fix(nubus): Add security context for kc proxy

## [1.3.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.1...v1.3.2) (2025-05-06)

### Bug Fixes

* **dovecot:** Update Helm chart to fix migration mode ([7ba84b9](7ba84b99ca))
* **helmfile:** Explicitly template auth-modules in OX App Suite; Streamline name of OX App Suite EE image ([6cbb6b6](6cbb6b6922))

.gitlab-ci.yml

@@ -232,8 +232,8 @@ variables:
   extends: ".environments"
   environment:
     name: "${NAMESPACE}"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.3.2\
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.3.1\
-          @sha256:87358b39af7403c9a536d1b71fd87ee84394310497dc0fbc90f78b75a3057712"
+          @sha256:de527f493044f06009045c369be831ababbc8dd74adaa378613c5acb1e654959"
   script:
     - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
     # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD

CHANGELOG.md

@@ -1,28 +1,3 @@
-# [1.4.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.2...v1.4.0) (2025-05-20)
-
-
-### Bug Fixes
-
-* **docs:** Update requirements, bump helmfile to v1.0.0 ([88b29c5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/88b29c57e8197f072b9c80019255ee0b7d1188e1))
-* **dovecot:** Encode object storage password and add more template values ([c40de73](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/c40de73ccf02bf77df0c3a17c2fccf2e113c4b35))
-* **nubus:** [[#182](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/182)] Add `KC_TRUSTSTORE_PATHS` to Keycloak when using self-signed certificates ([006aed7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/006aed791e5cf58850712e468a15c8abe1ee0973))
-* **nubus:** [[#183](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/183)] Do not override `nubusPortalConsumer.waitForDependency.image` when using self-signed certificates ([b45a0bf](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b45a0bf832506fb60488cd01c9c883b58e1d60b6))
-* **nubus:** Update ArgoCD hook annotations ([f2b1384](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f2b13846700d8a49a066b3343b043dac89d326f5))
-* **open-xchange:** Update Open-Xchange to v8.36 ([b40b863](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b40b8630c1a5ba7452d0461d38b1175fa647226d))
-* **open-xchange:** Update Open-Xchange to v8.37 ([174c73c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/174c73c012e911342644bdcb89d22b35be9baa36))
-* **openproject:** Update to 15.5.1 ([e91efa8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e91efa8ecc1be9b444092e1a291747bb9f0c00ea))
-* **openxchange:** Add proper dav URLs in client onboarding and disable unnecessary oauth section ([bba2af0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bba2af0f06942bd2063cc7b79f3e39fdb07838f0))
-* **openxchange:** Disable redundant o-x-authentication-oauth package ([1d2b17b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1d2b17b4951581e1f60d8a7f2402512dc1c1c568))
-* **openxchange:** Enable DAV support ([709e50f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/709e50ff7c020347dad953be7380d08438d3ab69))
-
-
-### Features
-
-* **collabora:** Update enterprise image to 24.04.13.4.1 ([b590810](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b5908100ddbd7497f7f858e874bcbf7979480d1b))
-* **helmfile:** Define `global.additionalMailDomains` as list; if you use the setting already, check `migrations.md` for details ([4b30576](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4b305768c444c166e28829ee05631451ba997126))
-* **helmfile:** Option to select default file format for weboffice using; see `functional.weboffice.defaultFormat` in `functional.yaml.gotmpl` for details ([5f58a85](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5f58a857acab38fa7f56e1e14ef0a6f805c7622e))
-* **nubus:** Update nubus to v1.9.1 ([3d694a8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d694a8248d5e983ab3e05753326088b375f2d82))
-
 ## [1.3.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.1...v1.3.2) (2025-05-06)
 
 

README-EE.md

@@ -94,7 +94,7 @@ Details regarding the scope/limitation of the component's licenses:
 
 - Nextcloud: Enterprise license to enable [Nextcloud Enterprise](https://nextcloud.com/de/enterprise/) specific features, can be used across multiple installations until the licensed number of users is reached.
 - OpenProject: Domain specific enterprise license to enable [OpenProject's Enterprise feature set](https://www.openproject.org/enterprise-edition/), domain matching can use regular expressions.
-- XWiki: Deployment specific enterprise license (key pair) to activate the [XWiki Pro](https://xwiki.com/en/offerings/products/xwiki-pro) apps. *Caution! XWiki needs these license keys as one-line strings. Multi-line strings result in installation failure*
+- XWiki: Deployment specific enterprise license (key pair) to activate the [XWiki Pro](https://xwiki.com/en/offerings/products/xwiki-pro) apps.
 
 # Component overview
 

README.md

@@ -38,7 +38,7 @@ openDesk currently features the following functional main components:
 | Collaborative notes  | Notes (aka Docs)            | [2.4.0](https://github.com/suitenumerique/docs/releases/tag/v2.4.0)                                                           | Online documentation/welcome document available in installed application                                                              |
 | Diagram editor       | CryptPad ft. diagrams.net   | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                                                        | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
 | File management      | Nextcloud                   | [30.0.6](https://nextcloud.com/de/changelog/#30-0-6)                                                                          | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
-| Groupware            | OX App Suite                | [8.37](https://documentation.open-xchange.com/appsuite/releases/8.37/)                                                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
+| Groupware            | OX App Suite                | [8.35](https://documentation.open-xchange.com/appsuite/releases/8.35/)                                                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
 | Knowledge management | XWiki                       | [16.10.5](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.5/)                                              | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
 | Portal & IAM         | Nubus                       | [1.9.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html#version-1-9-1-2025-05-07) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
 | Project management   | OpenProject                 | [15.5.1](https://www.openproject.org/docs/release-notes/15-5-1/)                                                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |

docs/architecture/apis.md

@@ -16,9 +16,9 @@ This chapter presents APIs available in openDesk, grouped by application.
   * [UDM Simple API](#udm-simple-api)
   * [UDM REST API](#udm-rest-api)
   * [UCR Python API](#ucr-python-api)
-  * [Identity Store and Directory Service (LDAP)](#identity-store-and-directory-service-ldap)
+  * [LDAP](#ldap)
-  * [Nubus Provisioning Service](#nubus-provisioning-service)
+  * [Nubus Provisioning Service (**TBD**)](#nubus-provisioning-service-tbd)
-  * [Nubus Authorization Service](#nubus-authorization-service)
+  * [Nubus Authorization Service (**TBD**)](#nubus-authorization-service-tbd)
 * [Groupware - OX AppSuite / OX Dovecot](#groupware---ox-appsuite--ox-dovecot)
   * [Usage of APIs within openDesk](#usage-of-apis-within-opendesk)
   * [HTTP API](#http-api)
@@ -65,13 +65,11 @@ This chapter presents APIs available in openDesk, grouped by application.
 
