fix(intercom): Converge sessions to a working state

fix(openproject): Update to 15.1.1
fix(docs): Add permissions.md
2025-12-06 15:31:38 +01:00 · 2025-01-16 10:37:31 +01:00 · 2025-01-15 07:15:59 +01:00 · 2025-01-14 16:57:04 +01:00 · 2025-01-09 10:41:25 +01:00 · 2025-01-09 07:05:49 +01:00
30 changed files with 214 additions and 561 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -186,9 +186,6 @@ variables:
    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail.
                  GRACE_PERIOD is the period in seconds that should be waited before running the tests."
    value: "0"
-  TESTS_NUMBER_OF_THREADS:
-    description: "How many threads are used for executing the tests in parallel?"
-    value: "8"

 # Declare .environments which is in `opendesk-env` repository. In case it is not available
 # 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
@@ -563,8 +560,7 @@ run-tests:
          \"screenshot_redirect_step\": \"yes\", \
          \"testset\": \"${TESTS_TESTSET}\", \
          \"testprofile\": \"Namespace\", \
-          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\", \
-          \"NUMBER_OF_THREADS\": \"${TESTS_NUMBER_OF_THREADS}\" \
+          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\" \
        } \
      }" \
      "https://${TESTS_PROJECT_URL}/trigger/pipeline"
--- a/.kyverno/policies/template-storage.yaml
+++ b/.kyverno/policies/template-storage.yaml
@@ -10,7 +10,7 @@ metadata:
    policies.kyverno.io/subject: "Pod"
    policies.kyverno.io/description: >-
      This policy validates if `.Values.persistence.storageClassNames` variables are used in templates and if the size
-      of volumes can be customized by `.Values.persistence.storages.<COMPONENT>.size` variable.
+      of volumes can be customized by `.Values.persistence.size` variable.
 spec:
  background: true
  rules:
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,36 +1,3 @@
-## [1.1.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.0...v1.1.1) (2025-01-27)
-
-
-### Bug Fixes
-
-* **docs:** Add permissions.md ([04ab28c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/04ab28c029bb60575c1936ca5acdd2f829b26c06))
-* **element:** MatrixID for Element "Welcome User" to support deployments where matrix domain differs from homeserver FQDN ([ccb51a0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ccb51a0de32525a93fd982d52dc8e6a35db8f09a))
-* **element:** Update Element to 1.11.90 ([335806a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/335806a53e51c3fc6a03440316e909aa51af5be8))
-* **element:** Update Helm chart to v6.0.2 for a fix when using non generated secrets in `opendesk-synapse` ([d5e73fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d5e73feb880c33e8127f284fcc685ffdc15874a8))
-* **element:** Update Synapse to 1.121.1 ([33ff922](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/33ff9227b745f99e3abdde6dbbe6b00042fca655))
-* **helmfile:** Move the access restriction configuration for Keycloak client scopes into helmfile templating, instead of hardcoded Helm chart values ([3662b5c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3662b5cd255b37321d3a3625f78feff07b7e633c))
-* **helmfile:** Remove duplicate entries from `secrets.yaml.gotmpl` ([a13cf63](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a13cf630242343dc8f759cfeb423ff626480b086))
-* **helmfile:** Support component specific storageClassNames. **Note:** Please check the migration.md if you upgrade a deployment that has set custom PVC sizes using `persistence.size` settings. ([bacf51e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bacf51efb1b042b80f13f5cf3f50557006f32374))
-* **helmfile:** Support PostgreSQL as alternative database backend for Nextcloud and XWiki. **Note:** PostgreSQL is likely to become the preferred option/default in the future and MariaDB might be deprecated at a later point. ([a0f52ee](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a0f52ee7d4f6a9b82c9d4e288bc4c6cc96018985))
-* **helmfile:** Update `opendesk-alerts` and `opendesk-dashboards` to get predictable sort order, improving GitOps deployments ([0c91117](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0c91117575a3b56ff9f0b4ae72a501b9f3b4384c))
-* **helmfile:** Update upstream images for k8s/kubectl to v1.32.0 ([b71c2e5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b71c2e57eec10093d96804e249fbaf81c51fb22e))
-* **intercom:** Remove legacy OIDC claims ([6796f32](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6796f320f72db02d67b73685aa6356cda9ac86d1))
-* **nextcloud:** Update image and Helm chart to support app toggles during deployment ([1cdfcf2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1cdfcf2784271f2b8ea61d2e8e534db2aa386f4b))
-* **nextcloud:** Update to Nextcloud 29.0.10 ([d096fb1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d096fb1154dbcd092e105d4450e7996dfda0388e))
-* **nubus:** Fix `pullPolicy` setting for `ldapServer.leaderElector` to satisfy Kyverno linter ([6f2f7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6f2f7cd5db6708c1fc523e3cf3160f39f1dba2bb))
-* **nubus:** Merge yaml files for better maintainability ([6c67eca](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6c67eca7aa68c3f597cc5790ba1046ca0855c329))
-* **nubus:** Pre-create groups in Keycloak to avoid race condition on group sync when initial users login parallel ([5496317](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5496317fee1ca47a80d0798b9048a1474ca8e2a6))
-* **nubus:** Remove `extra` settings from ldapServer needed for openDesk 1.0.0 LDAP migration ([fab862e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fab862eec689bf8ef547c4bd06244313f24f6d0b))
-* **nubus:** Remove b64 encoded files from CSS, instead use `opendesk-static-files` ([2926e2c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2926e2c93a2b4be24abd1e6dd4ce02071a629cb4))
-* **nubus:** Template `secrets.nubus.masterpassword`. **Note:** Please check migrations.md for details. ([5aae75a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5aae75a1521f73e497859fe3d3b89a8752bb47a1))
-* **nubus:** Update customizations for group cleanup ([0b230fa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0b230fa2cc841edfde99f5d94dc9c8054bfbb5ec))
-* **open-xchange:** Add missing `registryOpencodeDe` to OX-Connector's `waitForDependency` image ([a16d907](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a16d9071c96ef7fde87e6579c328e1e05509824b))
-* **openproject:** Update to 15.1.1 ([b4b714f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4b714ff41a8f01d4b44c6d5ced3f036f7d90699))
-* **openproject:** Update to 15.2.0 ([9d8e9c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d8e9c3ade9917fb8044331ebdea8d7bca4066b0))
-* **static-files:** Update Helm chart to use more generic `assets` over `theme.imagery.assets` ([63562c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63562c1aae6b2c33ea39b93c11e842c2ab1e2c25))
-* **static-files:** Update Helm chart to v4.0.1 to support longer domain names ([b0e665b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b0e665b031baf36c59eea85b3d575f1a49290bf1))
-* **xwiki:** Update Helm chart to v1.4.1 to fix support for custom `ingressClassName` values. Ref [#144](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/144) ([033cb55](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/033cb558ddc0b47d17b006cdc75c593c5c356147))
-
 # [1.1.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.0.0...v1.1.0) (2024-12-24)


--- a/README.md
+++ b/README.md
@@ -36,8 +36,8 @@ openDesk currently features the following functional main components:
 | File management      | Nextcloud                   | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8)                                                 | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                           |
 | Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
 | Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)                       | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
-| Portal & IAM         | Nubus                       | [1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | [15.2.0](https://www.openproject.org/docs/release-notes/15-2-0/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Portal & IAM         | Nubus                       | [1.4.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
+| Project management   | OpenProject                 | [15.1.1](https://www.openproject.org/docs/release-notes/15-1-1/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
 | Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
 | Weboffice            | Collabora                   | [24.04.9.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |

--- a/docs/enhanced-configuration/idp-federation.md
+++ b/docs/enhanced-configuration/idp-federation.md
@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Federation with external identity provider (IdP)</h1>

 <!-- TOC -->
+* [Context](#context)
 * [References](#references)
 * [Prerequisites](#prerequisites)
  * [User accounts](#user-accounts)
@@ -152,9 +153,10 @@ The following configuration is taking place in the Keycloak realm `opendesk`.
  - *Client authentication*: `Client secret sent as post` (default)
  - *Client ID*: Use the client ID you took from your organization's IdP config (`opendesk-federation-client` in this example)
  - *Client Secret*: Use the secret you took from your organization's IdP config
-  - When completed with *Add*, you get to the detailed IdP configuration that at least needs some the following update:
+  - When completed with *Add*, you get to the detailed IdP configured that also needs some updates (you may need to open the *Advanced* section to access some settings)
+    - *Back-channel logout*: `On`
+    - *Disable user info*: `On`
    - *First login flow override*: `auto-federate-flow`
-    - Depending on your organizations IdP and process preferences additional setting may be required

 - In case you want to forcefully redirect all users to your organization's IdP (disabling login with local openDesk accounts):
  - *Authentication* > `2fa-browser`
--- a/docs/external-services.md
+++ b/docs/external-services.md
@@ -11,7 +11,6 @@ This document will cover the additional configuration for external services like
 * [Database](#database)
 * [Object storage](#object-storage)
 * [Cache](#cache)
-* [Footnotes](#footnotes)
 <!-- TOC -->

 # Database
@@ -19,134 +18,93 @@ This document will cover the additional configuration for external services like
 When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.

