fix(intercom): Converge sessions to a working state

fix(openproject): Update to 15.1.1
fix(docs): Add permissions.md
2025-12-06 15:31:38 +01:00 · 2025-01-16 10:37:31 +01:00 · 2025-01-15 07:15:59 +01:00 · 2025-01-14 16:57:04 +01:00 · 2025-01-09 10:41:25 +01:00 · 2025-01-09 07:05:49 +01:00
190 changed files with 1321 additions and 3319 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -8,9 +8,6 @@
 helmfile/environments/dev/*.yaml.gotmpl
 helmfile/environments/test/*.yaml.gotmpl
 helmfile/environments/prod/*.yaml.gotmpl
 helmfile/environments/dev/*/
 helmfile/environments/test/*/
 helmfile/environments/prod/*/
 !helmfile/environments/dev/sample.yaml.gotmpl
 !helmfile/environments/test/sample.yaml.gotmpl
 !helmfile/environments/prod/sample.yaml.gotmpl
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -9,12 +9,6 @@ include:
      - "ci/common/lint.yml"
      - "ci/release-automation/semantic-release.yml"
  - local: "/.gitlab/generate/generate-docs.yml"
  - local: "/.gitlab/renovate/renovate.yml"
  - local: "/.gitlab/release/release-common.yml"
  - local: "/.gitlab/release/release-generate-version.yml"
  - local: "/.gitlab/release/release-semantic.yml"
  - local: "/.gitlab/lint/lint-common.yml"
  - local: "/.gitlab/lint/lint-reuse.yml"
  - project: "${PROJECT_PATH_CUSTOM_ENVIRONMENT_CONFIG}"
    file: "gitlab/environments.yaml"
    ref: "main"
@@ -79,12 +73,6 @@ variables:
    options:
      - "yes"
      - "no"
  OPENDESK_ENTERPRISE:
    description: "Set to `true` if you want to deploy openDesk EE (but be sure you provide the required EE keys/tokens for the application)"
    value: "false"
    options:
      - "true"
      - "false"
  DEPLOY_ALL_COMPONENTS:
    description: "Enable all component deployment (overwrites 'no' setting on component level)."
    value: "no"
@@ -185,26 +173,19 @@ variables:
  TESTS_BRANCH:
    description: "Branch of E2E-tests on which the test pipeline is triggered"
    value: "develop"
  TESTS_PROJECT_URL:
    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
    value: "gitlab.opencode.de/api/v4/projects/1506"
  TESTS_TESTSET:
-    description: "Selects test set for E2E-tests (Regression, Smoke or Nightly), name multiple comma separated to trigger the sets in one launch, use semikolon to trigger the sets in different launches."
+    description: "Selects test set for E2E-tests"
    value: "Smoke"
  TESTS_BROWSER:
    description: "Select the browser (engine) to use for the test run."
    value: "chromium"
    options:
-      - "chromium"
+      - "Regression"
-      - "webkit"
+      - "Smoke"
      - "firefox"
  TESTS_GRACE_PERIOD:
    description: "A new deployment sometimes needs a few minutes to sort itself. If tested too early tests may fail.
                  GRACE_PERIOD is the period in seconds that should be waited before running the tests."
    value: "0"
  TESTS_NUMBER_OF_THREADS:
    description: "How many threads are used for executing the tests in parallel?"
    value: "8"
  TESTS_PROJECT_URL:
    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
    value: "gitlab.opencode.de/api/v4/projects/1506"
 # Declare .environments which is in `opendesk-env` repository. In case it is not available
 # 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
@@ -299,18 +280,6 @@ env-start:
        ca:
          secretName: opendesk-root-cert-secret
      EOF
  after_script:
    # Set credentials for openDesk Enterprise Registry
    - |
      if [ "${OPENDESK_ENTERPRISE}" = "true" ]; then
        kubectl create secret \
        --namespace "${NAMESPACE}" \
        docker-registry enterprise-registry \
        --docker-server "registry.opencode.de" \
        --docker-username "${OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME}" \
        --docker-password "${OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD}" \
        --dry-run=client -o yaml | kubectl apply -f -
      fi
  stage: "env"
 policies-deploy:
@@ -552,8 +521,7 @@ import-default-accounts:
        --admin_enable_fileshare True \
        --admin_enable_knowledgemanagement True \
        --admin_enable_projectmanagement True \
-        --create_admin_accounts True \
+        --create_admin_accounts True
        --verify_certificate False
 run-tests:
  stage: "post-execute"
@@ -584,7 +552,6 @@ run-tests:
          \"namespace\": \"${NAMESPACE}\", \
          \"url\": \"https://portal.${DOMAIN}/\", \
          \"language\": \"${LANGUAGE}\", \
          \"browser\": \"${TESTS_BROWSER}\", \
          \"udm_api_username\": \"Administrator\", \
          \"udm_api_password\": \"${DEFAULT_ADMINISTRATOR_PASSWORD}\", \
          \"screenshot_test\": \"yes\", \
@@ -593,9 +560,7 @@ run-tests:
          \"screenshot_redirect_step\": \"yes\", \
          \"testset\": \"${TESTS_TESTSET}\", \
          \"testprofile\": \"Namespace\", \
-          \"OPENDESK_ENTERPRISE\": \"${OPENDESK_ENTERPRISE}\", \
+          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\" \
          \"GRACE_PERIOD\": \"${TESTS_GRACE_PERIOD}\", \
          \"NUMBER_OF_THREADS\": \"${TESTS_NUMBER_OF_THREADS}\" \
        } \
      }" \
      "https://${TESTS_PROJECT_URL}/trigger/pipeline"
@@ -665,4 +630,110 @@ avscan-start:
      - artifact: "dynamic-scans.yml"
        job: "avscan-prepare"
    strategy: "depend"
 # Overwrite shared settings
 .common-semantic-release:
  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
  tags: []
 conventional-commits-linter:
  rules:
    - if: >
          $RUN_RENOVATE == "yes" ||
          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
      when: "never"
    - when: "always"
 common-yaml-linter:
  rules:
    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
      when: "never"
    - when: "always"
 reuse-linter:
  allow_failure: false
  rules:
    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
      when: "never"
    - when: "always"
 generate-release-version:
  rules:
    - if: >
        $JOB_RELEASE_ENABLED != 'false' &&
        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "on_success"
 release:
  rules:
    - if: >
        $JOB_AVSCAN_ENABLED != 'false' &&
        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "on_success"
  script:
    - >
      export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
      "@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
      grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
    - |
      if [ -z "${RELEASE_VERSION}" ]; then
        echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
      else
        echo "RELEASE_VERSION=${RELEASE_VERSION}"
      fi
    - |
      echo -e "\n[INFO] Writing data to helm value file..."
