavax.net.ssl.trustStorePassword" .Values.secrets.certificates.password | quote }}
-{{- end }}
+  {{- end }}

 externalDB:
  {{- if eq .Values.databases.xwiki.type "mariadb" }}
@@ -73,16 +76,19 @@ customConfigs:
    xwiki.authentication.ldap.server: {{ .Values.ldap.host | quote }}
    xwiki.authentication.ldap.port: 389
    ## Authentication to the LDAP server
-    xwiki.authentication.ldap.bind_DN: "uid=ldapsearch_xwiki,cn=users,dc=swp-ldap,dc=internal"
+    xwiki.authentication.ldap.bind_DN: "uid=ldapsearch_xwiki,cn=users,{{ .Values.ldap.baseDn }}"
    xwiki.authentication.ldap.bind_pass: {{ .Values.secrets.nubus.ldapSearch.xwiki | quote }}
    ## Base DN used for searching for users
-    xwiki.authentication.ldap.base_DN: "dc=swp-ldap,dc=internal"
+    xwiki.authentication.ldap.base_DN: "{{ .Values.ldap.baseDn }}"
    ## Allow short update cycles of the LDAP group cache
    xwiki.authentication.ldap.groupcache_expiration: 300
    ## Mapping for XWiki attributes to the respective LDAP attributes
    xwiki.authentication.ldap.fields_mapping: "last_name=sn,first_name=givenName,email=mailPrimaryAddress"

  xwiki.properties:
+    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+    distribution.defaultUI: "com.xwiki.projects.swp:xwiki-swp-flavor-enterprise-main"
+    {{- end }}
    wikiInitializer.initialRequest.xwiki.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/distribution/"
    wikiInitializer.initialRequest.xwiki.contextPath: "/"
    wikiInitializer.initialRequest.xwiki.remoteAddress: "{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
@@ -155,11 +161,12 @@ properties:
  "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.server": "{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}"
  "property:xwiki:XWiki.XWikiServerXwiki^XWiki.XWikiServerClass.port": 443

-  ## This option overwrites the LDAP group mappings including all dynamically created mappings, therefore on XWiki restart an LDAP sync is triggered to load the dynamic mapping.
-  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.ldap_group_mapping": "xwiki:XWiki.XWikiAdminGroup=cn=managed-by-attribute-KnowledgemanagementAdmin,cn=groups,dc=swp-ldap,dc=internal"
+  ## This option overwrites the LDAP group mappings including all dynamically created mappings,
+  # therefore on XWiki restart an LDAP sync is triggered to load the dynamic mapping.
+  "property:xwiki:XWiki.XWikiPreferences^XWiki.XWikiPreferences.ldap_group_mapping": "xwiki:XWiki.XWikiAdminGroup=cn=managed-by-attribute-KnowledgemanagementAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
  ## SMTP settings
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.from": "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
-  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.host": {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.port": 25
  "property:xwiki:Mail.MailConfig^Mail.SendMailConfigClass.properties": "mail.smtp.starttls.enable=false"
  ## Link LDAP users and users authenticated through OIDC
@@ -196,7 +203,7 @@ properties:
    1
  ## Base DN under which groups should be searched for
  "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.ldapGroupImportSearchDN":
-    "dc=swp-ldap,dc=internal"
+    "{{ .Values.ldap.baseDn }}"
  ## LDAP filter to only synchronize some groups
  "property:xwiki:LDAPUserImport.WebHome^LDAPUserImport.LDAPUserImportConfigClass.ldapGroupImportSearchFilter":
    "(&(objectClass=opendeskKnowledgemanagementGroup)(opendeskKnowledgemanagementEnabled=TRUE))"
--- a/helmfile/bases/environments.yaml.gotmpl
+++ b/helmfile/bases/environments.yaml.gotmpl
@@ -5,16 +5,28 @@ environments:
  default:
    values:
      - "../../environments/default/*.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
+      {{- end }}
  dev:
    values:
      - "../../environments/default/*.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
+      {{- end }}
      - "../../environments/dev/*.yaml.gotmpl"
  test:
    values:
      - "../../environments/default/*.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
+      {{- end }}
      - "../../environments/test/*.yaml.gotmpl"
  prod:
    values:
      - "../../environments/default/*.yaml.gotmpl"
+      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      - "../../environments/default-enterprise-overrides/*.yaml.gotmpl"
+      {{- end }}
      - "../../environments/prod/*.yaml.gotmpl"
 ...
--- a/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
@@ -0,0 +1,17 @@
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+charts:
+  dovecot:
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/product-development/charts/opendesk-dovecot-pro"
+    name: "dovecot"
+    version: "1.0.0"
+    verify: true
+  oxAppSuite:
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/charts-mirror"
+    name: "appsuite-public-sector-pro-chart"
+    version: "1.10.114"
+    verify: false
+...
--- a/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+images:
+  collabora:
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/collabora/images/collabora-online-for-opendesk"
+    tag: "24.04.9.4.2@sha256:7c38f2568855ec33c11296d65384766230ea3097a245a60b9e8b0b62cb9cc17f"
+  dovecot:
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/dovecot-pro"
+    tag: "3.0.1-rev3@sha256:b87f16562dd486c0f97e8147a797af16a54f25f1ac64826f4f53bd8177ec9a33"
+  nextcloud:
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/nextcloud/images/opendesk-nextcloud"
+    tag: "1.1.2@sha256:64f08ff9c9481e67b41bdcc70aeb278b6beba061ba1c989ba96cc471ff46dd9c"
+  openxchangeCoreMW:
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/core-mw"
+    tag: "8.30.63@sha256:181fcb31f500f88573e6b735587b52df906199337fa62aeee1e64aacdc64f548"
+...