-> **Note**<br>
-> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely become the preferred option/default in the future and MariaDB might be deprecated at a later point requiring migrations[^1] if you do not select PostgreSQL for new installations.
-
-| Component        | Name               | Parameter | Key                                           | Default                      |
-| ---------------- | ------------------ | --------- | --------------------------------------------- | ---------------------------- |
-| Element          | Synapse            |           |                                               |                              |
-|                  |                    | Type      | `databases.synapse.type`                      | `postgresql`                 |
-|                  |                    | Name      | `databases.synapse.name`                      | `matrix`                     |
-|                  |                    | Host      | `databases.synapse.host`                      | `postgresql`                 |
-|                  |                    | Port      | `databases.synapse.port`                      | `5432`                       |
-|                  |                    | Username  | `databases.synapse.username`                  | `matrix_user`                |
-|                  |                    | Password  | `databases.synapse.password`                  |                              |
-| Nubus            | Guardian Mgmt API  |           |                                               |                              |
-|                  |                    | Type      | `databases.umsGuardianManagementApi.type`     | `postgresql`                 |
-|                  |                    | Name      | `databases.umsGuardianManagementApi.name`     | `guardianmanagementapi`      |
-|                  |                    | Host      | `databases.umsGuardianManagementApi.host`     | `postgresql`                 |
-|                  |                    | Port      | `databases.umsGuardianManagementApi.port`     | `5432`                       |
-|                  |                    | Username  | `databases.umsGuardianManagementApi.username` | `guardianmanagementapi_user` |
-|                  |                    | Password  | `databases.umsGuardianManagementApi.password` |                              |
-|                  | Keycloak           |           |                                               |                              |
-|                  |                    | Type      | `databases.keycloak.type`                     | `postgresql`                 |
-|                  |                    | Name      | `databases.keycloak.name`                     | `keycloak`                   |
-|                  |                    | Host      | `databases.keycloak.host`                     | `postgresql`                 |
-|                  |                    | Port      | `databases.keycloak.port`                     | `5432`                       |
-|                  |                    | Username  | `databases.keycloak.username`                 | `keycloak_user`              |
-|                  |                    | Password  | `databases.keycloak.password`                 |                              |
-|                  | Keycloak Extension |           |                                               |                              |
-|                  |                    | Type      | `databases.keycloakExtension.type`            | `postgresql`                 |
-|                  |                    | Name      | `databases.keycloakExtension.name`            | `keycloak_extensions`        |
-|                  |                    | Host      | `databases.keycloakExtension.host`            | `postgresql`                 |
-|                  |                    | Port      | `databases.keycloakExtension.port`            | `5432`                       |
-|                  |                    | Username  | `databases.keycloakExtension.username`        | `keycloak_extensions_user`   |
-|                  |                    | Password  | `databases.keycloakExtension.password`        |                              |
-|                  | Notifications API  |           |                                               |                              |
-|                  |                    | Type      | `databases.umsNotificationsApi.type`          | `postgresql`                 |
-|                  |                    | Name      | `databases.umsNotificationsApi.name`          | `notificationsapi`           |
-|                  |                    | Host      | `databases.umsNotificationsApi.host`          | `postgresql`                 |
-|                  |                    | Port      | `databases.umsNotificationsApi.port`          | `5432`                       |
-|                  |                    | Username  | `databases.umsNotificationsApi.username`      | `notificationsapi_user`      |
-|                  |                    | Password  | `databases.umsNotificationsApi.password`      |                              |
-|                  | Self Service       |           |                                               |                              |
-|                  |                    | Type      | `databases.umsSelfservice.type`               | `postgresql`                 |
-|                  |                    | Name      | `databases.umsSelfservice.name`               | `selfservice`                |
-|                  |                    | Host      | `databases.umsSelfservice.host`               | `postgresql`                 |
-|                  |                    | Port      | `databases.umsSelfservice.port`               | `5432`                       |
-|                  |                    | Username  | `databases.umsSelfservice.username`           | `selfservice_user`           |
-|                  |                    | Password  | `databases.umsSelfservice.password`           |                              |
-| Nextcloud        | Nextcloud          |           |                                               |                              |
-|                  |                    | Type      | `databases.nextcloud.type`                    | `mariadb`                    |
-|                  |                    | Name      | `databases.nextcloud.name`                    | `nextcloud`                  |
-|                  |                    | Host      | `databases.nextcloud.host`                    | `mariadb`                    |
-|                  |                    | Port      | `databases.nextcloud.port`                    | `3306`                       |
-|                  |                    | Username  | `databases.nextcloud.username`                | `nextcloud_user`             |
-|                  |                    | Password  | `databases.nextcloud.password`                |                              |
-| Notes            | Notes              |           |                                               |                              |
-|                  |                    | Type      | `databases.notes.type`                        | `postgresql`                 |
-|                  |                    | Name      | `databases.notes.name`                        | `notes`                      |
-|                  |                    | Host      | `databases.notes.host`                        | `postgresql`                 |
-|                  |                    | Port      | `databases.notes.port`                        | `5432`                       |
-|                  |                    | Username  | `databases.notes.username`                    | `notes_user`                 |
-|                  |                    | Password  | `databases.notes.password`                    |                              |
-| OpenProject      | OpenProject        |           |                                               |                              |
-|                  |                    | Type      | `databases.openproject.type`                  | `postgresql`                 |
-|                  |                    | Name      | `databases.openproject.name`                  | `openproject`                |
-|                  |                    | Host      | `databases.openproject.host`                  | `postgresql`                 |
-|                  |                    | Port      | `databases.openproject.port`                  | `5432`                       |
-|                  |                    | Username  | `databases.openproject.username`              | `openproject_user`           |
-|                  |                    | Password  | `databases.openproject.password`              |                              |
-| OX App Suite[^2] | OX App Suite       |           |                                               |                              |
-|                  |                    | Type      | `databases.oxAppSuite.type`                   | `mariadb`                    |
-|                  |                    | Name      | `databases.oxAppSuite.name`                   | `openxchange`                |
-|                  |                    | Host      | `databases.oxAppSuite.host`                   | `mariadb`                    |
-|                  |                    | Port      | `databases.oxAppSuite.port`                   | `3306`                       |
-|                  |                    | Username  | `databases.oxAppSuite.username`               | `root`                       |
-|                  |                    | Password  | `databases.oxAppSuite.password`               |                              |
-| XWiki[^3]        | XWiki              |           |                                               |                              |
-|                  |                    | Type      | `databases.xwiki.type`                        | `mariadb`                    |
-|                  |                    | Name      | `databases.xwiki.name`                        | `xwiki`                      |
-|                  |                    | Host      | `databases.xwiki.host`                        | `mariadb`                    |
-|                  |                    | Port      | `databases.xwiki.port`                        | `3306`                       |
-|                  |                    | Username  | `databases.xwiki.username`                    | `root`                       |
-|                  |                    | Password  | `databases.xwiki.password`                    |                              |
+| Component    | Name               | Type       | Parameter | Key                                      | Default                    |
+| ------------ | ------------------ | ---------- | --------- | ---------------------------------------- | -------------------------- |
+| Element      | Synapse            | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
+|              |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
+|              |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
+|              |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
+|              |                    |            | Password  | `databases.synapse.password`             |                            |
+| Keycloak     | Keycloak           | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
+|              |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
+|              |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
+|              |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
+|              |                    |            | Password  | `databases.keycloak.password`            |                            |
+|              | Keycloak Extension | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
+|              |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
+|              |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
+|              |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
+|              |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
+| UMS          | Notifications API  | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
+|              |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
+|              |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
+|              |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
+|              |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
+|              | Self Service       | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
+|              |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
+|              |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
+|              |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
+|              |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
+| Nextcloud    | Nextcloud          | MariaDB    |           |                                          |                            |
+|              |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
+|              |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
+|              |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
+|              |                    |            | Password  | `databases.nextcloud.password`           |                            |
+| OpenProject  | OpenProject        | PostgreSQL |           |                                          |                            |
+|              |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
+|              |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
+|              |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
+|              |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
+|              |                    |            | Password  | `databases.openproject.password`         |                            |
+| OX App Suite | OX App Suite       | MariaDB    |           |                                          |                            |
+|              |                    |            | Name      | `databases.oxAppSuite.name`              | `CONFIGDB`                 |
+|              |                    |            | Host      | `databases.oxAppSuite.host`              | `mariadb`                  |
+|              |                    |            | Username  | `databases.oxAppSuite.username`          | `root`                     |
+|              |                    |            | Password  | `databases.oxAppSuite.password`          |                            |
+| XWiki        | XWiki              | MariaDB    |           |                                          |                            |
+|              |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
+|              |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
+|              |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
+|              |                    |            | Password  | `databases.xwiki.password`               |                            |

 # Object storage

 When deploying this suite to production, you need to configure the applications to use your production-grade object
 storage service.