      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
      # SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
      # SPDX-License-Identifier: Apache-2.0
      ---
      global:
        systemInformation:
          releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
      ...
      EOF
    - |
      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
      {
        "branches": ["main"],
        "plugins": [
          "@semantic-release/gitlab",
          "@semantic-release/release-notes-generator",
          "@semantic-release/changelog",
          ["@semantic-release/git", {
            "assets": [
              "charts/**/Chart.yaml",
              "CHANGELOG.md",
              "charts/**/README.md",
              "helmfile/environments/default/global.generated.yaml.gotmpl",
              ".kyverno/kyverno-test.yaml",
              "docs"
            ],
            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
          }]
        ]
      }
      EOF
    - "semantic-release"
  needs:
    - "generate-docs"
 renovate:
  rules:
    - if: >
        $RUN_RENOVATE == "yes"
      when: "on_success"
  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
  variables:
    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
    # Increase the renovatebot log level on stdout
    LOG_LEVEL: "DEBUG"
  script:
    - "renovate ${RENOVATE_EXTRA_FLAGS}"
  stage: "renovate"
 ...
--- a/.gitlab/common/common.yml
+++ b/.gitlab/common/common.yml
@@ -2,8 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 variables:
-  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.2\
+  OPENDESK_CI_CLI_IMAGE: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:2.7.1\
-    @sha256:e33a6327b9c8f89f6e86d13804d5d81e9fdf6974a2f280874d6901067c22fd83"
+    @sha256:f09e36a4ad4b3a3a9ed260d6f36293002e39866a877c0a6b1efa16a88b8fd107"
  OPENDESK_LINT_IMAGE: "registry.opencode.de/bmi/opendesk/components/platform-development/images/ci-lint:1.0.14\
    @sha256:34d2a96e5fc25155abd48fef4d335b131c71d8cbc00ad531df0cae9918b9f2ab"
--- a/.gitlab/lint/lint-common.yml
+++ b/.gitlab/lint/lint-common.yml
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024-2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
+# SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 include:
@@ -8,18 +8,4 @@ include:
  extends: ".common"
  stage: "lint"
 common-yaml-linter:
  rules:
    - if: "$JOB_COMMON_YAML_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
      when: "never"
    - when: "always"
 conventional-commits-linter:
  rules:
    - if: >
          $RUN_RENOVATE == "yes" ||
          $JOB_CONVENTIONAL_COMMITS_LINTER_ENABLED == 'false' ||
          $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'
      when: "never"
    - when: "always"
 ...
--- a/.gitlab/lint/lint-reuse.yml
+++ b/.gitlab/lint/lint-reuse.yml
@@ -1,10 +0,0 @@
 # SPDX-FileCopyrightText: 2025 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 # SPDX-License-Identifier: Apache-2.0
 ---
 reuse-linter:
  allow_failure: false
  rules:
    - if: "$JOB_REUSE_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|web|merge_request_event'"
      when: "never"
    - when: "always"
 ...
--- a/.gitlab/release/release-common.yml
+++ b/.gitlab/release/release-common.yml
@@ -1,8 +0,0 @@
 # SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 # Overwrite shared settings
 .common-semantic-release:
  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/semantic-release:1.1.0"
  tags: []
 ...
--- a/.gitlab/release/release-generate-version.yml
+++ b/.gitlab/release/release-generate-version.yml
@@ -1,11 +0,0 @@
 # SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 generate-release-version:
  rules:
    - if: >
        $JOB_RELEASE_ENABLED != 'false' &&
        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "on_success"
 ...
--- a/.gitlab/release/release-semantic.yml
+++ b/.gitlab/release/release-semantic.yml
@@ -1,63 +0,0 @@
 # SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 release:
  cache:
    - key: "generate-docs-${CI_COMMIT_REF_SLUG}"
      paths:
        - "${CI_PROJECT_DIR}/docs"
      policy: "pull"
  rules:
    - if: >
        $JOB_AVSCAN_ENABLED != 'false' &&
        $CI_COMMIT_BRANCH == $RELEASE_BRANCH &&
        $CI_PIPELINE_SOURCE =~ "push|merge_request_event"
      when: "on_success"
  script:
    - >
      export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
      "@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
      grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
    - |
      if [ -z "${RELEASE_VERSION}" ]; then
        echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
      else
        echo "RELEASE_VERSION=${RELEASE_VERSION}"
      fi
    - |
      echo -e "\n[INFO] Writing data to helm value file..."
      cat <<EOF >helmfile/environments/default/global.generated.yaml.gotmpl
      # SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
      # SPDX-License-Identifier: Apache-2.0
      ---
      global:
        systemInformation:
          releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
      ...
      EOF
    - |
      cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
      {
        "branches": ["main"],
        "plugins": [
          "@semantic-release/gitlab",
          "@semantic-release/release-notes-generator",
          "@semantic-release/changelog",
          ["@semantic-release/git", {
            "assets": [
              "charts/**/Chart.yaml",
              "CHANGELOG.md",
              "charts/**/README.md",
              "helmfile/environments/default/global.generated.yaml.gotmpl",
              ".kyverno/kyverno-test.yaml",
              "docs"
            ],
            "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
          }]
        ]
      }
      EOF
    - "semantic-release"
  needs:
    - "generate-docs"
 ...