 # IAM - Nubus
 
-![Overview of functional components in Univention Nubus for Kubernetes](./apis_images/IAM-overview_functional_components_structured.svg)  
+![High-level architecture of Univention part withAPIs/interfaces highlighted](./apis_images/IAM-overview.png)
-[Source](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/overview/components.html#overview-components-fig)
 
 ## UMC Python API
 
-![Composition of UMC component with APIs highlighted](./apis_images/IAM-umc-architecture.png)  
+![Composition of UMC component with APIs highlighted](./apis_images/IAM-umc-architecture.png)
-[Source](https://docs.software-univention.de/developer-reference/latest/en/umc/architecture.html#umc-api)
 
 | Name                           | UMC Python API                                                                                                                                                                                                                                 |
 | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -90,20 +88,20 @@ This chapter presents APIs available in openDesk, grouped by application.
 
 ## UMC store API
 
-| Name                           | UMC store API (also named UMC JavaScript API or Dojo/UMC JavaScript API)                                     |
+| Name                           | UMC store API (also named UMC JavaScript API or Dojo/UMC JavaScript API)                                 |
-| ------------------------------ | ----------------------------------------------------------------------------------------------------------   |
+| ------------------------------ |----------------------------------------------------------------------------------------------------------|
-| Purpose                        | Encapsulate and ease the access to JavaScript module data                                                    |
+| Purpose                        | Encapsulate and ease the access to JavaScript module data                                                |
-| Versioning                     |                                                                                                              |
+| Versioning                     |                                                                                                          |
-| Authentication                 |                                                                                                              |
+| Authentication                 |                                                                                                          |
-| In openDesk provided by        | Nubus UMC                                                                                                    |
+| In openDesk provided by        | Nubus UMC                                                                                                |
-| Transport protocol             |                                                                                                              |
+| Transport protocol             |                                                                                                          |
-| Usage within component         |                                                                                                              |
+| Usage within component         |                                                                                                          |
-| Usage within openDesk          |                                                                                                              |
+| Usage within openDesk          |                                                                                                          |
-| Usage for external integration |                                                                                                              |
+| Usage for external integration |                                                                                                          |
-| Parallel access                | Allowed                                                                                                      |
+| Parallel access                | Allowed                                                                                                  |
-| Message protocol               |                                                                                                              |
+| Message protocol               |                                                                                                          |
-| Supported standards            |                                                                                                              |
+| Supported standards            |                                                                                                          |
-| Documentation                  | https://docs.software-univention.de/developer-reference/latest/en/umc/local-system-module.html#umc-store-api |
+| Documentation                  | https://docs.software-univention.de/developer-reference/5.0/en/umc/local-system-module.html#umc-store-api |
 
 ## IntercomService (ICS) API
 
@@ -115,7 +113,7 @@ This chapter presents APIs available in openDesk, grouped by application.
 | In openDesk provided by        | Nubus UMC                                                                                                                                                                                                                           |
 | Transport protocol             | HTTP(S)                                                                                                                                                                                                                             |
 | Usage within component         |                                                                                                                                                                                                                                     |
-| Usage within openDesk          | The ICS implements the BFF pattern for various openDesk inter-component integrations, see [components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/components.md#component-integration)      |
+| Usage within openDesk          | The ICS implements the BFF pattern for various openDesk inter-component integrations, see [components.md](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/develop/docs/components.md#component-integration) |
 | Usage for external integration |                                                                                                                                                                                                                                     |
 | Parallel access                | Allowed                                                                                                                                                                                                                             |
 | Message protocol               | Depends on the integration use case.                                                                                                                                                                                                |
@@ -137,29 +135,28 @@ This chapter presents APIs available in openDesk, grouped by application.
 | Parallel access                | Allowed                                                                                                                                                                                                                             |
 | Message protocol               | Depends on the integration use case.                                                                                                                                                                                                |
 | Supported standards            |                                                                                                                                                                                                                                     |
-| Documentation                  | https://docs.software-univention.de/developer-reference/latest/en/listener/api.html                                                                                                                                                 |
+| Documentation                  | https://docs.software-univention.de/developer-reference/5.0/en/listener/api.html                                                                                                                                                    |
 
-More details on the Nubus provisioning service can be found here: https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/provisioning-service.html
+More details on the Nubus provisioning service can be found here: https://docs.software-univention.de/nubus-kubernetes-architecture/0.5/en/components/provisioning-service.html
 
 ## UDM Simple API
 
-![Architecture of UDM](./apis_images/IAM-udm-architecture.svg)  
+![Composition of UMC component with APIs highlighted](./apis_images/IAM-udm.png)
-[Source](https://docs.software-univention.de/architecture/latest/en/services/udm.html#architecture-model-udm)
 