--- a/helmfile/environments/default-enterprise-overrides/objectstores.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/objectstores.yaml.gotmpl
@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+objectstores:
+  dovecot:
+    bucket: "dovecot"
+    endpoint: ""
+    region: "eu-west-1"
+    secretKey: ""
+    username: "dovecot_user"
+    storageClass: "STANDARD"
+    useSSL: true
+    pathStyle: true
+    port: 443
+...
--- a/helmfile/environments/default-enterprise-overrides/resources.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/resources.yaml.gotmpl
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+resources:
+  collabora:
+    # When using CollaboraController for autoscaling, `targetMemoryUtilizationPercentage` and
+    # `targetCPUUtilizationPercentage` defined at `enterpriseFeatures.collabora.autoscaling`
+    # are checked against the values defined below under `requests`, so please ensure you set these
+    # appropriately to avoid unnecessary scaling.
+    requests:
+      cpu: 3
+      memory: "3Gi"
+...
--- a/helmfile/environments/default/charts.yaml.gotmpl
+++ b/helmfile/environments/default/charts.yaml.gotmpl
@@ -7,11 +7,14 @@
 ---
 charts:
  cassandra:
-    # Component is required for openDesk Enterprise only.
-    registry: ""
-    repository: ""
-    name: ""
-    version: ""
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "bitnamicharts/cassandra"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/external/charts/bitnami-charts"
+    name: "cassandra"
+    version: "12.0.4"
    verify: true
  certificates:
    # providerCategory: "Platform"
@@ -56,12 +59,14 @@ charts:
    version: "1.1.21"
    verify: true
  collaboraController:
-    # Component is required for openDesk Enterprise only.
-    registry: ""
-    repository: ""
-    name: ""
-    version: ""
-    verify: true
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Collabora"
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/collabora/charts-mirror"
+    name: "cool-controller"
+    version: "1.1.1"
+    verify: false
  cryptpad:
    # providerCategory: "Supplier"
    # providerResponsible: "XWiki"
@@ -106,16 +111,6 @@ charts:
    name: "opendesk-element"
    version: "6.0.2"
    verify: true
-  elementWeb:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
-    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-element"
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
-    name: "opendesk-element-web"
-    version: "6.0.2"
-    verify: true
  elementWellKnown:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -178,7 +173,7 @@ charts:
    name: "matrix-neoboard-widget"
    version: "3.5.1"
    verify: true
-  matrixNeochoiseWidget:
+  matrixNeochoiceWidget:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry.opencode.de"
@@ -256,7 +251,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud"
-    version: "3.7.1"
+    version: "3.9.2"
    verify: true
  nextcloudManagement:
    # providerCategory: "Platform"
@@ -266,7 +261,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud-management"
-    version: "3.7.1"
+    version: "3.9.2"
    verify: true
  nginx:
    # providerCategory: "Community"
@@ -338,7 +333,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
    name: "opendesk-keycloak-bootstrap"
-    version: "2.2.3"
+    version: "2.3.0"
    verify: true
  opendeskStaticFiles:
    # providerCategory: "Platform"
@@ -360,7 +355,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
    name: "openproject"
-    version: "9.5.0"
+    version: "9.5.1"
    verify: true
  openprojectBootstrap:
    # providerCategory: "Platform"
@@ -392,7 +387,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
    name: "appsuite-public-sector"
-    version: "2.12.85"
+    version: "2.15.50"
    verify: false
  oxAppSuiteBootstrap:
    # providerCategory: "Platform"
@@ -447,8 +442,8 @@ charts:
    version: "18.6.1"
    verify: true
  synapse:
-    # providerCategory: "Platform"
-    # providerResponsible: "openDesk"
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
    # upstreamRegistry: "https://registry.opencode.de"
    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-synapse"
    registry: "registry.opencode.de"
@@ -457,18 +452,22 @@ charts:
    version: "6.0.2"
    verify: true
  synapseAdmin:
-    # Component is required for openDesk Enterprise only.
-    registry: ""
-    repository: ""
-    name: ""
-    version: ""
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
+    name: "opendesk-synapse-admin"
+    version: "5.0.1"
    verify: true
  synapseAdminbotWeb:
-    # Component is required for openDesk Enterprise only.
-    registry: ""
-    repository: ""
-    name: ""
-    version: ""
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
+    name: "opendesk-synapse-adminbot-web"
+    version: "5.0.1"
    verify: true
  synapseCreateAccount:
    # providerCategory: "Platform"
@@ -481,18 +480,22 @@ charts:
    version: "6.0.2"
    verify: true
  synapseGroupsync:
-    # Component is required for openDesk Enterprise only.
-    registry: ""
-    repository: ""
-    name: ""
-    version: ""
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
+    name: "opendesk-synapse-groupsync"
+    version: "5.0.1"
    verify: true
  synapsePipe:
-    # Component is required for openDesk Enterprise only.
-    registry: ""
-    repository: ""
-    name: ""
-    version: ""
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
+    name: "opendesk-synapse-pipe"
+    version: "5.0.1"
    verify: true
  synapseWeb:
    # providerCategory: "Platform"
--- a/helmfile/environments/default/cluster.yaml.gotmpl
+++ b/helmfile/environments/default/cluster.yaml.gotmpl
@@ -2,6 +2,11 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 cluster:
+  # Specify a label to prefer for scheduling of CPU heavy workloads that don't support horizontal scaling.
+  computeNodeLabel: {}
+#    key: key-of-nodeselector-label
+#    value: value-of-nodeselector-label
+
  service:
    # Based on the available Implementations of your cluster, choose the type of Service.
    # Choose out of "ClusterIP", "NodePort" or "LoadBalancer.
--- a/helmfile/environments/default/customization.yaml.gotmpl
+++ b/helmfile/environments/default/customization.yaml.gotmpl
@@ -1,19 +1,26 @@
 # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
-# This variable allows customization of helmfile releases by loading custom values file.