--- a/.gitlab/renovate/renovate.yml
+++ b/.gitlab/renovate/renovate.yml
@@ -1,19 +0,0 @@
 # SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 renovate:
  rules:
    - if: >
        $RUN_RENOVATE == "yes"
      when: "on_success"
  # The `-full` image does not install the dependencies on the fly, that is our preferred approach
  image: "${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/renovate/renovate:37.356-full"
  variables:
    RENOVATE_CONFIG_FILE: "${CI_PROJECT_DIR}/.renovate/config.yaml"
    RENOVATE_ENDPOINT: "${CI_API_V4_URL}"
    # Increase the renovatebot log level on stdout
    LOG_LEVEL: "DEBUG"
  script:
    - "renovate ${RENOVATE_EXTRA_FLAGS}"
  stage: "renovate"
 ...
--- a/.kyverno/policies/template-storage.yaml
+++ b/.kyverno/policies/template-storage.yaml
@@ -10,7 +10,7 @@ metadata:
    policies.kyverno.io/subject: "Pod"
    policies.kyverno.io/description: >-
      This policy validates if `.Values.persistence.storageClassNames` variables are used in templates and if the size
-      of volumes can be customized by `.Values.persistence.storages.<COMPONENT>.size` variable.
+      of volumes can be customized by `.Values.persistence.size` variable.
 spec:
  background: true
  rules:
--- a/.renovate/config.yaml
+++ b/.renovate/config.yaml
@@ -32,7 +32,7 @@ repositories:
    # Commit type to use if Semantic Commits are enabled (default: "chore")
    semanticCommitType: "chore"
    # Enable dependency dashboard
-    dependencyDashboard: false
+    dependencyDashboard: true
    # Include package files only within these defined paths
    includePaths:
      - "helmfile/environments/default/images.yaml.gotmpl"
@@ -59,47 +59,30 @@ repositories:
      - matchDatasources: [ "docker" ]
        matchDepTypes: [ "openDesk" ]
        groupName: "Platform"
        groupSlug: "platform"
        branchTopic: "platform"
      - matchDatasources: [ "docker" ]
        matchDepTypes: [ "Collabora" ]
        groupName: "Collabora"
        groupSlug: "collabora"
        branchTopic: "collabora"
      - matchDatasources: [ "docker" ]
        matchDepTypes: [ "Element" ]
        groupName: "Element"
        groupSlug: "element"
        branchTopic: "element"
      - matchDatasources: [ "docker" ]
        matchDepTypes: [ "Nordeck" ]
        groupName: "Nordeck"
        groupSlug: "nordeck"
        branchTopic: "nordeck"
      - matchDatasources: [ "docker" ]
        matchDepTypes: [ "Open-Xchange" ]
        groupName: "Open-Xchange"
        groupSlug: "openxchange"
        branchTopic: "openxchang"
      - matchDatasources: [ "docker" ]
        matchDepTypes: [ "OpenProject" ]
        groupName: "OpenProject"
        groupSlug: "openproject"
        branchTopic: "openproject"
      - matchDatasources: [ "docker" ]
-        matchDepTypes: [ "Nextcloud" ]
+        matchDepTypes: [ "OpenProject" ]
-        groupName: "nextcloud"
+        groupName: "OpenProject"
        branchTopic: "nextcloud"
      - matchDatasources: [ "docker" ]
        matchDepTypes: [ "Univention" ]
        groupName: "Univention"
        groupSlug: "univention"
        branchTopic: "univention"
      - matchDatasources: [ "docker" ]
        matchDepTypes: [ "XWiki" ]
        groupName: "XWiki"
        groupSlug: "xwiki"
        branchTopic: "xwiki"
    # Add merge request labels
    labels:
      - "renovate"
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,68 +1,3 @@
 ## [1.1.2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.1...v1.1.2) (2025-02-19)
 ### Bug Fixes
 * **dovecot:** Add Dovecot Pro [EE] ([6e343c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6e343c76a32a5bf4b431bdad6be1f7d107caa4f5))
 * **element:** Add Element EE components ([61d94a8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/61d94a8de655d1289aaf59c42f0dbf30b0156e1f))
 * **helmfile:** Add missing customizing option for Matrix widgets ([9c79c44](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9c79c44453af7b0c68f4ee2a5e40f1f9fb298570))
 * **helmfile:** Add SSL option for Keycloak Extensions Proxy's PostgreSQL connection ([91d0f98](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/91d0f9868226b08128af518be741c8614342581e))
 * **helmfile:** Fine-grained service types ([de8b560](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/de8b560fe7e2294229a959398be60bec9b6a7790))
 * **helmfile:** Integrate oD EE ([03ec704](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/03ec70435c365eca9f555a195b7ab92cc9eee907))
 * **helmfile:** Introduce `apps` as top level in `opendesk_main.yaml.gotmpl`; Please check migrations.md for upgrades of existing installations ([2fcf014](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2fcf014894ac3356ef8c6e57dda30c5176172e5e))
 * **helmfile:** Make openDesk IAM attributes optional with enabled as default ([b32996d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b32996da347c7ec24fb53afe72fee8c07631bebe))
 * **helmfile:** Provide toggle in `functional.yaml.gotmpl` for "new device notification" mails ([284c9fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/284c9fe0c7e217e3f92ec70eaad6ccf593ff2a87))
 * **helmfile:** Remove reference to no longer required `elementWeb` chart ([cd9c54b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/cd9c54b17733f9e334c558ccd86e69677264970a))
 * **helmfile:** Set default for domain to `opendesk.internal` to avoid enforcing DOMAIN environment variable for deployments using YAML overrides ([930ae9d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/930ae9d3e71bcd3f4034aa4dae5eabb3ae04d11b))
 * **helmfile:** Update/streamline theming ([8eeaa23](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8eeaa23c2f68e8e0cbda5b3763ab15ba8262c48d))
 * **jitsi:** Support for phone dial-in into Jitsi conferences ([1323ef1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1323ef142e789820acb05cb4991d10502a35498b))
 * **nextcloud:** Update `groupfolders` app to fix group selection in admin mode ([ab49bf9](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ab49bf9f6bb945cdce3950e46382b7361c48e6e4))