-| Component   | Name        | Parameter       | Key                                      | Default            |
+| Component   | Name        | Parameter       | Key                                      | Default            |
 |-------------|-------------|-----------------|------------------------------------------|--------------------|
-| OpenProject | OpenProject |                 |                                          |                    |
-|             |             | Backend         | `objectstores.openproject.backend`       | `minio`            |
-|             |             | Bucket          | `objectstores.openproject.bucket`        | `openproject`      |
-|             |             | Endpoint        | `objectstores.openproject.endpoint`      |                    |
-|             |             | Provider        | `objectstores.openproject.provider`      | `AWS`              |
-|             |             | Region          | `objectstores.openproject.region`        |                    |
-|             |             | Secret          | `objectstores.openproject.secret`        |                    |
-|             |             | Username        | `objectstores.openproject.username`      | `openproject_user` |
-|             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |
+| OpenProject | OpenProject |                 |                                          |                    |
+|             |             | Backend         | `objectstores.openproject.backend` | `minio` |
+|             |             | Bucket          | `objectstores.openproject.bucket` | `openproject` |
+|             |             | Endpoint        | `objectstores.openproject.endpoint` |                    |
+|             |             | Provider        | `objectstores.openproject.provider` | `AWS` |
+|             |             | Region          | `objectstores.openproject.region` |                    |
+|             |             | Secret          | `objectstores.openproject.secret` |                    |
+|             |             | Username        | `objectstores.openproject.username` | `openproject_user` |
+|             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |

 # Cache

 When deploying this suite to production, you need to configure the applications to use your production-grade cache
 service.

-| Component        | Name             | Type      | Parameter | Key                          | Default          |
+| Component        | Name             | Type      | Parameter | Key                          | Default          |
 |------------------|------------------|-----------|-----------|------------------------------|------------------|
-| Intercom Service | Intercom Service | Redis     |           |                              |                  |
-|                  |                  |           | Host      | `cache.intercomService.host` | `redis-headless` |
-|                  |                  |           | Port      | `cache.intercomService.port` | `6379`           |
-| Nextcloud        | Nextcloud        | Redis     |           |                              |                  |
-|                  |                  |           | Host      | `cache.nextcloud.host`       | `redis-headless` |
-|                  |                  |           | Port      | `cache.nextcloud.port`       | `6379`           |
-| OpenProject      | OpenProject      | Memcached |           |                              |                  |
-|                  |                  |           | Host      | `cache.openproject.host`     | `memcached`      |
-|                  |                  |           | Port      | `cache.openproject.port`     | `11211`          |
-| UMS              | Self Service     | Memcached |           |                              |                  |
-|                  |                  |           | Host      | `cache.umsSelfservice.host`  | `memcached`      |
-|                  |                  |           | Port      | `cache.umsSelfservice.port`  | `11211`          |
-
-# Footnotes
-
-[^1] The upstream product provide some valuable information regarding database migrations:
- Nextcloud: https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
- XWiki:
-  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
-  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
-
-[^2] OX App Suite only supports MariaDB and requires root access, as it manages its databases itself.
-
-[^3] XWiki requires root access when using MariaDB as sub-wikis are using separate databases that are managed by XWiki. When using PostgreSQL with XWiki no root user is required as the sub-wikis are managed within multiple schemes within a single database.
+| Intercom Service | Intercom Service | Redis     |           |                              |                  |
+|                  |                  |           | Host      | `cache.intercomService.host` | `redis-headless` |
+|                  |                  |           | Port      | `cache.intercomService.port` | `6379` |
+| Nextcloud        | Nextcloud        | Redis     |           |                              |                  |
+|                  |                  |           | Host      | `cache.nextcloud.host` | `redis-headless` |
+|                  |                  |           | Port      | `cache.nextcloud.port` | `6379` |
+| OpenProject      | OpenProject      | Memcached |           |                              |                  |
+|                  |                  |           | Host      | `cache.openproject.host` | `memcached` |
+|                  |                  |           | Port      | `cache.openproject.port` | `11211` |
+| UMS              | Self Service     | Memcached |           |                              |                  |
+|                  |                  |           | Host      | `cache.umsSelfservice.host` | `memcached` |
+|                  |                  |           | Port      | `cache.umsSelfservice.port` | `11211` |
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -8,26 +8,23 @@ SPDX-License-Identifier: Apache-2.0
 <!-- TOC -->
 * [Disclaimer](#disclaimer)
 * [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
-* [Manual checks/actions](#manual-checksactions)
-  * [From v1.1.0](#from-v110)
-    * [Pre-upgrade from v1.1.0](#pre-upgrade-from-v110)
-      * [Helmfile feature update: Component specific `storageClassName`](#helmfile-feature-update-component-specific-storageclassname)
+* [Manual update steps](#manual-update-steps)
+  * [From v1.1.0: Manual checks/steps](#from-v110-manual-checkssteps)
+    * [Pre-upgrade](#pre-upgrade)
      * [Helmfile new secret: `secrets.nubus.masterpassword`](#helmfile-new-secret-secretsnubusmasterpassword)
-  * [From v1.0.0](#from-v100)
-    * [Pre-upgrade from v1.0.0](#pre-upgrade-from-v100)
-      * [Helmfile cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
-      * [Helmfile cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
-      * [Helmfile cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
-      * [Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
+  * [From v1.0.0: Manual checks/steps](#from-v100-manual-checkssteps)
+    * [Pre-upgrade](#pre-upgrade-1)
+      * [Helmfile Cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
+      * [Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
+      * [Helmfile Cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
+      * [Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
      * [Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names](#helmfile-cleanup-streamlining-openxchange-and-oxappsuite-attribute-names)
      * [Helmfile feature update: Dicts to define `customization.release`](#helmfile-feature-update-dicts-to-define-customizationrelease)
      * [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
      * [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
      * [External requirements: Redis 7.4](#external-requirements-redis-74)
-    * [Post-upgrade from v1.0.0](#post-upgrade-from-v100)
-      * [XWiki fix-ups](#xwiki-fix-ups)
-  * [From v0.9.0](#from-v090)
-    * [Pre-upgrade from v0.9.0](#pre-upgrade-from-v090)
+  * [From v0.9.0: Manual checks/steps](#from-v090-manual-checkssteps)
+    * [Pre-upgrade: Manual steps](#pre-upgrade-manual-steps)
      * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
      * [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
      * [Changed openDesk defaults: Matrix presence status disabled](#changed-opendesk-defaults-matrix-presence-status-disabled)
@@ -35,17 +32,17 @@ SPDX-License-Identifier: Apache-2.0
      * [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
      * [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
      * [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
-    * [Post-upgrade from v0.9.0](#post-upgrade-from-v090)
+    * [Post-upgrade](#post-upgrade)
      * [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
      * [Optional Cleanup](#optional-cleanup)
-  * [From v0.8.1](#from-v081)
-    * [Pre-upgrade from v0.8.1](#pre-upgrade-from-v081)
+  * [From v1.1.0: Manual checks/steps](#from-v110-manual-checkssteps-1)
+    * [Pre-upgrade](#pre-upgrade-2)
      * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
      * [Updated customizable template attributes](#updated-customizable-template-attributes)
      * [`migrations` S3 bucket](#migrations-s3-bucket)
 * [Automated migrations - Details](#automated-migrations---details)
-  * [From v1.0.0 (automated)](#from-v100-automated)
-  * [From v0.9.0 (automated)](#from-v090-automated)
+  * [From v1.1.0: Automated migrations](#from-v110-automated-migrations)
+  * [From v0.9.0: Automated migrations](#from-v090-automated-migrations)
  * [Related components and artifacts](#related-components-and-artifacts)
  * [Development](#development)
 <!-- TOC -->
@@ -82,74 +79,27 @@ To upgrade existing deployments, you cannot skip any version mentioned in the co

 When interested in more details about the automated migrations, please read section [Automated migrations - Details](#automated-migrations---details).