+# The following structure allows customization of Helmfile releases by loading custom value files.
 #
-# **Warning**: Customizations are a very powerful tool to apply individual changes to your
+# The keys, like the example key `collaboraOnline` below can be chosen freely.
+#
+# **Note:** You have to reference a file and cannot just template additional yaml structure below
+# the key.
+#
+# **Warning:** Customizations are a very powerful tool to apply individual changes to your
 # openDesk installation. As there are no limits set for what you use it, openDesk cannot
 # support the configurations you are about to create using the customization-option. If you
 # have the demand for a specific configuration, try to get it into the openDesk standard
 # by creating a ticket at https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/issues
 #
 # Example:
+# ```
 # customization:
 #   release:
 #     collaboraOnline:
-#       myCustomConfig: "/path/to/additional/file.yaml.gotmpl"
+#       myCustomConfig: '{{ env "PWD" }}/path/to/additional/file.yaml.gotmpl'
+# ```
 customization:
  release:
    # collabora
@@ -25,6 +32,13 @@ customization:
    opendeskWellKnown: {}
    opendeskSynapseWeb: {}
    opendeskSynapse: {}
+    matrixUserVerificationServiceBootstrap: {}
+    matrixUserVerificationService: {}
+    matrixNeoboardWidget: {}
+    matrixNeochoiceWidget: {}
+    matrixNeodatefixWidget: {}
+    matrixNeodatefixBotBootstrap: {}
+    matrixNeodatefixBot: {}
    # jitsi
    jitsi: {}
    # migrations-post
--- a/helmfile/environments/default/database.yaml.gotmpl
+++ b/helmfile/environments/default/database.yaml.gotmpl
@@ -6,6 +6,22 @@
 databases:
  defaults:
    userConnectionLimit: 100
+  dovecotDictmap:
+    type: "cassandra"
+    name: "dovecot_dictmap"
+    host: "cassandra"
+    port: 9042
+    username: "dovecot_dictmap_user"
+    password: ""
+    connectionLimit: ~
+  dovecotACL:
+    type: "cassandra"
+    name: "dovecot_acl"
+    host: "cassandra"
+    port: 9042
+    username: "dovecot_acl_user"
+    password: ""
+    connectionLimit: ~
  keycloak:
    type: "postgresql"
    name: "keycloak"
@@ -19,6 +35,7 @@ databases:
    name: "keycloak_extensions"
    host: "postgresql"
    port: 5432
+    ssl: "false"
    username: "keycloak_extensions_user"
    password: ""
    connectionLimit: ~
@@ -54,6 +71,11 @@ databases:
    port: 3306
    username: "root"
    password: ""
+    # Optional settings: Route read queries to a different host.
+    readHost: ~
+    # If provided, uses a different set of credentials for read queries. By default oxAppSuite.username and oxAppsuite.password are used.
+    readUser: ~
+    readPassword: ~
    connectionLimit: ~
  synapse:
    type: "postgresql"
--- a/helmfile/environments/default/enterprise_features.yaml.gotmpl
+++ b/helmfile/environments/default/enterprise_features.yaml.gotmpl
@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+---
+enterpriseFeatures:
+  collabora:
+    # Collabora autoscaling can be configured here. To enable autoscaling enable the Collabora
+    # Controller, see `opendesk_main.yaml.gotmpl` for reference.
+    autoscaling:
+      minReplicas: 1
+      maxReplicas: 4
+      scaleDownDisabled: false
+      targetMemoryUtilizationPercentage: 99
+      targetCPUUtilizationPercentage: 99
+
+...
--- a/helmfile/environments/default/enterprise_keys.yaml.gotmpl
+++ b/helmfile/environments/default/enterprise_keys.yaml.gotmpl
@@ -0,0 +1,20 @@
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-License-Identifier: Apache-2.0
+# The variables set in this file are required to upgrade components to their "Enterprise" product variant.
+---
+enterpriseKeys:
+  openproject:
+    # Enterprise token must match the deployment's OpenProject host name.
+    token: ~
+  xwiki:
+    # Per instance their must be a unique set of keys.
+    opendeskEnterpriseLicense: ""
+    proApplicationslicense: ""
+  nextcloud:
+    # Subscription key can be used for all customer owned instances, the number of users
+    # from all instances and is limited by the number of users the key was bought for.
+    subscriptionKey: ""
+    # Subscription data is required for air gapped installations.
+    subscriptionData: ""
+
+...
--- a/helmfile/environments/default/functional.yaml.gotmpl
+++ b/helmfile/environments/default/functional.yaml.gotmpl
@@ -10,6 +10,10 @@ functional:
        enabled: true

  authentication:
+    newDeviceLoginNotification:
+      # openDesk's Keycloak extensions can send out an email every time a user logs in with a new "device".
+      # It uses device/browser fingerprinting to identify such an event. The feature can be toggled below.
+      enabled: true
    twoFactor:
      # Define a list of groups to enable 2FA for.
      # Note: Removing a group from the list will not disable 2FA for the removed group.
@@ -91,6 +95,11 @@ functional:
    # Configure if the a re-direct to the login dialogue is enforced, or if the portal is shown and the user as to actively
    # trigger the login flow, e.g. but clicking on the "Login" portal tile.
    enforceLogin: true
+    # Link to the legal notice shown in the portal menu, set to "~" if you want to remove the link
+    linkLegalNotice: "https://opendesk.eu/impressum"
+    # Link to the privacy statement shown in the portal menu, set to "~" if you want to remove the link
+    linkPrivacyStatement: "https://zendis.de/datenschutzerklaerung"
+
  chat:
    matrix:
      profile:
--- a/helmfile/environments/default/global.generated.yaml.gotmpl
+++ b/helmfile/environments/default/global.generated.yaml.gotmpl
@@ -3,5 +3,5 @@
 ---
 global:
  systemInformation:
-    releaseVersion: "v1.1.1"
+    releaseVersion: "v1.1.2"
 ...