-| Name                           | UDM Simple API                                                                                                                                    |
+| Name                           | UDM Simple API                                                    |
-| ------------------------------ | -------------------------------------------------------------------                                                                               |
+| ------------------------------ |-------------------------------------------------------------------|
-| Purpose                        | Allows use of capability and objects directly in Python programs.                                                                                 |
+| Purpose                        | Allows use of capability and objects directly in Python programs. |
-| Versioning                     |                                                                                                                                                   |
+| Versioning                     |                                                                   |
-| Authentication                 |                                                                                                                                                   |
+| Authentication                 |                                                                   |
-| In openDesk provided by        | Univention Directory Manager                                                                                                                      |
+| In openDesk provided by        | Univention Directory Manager                                      |
-| Transport protocol             |                                                                                                                                                   |
+| Transport protocol             |                                                                   |
-| Usage within component         | Allows to use UDM capability and objects directly in Python programs. UDM Simple API provides Python modules and classes below `univention.udm.*` |
+| Usage within component         |                                                                   |
-| Usage within openDesk          |                                                                                                                                                   |
+| Usage within openDesk          |                                                                   |
-| Usage for external integration |                                                                                                                                                   |
+| Usage for external integration |                                                                   |
-| Parallel access                | Allowed                                                                                                                                           |
+| Parallel access                | Allowed                                                           |
-| Message protocol               | Depends on the integration use case.                                                                                                              |
+| Message protocol               | Depends on the integration use case.                              |
-| Supported standards            |                                                                                                                                                   |
+| Supported standards            |                                                                   |
-| Documentation                  | https://docs.software-univention.de/ucs-python-api/univention.udm.html#module-univention.udm.                                                     |
+| Documentation                  |                                                                   |
 
 ## UDM REST API
 
@@ -169,72 +166,58 @@ More details on the Nubus provisioning service can be found here: https://docs.s
 | Versioning                     |                                                                                                                                            |
 | Authentication                 | Basic Auth                                                                                                                                 |
 | In openDesk provided by        | Univention Directory Manager                                                                                                               |
-| Transport protocol             | HTTP()                                                                                                                                     |
+| Transport protocol             | HTTP(S)                                                                                                                                    |
 | Usage within component         | The Nubus bootstrapping process makes use of the API.                                                                                      |
 | Usage within openDesk          |                                                                                                                                            |
 | Usage for external integration | The [openDesk User Importer](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/user-import) utilizes the API. |
 | Parallel access                | Allowed                                                                                                                                    |
 | Message protocol               | Depends on the integration use case.                                                                                                       |
 | Supported standards            |                                                                                                                                            |
-| Documentation                  | https://docs.software-univention.de/nubus-kubernetes-customization/latest/en/api/udm-rest.html                                             |
+| Documentation                  | https://docs.software-univention.de/developer-reference/5.0/en/udm/rest-api.html                                                           |
 
 ## UCR Python API
 
-![Architecture overview of UCR](./apis_images/IAM-ucr-architecture.svg)  
+![Composition of UCR component with APIs/interfaces highlighted](./apis_images/IAM-ucr.png)
-[Source](https://docs.software-univention.de/architecture/latest/en/services/ucr.html#services-ucr-architecture-model)
 
-| Name                           | UCR Python API                                                                                         |
+| Name                           | UCR Python API                                                                                      |
-| ------------------------------ | ---------------------------------------------------------------------------------------------------    |
+| ------------------------------ | --------------------------------------------------------------------------------------------------- |
-| Purpose                        | Offers a programming interface for components and other Python programs.                               |
+| Purpose                        | Offers a programming interface for components and other Python programs.                            |
-| Versioning                     |                                                                                                        |
+| Versioning                     |                                                                                                     |
-| Authentication                 |                                                                                                        |
+| Authentication                 |                                                                                                     |
-| In openDesk provided by        | Nubus                                                                                                  |
+| In openDesk provided by        | Nubus                                                                                               |
-| Transport protocol             |                                                                                                        |
+| Transport protocol             |                                                                                                     |
-| Usage within component         | The Nubus bootstrapping process makes use of the API.                                                  |
+| Usage within component         | The Nubus bootstrapping process makes use of the API.                                               |
-| Usage within openDesk          |                                                                                                        |
+| Usage within openDesk          |                                                                                                     |
-| Usage for external integration |                                                                                                        |
+| Usage for external integration |                                                                                                     |
-| Parallel access                | Allowed                                                                                                |
+| Parallel access                | Allowed                                                                                             |
-| Message protocol               |                                                                                                        |
+| Message protocol               |                                                                                                     |
-| Supported standards            |                                                                                                        |
+| Supported standards            |                                                                                                     |
-| Documentation                  | https://docs.software-univention.de/developer-reference/latest/en/ucr/usage.html#using-ucr-from-python |
+| Documentation                  | https://docs.software-univention.de/developer-reference/5.0/en/ucr/usage.html#using-ucr-from-python |
 
-## Identity Store and Directory Service (LDAP)
+## LDAP
 
-![Overview of the Identity Store and Directory Service](./apis_images/IAM-functional_component_identity_store.svg)  
+| Name                           | LDAP                                                                                                                    |
-[Source](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/identity-store.html#component-identity-store-figure)
+| ------------------------------ |-------------------------------------------------------------------------------------------------------------------------|
+| Purpose                        | Read access to Nubus LDAP                                                                                               |
+| Versioning                     | n/a                                                                                                                     |
+| Authentication                 | LDAP user auth                                                                                                          |
+| In openDesk provided by        | Nubus openLDAP                                                                                                          |
+| Transport protocol             | LDAP                                                                                                                    |
+| Usage within component         | Data backend for Nubus                                                                                                  |
+| Usage within openDesk          | Used by multiple applications to access user/group data, e.g. Nextcloud Server, OpenProject, OX AppSuite backend, XWiki |
+| Usage for external integration | Not recommended                                                                                                         |
+| Parallel access                | Allowed                                                                                                                 |
+| Message protocol               | LDAP                                                                                                                    |
+| Supported standards            | LDAP                                                                                                                    |
+| Documentation                  | https://docs.software-univention.de/manual/5.0/en/domain-ldap/ldap-directory.html                                       |
 
-| Name                           | Identity Store and Directory Service (LDAP)                                                                                                           |
+## Nubus Provisioning Service (**TBD**)
-| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------                             |
-| Purpose                        | Read access to Nubus LDAP                                                                                                                             |
-| Versioning                     | n/a                                                                                                                                                   |
-| Authentication                 | LDAP user auth                                                                                                                                        |
-| In openDesk provided by        | Nubus openLDAP                                                                                                                                        |
-| Transport protocol             | LDAP                                                                                                                                                  |
-| Usage within component         | Data backend for Nubus                                                                                                                                |
-| Usage within openDesk          | Used by multiple applications to access user/group data, e.g. Nextcloud Server, OpenProject, OX AppSuite backend, XWiki                               |
-| Usage for external integration | Not recommended                                                                                                                                       |
-| Parallel access                | Allowed                                                                                                                                               |
-| Message protocol               | LDAP                                                                                                                                                  |
-| Supported standards            | LDAP                                                                                                                                                  |
-| Documentation                  | https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/identity-store.html#component-identity-store-directory-service |
 
-## Nubus Provisioning Service
+To be delivered.
 