-# Manual checks/actions
+# Manual update steps

 Be sure you check all the sections for the releases your are going to update your current deployment from.

-## From v1.1.0
+## From v1.1.0: Manual checks/steps

-### Pre-upgrade from v1.1.0
-
-#### Helmfile feature update: Component specific `storageClassName`
-
-With openDesk 1.1.1 we support component specific `storageClassName` definitions beside the global ones, but we had to adapt the structure that can be found in `persistence.yaml.gotmpl` to achieve this in a clean manner.
-
-If you have set custom `persistence.size.*`-values for your deployment, please continue reading as you need to adapt your `persistence` settings to the new structure.
-
-When comparing the [old 1.1.0 structure](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.0/helmfile/environments/default/persistence.yaml.gotmpl) with the [new one](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.1/helmfile/environments/default/persistence.yaml.gotmpl) you can spot the changes:
-
- We replaced `persistence.size` with `persistence.storages`.
- Below each component you can define now the `size` and the optional component specific `storageClassName`.
- We streamlined all components to be on the same level, as Nubus had an additional level of nesting before.
-
-So a setting of:
-
-```yaml
-persistence:
-  size:
-    synapse: "1Gi"
-```
-
-needs to be changed to:
-
-```yaml
-persistence:
-  storages:
-    synapse:
-      size: "1Gi"
-```
-
-or for the Nubus related entries, the following:
-
-```yaml
-persistence:
-  size:
-    nubus:
-      ldapServerData: "1Gi"
-```
-
-needs to be changed to:
-
-```yaml
-persistence:
-  storages:
-    nubusLdapServerData:
-      size: "1Gi"
-```
+### Pre-upgrade

 #### Helmfile new secret: `secrets.nubus.masterpassword`

 A not yet templated secret was discovered in the Nubus deployment that is now defined in [`secrets.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl) with the key `secrets.nubus.masterpassword`. If you define your own secrets, please be sure this new secret is set to the value of the `MASTER_PASSWORD` environment variable used in your deployment.

-## From v1.0.0
+## From v1.0.0: Manual checks/steps

-### Pre-upgrade from v1.0.0
+### Pre-upgrade

-#### Helmfile cleanup: Restructured `/helmfile/files/theme` folder
+#### Helmfile Cleanup: Restructured `/helmfile/files/theme` folder

 If you make use of the [theme folder](../helmfile/files/theme/) or the [`theme.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl), e.g. to applying your own imagery, please ensure you adhere to the new structure of the folder and the yaml-file.

-#### Helmfile cleanup: Consistent use of `*.yaml.gotmpl`
+#### Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`

 In v1.0.0 the files in [`/helmfile/environments/default`](../helmfile/environments/default/) had mixed extensions,
 we have streamlined them to consistently use `*.yaml.gotmpl`.
@@ -159,7 +109,7 @@ This change requires manual action likely in two situations:
 1. You are referencing our upstream files from the aforementioned directory, e.g. in your Argo CD deployment. Please update your references to use the filenames with the new extension.
 2. You have custom files containing configuration information that are named just `*.yaml`: Please rename them to `*.yaml.gotmpl`.

-#### Helmfile cleanup: Prefixing certain app directories with `opendesk-`
+#### Helmfile Cleanup: Prefixing certain app directories with `opendesk-`

 To make it more obvious that some elements from below the [`apps`](../helmfile/apps/) directory are completely
 provided by openDesk, we have prefixed these app directories with `opendesk-`.
@@ -174,7 +124,7 @@ The described changes most likely require manual action in the following situati

 - You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.

-#### Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services
+#### Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services

 In v1.0.0 there was a directory `/helmfile/apps/services` that was intended to contain all the services an operator had to provide externally for production deployments.

@@ -304,34 +254,9 @@ The update from openDesk 1.0.0 contains Redis 7.4.1, like the other openDesk bun

 Please ensure for the Redis you are using that it is updated to at least 7.4 to support the requirement of OX App Suite.

-### Post-upgrade from v1.0.0
+## From v0.9.0: Manual checks/steps

-#### XWiki fix-ups
-
-Unfortunately XWiki does not upgrade itself as expected. A bug with the supplier has already been filed. The following additional steps are required:
-
-1. To enforce re-indexing of the now fixed full-text search access the XWiki Pod and run the following commands to delete two search related directories. To complete this you need to restart the XWiki Pod, but that is anyway part of the next step:
-   ```
-   rm -rf /usr/local/xwiki/data/store/solr/search_9
-   rm -rf /usr/local/xwiki/data/cache/solr/search_9
-   ```
-
-2. This is necessary if the openDesk single sign-on does not longer work and you get a standard XWiki login dialogue instead.
-   - Find the XWiki ConfigMap `xwiki-init-scripts` and find in its `entrypoint` key data the lines beginning with `xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg"`
-   - Before those lines add the following line, of course setting `<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>` to a value you are happy with.
-     ```
-         xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg" 'xwiki.superadminpassword' '<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>'
-     ```
-   - Restart the XWiki Pod.
-   - Access XWiki's web UI and login with `superadmin` and the above set password.
-   - Once XWiki UI is fully rendered, remove the line with the temporary `superadmin` password from the aforementioned ConfigMap.
-   - Restart the XWiki Pod.
-
-You should have now a properly working XWiki instance with single sign-on and full-text search.
-
-## From v0.9.0
-
-### Pre-upgrade from v0.9.0
+### Pre-upgrade: Manual steps

 #### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus

@@ -515,7 +440,7 @@ The IAMs admin account `Administrator` is a member of this group by default, but

 If you need other accounts to use the API, please assign them to the aforementioned group.