--- a/helmfile/environments/default/global.yaml.gotmpl
+++ b/helmfile/environments/default/global.yaml.gotmpl
@@ -10,13 +10,15 @@ global:

  ## Define host
  #
-  domain: {{ env "DOMAIN" | default "souvap.cloud" | quote }}
+  domain: {{ env "DOMAIN" | default "opendesk.internal" | quote }}

  ## Define mail host
+  ## If this is unset the "domain" value above should be used in all references
  #
  mailDomain: {{ env "MAIL_DOMAIN" | quote }}

  ## Define synapse host
+  ## If this is unset the "domain" value above should be used in all references
  #
  matrixDomain: {{ env "MATRIX_DOMAIN" | quote }}

@@ -31,6 +33,7 @@ global:
  #         deployment.
  #
  hosts:
+    adminBot: "adminbot"
    collabora: "office"
    cryptpad: "pad"
    element: "chat"
@@ -50,6 +53,7 @@ global:
    openxchange: "webmail"
    static: "static"
    synapse: "matrix"
+    synapseAdmin: "synapse-admin"
    synapseFederation: "matrix-federation"
    whiteboard: "whiteboard"
    xwiki: "wiki"
--- a/helmfile/environments/default/images.yaml.gotmpl
+++ b/helmfile/environments/default/images.yaml.gotmpl
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -13,6 +13,22 @@ images:
    registry: "registry-1.docker.io"
    repository: "bitnami/os-shell"
    tag: "12-debian-12-r34@sha256:41e0561b0f08011c24acc5e8ad4c0d09a36062cfab35d9ec7b3fdd4cfecc01e0"
+  cassandra:
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "bitnami/cassandra"
+    registry: "registry-1.docker.io"
+    repository: "bitnami/cassandra"
+    tag: "5.0.2-debian-12-r1@sha256:9f5fd6fe3a24b7e5ea215a99a0e0d6a10d11a914d6eb8c511780271a9097f5ea"
+  cassandraExporter:
+    # providerCategory: "Community"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "bitnami/cassandra-exporter"
+    registry: "registry-1.docker.io"
+    repository: "bitnami/cassandra-exporter"
+    tag: "2.3.8-debian-12-r31@sha256:ae861f6c8712dd32c2304c680e4564802df689a62dc4aed2f4e7cfcbba8a8051"
  clamd:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -29,6 +45,13 @@ images:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
    tag: "24.04.9.2.1@sha256:749917bf9146d8507b3a63d422a30ebe4f499700421c30527e32f322a015c73d"
+  collaboraController:
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Collabora"
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/collabora/images-mirror/cool-controller"
+    tag: "1.1.0@sha256:dfbbb6a9bfac94d39bd735eb143084803a774d2fc673a138bf08d4044e8d942a"
  cryptpad:
    # providerCategory: "Supplier"
    # providerResponsible: "XWiki"
@@ -62,6 +85,48 @@ images:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images/opendesk-element-web"
    tag: "1.11.7@sha256:c5881cea86a721252e724000e4ed870cae66f9b3eabc45074e1f43b1818423bc"
+  elementAdminBot:
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/element/images-mirror/access_element_web"
+    tag: "v1.11.85@sha256:0e36121cbaab5a8146ef8561d8e77b38f711f855f1a353df3bb96a8d13303812"
+  elementGroupsync:
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/element/images-mirror/groupsync"
+    tag: "v0.14.0@sha256:a8cee92b9035d8cc80cc13194e4e0118c7dfbfcbc4c0ee5ac173582d0cd55846"
+  elementHaProxy:
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/element/images-mirror/haproxy"
+    tag: "3.0-alpine@sha256:c22c8710886104a48b920306f063401f0d11811858e3c6b9d87d88a7556b2e61"
+  elementPipe:
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/element/images-mirror/pipe"
+    tag: "6.3.1@sha256:7f487af25f220d31aa987665f9d1393b42e925c6b1a7e0458daaa91e8e7bf0c4"
+  elementSynapseAdmin:
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "zendis/opendesk-enterprise/components/supplier/element/images-mirror/synapse_admin"
+    tag: "v16.105.5-24.10@sha256:563979fc69162adf93f1286cf79dcbe58adf878a0e4e9332044e5ab6a7170350"
+  elementSyncAdmins:
+    # Enterprise Component
+    # providerCategory: "Supplier"
+    # providerResponsible: "Element"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/opendesk-element-syncadmins"
+    tag: "1.0.3@sha256:1dea24d5f65a6f9ac63b402c772dd81dcd07a847d24845901c8a039461043097"
  freshclam:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -97,7 +162,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jibri"
-    tag: "stable-9823@sha256:dd7a330cb14d95b7661167d7b4e1a8f2e988952ba4ea24baa0a96e09bebd40b1"
+    tag: "stable-9955@sha256:a07b82f2758389b2071c794810145111641e78f1b768b1bbfa6d3d1dc76d3da9"
  jicofo:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -107,7 +172,17 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jicofo"
-    tag: "stable-9823@sha256:551aa2adf078f8872474481a9bda7b7526fc5cae2853ce0be2aa1f6d91bf2ecc"
+    tag: "stable-9955@sha256:f1a1478d231bc4891b5eea06443d72187c378d5e38403bb545aab281446f8d50"
+  jigasi:
+    # providerCategory: "Supplier"
+    # providerResponsible: "Nordeck"
+    # upstreamRegistry: "https://registry-1.docker.io"