 * **nextcloud:** Update Nextcloud to 29.0.11 and support for Cron-Job specific resource definitions ([09f4829](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/09f482981b96774b3fe0948b7bb120be90157148))
 * **nubus:** Disable unused notification feature ([955f17e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/955f17ef8bb72459beb536cdcf6b502b16eabbff))
 * **nubus:** Fix Keycloak dialogue background length on small screens ([4662709](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/466270967310fab9333b892c904efa86d21f7d17))
 * **nubus:** Only configure apps that are deployed to show up in IAM admin UI and Keycloak ([1f051e7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1f051e777905668297c98dfa507875c08158bfda))
 * **nubus:** Re-implement toggle for UDM-REST-API based on `functional.externalServices.nubus.udmRestApi.enabled` ([777e7d2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/777e7d2fc6afa9c53a4ff1c6853c9960b9a22d5f))
 * **nubus:** Remove doublet `resources` key in `udm-listener` StatefulSet ([10e0b0a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/10e0b0ad6cbd89bd88b119f17b6cba6ec698f698))
 * **nubus:** Support for custom UDM commands ([aff8edb](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/aff8edbde2150763d6a36f97b9403c8c67e51fab))
 * **nubus:** Update Keycloak Extensions Proxy ([601e649](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/601e6499132c3adaaaea374033511eab09132cb2))
 * **open-xchange:** Parameters to split read and write queries to MariaDB ([370247b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/370247b95197792a65b84b2d01b9c1806f8b059a))
 * **open-xchange:** Update OX App Suite to 8.33 ([581c8ae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/581c8aed1f86bad251141ecb105e59d0054d5a1a))
 * **openproject:** Update OpenProject to 15.2.1 ([83c311b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/83c311b101a6fa551d9c25ea4e9a7ef6673137ca))
 * **oxconnector:** Update to strict `securityContext` from upstream defaults ([32df165](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/32df1657d29a2d73495d52b62bb77521cb8b8e86))
 ## [1.1.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.1.0...v1.1.1) (2025-01-27)
 ### Bug Fixes
 * **docs:** Add permissions.md ([04ab28c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/04ab28c029bb60575c1936ca5acdd2f829b26c06))
 * **element:** MatrixID for Element "Welcome User" to support deployments where matrix domain differs from homeserver FQDN ([ccb51a0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ccb51a0de32525a93fd982d52dc8e6a35db8f09a))
 * **element:** Update Element to 1.11.90 ([335806a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/335806a53e51c3fc6a03440316e909aa51af5be8))
 * **element:** Update Helm chart to v6.0.2 for a fix when using non generated secrets in `opendesk-synapse` ([d5e73fe](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d5e73feb880c33e8127f284fcc685ffdc15874a8))
 * **element:** Update Synapse to 1.121.1 ([33ff922](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/33ff9227b745f99e3abdde6dbbe6b00042fca655))
 * **helmfile:** Move the access restriction configuration for Keycloak client scopes into helmfile templating, instead of hardcoded Helm chart values ([3662b5c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3662b5cd255b37321d3a3625f78feff07b7e633c))
 * **helmfile:** Remove duplicate entries from `secrets.yaml.gotmpl` ([a13cf63](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a13cf630242343dc8f759cfeb423ff626480b086))
 * **helmfile:** Support component specific storageClassNames. **Note:** Please check the migration.md if you upgrade a deployment that has set custom PVC sizes using `persistence.size` settings. ([bacf51e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bacf51efb1b042b80f13f5cf3f50557006f32374))
 * **helmfile:** Support PostgreSQL as alternative database backend for Nextcloud and XWiki. **Note:** PostgreSQL is likely to become the preferred option/default in the future and MariaDB might be deprecated at a later point. ([a0f52ee](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a0f52ee7d4f6a9b82c9d4e288bc4c6cc96018985))
 * **helmfile:** Update `opendesk-alerts` and `opendesk-dashboards` to get predictable sort order, improving GitOps deployments ([0c91117](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0c91117575a3b56ff9f0b4ae72a501b9f3b4384c))
 * **helmfile:** Update upstream images for k8s/kubectl to v1.32.0 ([b71c2e5](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b71c2e57eec10093d96804e249fbaf81c51fb22e))
 * **intercom:** Remove legacy OIDC claims ([6796f32](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6796f320f72db02d67b73685aa6356cda9ac86d1))
 * **nextcloud:** Update image and Helm chart to support app toggles during deployment ([1cdfcf2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1cdfcf2784271f2b8ea61d2e8e534db2aa386f4b))
 * **nextcloud:** Update to Nextcloud 29.0.10 ([d096fb1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d096fb1154dbcd092e105d4450e7996dfda0388e))
 * **nubus:** Fix `pullPolicy` setting for `ldapServer.leaderElector` to satisfy Kyverno linter ([6f2f7cd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6f2f7cd5db6708c1fc523e3cf3160f39f1dba2bb))
 * **nubus:** Merge yaml files for better maintainability ([6c67eca](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6c67eca7aa68c3f597cc5790ba1046ca0855c329))
 * **nubus:** Pre-create groups in Keycloak to avoid race condition on group sync when initial users login parallel ([5496317](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5496317fee1ca47a80d0798b9048a1474ca8e2a6))
 * **nubus:** Remove `extra` settings from ldapServer needed for openDesk 1.0.0 LDAP migration ([fab862e](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/fab862eec689bf8ef547c4bd06244313f24f6d0b))
 * **nubus:** Remove b64 encoded files from CSS, instead use `opendesk-static-files` ([2926e2c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2926e2c93a2b4be24abd1e6dd4ce02071a629cb4))