-![Overview of the Provisioning Service and its components](./apis_images/IAM-functional_component_provisioning_service_complete.svg)  
+## Nubus Authorization Service (**TBD**)
-[Source](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/provisioning-service.html#component-provisioning-service-complete-figure)
 
-| Name          | Nubus Proisioning Service                                                                                        |
+To be delivered.
-| ------------- | ---------------------------------------------------------------------------------------------------              |
-| Documentation | https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/components/provisioning-service.html |
-
-## Nubus Authorization Service
-
-![ArchiMate view of the interfaces and protocols of the Authorization Service](./apis_images/IAM-interfaces_authorization_service.svg)  
-[Source](https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/overview/interfaces-protocols.html#authorization-service)
-
-| Name          | Nubus Authorization Service                                                                                                          |
-| ------------- | ---------------------------------------------------------------------------------------------------                                  |
-| Documentation | https://docs.software-univention.de/nubus-kubernetes-architecture/latest/en/overview/interfaces-protocols.html#authorization-service |
 
 # Groupware - OX AppSuite / OX Dovecot
 

docs/getting-started.md

@@ -70,10 +70,6 @@ For your convenience, we recommend creating a `*.domain.tld` A-Record for your c
 | domain.tld                    | TXT  | `v=spf1 +a +mx +a:mail.domain.tld ~all`            | Optional, use proper MTA record if present                        |
 | _dmarc.domain.tld             | TXT  | `v=DMARC1; p=quarantine`                           | Optional                                                          |
 | default._domainkey.domain.tld | TXT  | `v=DKIM1; k=rsa; h=sha256; ...`                    | Optional, DKIM settings                                           |
-| _caldavs._tcp.domain.tld      | SRV  | 10 1 443 dav.domain.tld.                           | Optional, CalDav auto discovery                                   |
-| _caldav._tcp.domain.tld       | SRV  | 10 1  80 dav.domain.tld.                           | Optional, CalDav auto discovery                                   |
-| _carddavs._tcp.domain.tld     | SRV  | 10 1 443 dav.domain.tld.                           | Optional, CardDav auto discovery                                  |
-| _carddav._tcp.domain.tld      | SRV  | 10 1  80 dav.domain.tld.                           | Optional, CardDav auto discovery                                  |
 
 ## Domain
 

docs/requirements.md

@@ -29,13 +29,11 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
 - K8s cluster >= v1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
 - Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases)
-- [Helm](https://helm.sh/) >= v3.17.3
+- [Helm](https://helm.sh/) >= v3.9.0
-- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= v1.0.0
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= v1.0.0-rc8
-- [HelmDiff](https://github.com/databus23/helm-diff) >= v3.11.0
+- [HelmDiff](https://github.com/databus23/helm-diff) >= v3.6.0
 - Volume provisioner supporting RWO (read-write-once)[^1]
 - Certificate handling with [cert-manager](https://cert-manager.io/)
-
-**Additional openDesk Enterprise requirements**
 - [OpenKruise](https://openkruise.io/)[^2] >= v1.6
 
 # Hardware

docs/security-context.md

@@ -197,7 +197,7 @@ This list gives you an overview of templated security settings and if they compl
 | **nubus**/ums/nubusUdmListener | :x: | no | n/a | yes | yes | 102 | 65534 | yes | yes |
 | **nubus**/ums/nubusUdmRestApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusUmcGateway | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
-| **nubus**/ums/nubusUmcServer | :x: | no | n/a | yes | yes | 999 | 999 | yes | yes |
+| **nubus**/ums/nubusUmcServer | :x: | no | n/a | yes | no | 0 | 0 | yes | yes |
 | **open-xchange**/dovecot | :x: | no | n/a | yes | n/a | n/a | n/a | yes | no ["CHOWN","DAC_OVERRIDE","KILL","NET_BIND_SERVICE","SETGID","SETUID","SYS_CHROOT"] |
 | **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |

helmfile/apps/nubus/values-nubus.yaml.gotmpl

@@ -197,12 +197,6 @@ keycloak:
         name: "ums-opendesk-keycloak-credentials"
         keyMapping:
           adminPassword: "admin_password"
-    login:
-      messages:
-        de:
-          loginTitle: "Anmeldung bei opendesk"
-        en:
-          loginTitle: "Sign in to opendesk"
   podAnnotations:
     intents.otterize.com/service-name: "ums-keycloak"
     {{- with .Values.annotations.nubusKeycloak.pod }}
@@ -706,6 +700,17 @@ nubusKeycloakExtensions:
     resources:
       {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 6 }}
     securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - "ALL"
+      enabled: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      seccompProfile:
+        type: "RuntimeDefault"
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
       seccompProfile:
         type: "RuntimeDefault"
       seLinuxOptions:
@@ -1415,7 +1420,7 @@ nubusSelfServiceConsumer:
 nubusStackDataUms:
   additionalAnnotations:
     argocd.argoproj.io/hook: "Sync"
-    argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
+    argocd.argoproj.io/hook-delete-policy: "HookSucceeded"
     intents.otterize.com/service-name: "ums-stack-data-ums"
     {{- with .Values.annotations.nubusStackDataUms.additional }}
     {{ . | toYaml | nindent 4 }}
@@ -1748,7 +1753,6 @@ nubusUmcGateway:
 nubusKeycloakBootstrap:
   additionalAnnotations:
     argocd.argoproj.io/hook: "Sync"
-    argocd.argoproj.io/hook-delete-policy: "BeforeHookCreation"
     {{- with .Values.annotations.nubusKeycloakBootstrapNubus.additional }}
     {{ . | toYaml | nindent 4 }}
     {{- end }}
@@ -1765,7 +1769,7 @@ nubusKeycloakBootstrap:
     capabilities:
       drop:
         - "ALL"
-    readOnlyRootFilesystem: false
+    readOnlyRootFilesystem: true
     runAsGroup: 1000
     runAsNonRoot: true
     runAsUser: 1000

helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl

@@ -36,7 +36,6 @@ dovecot:
       value: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
     keyspace: {{ .Values.databases.dovecotACL.name | quote }}
   objectStorage:
-    bucket: {{ .Values.objectstores.dovecot.bucket | quote }}
     encryption:
       privateKey:
         value: {{ env "DOVECOT_CRYPT_PRIVATE_KEY" | quote }}

helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl

@@ -83,10 +83,6 @@ containerSecurityContext:
   seLinuxOptions:
     {{ .Values.seLinuxOptions.dovecot | toYaml | nindent 4 }}
 
-{{- if .Values.debug.enabled }}
-debug: true
-{{- end }}
-
 {{- if .Values.certificate.selfSigned }}
 extraVolumes:
   - name: "trusted-cert-secret-volume"

helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl

@@ -108,9 +108,8 @@ appsuite:
       hosts:
         - "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
     dav:
-      enabled: {{ .Values.functional.groupware.davSupport.enabled }}
       hosts:
-        - "{{ .Values.global.hosts.openxchangeDav }}.{{ .Values.global.domain }}"
+        - "{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}"
     routes:
       appsuite-base:
         annotations:
@@ -216,7 +215,7 @@ appsuite:
         host: "all"
         productName: {{ .Values.theme.texts.productName | quote }}
         oidcLogin: true
-        oidcPath: "/oidc/"
+        oidcPath: "/oidc"
     masterAdmin: "admin"
     masterPassword: {{ .Values.secrets.oxAppSuite.adminPassword | quote }}
     hzGroupName: "hzgroup"
@@ -279,14 +278,17 @@ appsuite:
       status:
         {{- if .Values.functional.migration.oxAppSuite.enabled }}
         open-xchange-oidc: "disabled"
-        open-xchange-authentication-masterpassword: "enabled"
-        {{- else }}
-        open-xchange-oidc: "enabled"
-        open-xchange-authentication-masterpassword: "disabled"
-        {{- end }}
         open-xchange-authentication-oauth: "disabled"
+        open-xchange-authentication-masterpassword: "enabled"
         open-xchange-authentication-database: "disabled"
         open-xchange-authentication-ldap: "disabled"
+        {{- else }}
+        open-xchange-oidc: "enabled"
+        open-xchange-authentication-oauth: "enabled"
+        open-xchange-authentication-masterpassword: "disabled"
+        open-xchange-authentication-database: "disabled"
+        open-xchange-authentication-ldap: "disabled"
+        {{- end }}
         # OX Documents (office-web) is not used in openDesk
         open-xchange-documents-backend: "disabled"
         open-xchange-documents-monitoring: "disabled"
@@ -321,8 +323,18 @@ appsuite:
       com.openexchange.oidc.startDefaultBackend: "true"
       com.openexchange.oidc.userLookupClaim: "opendesk_username"
       com.openexchange.oidc.userLookupNamePart: "full"
-      com.openexchange.oidc.enablePasswordGrant: "true"
+      # OAUTH
-      com.openexchange.oidc.passwordGrantUserNamePart: "local-part"
+      com.openexchange.oauth.provider.enabled: "true"
+      com.openexchange.oauth.provider.allowedIssuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+      com.openexchange.oauth.provider.contextLookupClaim: "context"
+      com.openexchange.oauth.provider.contextLookupNamePart: "full"
+      com.openexchange.oauth.provider.jwt.jwksUri: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
+      com.openexchange.oauth.provider.mode: "expect_jwt"
+      com.openexchange.oauth.provider.userLookupNamePart: "full"
+      com.openexchange.oauth.provider.userLookupClaim: "opendesk_username"
+      com.openexchange.authentication.oauth.clientId: "opendesk-oxappsuite"
+      com.openexchange.authentication.oauth.tokenEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
+      com.openexchange.authentication.oauth.clientSecret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
       # MAIL
       com.openexchange.mail.authType: "xoauth2"
       com.openexchange.mail.loginSource: "mail"
@@ -386,15 +398,6 @@ appsuite:
       # http = (await import('./io.ox/core/http.js')).default
       # await http.POST({ module: 'oxguard/smime', params: { action: 'test' } })
       com.openexchange.smime.test: "true"
-      # DAV
-      {{- if .Values.functional.groupware.davSupport.enabled }}
-      com.openexchange.caldav.enabled: "true"
-      com.openexchange.caldav.url: {{ printf "https://%s.%s/caldav/[folderId]" .Values.global.hosts.openxchangeDav .Values.global.domain }}
-      com.openexchange.carddav.enabled: "true"
-      com.openexchange.carddav.url: {{ printf "https://%s.%s/carddav/[folderId]" .Values.global.hosts.openxchangeDav .Values.global.domain }}
-      com.openexchange.client.onboarding.caldav.url: {{ printf "https://%s.%s/" .Values.global.hosts.openxchangeDav .Values.global.domain }}
-      com.openexchange.client.onboarding.carddav.url: {{ printf "https://%s.%s/" .Values.global.hosts.openxchangeDav .Values.global.domain }}
-      {{- end }}
       # Other
       com.openexchange.secret.secretSource: "\"<user-id> + '@' + <context-id> + '/' + <random>\""
       {{- if .Values.certificate.selfSigned }}

helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl

@@ -5,7 +5,7 @@ images:
   collabora:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "24.04.13.4.1@sha256:4d4f88fa244280f6116b072a923ee7e5c183ab30ee9759952f9b6aa802802300"
+    tag: "24.04.13.3.1@sha256:7e9b63972415a5a8006ec6b7e904c2d78d9af467218ead7e578d0c8a5691f0bc"
   dovecot:
     registry: "registry.opencode.de"
     repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/dovecot-pro"

helmfile/environments/default/charts.yaml.gotmpl

@@ -56,7 +56,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/collabora/charts-mirror"
     name: "collabora-online"
-    version: "1.1.38"
+    version: "1.1.37"
     verify: true
   collaboraController:
     # Enterprise Component
@@ -241,7 +241,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/external/charts/bitnami-charts"
     name: "minio"
-    version: "16.0.10"
+    version: "14.10.1"
     verify: true
   nextcloud:
     # providerCategory: "Platform"
@@ -387,7 +387,7 @@ charts:
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
     name: "appsuite-public-sector"
-    version: "2.19.254"
+    version: "2.17.164"
     verify: false
   oxAppSuiteBootstrap:
     # providerCategory: "Platform"

helmfile/environments/default/functional.yaml.gotmpl

@@ -144,10 +144,6 @@ functional:
         versions: "auto"
         # yamllint enable rule:line-length
 
-  groupware:
-    davSupport:
-      enabled: true
-
   migration:
     oxAppSuite:
       # Note: Only available in openDesk Enterprise.

helmfile/environments/default/global.generated.yaml.gotmpl

@@ -3,5 +3,5 @@
 ---
 global:
   systemInformation:
-    releaseVersion: "v1.4.0"
+    releaseVersion: "v1.3.3"
 ...

helmfile/environments/default/global.yaml.gotmpl

@@ -55,7 +55,6 @@ global:
     nubus: "portal"
     openproject: "projects"
     openxchange: "webmail"
-    openxchangeDav: "dav"
     static: "static"
     synapse: "matrix"
     synapseAdmin: "synapse-admin"