+    # upstreamRepository: "jitsi/jigasi"
+    # upstreamMirrorTagFilterRegEx: '^stable-(\d+)-?\d?$'
+    # upstreamMirrorStartFrom: ["9955"]
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jigasi"
+    tag: "stable-9955@sha256:0e191ac39d3e7299d0bcc070fa1867cceb17fe8d92e9d5cd492aec4c268fa56f"
  jitsi:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -117,7 +192,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/web"
-    tag: "stable-9823@sha256:d37d0d34715a0089437c5c030251010e068926f93395d46753e1767d0ee16247"
+    tag: "stable-9955@sha256:81fdcfa14287fe3358532c363875584d0cdd40ff4030695b713af6e60192d306"
  jitsiKeycloakAdapter:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -127,7 +202,7 @@ images:
    # upstreamMirrorStartFrom: ["2023", "12", "14"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jitsi-keycloak-adapter"
-    tag: "v20241023@sha256:2391799c5168222f0e3ebb94d7c3cb3bcea6f075399458197f0c1bbbb8f293fe"
+    tag: "v20250117@sha256:254025cb03a05a1eba5971a1f07f13a4148c4ac8538a7e7c79fbd4b86e2f2cd5"
  jitsiPatchJVB:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -145,7 +220,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/jvb"
-    tag: "stable-9823@sha256:e6e43071ce26628c816bea46a259c7462c8d5edbbd2ed66f983b1e0f2d9a6cb2"
+    tag: "stable-9955@sha256:27753ac320910e04f5c4f4f628d20995ea969ea38523d90a9066adc52f9bc022"
  mariadb:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -219,7 +294,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-migrations"
-    tag: "1.4.0@sha256:0c74011e4c1216857b73695741196908afcacc2f531fd1c894b8f574ac98f9a2"
+    tag: "1.4.1@sha256:c831f3bb27da483cbf46239d8f96df9597f710fbe3804f198ee1d89b1be71936"
  milter:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -243,7 +318,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.4.0@sha256:03d3273b49a3a51fc2d418302070657ad4198ee014f15ff4320e2164625431a1"
+    tag: "2.4.6@sha256:ebd5777c1244199df42f23b5a9df5339d86d353b95c68e7505f142c9c247eb73"
  nextcloudExporter:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -373,7 +448,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "0", "3"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/keycloak-proxy"
-    tag: "0.11.0@sha256:9b2079ed4078daee00d95ac2de4d72497131e699b967943db5be1c655048edb0"
+    tag: "0.15.3@sha256:087a8f242ac40f01bdc8326b220ec5b0034b64b3a3be6cf3968563c3d48eb056"
  nubusLdapNotifier:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -453,7 +528,15 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-    tag: "1.9.1@sha256:4cc4d4bc39167d7dc305ab1787763fd1091fa1284ddf373e081c595d4dce39a9"
+    tag: "1.12.0@sha256:78d8e35f4dd7acd6b702a3aa4697424ae2f27898886b9b9086fd0ddc7884c391"
+  nubusOpendeskExtensionA2gMapper:
+    # providerCategory: "Platform"
+    # providerResponsible: "openDesk"
+    # upstreamRegistry: "https://registry.opencode.de"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nubus-a2g-mapper"
+    registry: "registry.opencode.de"
+    repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus-a2g-mapper"
+    tag: "1.0.1@sha256:527cf7d0515df441b7ac8bc29b40f8703c87246ddc9594d9e24531571dc6359d"
  nubusOpenPolicyAgent:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -501,7 +584,7 @@ images:
    # upstreamRepository: "nubus/images/portal-frontend"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus-portal-update"
-    tag: "1.10.13@sha256:2f84f50af5d6ed31587e5ea9d043c9c30599d91350e13ea1ca31c9c9737a32cc"
+    tag: "1.10.14@sha256:fbdec057958fd7e728431cf96896b8453c2f5b390ce3d2f169a7766f49926b1b"
  nubusPortalServer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -521,7 +604,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-dispatcher"
-    tag: "0.46.0@sha256:01464a4f2e1297ff2d1a507e69829fa7d0b84543e88280113bd9b9fb88bf2bce"
+    tag: "0.48.1@sha256:0fac927b2690d6b704e4918102adcbd971effd2cf4af2fb7b86aba5902788a8e"
  nubusProvisioningEventsAndConsumerApi:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -531,7 +614,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-events-and-consumer-api"
-    tag: "0.46.0@sha256:c9025d0c058a36fb7926a6ad9768f9909efa4dff76022d7b7de862b000da6e6f"
+    tag: "0.48.1@sha256:042633fbf98f9600fa79103476871f4754aab5633b0d04ad4aae780e80f685f4"
  nubusProvisioningPrefill:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -541,7 +624,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-prefill"
-    tag: "0.46.0@sha256:e7dfa77a8fe5b6d40d734b04dda9583c03ae8cf48221e6f0af0b35052514a948"
+    tag: "0.48.1@sha256:6019d3ab31a69c46c12addb7b7ede30e9b25d236169f3bb4bde678d576f207d3"
  nubusProvisioningUdmListener:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -551,7 +634,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-listener"
-    tag: "0.46.0@sha256:648101e9115fa9c32583f2588a722201fed8b537167931cce3aee1111c6f50b2"