 * **nubus:** Template `secrets.nubus.masterpassword`. **Note:** Please check migrations.md for details. ([5aae75a](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/5aae75a1521f73e497859fe3d3b89a8752bb47a1))
 * **nubus:** Update customizations for group cleanup ([0b230fa](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0b230fa2cc841edfde99f5d94dc9c8054bfbb5ec))
 * **open-xchange:** Add missing `registryOpencodeDe` to OX-Connector's `waitForDependency` image ([a16d907](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a16d9071c96ef7fde87e6579c328e1e05509824b))
 * **openproject:** Update to 15.1.1 ([b4b714f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b4b714ff41a8f01d4b44c6d5ced3f036f7d90699))
 * **openproject:** Update to 15.2.0 ([9d8e9c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9d8e9c3ade9917fb8044331ebdea8d7bca4066b0))
 * **static-files:** Update Helm chart to use more generic `assets` over `theme.imagery.assets` ([63562c1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/63562c1aae6b2c33ea39b93c11e842c2ab1e2c25))
 * **static-files:** Update Helm chart to v4.0.1 to support longer domain names ([b0e665b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b0e665b031baf36c59eea85b3d575f1a49290bf1))
 * **xwiki:** Update Helm chart to v1.4.1 to fix support for custom `ingressClassName` values. Ref [#144](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/issues/144) ([033cb55](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/033cb558ddc0b47d17b006cdc75c593c5c356147))
 # [1.1.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.0.0...v1.1.0) (2024-12-24)
--- a/README-EE.md
+++ b/README-EE.md
@@ -1,106 +0,0 @@
 <!--
 SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
 <h1>openDesk Enterprise Edition</h1>
 <!-- TOC -->
 * [Components](#components)
 * [Enabling the Enterprise deployment](#enabling-the-enterprise-deployment)
 * [Configuring the oD EE deployment for self-hosted installations](#configuring-the-od-ee-deployment-for-self-hosted-installations)
  * [Registry access](#registry-access)
  * [License keys](#license-keys)
 <!-- TOC -->
 openDesk Enterprise Edition is recommended for production use. It receives support and patches from ZenDiS and the suppliers of the components due to the included product subscriptions.
 The document refers to openDesk Community Edition as "oD CE" and for the openDesk Enterprise Edition it is "oD EE".
 Please contact [ZenDiS](mailto:opendesk@zendis.de) to get openDesk Enterprise, either as SaaS offering or for you on-premise installation.
 # Components
 The following components using the same codebase and artifacts for their Enterprise and Community offering:
 - Cryptpad
 - Jitsi
 - Nubus
 - OpenProject
 - XWiki
 The following components have - at least partially - Enterprise specific artifacts:
 - Collabora: Collabora Online image version `<major>.<minor>.<patch>.3` will be used once available, at the same time the Collabora Development Edition image will be updated to `<major>.<minor>.<patch>.2` for oD CE.
 - Element: Some artifacts providing additional functionality are only available in oD EE. For the shared artifacts we keep the ones in oD CE and oD EE in sync.
 - Nextcloud: Specific enterprise image based on the NC Enterprise package is build based on the same release version as used in oD CE.
 - OX AppSuite: oD CE and EE are using the same release version, in EE an enterprise-built container of the AppSuite's Core-Middleware is being integrated.
 - OX Dovecot Pro 3: Dovecot Pro provides support for S3 storage and this feature is used by default.
 # Enabling the Enterprise deployment
 To enable the oD EE deployment you must set the environment variable `OPENDESK_ENTERPRISE` to any value that does not evaluate to boolean *false* for [Helm flow control](https://helm.sh/docs/chart_template_guide/control_structures/#ifelse), e.g. `"true"`, `"yes"` or `"1"`:
 ```shell
 OPENDESK_ENTERPRISE=true
 ```
 > **Note**
 > Upgrading from oD CE to EE is currently not supported, especially due to the fact it requires a migration
 > from Dovecot 2.x (standard storage) to Dovecot Pro 3.x (S3).
 # Configuring the oD EE deployment for self-hosted installations
 ## Registry access
 With openDesk EE you get access to the related artifact registry owned by ZenDiS.
 Three steps are required to access the registry - for step #1 and #2 you can set some variables. You can to define a `<your_name_for_the_secret>` freely, like `enterprise-secret`, as long as it consistent in step #1 and #3.
 ```shell
 NAMESPACE=<your_namespace>
 NAME_FOR_THE_SECRET=<your_name_for_the_secret>
 YOUR_ENTERPRISE_REGISTRY_USERNAME=<your_registry_credential_username>
 YOUR_ENTERPRISE_REGISTRY_PASSWORD=<your_registry_credential_password>
 ```
 1. Add your registry credentials as secret to the namespace you want to deploy openDesk to. Do not forget to create the namespace if it does not exist yet (`kubectl create namespace ${NAMESPACE}`).
 ```shell
 kubectl create secret --namespace "${NAMESPACE}" \
  docker-registry "${NAME_FOR_THE_SECRET}" \
  --docker-server "registry.opencode.de" \
  --docker-username "${YOUR_ENTERPRISE_REGISTRY_USERNAME}" \
  --docker-password "${YOUR_ENTERPRISE_REGISTRY_PASSWORD}" \
  --dry-run=client -o yaml | kubectl apply -f -
 ```
 2. Docker login to the registry to access Helm charts for local deployments:
 ```shell
 docker login registry.opencode.de -u ${YOUR_ENTERPRISE_REGISTRY_USERNAME} -p ${YOUR_ENTERPRISE_REGISTRY_PASSWORD}
 ```
 3. Reference the secret from step #1 in the deployment as well as the registry itself for `images` and `helm` charts:
 ```yaml
 global:
  imagePullSecrets:
    - "<your_name_for_the_secret>"
 repositories:
  image:
    registryOpencodeDeEnterprise: "registry.opencode.de"
  helm:
    registryOpencodeDeEnterprise: "registry.opencode.de"
 ```
 ## License keys
 Some applications require license information for their Enterprise features to be enabled. With the aforementioned registry credentials you will also receive a file called `enterprise.yaml` containing the relevant license keys.