-### Post-upgrade from v0.9.0
+### Post-upgrade

 #### Configuration Improvement: Separate user permission for using Video Conference component

@@ -545,9 +470,9 @@ kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
 kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
 ```

-## From v0.8.1
+## From v1.1.0: Manual checks/steps

-### Pre-upgrade from v0.8.1
+### Pre-upgrade

 #### Updated `cluster.networking.cidr`

@@ -570,7 +495,7 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0

 # Automated migrations - Details

-## From v1.0.0 (automated)
+## From v1.1.0: Automated migrations

 With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.

@@ -581,7 +506,7 @@ creating the config map with the mentioned label.
 > **Note**<br>
 > Details can be found in [run_3.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).

-## From v0.9.0 (automated)
+## From v0.9.0: Automated migrations

 The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.

--- a/helmfile/apps/element/values-element.yaml.gotmpl
+++ b/helmfile/apps/element/values-element.yaml.gotmpl
@@ -98,7 +98,7 @@ configuration:
            - org.matrix.msc2762.receive.event:net.nordeck.meetings.sub_meetings.send_message
            - org.matrix.msc3973.user_directory_search

-  welcomeUserId: "@meetings-bot:{{ .Values.global.matrixDomain | default .Values.global.domain }}"
+  welcomeUserId: "@meetings-bot:{{ .Values.global.domain }}"

 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
@@ -81,8 +81,8 @@ liveness sample:
  enabled: true

 persistence:
-  size: {{ .Values.persistence.storages.matrixNeoDateFixBot.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.matrixNeoDateFixBot.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.matrixNeoDateFixBot | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

 podAnnotations: {}

--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -176,8 +176,8 @@ image:
  tag: {{ .Values.images.synapse.tag | quote }}

 persistence:
-  size: {{ .Values.persistence.storages.synapse.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.synapse.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.synapse | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

 podAnnotations: {}

--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -138,8 +138,8 @@ jitsi:
    resources:
      {{ .Values.resources.prosody | toYaml | nindent 6 }}
    persistence:
-      size: {{ .Values.persistence.storages.prosody.size | quote }}
-      storageClassName: {{ coalesce .Values.persistence.storages.prosody.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+      size: {{ .Values.persistence.size.prosody | quote }}
+      storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: {}
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -25,7 +25,6 @@ configuration:
      value: "nextcloud"
    password:
      value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
-
  antivirus:
    {{- if .Values.antivirus.icap.host }}
    host: {{ .Values.antivirus.icap.host | quote }}
@@ -38,7 +37,6 @@ configuration:
    {{- end }}
    port: 1344
    {{- end }}
-
  cache:
    auth:
      enabled: true
@@ -49,36 +47,10 @@ configuration:
    host: {{ .Values.cache.nextcloud.host | quote }}
    port: {{ .Values.cache.nextcloud.port | quote }}
    tls: {{ .Values.cache.nextcloud.tls }}
-
-  feature:
-    apps:
-      contacts:
-        enabled: false
-      cryptpad:
-        enabled: {{ .Values.cryptpad.enabled }}
-      filesZip:
-        enabled: true
-      groupfolders:
-        enabled: true
-      integrationOpenproject:
-        enabled: {{ .Values.openproject.enabled }}
-      spreed:
-        enabled: true
-    circles:
-      enabled: false
-
  collabora:
    # internalWopiUrl: ""
    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
-
  database:
-    {{ if eq .Values.databases.nextcloud.type "mariadb" }}
-    type: "mysql"
-    {{ else if eq .Values.databases.nextcloud.type "postgresql" }}
-    type: "pgsql"
-    {{ else }}
-    {{ .Values.databases.nextcloud.type | quote }}
-    {{ end }}
    host: {{ .Values.databases.nextcloud.host | quote }}
    port: {{ .Values.databases.nextcloud.port | quote }}
    name: {{ .Values.databases.nextcloud.name | quote }}
@@ -86,20 +58,12 @@ configuration:
      username:
        value: {{ .Values.databases.nextcloud.username | quote }}
      password:
-        {{- if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
        value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
-        {{- else if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
-        value: {{ .Values.databases.nextcloud.password | default .Values.secrets.postgresql.nextcloudUser | quote }}
-        {{- else }}
-        value: {{ .Values.databases.nextcloud.password | quote }}
-        {{- end }}
-
  ldap:
    host: {{ .Values.ldap.host | quote }}
    password:
      value: {{ .Values.secrets.nubus.ldapSearch.nextcloud | quote }}
    adminGroupName: "managed-by-attribute-FileshareAdmin"
-
  objectstore:
    auth:
      accessKey:
@@ -113,19 +77,16 @@ configuration:
    port: {{ .Values.objectstores.nextcloud.port | quote }}
    pathStyle: {{ .Values.objectstores.nextcloud.pathStyle | quote }}
    useSSL: {{ .Values.objectstores.nextcloud.useSSL | quote }}
-
  oidc:
    username:
      value: "opendesk-nextcloud"
    password:
      value: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
-
  opendeskIntegration:
    username:
      value: "opendesk_username"
    password:
      value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
-
  sharing:
    allowLinks: {{ .Values.functional.filestore.sharing.external.enabled }}
    allowMailNotification: {{ .Values.functional.filestore.sharing.external.enabled }}
@@ -139,7 +100,6 @@ configuration:
    defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
    defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
    sendPasswordMail: {{ .Values.functional.filestore.sharing.external.sendPasswordMail | quote }}
-
  smtp:
    auth:
      enabled: false
@@ -153,7 +113,6 @@ configuration:
    mailDomain: "{{ .Values.global.domain }}"
    security: ""
    skipVerifyPeer: true
-
  quota:
    default: "{{ .Values.functional.filestore.quota.default }} GB"
    retentionObligation:
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -63,13 +63,6 @@ aio:
      port: {{ .Values.cache.nextcloud.port | quote }}
      tls: {{ .Values.cache.nextcloud.tls }}
    database:
-      {{ if eq .Values.databases.nextcloud.type "mariadb" }}
-      type: "mysql"
-      {{ else if eq .Values.databases.nextcloud.type "postgresql" }}
-      type: "pgsql"
-      {{ else }}
-      {{ .Values.databases.nextcloud.type | quote }}
-      {{ end }}
      host: {{ .Values.databases.nextcloud.host | quote }}
      port: {{ .Values.databases.nextcloud.port | quote }}
      name: {{ .Values.databases.nextcloud.name | quote }}
@@ -77,13 +70,7 @@ aio:
        username:
          value: {{ .Values.databases.nextcloud.username | quote }}
        password:
-          {{- if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
-          {{- else if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
-          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.postgresql.nextcloudUser | quote }}
-          {{- else }}
-          value: {{ .Values.databases.nextcloud.password | quote }}
-          {{- end }}
    trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
  containerSecurityContext:
    allowPrivilegeEscalation: false
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -581,8 +581,8 @@ nubusPortalConsumer:
      accessKey: {{ .Values.objectstores.nubus.username | quote }}
      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
  persistence:
-    size: {{ .Values.persistence.storages.nubusPortalConsumer.size | quote }}
-    storageClass: {{ coalesce .Values.persistence.storages.nubusPortalConsumer.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.portalConsumer | quote }}
  podAnnotations:
    intents.otterize.com/service-name: "ums-portal-consumer"
  provisioningApi:
@@ -811,8 +811,8 @@ nubusLdapServer:
        tag: {{ .Values.images.nubusLdapServerLeaderElector.tag }}
        pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  persistence:
-    size: {{ .Values.persistence.storages.nubusLdapServerData.size | quote }}
-    storageClass: {{ coalesce .Values.persistence.storages.nubusLdapServerData.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.ldapServerData | quote }}
  replicaCountPrimary: {{ .Values.replicas.umsLdapServerPrimary }}
  replicaCountSecondary: {{ .Values.replicas.umsLdapServerSecondary }}
  replicaCountProxy: {{ .Values.replicas.umsLdapServerProxy }}
@@ -914,8 +914,7 @@ nubusProvisioning:
        tag: {{ .Values.images.nubusNatsBox.tag }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    persistence:
-      size: {{ .Values.persistence.storages.nubusProvisioningNats.size }}
-      storageClass: {{ coalesce .Values.persistence.storages.nubusProvisioningNats.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+      size: {{ .Values.persistence.size.nubus.provisioningNats }}
    reloader:
      image:
        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsReloader.registry | quote }}
--- a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -21,50 +21,6 @@ cleanup:
  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}

 config:
-  clientAccessRestrictions:
-    matrix:
-      client: "opendesk-matrix"
-      scope: "opendesk-matrix-scope"
-      role: "opendesk-matrix-access-control"
-      group: "managed-by-attribute-Livecollaboration"
-    jitsi:
-      client: "opendesk-jitsi"
-      scope: "opendesk-jitsi-scope"
-      role: "opendesk-jitsi-access-control"
-      group: "managed-by-attribute-Videoconference"
-    xwiki:
-      client: "opendesk-xwiki"
-      scope: "opendesk-xwiki-scope"
-      role: "opendesk-xwiki-access-control"
-      group: "managed-by-attribute-Knowledgemanagement"
-    openproject:
-      client: "opendesk-openproject"
-      scope: "opendesk-openproject-scope"
-      role: "opendesk-openproject-access-control"
-      group: "managed-by-attribute-Projectmanagement"
-    nextcloud:
-      client: "opendesk-nextcloud"
-      scope: "opendesk-nextcloud-scope"
-      role: "opendesk-nextcloud-access-control"
-      group: "managed-by-attribute-Fileshare"
-    oxAppSuite:
-      client: "opendesk-oxappsuite"
-      scope: "opendesk-oxappsuite-scope"
-      role: "opendesk-oxappsuite-access-control"
-      group: "managed-by-attribute-Groupware"
-    dovecot:
-      client: "opendesk-dovecot"
-      scope: "opendesk-dovecot-scope"
-      role: "opendesk-dovecot-access-control"
-      group: "managed-by-attribute-Groupware"
-    {{- if .Values.notes.enabled }}
-    notes:
-      client: "opendesk-notes"
-      scope: "opendesk-notes-scope"
-      role: "opendesk-notes-access-control"
-      group: "managed-by-attribute-Notes"
-    {{- end }}
-
  componentEnabled:
    notes: {{ .Values.notes.enabled }}
  custom:
@@ -73,11 +29,8 @@ config:
    clients:
      {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
  managed:
-    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list',
-                    'offline_access', 'roles', 'address', 'phone' ]
-    clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}',
-               '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}',
-               '${client_security-admin-console}' ]
+    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
+    clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
  keycloak:
    adminUser: "kcadmin"
    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
@@ -87,15 +40,6 @@ config:
      internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
  twoFactorSettings:
    additionalGroups: {{ .Values.functional.authentication.twoFactor.groups }}
-  precreateGroups: [ 'Domain Admins', 'Domain Users', '2fa-users', 'IAM API - Full Access',
-                     'managed-by-attribute-Fileshare', 'managed-by-attribute-FileshareAdmin',
-                     'managed-by-attribute-Knowledgemanagement', 'managed-by-attribute-KnowledgemanagementAdmin',
-                     'managed-by-attribute-Livecollaboration', 'managed-by-attribute-LivecollaborationAdmin',
-                     'managed-by-attribute-Projectmanagement', 'managed-by-attribute-ProjectmanagementAdmin',
-                     'managed-by-attribute-Videoconference',
-                     'managed-by-attribute-Groupware',
-                     'managed-by-attribute-Notes' ]
-
  opendesk:
    # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
    # to LDAP group membership to ensure a user cannot access an application without the required
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -92,15 +92,15 @@ podSecurityContext:

 persistence:
  {{- if .Values.cluster.persistence.readWriteMany.enabled }}
-  storageClassName: {{ coalesce .Values.persistence.storages.dovecot.storageClassName .Values.persistence.storageClassNames.RWX | quote }}
+  storageClassName: {{ .Values.persistence.storageClassNames.RWX | quote }}
  accessModes:
    - "ReadWriteMany"
  {{- else }}
-  storageClassName: {{ coalesce .Values.persistence.storages.dovecot.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
  accessModes:
    - "ReadWriteOnce"
  {{- end }}
-  size: {{ .Values.persistence.storages.dovecot.size | quote }}
+  size: {{ .Values.persistence.size.dovecot | quote }}

 resources:
  {{ .Values.resources.dovecot | toYaml | nindent 2 }}
--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -66,8 +66,7 @@ resourcesWaitForDependency:
  {{ .Values.resources.oxConnector | toYaml | nindent 2 }}

 persistence:
-  size: {{ .Values.persistence.storages.oxConnector.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.oxConnector.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

 podAnnotations: {}

--- a/helmfile/apps/services-external/values-clamav-distributed.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-clamav-distributed.yaml.gotmpl
@@ -152,6 +152,6 @@ milter:
    {{ .Values.resources.milter | toYaml | nindent 4 }}

 persistence:
-  size: {{ .Values.persistence.storages.clamav.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.clamav.storageClassName .Values.persistence.storageClassNames.RWX | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWX | quote }}
+  size: {{ .Values.persistence.size.clamav | quote }}
 ...
--- a/helmfile/apps/services-external/values-clamav-simple.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-clamav-simple.yaml.gotmpl
@@ -37,8 +37,8 @@ image:
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 persistence:
-  size: {{ .Values.persistence.storages.clamav.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.clamav.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.clamav | quote }}

 podAnnotations: {}

--- a/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
@@ -39,40 +39,40 @@ job:
  retries: 10
  wait: 30
  users:
-    - username: "openxchange_user"
-      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
-      connectionLimit: {{ .Values.databases.oxAppSuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-{{ if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
    - username: {{ .Values.databases.nextcloud.username | quote }}
      password: {{ .Values.secrets.mariadb.nextcloudUser | quote}}
      connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-{{ end }}
-{{ if eq .Values.databases.xwiki.type "mariadb" }}
+    # OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
+    # users for the moment.
+    - username: "openxchange_user"
+    # - username: {{ .Values.databases.xwiki.username | quote }}
+      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
+      connectionLimit: {{ .Values.databases.oxAppSuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
    - username: "xwiki_user"
+    # - username: {{ .Values.databases.oxAppSuite.username | quote }}
      password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-{{ end }}
  databases:
-    # OX uses root user and auto automanages the database, we add a dummy user and create a dummy/empty database.
-    - name: "openxchange_dummy"
-      user: "openxchange_user"
-{{ if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
    - name: {{ .Values.databases.nextcloud.name | quote }}
      user: {{ .Values.databases.nextcloud.username | quote }}
-{{ end }}
-{{ if eq .Values.databases.xwiki.type "mariadb" }}
-    # XWiki uses root user to create new subwiki databases, we add a dummy user.
-    - name: {{ .Values.databases.xwiki.name | quote }}
+    # OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
+    # users for the moment.
+    - name: "openxchange"
+      user: "openxchange_user"
+    # - name: {{ .Values.databases.oxAppSuite.name | quote }}
+    #   user: {{ .Values.databases.oxAppSuite.username | quote }}
+    - name: "xwiki"
      user: "xwiki_user"
-{{ end }}
+    # - name: {{ .Values.databases.xwiki.name | quote }}
+    #   user: {{ .Values.databases.xwiki.username | quote }}

 mariadb:
  rootPassword:
    value: {{ .Values.secrets.mariadb.rootPassword | quote }}

 persistence:
-  size: {{ .Values.persistence.storages.mariadb.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.mariadb.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.mariadb | quote }}

 podAnnotations:
  argocd.argoproj.io/hook: "PostSync"
--- a/helmfile/apps/services-external/values-minio.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-minio.yaml.gotmpl
@@ -90,8 +90,8 @@ podSecurityContext:
  fsGroup: 1001

 persistence:
-  size: {{ .Values.persistence.storages.minio.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.minio.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: "{{ .Values.persistence.storageClassNames.RWO }}"
+  size: "{{ .Values.persistence.size.minio }}"

 provisioning:
  enabled: true
--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -34,8 +34,8 @@ image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}

 persistence:
-  size: {{ .Values.persistence.storages.postfix.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.postfix.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.postfix | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

 podSecurityContext:
  enabled: true
--- a/helmfile/apps/services-external/values-postgresql.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postgresql.yaml.gotmpl
@@ -69,16 +69,6 @@ job:
    - username: {{ .Values.databases.umsSelfservice.username | quote }}
      password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