helmfile/environments/default/images.yaml.gotmpl

@@ -12,7 +12,7 @@ images:
     # upstreamRepository: "bitnami/os-shell"
     registry: "registry-1.docker.io"
     repository: "bitnami/os-shell"
-    tag: "12-debian-12-r44@sha256:6388c7c27a09472906e2f2094410c9ffdadf23b4b242293ce023d0314ec10920"
+    tag: "12-debian-12-r34@sha256:41e0561b0f08011c24acc5e8ad4c0d09a36062cfab35d9ec7b3fdd4cfecc01e0"
   cassandra:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -20,7 +20,7 @@ images:
     # upstreamRepository: "bitnami/cassandra"
     registry: "registry-1.docker.io"
     repository: "bitnami/cassandra"
-    tag: "5.0.4-debian-12-r3@sha256:af57aa07f866673d4f605bc555e2699dfa7615de216d6a2d0cc607c81831ec2f"
+    tag: "5.0.2-debian-12-r1@sha256:9f5fd6fe3a24b7e5ea215a99a0e0d6a10d11a914d6eb8c511780271a9097f5ea"
   cassandraExporter:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -28,7 +28,7 @@ images:
     # upstreamRepository: "bitnami/cassandra-exporter"
     registry: "registry-1.docker.io"
     repository: "bitnami/cassandra-exporter"
-    tag: "2.3.8-debian-12-r46@sha256:e44c65f08d85153041f68bcf180f948341d74018eef8b56e8869ed87fdfd34f0"
+    tag: "2.3.8-debian-12-r31@sha256:ae861f6c8712dd32c2304c680e4564802df689a62dc4aed2f4e7cfcbba8a8051"
   clamd:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -36,7 +36,7 @@ images:
     # upstreamRepository: "clamav/clamav"
     registry: "registry-1.docker.io"
     repository: "clamav/clamav"
-    tag: "1.4.2-38_base@sha256:e7d108f30ea8f16935dbd12e4b58665f1bc148ce3dd59028cf04088330216910"
+    tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
   collabora:
     # providerCategory: "Supplier"
     # providerResponsible: "Collabora"
@@ -44,7 +44,7 @@ images:
     # upstreamRepository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/collabora/images/collabora-online-for-opendesk"
-    tag: "24.04.14.3.1@sha256:b7085475740a4e92ad3611d52808b6d822478e52286d18d3272a9b685e049464"
+    tag: "24.04.13.3.1@sha256:f04a31d72b2b12b530b4e88b3ecb81eb96ebd98112515db59499ff71a4ec905f"
   collaboraController:
     # Enterprise Component
     # providerCategory: "Supplier"
@@ -84,7 +84,7 @@ images:
     # upstreamRepository: "alpine/k8s"
     registry: "registry-1.docker.io"
     repository: "alpine/k8s"
-    tag: "1.33.0@sha256:60333a52c38e9a8df0a9b93a5a24a4870f0db2c7ea3266b185386bd0a500d7dc"
+    tag: "1.32.3@sha256:eec3541331932d8613ce7b3283508063cba7f704302e9b4eda45e49b38a2a0f9"
   element:
     # providerCategory: "Supplier"
     # providerResponsible: "Element"
@@ -136,7 +136,7 @@ images:
     # upstreamRepository: "clamav/clamav"
     registry: "registry-1.docker.io"
     repository: "clamav/clamav"
-    tag: "1.4.2-38_base@sha256:e7d108f30ea8f16935dbd12e4b58665f1bc148ce3dd59028cf04088330216910"
+    tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
   icap:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -230,7 +230,7 @@ images:
     # upstreamRepository: "library/mariadb"
     registry: "registry-1.docker.io"
     repository: "library/mariadb"
-    tag: "10.6.21@sha256:8a16204dc96c08ed0ee2c52c0f9324aa5d2dd0e43ad23a471d447a39f75765b5"
+    tag: "10.5@sha256:aa1ccc18000c32d1f39ac0b055117b27bffd93e622ec961d682de40fe2a1a95f"
   matrixNeoBoardWidget:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -288,7 +288,7 @@ images:
     # upstreamRepository: "bitnami/memcached"
     registry: "registry-1.docker.io"
     repository: "bitnami/memcached"
-    tag: "1.6.38-debian-12-r3@sha256:3e548fba727578be9d996262471f5f3e07726d625702d26743a5e0f34684cb21"
+    tag: "1.6.21-debian-11-r107@sha256:247ec29efd6030960047a623aef025021154662edf6b6d6e88c97936f164d99d"
   migrations:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -304,7 +304,7 @@ images:
     # upstreamRepository: "clamav/clamav"
     registry: "registry-1.docker.io"
     repository: "clamav/clamav"
-    tag: "1.4.2-38_base@sha256:e7d108f30ea8f16935dbd12e4b58665f1bc148ce3dd59028cf04088330216910"
+    tag: "1.1.1-10_base@sha256:aed8d5a3ef58352c862028fae44241215a50eae0b9acb7ba8892b1edc0a6598f"
   minio:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -312,7 +312,7 @@ images:
     # upstreamRepository: "bitnami/minio"
     registry: "registry-1.docker.io"
     repository: "bitnami/minio"
-    tag: "2025.4.22-debian-12-r1@sha256:d7cd0e172c4cc0870f4bdc3142018e2a37be9acf04d68f386600daad427e0cab"
+    tag: "2024.12.13-debian-12-r0@sha256:2a258ab6876f6ed3cd5609836d065f20927955a2ae721fd9edde8ca388b52135"
   nextcloud:
     # providerCategory: "Platform"
     # providerResponsible: "openDesk"
@@ -336,7 +336,7 @@ images:
     # upstreamRepository: "nginxinc/nginx-s3-gateway"
     registry: "registry-1.docker.io"
     repository: "nginxinc/nginx-s3-gateway"
-    tag: "unprivileged-oss-20250512@sha256:064d14fc64ba968bd8123f2f25e446e597cfc5170124879b3834deac1a6d69fd"
+    tag: "unprivileged-oss-20241111@sha256:20d6b6ec5fc987b18c3e345de33674374a8335c593d6d0841ac64eb49ae2dea4"
   notesBackend:
     # providerCategory: "Supplier"
     # providerResponsible: "DINUM"
@@ -720,7 +720,7 @@ images:
     # upstreamRepository: "library/nginx"
     registry: "registry-1.docker.io"
     repository: "library/nginx"
-    tag: "1.28.0-alpine3.21@sha256:aed99734248e851764f1f2146835ecad42b5f994081fa6631cc5d79240891ec9"
+    tag: "1.27.3-alpine3.20@sha256:41523187cf7d7a2f2677a80609d9caa14388bf5c1fbca9c410ba3de602aaaab4"
   openproject:
     # providerCategory: "Supplier"
     # providerResponsible: "OpenProject"
@@ -754,7 +754,7 @@ images:
     # upstreamRepository: "alpine/k8s"
     registry: "registry-1.docker.io"
     repository: "alpine/k8s"
-    tag: "1.33.0@sha256:60333a52c38e9a8df0a9b93a5a24a4870f0db2c7ea3266b185386bd0a500d7dc"
+    tag: "1.31.3@sha256:77812543abe5649b286d5f0dc17a7dbaa4056433225f6f695150f329cb4b6803"
   openxchangeCoreGuidedtours:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -764,7 +764,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "6", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-guidedtours"
-    tag: "8.6.15@sha256:f8ea7b3f4003b518c43b12118980d26d1258396f55848af6a64e7a3e7e103c1d"
+    tag: "8.6.14@sha256:c00546144667d2d5036fa37b2e6185f1abb53c13e9eee7b0c78ec64ac8e5250a"
   openxchangeCoreMW:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -774,7 +774,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "51"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/middleware-public-sector"
-    tag: "8.37.62@sha256:2eb5f4a472c329cbf170b6e7fba5790756dcc3f6360d5d36dfff5eb06b09f8c3"