 Please place the file next your other `.yaml.gotmpl` file(s) that configure your deployment.
 Details regarding the scope/limitation of the component's licenses:
 - Nextcloud: Enterprise license to enable [Nextcloud Enterprise](https://nextcloud.com/de/enterprise/) specific features, can be used across multiple installations until the licensed number of users is reached.
 - OpenProject: Domain specific enterprise license to enable [OpenProject's Enterprise feature set](https://www.openproject.org/enterprise-edition/), domain matching can use regular expressions.
 - XWiki: Deployment specific enterprise license (key pair) to activate the [XWiki Pro](https://xwiki.com/en/offerings/products/xwiki-pro) apps.
--- a/README.md
+++ b/README.md
@@ -13,7 +13,6 @@ SPDX-License-Identifier: Apache-2.0
 * [Getting started](#getting-started)
 * [Advanced customization](#advanced-customization)
 * [Architecture](#architecture)
 * [Testing](#testing)
 * [Permissions](#permissions)
 * [Releases](#releases)
 * [Data Storage](#data-storage)
@@ -28,8 +27,6 @@ SPDX-License-Identifier: Apache-2.0
 openDesk is a Kubernetes based, open-source and cloud-native digital workplace suite provided by the
 *Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH*.
 For production use the [openDesk Enterprise Edition](./README-EE.md) is required.
 openDesk currently features the following functional main components:
 | Function             | Functional Component        | Component<br/>Version                                                                                | Upstream Documentation                                                                                                                |
@@ -39,10 +36,10 @@ openDesk currently features the following functional main components:
 | File management      | Nextcloud                   | [29.0.8](https://nextcloud.com/de/changelog/#29-0-8)                                                 | [Nextcloud 29](https://docs.nextcloud.com/)                                                                                           |
 | Groupware            | OX App Suite                | [8.30](https://documentation.open-xchange.com/appsuite/releases/8.30/)                               | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
 | Knowledge management | XWiki                       | [16.4.4](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.4.4/)                       | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
-| Portal & IAM         | Nubus                       | [1.5.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
+| Portal & IAM         | Nubus                       | [1.4.0](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | [15.3.2](https://www.openproject.org/docs/release-notes/15-3-2/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Project management   | OpenProject                 | [15.1.1](https://www.openproject.org/docs/release-notes/15-1-1/)                                     | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
 | Videoconferencing    | Jitsi                       | [2.0.9823](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9823)                | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
-| Weboffice            | Collabora                   | [24.04.12.4](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
+| Weboffice            | Collabora                   | [24.04.9.2](https://www.collaboraoffice.com/code-24-04-release-notes/)                               | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |
 While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
 align the applications with best practices regarding container design and operations.
@@ -80,11 +77,7 @@ You would like to install openDesk in your own infrastructure?
 # Architecture
-More information on openDesk's architecture can be found in our [architecture docs](./docs/architecture.md).
+More information on openDesk's architecture can be found in our [Architecture docs](./docs/architecture.md).
 # Testing
 openDesk is continously tested to ensure a high quality. Read how we test in openDesk in our [test concept](./docs/testing.md).
 # Permissions
@@ -130,4 +123,4 @@ This project uses the following license: Apache-2.0
 # Copyright
-Copyright (C) 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+Copyright (C) 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
--- a/dev/README.md
+++ b/dev/README.md
@@ -7,40 +7,30 @@ SPDX-License-Identifier: Apache-2.0
 * [charts-local.py](#charts-localpy)
  * [Commandline parameter](#commandline-parameter)
-    * [`--match <your_string>`](#--match-your_string)
+    * [`--branch`](#--branch)
    * [`--revert`](#--revert)
    * [`--branch` (deprecated)](#--branch-deprecated)
 # charts-local.py
-This script helps you with cloning/pulling Helm charts and referencing them directly in the openDesk
+This script helps you on cloning the platform development Helm charts and referencing them directly in the openDesk
-Helmfile deployment for comfortable local test and development. The charts will be cloned/pulled into a directory
+Helmfile deployment for comfortable local test and development. The charts will be cloned into a directory
-created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
+parallel created next to the `opendesk` repo containing this documentation and the `charts-local.py` script.
 The name of the chart directory is derived from the branch name you are working with in this `opendesk` repo.
-The name of the directory containing the charts is based on the (currently) selected branch of the openDesk
+The script will create `.bak` copies of the helmfiles that have been touched.
 repo prefixed with `charts-`.
 The script will create `.bak` copies of the helmfiles that have been touched that can easily be reverted to
 using the `--revert` option.
 Run the script with `-h` to get information about the script's parameter on commandline.
 ## Commandline parameter
-### `--match <your_string>`
+### `--branch`
 Will only fetch repos or pull images for charts which name matches `<your_string>`.
 ### `--revert`
 Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
 scripts itself back to their original location.
 ### `--branch` (deprecated)
 Optional parameter: Defines a branch for the `opendesk` repo to work with. The script will create the branch if it
 does not exist yet. Otherwise it will switch to defined branch.
 If parameter is omitted the current branch of the `opendesk` repo will be used.
-As this parameter was used rarely, we might remove the support in a later version.
+### `--revert`
 Reverts the changes in the helmfiles pointing to the local Helm charts by copying the backup files created by the
 scripts itself back to their original location.