      connectionLimit: {{ .Values.databases.umsSelfservice.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-{{ if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
-    - username: {{ .Values.databases.nextcloud.username | quote }}
-      password: {{ .Values.secrets.postgresql.nextcloudUser | quote }}
-      connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-{{ end }}
-{{ if eq .Values.databases.xwiki.type "postgresql" }}
-    - username: {{ .Values.databases.xwiki.username | quote }}
-      password: {{ .Values.secrets.postgresql.xwikiUser | quote }}
-      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-{{ end }}
  databases:
    - name: {{ .Values.databases.keycloak.name | quote }}
      user: {{ .Values.databases.keycloak.username | quote }}
@@ -97,19 +87,10 @@ job:
      user: {{ .Values.databases.umsNotificationsApi.username | quote }}
    - name: {{ .Values.databases.umsSelfservice.name | quote }}
      user: {{ .Values.databases.umsSelfservice.username | quote }}
-{{ if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
-    - name: {{ .Values.databases.nextcloud.name | quote }}
-      user: {{ .Values.databases.nextcloud.username | quote }}
-{{ end }}
-{{ if eq .Values.databases.xwiki.type "postgresql" }}
-    - name: {{ .Values.databases.xwiki.name | quote }}
-      user: {{ .Values.databases.xwiki.username | quote }}
-      additionalParams: "ENCODING 'UNICODE' template=template0"
-{{ end }}

 persistence:
-  size: {{ .Values.persistence.storages.postgresql.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.postgresql.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.postgresql | quote }}

 podAnnotations:
  argocd.argoproj.io/hook: "PostSync"
--- a/helmfile/apps/services-external/values-redis.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-redis.yaml.gotmpl
@@ -12,7 +12,7 @@ auth:
 global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-  storageClass: {{ coalesce .Values.persistence.storages.redis.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

 image:
  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.redis.registry | quote }}
@@ -37,7 +37,7 @@ master:
      {{ .Values.seLinuxOptions.redis | toYaml | nindent 6 }}
  count: {{ .Values.replicas.redis }}
  persistence:
-    size: {{ .Values.persistence.storages.redis.size | quote }}
+    size: {{ .Values.persistence.size.redis | quote }}
  podAnnotations: {}
  resources:
    {{ .Values.resources.redis | toYaml | nindent 4 }}
--- a/helmfile/apps/xwiki/values.yaml.gotmpl
+++ b/helmfile/apps/xwiki/values.yaml.gotmpl
@@ -5,16 +5,10 @@ SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
-  {{- if eq .Values.databases.xwiki.type "mariadb" }}
-  name: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.xwikiMariadb.registry }}/{{ .Values.images.xwikiMariadb.repository }}"
-  tag: {{ .Values.images.xwikiMariadb.tag | quote }}
-  {{- else if eq .Values.databases.xwiki.type "postgresql" }}
-  name: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.xwikiPostgres.registry }}/{{ .Values.images.xwikiPostgres.repository }}"
-  tag: {{ .Values.images.xwikiPostgres.tag | quote }}
-  {{- else }}
-  {{- fail "Unsupported value for .Values.databases.xwiki.type, supported values are 'mariadb' or 'postgresql'" }}
-  {{- end }}
+  name: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.xwiki.registry }}/{{ .Values.images.xwiki.repository }}"
+  tag: {{ .Values.images.xwiki.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
+
 imagePullSecrets: {{ .Values.global.imagePullSecrets }}

 {{- if .Values.certificate.selfSigned }}
@@ -25,11 +19,7 @@ javaOpts:
 {{- end }}

 externalDB:
-  {{- if eq .Values.databases.xwiki.type "mariadb" }}
  password: {{ .Values.databases.xwiki.password | default .Values.secrets.mariadb.rootPassword | quote }}
-  {{- else }}
-  password: {{ .Values.databases.xwiki.password | default .Values.secrets.postgresql.xwikiUser | quote }}
-  {{- end }}
  database: {{ .Values.databases.xwiki.name | quote }}
  user: {{ .Values.databases.xwiki.username | quote }}
  host: {{ printf "%s:%d" .Values.databases.xwiki.host .Values.databases.xwiki.port | quote }}
@@ -143,8 +133,8 @@ mysql:
  enabled: false

 persistence:
-  size: {{ .Values.persistence.storages.xwiki.size | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.xwiki.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.xwiki | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}

 postgresql:
  enabled: false
--- a/helmfile/environments/default/charts.yaml.gotmpl
+++ b/helmfile/environments/default/charts.yaml.gotmpl
@@ -104,7 +104,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-element"
-    version: "6.0.2"
+    version: "6.0.0"
    verify: true
  elementWeb:
    # providerCategory: "Platform"
@@ -114,7 +114,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-element-web"
-    version: "6.0.2"
+    version: "6.0.0"
    verify: true
  elementWellKnown:
    # providerCategory: "Platform"
@@ -124,7 +124,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-well-known"
-    version: "6.0.2"
+    version: "6.0.0"
    verify: true
  home:
    # providerCategory: "Platform"
@@ -143,10 +143,12 @@ charts:
    # upstreamRepository: "nubus/charts/intercom-service"
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
    # upstreamMirrorStartFrom: ["2", "0", "1"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
+    # registry: "registry.opencode.de"
+    # repository: "bmi/opendesk/components/supplier/univention/charts-mirror"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/charts"
    name: "intercom-service"
-    version: "2.7.3"
+    version: "2.9.0-pre-jconde-fix-logger"
    verify: true
  jitsi:
    # providerCategory: "Platform"
@@ -216,7 +218,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-matrix-user-verification-service"
-    version: "6.0.2"
+    version: "6.0.1"
    verify: true
  memcached:
    # providerCategory: "Community"
@@ -232,7 +234,7 @@ charts:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
    # upstreamRegistry: "https://registry.opencode.de"
-    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
+    # upstreamRepository: "bmi/opendesk/components/platform-development/charts/opendesk-element/opendesk-migrations"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-migrations"
    name: "opendesk-migrations"
@@ -256,7 +258,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud"
-    version: "3.7.1"
+    version: "3.6.2"
    verify: true
  nextcloudManagement:
    # providerCategory: "Platform"
@@ -266,7 +268,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-nextcloud"
    name: "opendesk-nextcloud-management"
-    version: "3.7.1"
+    version: "3.6.2"
    verify: true
  nginx:
    # providerCategory: "Community"
@@ -338,7 +340,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-keycloak-bootstrap"
    name: "opendesk-keycloak-bootstrap"
-    version: "2.2.3"
+    version: "2.2.0"
    verify: true
  opendeskStaticFiles:
    # providerCategory: "Platform"
@@ -360,7 +362,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
    name: "openproject"
-    version: "9.5.0"
+    version: "9.4.1"
    verify: true
  openprojectBootstrap:
    # providerCategory: "Platform"
@@ -434,7 +436,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-postgresql"
    name: "postgresql"
-    version: "2.1.2"
+    version: "2.1.1"
    verify: true
  redis:
    # providerCategory: "Community"
@@ -454,7 +456,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse"
-    version: "6.0.2"
+    version: "6.0.1"
    verify: true
  synapseAdmin:
    # Component is required for openDesk Enterprise only.
@@ -478,7 +480,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-create-account"
-    version: "6.0.2"
+    version: "6.0.0"
    verify: true
  synapseGroupsync:
    # Component is required for openDesk Enterprise only.
@@ -502,7 +504,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-element"
    name: "opendesk-synapse-web"
-    version: "6.0.2"
+    version: "6.0.0"
    verify: true
  xwiki:
    # providerCategory: "Supplier"
@@ -514,6 +516,6 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/xwiki/charts-mirror"
    name: "xwiki"
-    version: "1.4.1"
+    version: "1.4.0"
    verify: false
 ...
--- a/helmfile/environments/default/database.yaml.gotmpl
+++ b/helmfile/environments/default/database.yaml.gotmpl
@@ -1,13 +1,10 @@
 # SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
-#
-# See `external-services.md` for more details on the database configuration
 ---
 databases:
  defaults:
    userConnectionLimit: 100
  keycloak:
-    type: "postgresql"
    name: "keycloak"
    host: "postgresql"
    port: 5432
@@ -15,7 +12,6 @@ databases:
    password: ""
    connectionLimit: ~
  keycloakExtension:
-    type: "postgresql"
    name: "keycloak_extensions"
    host: "postgresql"
    port: 5432
@@ -23,8 +19,6 @@ databases:
    password: ""
    connectionLimit: ~
  nextcloud:
-    # Nextcloud itself also supports `postgresql` or `oci`
-    type: "mariadb"
    name: "nextcloud"
    host: "mariadb"
    port: 3306
@@ -32,7 +26,6 @@ databases:
    password: ""
    connectionLimit: ~
  notes:
-    type: "postgresql"
    name: "notes"
    host: "postgresql"
    port: 5432
@@ -40,7 +33,6 @@ databases:
    password: ""
    connectionLimit: ~
  openproject:
-    type: "postgresql"
    name: "openproject"
    host: "postgresql"
    port: 5432
@@ -48,7 +40,6 @@ databases:
    password: ""
    connectionLimit: ~
  oxAppSuite:
-    type: "mariadb"
    name: "configdb"
    host: "mariadb"
    port: 3306
@@ -56,7 +47,6 @@ databases:
    password: ""
    connectionLimit: ~
  synapse:
-    type: "postgresql"
    name: "matrix"
    host: "postgresql"
    port: 5432
@@ -79,7 +69,6 @@ databases:
    connectionPoolMax: "5"
    connectionLimit: ~
  umsGuardianManagementApi:
-    type: "postgresql"
    name: "guardianmanagementapi"
    host: "postgresql"
    port: 5432
@@ -87,7 +76,6 @@ databases:
    password: ""
    connectionLimit: ~
  umsNotificationsApi:
-    type: "postgresql"
    name: "notificationsapi"
    host: "postgresql"
    port: 5432
@@ -95,7 +83,6 @@ databases:
    password: ""
    connectionLimit: ~
  umsSelfservice:
-    type: "postgresql"
    name: "selfservice"
    host: "postgresql"
    port: 5432
@@ -103,8 +90,6 @@ databases:
    password: ""
    connectionLimit: 10
  xwiki:
-    # XWiki itself also supports `postgresql`
-    type: "mariadb"
    name: "xwiki"
    host: "mariadb"
    port: 3306
--- a/helmfile/environments/default/images.yaml.gotmpl
+++ b/helmfile/environments/default/images.yaml.gotmpl
@@ -61,7 +61,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/supplier/nordeck/images/opendesk-element-web"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/nordeck/images/opendesk-element-web"
-    tag: "1.11.7@sha256:c5881cea86a721252e724000e4ed870cae66f9b3eabc45074e1f43b1818423bc"
+    tag: "1.11.6@sha256:1ac5eeea24c5fbfdfeda44cb00651fa22864e26d8cb32add150c4bf1aea0fb36"
  freshclam:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -85,9 +85,11 @@ images:
    # upstreamRepository: "nubus/images/intercom-service"
    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)\.(\d+)$'
    # upstreamMirrorStartFrom: ["2", "1", "0"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/univention/images-mirror/intercom-service"
-    tag: "2.7.3@sha256:bae60a9a14df53431f81846bf98520e3340dbfc1abae88622ccbd3c6e81cd930"
+    # registry: "registry.opencode.de"
+    # repository: "bmi/opendesk/components/supplier/univention/images-mirror/intercom-service"
+    registry: "artifacts.software-univention.de"
+    repository: "nubus-dev/images/intercom-service"
+    tag: "2.9.0-pre-jconde-fix-logger@sha256:a78bcd6a624cfe3a944b9d75b1b2f382cc03e59e84193616a84e5c18a0bf0bb2"
  jibri:
    # providerCategory: "Supplier"
    # providerResponsible: "Nordeck"
@@ -243,7 +245,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.4.0@sha256:03d3273b49a3a51fc2d418302070657ad4198ee014f15ff4320e2164625431a1"
+    tag: "2.3.4@sha256:46c596818861486ee621cf8a454c2539a4e230e58b1aebb5735022de849de8e6"
  nextcloudExporter:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -645,7 +647,7 @@ images:
    # upstreamMirrorStartFrom: ["13", "1", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "15.2.0@sha256:5394a6cddc3f27efd20aeba4c2a0da0c0234ea914726f2d8cb6ebebeb500b9cf"
+    tag: "15.1.1@sha256:e64133498e00ec7b42aeedd064416df86ecfa1f2bf068cd7256de4e11cfccc49"
  openprojectBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -868,7 +870,7 @@ images:
    registry: "registry-1.docker.io"
    repository: "library/nginx"
    tag: "1.27.3-alpine3.20@sha256:41523187cf7d7a2f2677a80609d9caa14388bf5c1fbca9c410ba3de602aaaab4"
-  xwikiMariadb:
+  xwiki:
    # providerCategory: "Supplier"
    # providerResponsible: "XWiki"
    # upstreamRegistry: "https://git.xwikisas.com:5050"
@@ -878,14 +880,4 @@ images:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/xwiki"
    tag: "0.23-mariadb-jetty-alpine@sha256:d358212cc5c3addc4be02cfd0f2b08aa8b88399ac5848e152111f231356558da"
-  xwikiPostgres:
-    # providerCategory: "Supplier"
-    # providerResponsible: "XWiki"
-    # upstreamRegistry: "https://git.xwikisas.com:5050"
-    # upstreamRepository: "xwikisas/swp/xwiki"
-    # upstreamMirrorTagFilterRegEx: '^(\d+)\.(\d+)-postgres.+$'
-    # upstreamMirrorStartFrom: ["0", "23"]
-    registry: "registry.opencode.de"
-    repository: "bmi/opendesk/components/supplier/xwiki/images-mirror/xwiki"
-    tag: "0.23-postgres-jetty-alpine@sha256:01f7d6fd8397a7903c23452cded4866220d733554066b6f5746eecde183fe15a"
 ...
--- a/helmfile/environments/default/persistence.yaml.gotmpl
+++ b/helmfile/environments/default/persistence.yaml.gotmpl
@@ -2,55 +2,24 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 persistence:
-  # Will be used as default if not otherwise define on the component level
  storageClassNames:
    RWX: ""
    RWO: ""
-
-  storages:
-    clamav:
-      size: "1Gi"
-      storageClassName: ~
-    dovecot:
-      size: "1Gi"
-      storageClassName: ~
-    mariadb:
-      size: "1Gi"
-      storageClassName: ~
-    matrixNeoDateFixBot:
-      size: "1Gi"
-      storageClassName: ~
-    minio:
-      size: "10Gi"
-      storageClassName: ~
-    nubusLdapServerData:
-      size: "1Gi"
-      storageClassName: ~
-    nubusPortalConsumer:
-      size: "1Gi"
-      storageClassName: ~
-    nubusProvisioningNats:
-      size: "1Gi"
-      storageClassName: ~
-    oxConnector:
-      size: "1Gi"
-      storageClassName: ~
-    postfix:
-      size: "1Gi"
-      storageClassName: ~
-    postgresql:
-      size: "1Gi"
-      storageClassName: ~
-    prosody:
-      size: "1Gi"
-      storageClassName: ~
-    redis:
-      size: "1Gi"
-      storageClassName: ~
-    synapse:
-      size: "1Gi"
-      storageClassName: ~
-    xwiki:
-      size: "1Gi"
-      storageClassName: ~
+  size:
+    clamav: "1Gi"
+    dovecot: "1Gi"
+    mariadb: "1Gi"
+    matrixNeoDateFixBot: "1Gi"
+    minio: "10Gi"
+    postfix: "1Gi"
+    postgresql: "1Gi"
+    prosody: "1Gi"
+    redis: "1Gi"
+    synapse: "1Gi"
+    nubus:
+      ldapServerData: "1Gi"
+      ldapServerShared: "1Gi"
+      portalConsumer: "1Gi"
+      provisioningNats: "1Gi"
+    xwiki: "1Gi"
 ...
--- a/helmfile/environments/default/secrets.yaml.gotmpl
+++ b/helmfile/environments/default/secrets.yaml.gotmpl
@@ -57,13 +57,11 @@ secrets:
    keycloakUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "keycloak_user" | sha1sum | quote }}
    keycloakExtensionUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "keycloak_extensions_user" | sha1sum | quote }}
    matrixUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "matrix_user" | sha1sum | quote }}
-    nextcloudUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "nextcloud_user" | sha1sum | quote }}
    notesUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "notes_user" | sha1sum | quote }}
    openprojectUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "openproject_user" | sha1sum | quote }}
    umsNotificationsApiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "notificationsapi_user" | sha1sum | quote }}
    umsGuardianManagementApiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "guardianmanagementapi_user" | sha1sum | quote }}
    umsSelfserviceUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "selfservice_user" | sha1sum | quote }}
-    xwikiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "postgres" "xwiki_user" | sha1sum | quote }}
  mariadb:
    rootPassword: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "mariadb" "root_password" | sha1sum | quote }}
    xwikiUser: {{ derivePassword 1 "long" (env "MASTER_PASSWORD" | default "sovereign-workplace") "mariadb" "xwiki_user" | sha1sum | quote }}
Author	SHA1	Message	Date
Jaime Conde	483db34bb6	fix(intercom): Converge sessions to a working state	2025-01-16 10:37:31 +01:00
Oliver Günther	b2eefbab83	fix(openproject): Update to 15.1.1	2025-01-15 07:15:59 +01:00
René Fischer	381b4e7988	fix(docs): Add permissions.md	2025-01-14 16:57:04 +01:00
Norbert Tretkowski	6d300304ee	fix(docs): Fix debug option	2025-01-09 10:41:25 +01:00
Thorsten Roßner	da79f3b286	fix(static-files): Update Helm chart to v4.0.1 to support longer domain names	2025-01-09 07:05:49 +01:00
Philip Gaber	ed5bf231cc	docs: Fixed typos and incompatible characters in table	2025-01-08 14:52:58 +01:00
Thorsten Roßner	f4faebaf68	fix(nubus): Template `secrets.nubus.masterpassword`	2025-01-08 07:52:43 +01:00
Michael Weimann	574acb5976	docs(element): Add Matrix Modules and Widget API Co-Authored-By: Kim Brose <kim.brose@nordeck.net>	2025-01-07 10:36:57 +01:00
René Fischer	44d5e5a2b5	fix(docs): Fix doc link and missing TOC annotation	2025-01-06 15:21:37 +01:00
Thorsten Roßner	984b23c73b	fix(open-xchange): Add missing `registryOpencodeDe` to OX-Connector's `waitForDependency` image	2025-01-06 11:30:42 +01:00
Thorsten Roßner	abca53d02f	fix(nubus): Update customizations for group cleanup	2025-01-03 19:24:39 +00:00
Thorsten Roßner	a159724abd	fix(nubus): Fix `pullPolicy` setting for `ldapServer.leaderElector` to satisfy Kyverno linter	2025-01-03 19:24:39 +00:00
Thorsten Roßner	8c1b0802a0	fix(nubus): Remove `extra` settings from ldapServer needed for 1.0 LDAP migration	2025-01-03 19:24:39 +00:00
openDesk Bot	000af5a604	fix(helmfile): Update upstream images for k8s/kubectl to v1.32.0	2025-01-03 09:19:34 +01:00
Thorsten Roßner	ba9560d14b	fix(element): Update Element to v1.11.89 and Synapse to v1.121.1	2025-01-02 06:26:12 +00:00