+    tag: "0.48.1@sha256:39aeb312e0148400b54184dbbe4595cd75e8dc62c0abfaaf56efc863f2486810"
  nubusProvisioningUdmTransformer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -561,7 +644,7 @@ images:
    # upstreamMirrorStartFrom: ["0", "14", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/univention/images-mirror/provisioning-udm-transformer"
-    tag: "0.46.0@sha256:e1877879044e5b0967362b5ec9a491e046d674407fbf081756b5e9e0e2dcd8e5"
+    tag: "0.48.1@sha256:414a329af821e50b20c0443bc6364f91f4f6a8cc879cc881757a715f273c5a99"
  nubusSelfServiceConsumer:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -645,7 +728,7 @@ images:
    # upstreamMirrorStartFrom: ["13", "1", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "15.2.0@sha256:5394a6cddc3f27efd20aeba4c2a0da0c0234ea914726f2d8cb6ebebeb500b9cf"
+    tag: "15.2.1@sha256:bbdde5f9818997086fcf61b7b204500fad716997bba3953819162f170425f4f0"
  openprojectBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -689,7 +772,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "51"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/middleware-public-sector"
-    tag: "8.30.62@sha256:9e4341c723cf6671479dfaad37635f8b28bb510decb9b7f0fd2616faacbf0d1a"
+    tag: "8.33.56@sha256:4b3064fbcd068562a66cea1ff38c859aecc48038650efbf786d4122601ced674"
  openxchangeCoreUI:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -699,7 +782,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui"
-    tag: "8.30.1@sha256:bd15c87f0bd929be56dea260e35de0e089758eaf394c0eb4ece2991371c7ad5e"
+    tag: "8.33.2@sha256:8c98cc1f91a366a6c4f1464fb7efcef148fc614c117c34a9d5da45ee40c04bae"
  openxchangeCoreUIMiddleware:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -719,7 +802,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "799279"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-user-guide"
-    tag: "8.30.1161251@sha256:a082bcf5768c2cba22f36a4299665474af92fd18307a1de719fc541717aee0b7"
+    tag: "8.33.1228926@sha256:0b6356afdce7021b78ff49020cf4defcc671c0146547043e1313fc1136a2f576"
  openxchangeDocumentConverter:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -729,7 +812,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "50"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/documentconverter"
-    tag: "8.30.60@sha256:4b3c79f94beec71f1b3e6c1be3cb4894d25e3a3133390cb077bf6fa749cecbe8"
+    tag: "8.33.49@sha256:0bbb37e36aeaad00e7c6f78d4a25621be9fdd854dc39ba9dfa0ea923c088978c"
  openxchangeGotenberg:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -739,7 +822,7 @@ images:
    # upstreamMirrorStartFrom: ["7", "9", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/gotenberg"
-    tag: "8.2.0@sha256:ec5afe8eea496d3bef6c42291fde9c203c20e8a68189a2314ef876e9c0e67680"
+    tag: "8.12.0@sha256:2b36e1ea5db6d3d475348c0ed8df5edf09ab92781a9cfbb9ce7c96971cfcc5a8"
  openxchangeGuardUI:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -749,7 +832,7 @@ images:
    # upstreamMirrorStartFrom: ["4", "2", "2"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/guard-ui"
-    tag: "8.28.1@sha256:eed6a81f8393ce6ecdc8ea83507e0a734431a0eb8d30221f4cabe9fc7906e4e6"
+    tag: "8.32.0@sha256:5c9542f9112882e46c3b8cb6f0ca2bef61585abac0e640a4fafa7d7ef60a392b"
  openxchangeImageConverter:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -759,7 +842,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "50"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/imageconverter"
-    tag: "8.30.61@sha256:816008c99e38a7268a323c2c144f1855275c53ea678cd6fdf2ff2170bd7bcfac"
+    tag: "8.33.53@sha256:454c53e2b7f5fab14bf29495854ffe2c10f44c4d4a611e237232eeeb3903feb8"
  openxchangeNextcloudIntegrationUI:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -769,7 +852,7 @@ images:
    # upstreamMirrorStartFrom: ["1", "2", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/nextcloud-integration-ui"
-    tag: "1.2.0@sha256:3d0ef11196f7544a01539e6790e4402ad69e2a501312eb7c7bb128c6563d0a8d"
+    tag: "1.3.2@sha256:d9129b87a184cc0020a40f2720e3190c64b30ed983dc68e4b3fe52cc8a7ee1a4"
  openxchangePublicSectorUI:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -779,7 +862,7 @@ images:
    # upstreamMirrorStartFrom: ["2", "2", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/public-sector-ui"
-    tag: "2.3.0@sha256:a557816ee55500ecc3b46b60f0440ea66c7f0d90e888ce3b0df8a9acdd72acbe"
+    tag: "2.3.1@sha256:8bd35ef700eb48b8f40a71d02aea179cf2eae95a1be3b3b5f1cacb3698bc488a"
  oxConnector:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -815,7 +898,7 @@ images:
    # upstreamMirrorStartFrom: ["8922"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images-mirror/prosody"
-    tag: "stable-9823@sha256:1c52b4ca8397545d54067c67a54c50473d83242c75f001fbf20ee628dfc80b7b"
+    tag: "stable-9955@sha256:fa66872338c7c3b6fdb1f1a67ad770f2b62948f4193b91a58f12c0aa5ca2e783"