--- a/dev/charts-local.py
+++ b/dev/charts-local.py
@@ -18,6 +18,7 @@ p.add('--branch', env_var='CHART_DEV_BRANCH', help='The branch you want to work
 p.add('--git_hostname', env_var='GIT_HOSTNAME', default='git@gitlab.opencode.de', help='Set the hostname for the chart git checkouts.')
 p.add('--revert', default=False, action='store_true', help='Set this parameter if you want to revert the referencing of the local helm chart checkout paths in the helmfiles.')
 p.add('--match', default='', help="Clone/pull only charts that contain the given string in their name.")
 p.add('--pull', default=False, action='store_true', help='Will also pull and unpack Helm charts that are not developed by product development.')
 p.add('--loglevel', env_var='LOGLEVEL', default='DEBUG', help='Set the loglevel: DEBUG, INFO, WARNING, ERROR, CRITICAL-')
 options = p.parse_args()
@@ -77,10 +78,13 @@ def create_path_if_not_exists(path):
        Path(path).mkdir(parents=True, exist_ok=True)
 def clone_charts_locally(branch, charts):
-    charts_path = script_path+'/../../charts-'+branch.replace('/', '_')
+    charts_clone_path = script_path+'/../../chart-repo/'+branch.replace('/', '_')
    charts_pull_path = script_path+'/../../chart-pull/'+branch.replace('/', '_')
    charts_dict = {}
    doublette_dict = {}
-    create_path_if_not_exists(charts_path)
+    create_path_if_not_exists(charts_clone_path)
    if options.pull:
        create_path_if_not_exists(charts_pull_path)
    for chart in charts['charts']:
        tag = charts['charts'][chart]['version']
@@ -88,43 +92,41 @@ def clone_charts_locally(branch, charts):
        registry = charts['charts'][chart]['registry']
        name = charts['charts'][chart]['name']
        logging.debug(f"Working on {chart} / tag {tag} / repo {repository}")
        chart_local_path = charts_path+'/'+name
        if not options.match in name:
            logging.info(f"Chart name {name} does not match {options.match} - skipping...")
            continue
        elif registry == '':
            logging.info("Empty registry definition - skipping...")
            continue
        if os.path.isdir(chart_local_path):
            logging.debug(f"Found pre-existing {chart_local_path} skipping clone/pull, but will still reference chart in Helmfile...")
            charts_dict[chart] = chart_local_path
            git_url = options.git_hostname+':'+repository
            doublette_dict[git_url] = chart_local_path
            continue
        elif 'opendesk/components/platform-development/charts' in repository:
            logging.info("Cloning the charts repo")
            git_url = options.git_hostname+':'+repository
            chart_repo_path = charts_clone_path+'/'+charts['charts'][chart]['name']
            if git_url in doublette_dict:
                logging.debug(f"{chart} located at {git_url} is already checked out to {doublette_dict[git_url]}")
                charts_dict[chart] = doublette_dict[git_url]
            else:
-                logging.debug(f"Cloning into {chart_local_path}")
+                if os.path.isdir(chart_repo_path):
-                Repo.clone_from(git_url, chart_local_path)
+                    logging.debug(f"Already exists {chart_repo_path} leaving it unmodified")
-                chart_repo = Repo(path=chart_local_path)
+                else:
-                chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
+                    logging.debug(f"Cloning into {chart_repo_path}")
-                doublette_dict[git_url] = chart_local_path
+                    Repo.clone_from(git_url, chart_repo_path)
-                charts_dict[chart] = chart_local_path
+                    chart_repo = Repo(path=chart_repo_path)
-        else:
+                    chart_repo.git.checkout('v'+charts['charts'][chart]['version'])
                doublette_dict[git_url] = chart_repo_path
                charts_dict[chart] = chart_repo_path
        elif options.pull:
            logging.info("Pulling the chart")
-            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_path}"
+            helm_command = f"helm pull oci://{registry}/{repository}/{name} --version {tag} --untar --destination {charts_pull_path}"
            logging.debug(f"CLI command: {helm_command}")
            try:
-                subprocess.check_output(helm_command, shell = True)
+                output = subprocess.check_output(helm_command, shell = True)
            except subprocess.CalledProcessError:
                sys.exit(f"! CLI command '{helm_command}' failed")
-            charts_dict[chart] = chart_local_path
+        else:
            logging.debug("Not a product development chart and `--pull` option not enabled - skipping...")
    return charts_dict
 def grep_yaml(file):
    with open(file, 'r') as file:
        content = ''
@@ -154,12 +156,7 @@ def process_the_helmfiles(charts_dict, charts):
                    for chart_ident in charts_dict:
                        if '.Values.charts.'+chart_ident+'.name' in line:
                            logging.debug(f"found match with {chart_ident} in {line.strip()}")
-                            line = charts_dict[chart_ident]
+                            line = chart_def_prefix+charts_dict[chart_ident]+'/charts/'+charts['charts'][chart_ident]['name']+'" # replaced by local-dev script'+"\n"
                            if os.path.isdir(line+'/charts/'+charts['charts'][chart_ident]['name']):
                                line += '/charts/'+charts['charts'][chart_ident]['name']
                            elif not os.path.isdir(line):
                                sys.exit(f"! Did not find directory to reference in Helmfile: '{line}'")
                            line = chart_def_prefix+line+'" # replaced by local-dev script'+"\n"
                            child_helmfile_updated = True
                            break
                output.append(line)
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -407,8 +407,6 @@ In openDesk, Element is used for chat and direct audio & video calling.
 In openDesk, Jitsi is used for video conferencing and online meetings. It integrates with other applications to provide seamless communication capabilities.
 [Jigasi](https://github.com/jitsi/jigasi) (Jitsi's SIP component) also allows joining the meeting via phone call if an external SIP server and SIP trunk are provided.
 ## Nextcloud (Files)
 [Nextcloud](https://nextcloud.com) is a file storage and sync platform with powerful collaboration capabilities with desktop, mobile and web interfaces.