+    tag: "8.35.83@sha256:5c4180c1ba255193059241921e6fe0a34555592aa29104a145a0e1beb91157d2"
   openxchangeCoreUI:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -784,7 +784,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "1"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui"
-    tag: "8.37.1@sha256:eb30e03a5976d57a62d00a613336631d46bffc84c0d67e422f062635669f6b62"
+    tag: "8.35.2@sha256:658563b6ec4d3d5f2e06f2987cd8e730d91b8d0c65b0206495007d347f98965f"
   openxchangeCoreUIMiddleware:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -794,7 +794,7 @@ images:
     # upstreamMirrorStartFrom: ["2", "0", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-ui-middleware"
-    tag: "2.1.2@sha256:36fe59a047fa466bef6fcdeed1ed8e4bbeaf7824c37c63e3bfe7262cd135cb9e"
+    tag: "2.1.1@sha256:1a3e96243353a53e06bf3d90067d7d07de449e8273fa60a043d7ac4a5e6464c3"
   openxchangeCoreUserGuide:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -804,7 +804,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "799279"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-user-guide"
-    tag: "8.37.1354160@sha256:226b210268cd3c9b13a84a2ca1168e1ab08b62e19bccd3129adad7ffca514655"
+    tag: "8.35.1292950@sha256:a6937222e3b07b42c7dc6a066aae0cd05b3b899325a4e4aee50ee91355c9b3b5"
   openxchangeDocumentConverter:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -814,7 +814,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "50"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/documentconverter"
-    tag: "8.37.1751@sha256:c1bbe271d6c0ba9ecc1bbb4ba2a944099f0ba90133dd4e6d3aecd0ea51b2e5bd"
+    tag: "8.35.1671@sha256:0a7b9d7af9cd22562196b854ad11ca3fd477ddcc70f2ccd113e87ab3b7aad26c"
   openxchangeGotenberg:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -834,7 +834,7 @@ images:
     # upstreamMirrorStartFrom: ["4", "2", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/guard-ui"
-    tag: "8.33.2@sha256:920b5ac87128f30c176c0ae75c6bedd32d226a97c6c5a822235606c39992ee9a"
+    tag: "8.32.0@sha256:5c9542f9112882e46c3b8cb6f0ca2bef61585abac0e640a4fafa7d7ef60a392b"
   openxchangeImageConverter:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -844,7 +844,7 @@ images:
     # upstreamMirrorStartFrom: ["8", "20", "50"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/imageconverter"
-    tag: "8.37.2089@sha256:8109351da173fa836d5559973103c8890e6a6e2514866675387bbf4d49606917"
+    tag: "8.35.77@sha256:fb67cbaf0771ea6c18b5a1b94aaec9bf72b930227613e70535d382be58940372"
   openxchangeNextcloudIntegrationUI:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -854,7 +854,7 @@ images:
     # upstreamMirrorStartFrom: ["1", "2", "0"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/nextcloud-integration-ui"
-    tag: "1.4.1@sha256:423d596b52ab32778d7227d98ccc719f98395a00d95ff0bcac826665b59e1937"
+    tag: "1.4.0@sha256:4be267ab2dc8dbef6b8382e2de6b28f3851a7af7f68702f360d457898cb9011e"
   openxchangePublicSectorUI:
     # providerCategory: "Supplier"
     # providerResponsible: "Open-Xchange"
@@ -864,7 +864,7 @@ images:
     # upstreamMirrorStartFrom: ["2", "2", "1"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/public-sector-ui"
-    tag: "2.4.1@sha256:c9f0f5425517e1740aaf9998c5944ce36ce26eda52329754e6b8ac733e2dacc5"
+    tag: "2.4.0@sha256:6513e948028ed98aca633d9943ef3be5fed890e4757eee6b527b7215206d2bd6"
   oxConnector:
     # providerCategory: "Supplier"
     # providerResponsible: "Univention"
@@ -890,7 +890,7 @@ images:
     # upstreamRepository: "alpine/k8s"
     registry: "registry-1.docker.io"
     repository: "alpine/k8s"
-    tag: "1.33.0@sha256:60333a52c38e9a8df0a9b93a5a24a4870f0db2c7ea3266b185386bd0a500d7dc"
+    tag: "1.32.3@sha256:eec3541331932d8613ce7b3283508063cba7f704302e9b4eda45e49b38a2a0f9"
   postgresql:
     # providerCategory: "Community"
     # providerResponsible: "openDesk"
@@ -898,7 +898,7 @@ images:
     # upstreamRepository: "library/postgres"
     registry: "registry-1.docker.io"
     repository: "library/postgres"
-    tag: "15.13-alpine3.20@sha256:f7de0e2497b9a3b027d41377606f94bb0140a034ed303f6de690aa77637bfbc9"
+    tag: "15.4-alpine3.18@sha256:f36c528a2dc8747ea40b4cb8578da69fa75c5063fd6a71dcea3e3b2a6404ff7b"
   prosody:
     # providerCategory: "Supplier"
     # providerResponsible: "Nordeck"
@@ -916,7 +916,7 @@ images:
     # upstreamRepository: "bitnami/redis"
     registry: "registry-1.docker.io"
     repository: "bitnami/redis"
-    tag: "7.4.3-debian-12-r0@sha256:a25b5d07a14ec13730022c7cd9bab6308d55ccd86b74af7315553c17be884889"
+    tag: "7.4.1-debian-12-r2@sha256:3cfa11e8fef45c006a101ed7cfaae2cdaed7a5167c8ada2a3f76a1de54488cd0"
   synapse:
     # providerCategory: "Supplier"
     # providerResponsible: "Element"
@@ -926,7 +926,7 @@ images:
     # upstreamMirrorStartFrom: ["1", "91", "2"]
     registry: "registry.opencode.de"
     repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse"
-    tag: "v1.129.0@sha256:13ac3293547d8c06e1e03fca4e02ef9a47f132acc2e2cdb4143a01495dd924cf"
+    tag: "v1.127.1@sha256:0b0b933314ac9e1ba917a72c29d5b49c47828ab6e8df3aae3ac244ee947a89fc"
   synapseCreateUser:
     # providerCategory: "Community"
     # providerResponsible: "Nordeck"
@@ -934,7 +934,7 @@ images:
     # upstreamRepository: "alpine/k8s"
     registry: "registry-1.docker.io"
     repository: "alpine/k8s"
-    tag: "1.33.0@sha256:60333a52c38e9a8df0a9b93a5a24a4870f0db2c7ea3266b185386bd0a500d7dc"
+    tag: "1.32.0@sha256:6d49f7f37ae5f4c07bfe46edb44e3d3b6896974d1b87da76d8aa8d6e23b4d619"
   synapseGuestModule:
     # providerCategory: "Supplier"
     # providerResponsible: "Element"
@@ -952,7 +952,7 @@ images:
     # upstreamRepository: "rapidfort/haproxy-official"
     registry: "registry-1.docker.io"
     repository: "rapidfort/haproxy-official"
-    tag: "3.1.7-bookworm@sha256:ab50f196f66884f62fb379c40824036cd0dabb10df660097cff99b7ae22c2c44"
+    tag: "2.6.15-bullseye@sha256:47b6ca4074347788cb414fbf3db35d0c51e9e47af33be46457f95c750540887c"
   wellKnown:
     # providerCategory: "Community"
     # providerResponsible: "Element"
@@ -960,7 +960,7 @@ images:
     # upstreamRepository: "library/nginx"
     registry: "registry-1.docker.io"
     repository: "library/nginx"
-    tag: "1.28.0-alpine3.21@sha256:aed99734248e851764f1f2146835ecad42b5f994081fa6631cc5d79240891ec9"
+    tag: "1.27.3-alpine3.20@sha256:41523187cf7d7a2f2677a80609d9caa14388bf5c1fbca9c410ba3de602aaaab4"
   xwikiMariadb:
     # providerCategory: "Supplier"
     # providerResponsible: "XWiki"