  redis:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
--- a/helmfile/environments/default/opendesk_main.yaml.gotmpl
+++ b/helmfile/environments/default/opendesk_main.yaml.gotmpl
@@ -4,90 +4,89 @@
 #
 # Note: Currently only single namespace deployments are supported.
 ---
-certificates:
-  enabled: true
-  namespace: ~
-clamavDistributed:
-  enabled: false
-  namespace: ~
-clamavSimple:
-  enabled: true
-  namespace: ~
-collabora:
-  enabled: true
-  namespace: ~
-cryptpad:
-  enabled: true
-  namespace: ~
-dkimpy:
-  enabled: false
-  namespace: ~
-dovecot:
-  enabled: true
-  namespace: ~
-element:
-  enabled: true
-  namespace: ~
-home:
-  enabled: true
-  namespace: ~
-jitsi:
-  enabled: true
-  namespace: ~
-mariadb:
-  enabled: true
-  namespace: ~
-memcached:
-  enabled: true
-  namespace: ~
-migrations:
-  enabled: true
-  namespace: ~
-minio:
-  enabled: true
-  namespace: ~
-nextcloud:
-  enabled: true
-  namespace: ~
-notes:
-  enabled: false
-  namespace: ~
-nubus:
-  enabled: true
-  namespace: ~
-openproject:
-  enabled: true
-  namespace: ~
-oxAppSuite:
-  enabled: true
-  namespace: ~
-postfix:
-  enabled: true
-  namespace: ~
-postgresql:
-  enabled: true
-  namespace: ~
-redis:
-  enabled: true
-  namespace: ~
-staticFiles:
-  enabled: true
-  namespace: ~
-xwiki:
-  enabled: true
-  namespace: ~
-
-# openDesk Enterprise Components
-cassandra:
-  enabled: false
-  namespace: ~
-elementAdmin:
-  enabled: false
-  namespace: ~
-elementGroupsync:
-  enabled: false
-  namespace: ~
-collaboraController:
-  enabled: false
-  namespace: ~
+apps:
+  cassandra:
+    enabled: {{ if eq (env "OPENDESK_ENTERPRISE") "true" }}true{{ else }}false{{ end }}
+    namespace: ~
+  certificates:
+    enabled: true
+    namespace: ~
+  clamavDistributed:
+    enabled: false
+    namespace: ~
+  clamavSimple:
+    enabled: true
+    namespace: ~
+  collabora:
+    enabled: true
+    namespace: ~
+  collaboraController:
+    enabled: {{ if eq (env "OPENDESK_ENTERPRISE") "true" }}true{{ else }}false{{ end }}
+    namespace: ~
+  cryptpad:
+    enabled: true
+    namespace: ~
+  dkimpy:
+    enabled: false
+    namespace: ~
+  dovecot:
+    enabled: true
+    namespace: ~
+  element:
+    enabled: true
+    namespace: ~
+  elementAdmin:
+    enabled: false
+    namespace: ~
+  elementGroupsync:
+    enabled: false
+    namespace: ~
+  home:
+    enabled: true
+    namespace: ~
+  jitsi:
+    enabled: true
+    namespace: ~
+  mariadb:
+    enabled: true
+    namespace: ~
+  memcached:
+    enabled: true
+    namespace: ~
+  migrations:
+    enabled: true
+    namespace: ~
+  minio:
+    enabled: true
+    namespace: ~
+  nextcloud:
+    enabled: true
+    namespace: ~
+  notes:
+    enabled: false
+    namespace: ~
+  nubus:
+    enabled: true
+    namespace: ~
+  openproject:
+    enabled: true
+    namespace: ~
+  oxAppSuite:
+    enabled: true
+    namespace: ~
+  postfix:
+    enabled: true
+    namespace: ~
+  postgresql:
+    enabled: true
+    namespace: ~
+  redis:
+    enabled: true
+    namespace: ~
+  staticFiles:
+    enabled: true
+    namespace: ~
+  xwiki:
+    enabled: true
+    namespace: ~
 ...
--- a/helmfile/environments/default/persistence.yaml.gotmpl
+++ b/helmfile/environments/default/persistence.yaml.gotmpl
@@ -8,6 +8,10 @@ persistence:
    RWO: ""

  storages:
+    cassandra:
+      size: "1Gi"
+      commitLogsize: "256Mi"
+      storageClassName: ~
    clamav:
      size: "1Gi"
      storageClassName: ~
--- a/helmfile/environments/default/replicas.yaml.gotmpl
+++ b/helmfile/environments/default/replicas.yaml.gotmpl
@@ -5,6 +5,9 @@
 # When adding new components in here, do not forget to add them as well to
 # `../test/values.yaml.gotmpl` to ensure their linting coverage.
 replicas:
+  # -- component: Cassandra
+  # -- scalable: tbd
+  cassandra: 1
  # -- component: Antivirus (ClamAV)
  # -- scalable: true
  # -- comment: clamav-simple - supports `ReadWriteOnce` PVCs.
@@ -25,7 +28,13 @@ replicas:

  # -- component: Weboffice (Collabora)
  # -- scalable: true
+  # -- comment: If Collabora Controller is enabled, Collabora is autoscaling and the value below will be ignored.
+  # Please check `enterpriseFeatures.collabora.autoscaling` for autoscaling settings.
  collabora: 1
+  # -- scalable: true
+  # -- comment: Load between Collabora Controller Pods is going to one Pod (the leader) only, therefore raise the number
+  # e.g. to `2` for high availability of the Collabora Controller.
+  collaboraController: 1

  # -- component: Pad (CryptPad)
  # -- scalable: false
@@ -91,6 +100,8 @@ replicas:
  # -- scalable: true
  umsLdapServerSecondary: 0
  # -- scalable: true
+  # -- comment: The LDAP proxy is only required in situations where there are clients outside of UDM writing into the
+  # LDAP like Samba. This is not a use case within openDesk so the LDAP Proxy's replica count should be kept at `0`
  umsLdapServerProxy: 0
  # -- scalable: tbd
  umsNotificationsApi: 1
@@ -131,6 +142,8 @@ replicas:
  # -- scalable: tbd
  jicofo: 1
  # -- scalable: tbd
+  jigasi: 1
+  # -- scalable: tbd
  jitsi: 1
  # -- scalable: tbd
  jitsiKeycloakAdapter: 1
@@ -190,6 +203,8 @@ replicas:
  # -- scalable: tbd
  openxchangeNextcloudIntegrationUI: 1
  # -- scalable: tbd
+  openxchangePluginsUI: 1
+  # -- scalable: tbd
  openxchangePublicSectorUI: 1

  # -- component: Knowledge management (XWiki)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jonas Schulz	1992900c4f	feat(helmfile): Allow scheduling cpu intensive loads on dedicated pools	2025-02-19 16:50:07 +01:00
Thorsten Roßner	ef7e3d225d	ci(userimport): Disable certificate verification for user import	2025-02-19 12:36:02 +00:00
Dominik Kaminski	31a22f38cc	chore(docs): Add duration in self-signed certificate example	2025-02-19 11:03:12 +01:00
Thorsten Roßner	a25a0e9173	chore(helmfile): Disable Synapse admin and groupsync by default	2025-02-19 09:13:42 +01:00
Thomas Kaltenbrunner	ba333cd74e	chore(helmfile): Fix ee deployment	2025-02-19 08:24:40 +01:00
Dominik Kaminski	17a0adb67c	ci(gitlab): Add docs back to release and split ci file up	2025-02-19 08:24:40 +01:00
Philip Gaber	91d0f98682	fix(helmfile): Add SSL option for Keycloak Extensions Proxy's PostgreSQL connection	2025-02-19 08:24:32 +01:00
Thorsten Roßner	09f482981b	fix(nextcloud): Update Nextcloud to 29.0.11 and support for Cron-Job specific resource definitions	2025-02-19 08:23:56 +01:00
Thorsten Roßner	930ae9d3e7	fix(helmfile): Set default for domain to `opendesk.internal` to avoid enforcing DOMAIN environment variable for deployments using YAML overrides	2025-02-19 08:23:56 +01:00
Carsten Hoeger	581c8aed1f	fix(open-xchange): Update OX App Suite to 8.33	2025-02-19 08:23:56 +01:00
Thorsten Roßner	de8b560fe7	fix(helmfile): Fine-grained service types	2025-02-19 08:23:56 +01:00
Simon Herman	370247b951	fix(open-xchange): Parameters to split read and write queries to MariaDB	2025-02-19 08:23:56 +01:00
Thorsten Roßner	b32996da34	fix(helmfile): Make openDesk IAM attributes optional with enabled as default	2025-02-19 08:23:56 +01:00
Norbert Tretkowski	10e0b0ad6c	fix(nubus): Remove doublet `resources` key in `udm-listener` StatefulSet	2025-02-19 08:23:56 +01:00
Thorsten Roßner	32df1657d2	fix(oxconnector): Update to strict `securityContext` from upstream defaults	2025-02-19 08:23:56 +01:00
Jonas Schulz	8dcac46d98	chore(helmfile): Remove default value for domain	2025-02-19 08:23:56 +01:00
Thorsten Roßner	284c9fe0c7	fix(helmfile): Provide toggle in `functional.yaml.gotmpl` for "new device notification" mails	2025-02-19 08:23:56 +01:00
Oliver Günther	83c311b101	fix(openproject): Update OpenProject to 15.2.1	2025-02-19 08:23:56 +01:00
Thorsten Roßner	aff8edbde2	fix(nubus): Support for custom UDM commands	2025-02-19 08:23:56 +01:00
Thorsten Roßner	9c79c44453	fix(helmfile): Add missing customizing option for Matrix widgets	2025-02-19 08:23:56 +01:00
Thorsten Roßner	1e9e7d8e3a	chore(nextcloud): Bump image and charts to toggle BFP	2025-02-19 08:23:56 +01:00
Thorsten Roßner	1f051e7779	fix(nubus): Only configure apps that are deployed to show up in IAM admin UI and Keycloak	2025-02-19 08:23:56 +01:00
Philip Gaber	824e5cbf3e	chore(helmfile): Remove non-informative comments	2025-02-19 08:23:51 +01:00
Thorsten Roßner	955f17ef8b	fix(nubus): Disable unused notification feature	2025-02-19 08:23:51 +01:00
Thorsten Roßner	ab49bf9f6b	fix(nextcloud): Update `groupfolders` app to fix group selection in admin mode	2025-02-19 08:23:51 +01:00
Thorsten Roßner	777e7d2fc6	fix(nubus): Re-implement toggle for UDM-REST-API based on `functional.externalServices.nubus.udmRestApi.enabled`	2025-02-19 08:23:51 +01:00
Dominik Kaminski	b70959d82d	chore(docs): Update security-context.md	2025-02-19 08:23:51 +01:00
Thomas Kaltenbrunner	6e343c76a3	fix(dovecot): Add Dovecot Pro [EE]	2025-02-19 08:23:51 +01:00
Thorsten Roßner	cd9c54b177	fix(helmfile): Remove reference to no longer required `elementWeb` chart	2025-02-19 08:23:51 +01:00
Thorsten Roßner	4662709673	fix(nubus): Fix Keycloak dialogue background length on small screens	2025-02-19 08:23:51 +01:00
Thorsten Roßner	8eeaa23c2f	fix(helmfile): Update/streamline theming	2025-02-19 08:23:51 +01:00
Norbert Tretkowski	601e649913	fix(nubus): Update Keycloak Extensions Proxy	2025-02-19 08:23:51 +01:00
Thorsten Roßner	2fcf014894	fix(helmfile): Introduce `apps` as top level in `opendesk_main.yaml.gotmpl`; Please check migrations.md for upgrades of existing installations	2025-02-19 08:22:56 +01:00
Dominik Kaminski	c51c92536a	chore(helmfile): Use string compare instead of nil evaluation	2025-02-19 08:22:56 +01:00
Thorsten Roßner	e23c97430f	chore(helmfile): Dev tooling: Improve `charts-local.py` script to allow referencing local copies of pulled Helm charts	2025-02-19 08:22:45 +01:00
Thomas Kaltenbrunner	61d94a8de6	fix(element): Add Element EE components	2025-01-29 12:30:08 +01:00
emrah	4e21129456	docs(jitsi): Dial-in flow and related components	2025-01-29 06:48:05 +00:00
emrah	1323ef142e	fix(jitsi): Support for phone dial-in into Jitsi conferences	2025-01-29 06:48:05 +00:00
Thorsten Roßner	03ec70435c	fix(helmfile): Integrate oD EE	2025-01-28 18:10:47 +01:00