--- a/docs/debugging.md
+++ b/docs/debugging.md
@@ -168,7 +168,7 @@ While you will find all the details for the CLI tool in [the online documentatio
 `occ` is the CLI for Nextcloud; all the details can be found in the [upstream documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html).
-You can run occ commands in the `opendesk-nextcloud-aio` pod like this: `php /var/www/html/occ config:list`
+You can run occ commands in the `opendesk-nextcloud-php` pod like this: `php /var/www/html/occ config:list`
 ## OpenProject
--- a/docs/enhanced-configuration/idp-federation.md
+++ b/docs/enhanced-configuration/idp-federation.md
@@ -6,6 +6,7 @@ SPDX-License-Identifier: Apache-2.0
 <h1>Federation with external identity provider (IdP)</h1>
 <!-- TOC -->
 * [Context](#context)
 * [References](#references)
 * [Prerequisites](#prerequisites)
  * [User accounts](#user-accounts)
@@ -152,9 +153,10 @@ The following configuration is taking place in the Keycloak realm `opendesk`.
  - *Client authentication*: `Client secret sent as post` (default)
  - *Client ID*: Use the client ID you took from your organization's IdP config (`opendesk-federation-client` in this example)
  - *Client Secret*: Use the secret you took from your organization's IdP config
-  - When completed with *Add*, you get to the detailed IdP configuration that at least needs some the following update:
+  - When completed with *Add*, you get to the detailed IdP configured that also needs some updates (you may need to open the *Advanced* section to access some settings)
    - *Back-channel logout*: `On`
    - *Disable user info*: `On`
    - *First login flow override*: `auto-federate-flow`
    - Depending on your organizations IdP and process preferences additional setting may be required
 - In case you want to forcefully redirect all users to your organization's IdP (disabling login with local openDesk accounts):
  - *Authentication* > `2fa-browser`
--- a/docs/enhanced-configuration/self-signed-certificates.md
+++ b/docs/enhanced-configuration/self-signed-certificates.md
@@ -98,8 +98,6 @@ multiple namespaces in a cluster.
        name: selfsigned-issuer
        kind: ClusterIssuer
        group: cert-manager.io
      duration: 87600h # 10y
      renewBefore: 87599h
    ```
 1. Copy this cert's secret into the/each namespace you want to make use of the cert.
--- a/docs/external-services.md
+++ b/docs/external-services.md
@@ -11,7 +11,6 @@ This document will cover the additional configuration for external services like
 * [Database](#database)
 * [Object storage](#object-storage)
 * [Cache](#cache)
 * [Footnotes](#footnotes)
 <!-- TOC -->
 # Database
@@ -19,150 +18,93 @@ This document will cover the additional configuration for external services like
 When deploying this suite to production, you need to configure the applications to use your production-grade database
 service.
-> **Note**<br>
+| Component    | Name               | Type       | Parameter | Key                                      | Default                    |
-> openDesk supports PostgreSQL as alternative database backend for Nextcloud and XWiki. PostgreSQL is likely become the preferred option/default in the future and MariaDB might be deprecated at a later point requiring migrations[^1] if you do not select PostgreSQL for new installations.
+| ------------ | ------------------ | ---------- | --------- | ---------------------------------------- | -------------------------- |
-
+| Element      | Synapse            | PostgreSQL |           |                                          |                            |
-| Component          | Name               | Parameter | Key                                           | Default                      |
+|              |                    |            | Name      | `databases.synapse.name`                 | `matrix`                   |
-| ------------------ | ------------------ | --------- | --------------------------------------------- | ---------------------------- |
+|              |                    |            | Host      | `databases.synapse.host`                 | `postgresql`               |
-| Element            | Synapse            |           |                                               |                              |
+|              |                    |            | Port      | `databases.synapse.port`                 | `5432`                     |
-|                    |                    | Type      | `databases.synapse.type`                      | `postgresql`                 |
+|              |                    |            | Username  | `databases.synapse.username`             | `matrix_user`              |
-|                    |                    | Name      | `databases.synapse.name`                      | `matrix`                     |
+|              |                    |            | Password  | `databases.synapse.password`             |                            |
-|                    |                    | Host      | `databases.synapse.host`                      | `postgresql`                 |
+| Keycloak     | Keycloak           | PostgreSQL |           |                                          |                            |
-|                    |                    | Port      | `databases.synapse.port`                      | `5432`                       |
+|              |                    |            | Name      | `databases.keycloak.name`                | `keycloak`                 |
-|                    |                    | Username  | `databases.synapse.username`                  | `matrix_user`                |
+|              |                    |            | Host      | `databases.keycloak.host`                | `postgresql`               |
-|                    |                    | Password  | `databases.synapse.password`                  |                              |
+|              |                    |            | Port      | `databases.keycloak.port`                | `5432`                     |
-| Nubus              | Guardian Mgmt API  |           |                                               |                              |
+|              |                    |            | Username  | `databases.keycloak.username`            | `keycloak_user`            |
-|                    |                    | Type      | `databases.umsGuardianManagementApi.type`     | `postgresql`                 |
+|              |                    |            | Password  | `databases.keycloak.password`            |                            |
-|                    |                    | Name      | `databases.umsGuardianManagementApi.name`     | `guardianmanagementapi`      |
+|              | Keycloak Extension | PostgreSQL |           |                                          |                            |
-|                    |                    | Host      | `databases.umsGuardianManagementApi.host`     | `postgresql`                 |
+|              |                    |            | Name      | `databases.keycloakExtension.name`       | `keycloak_extensions`      |
-|                    |                    | Port      | `databases.umsGuardianManagementApi.port`     | `5432`                       |
+|              |                    |            | Host      | `databases.keycloakExtension.host`       | `postgresql`               |
-|                    |                    | Username  | `databases.umsGuardianManagementApi.username` | `guardianmanagementapi_user` |
+|              |                    |            | Port      | `databases.keycloakExtension.port`       | `5432`                     |
-|                    |                    | Password  | `databases.umsGuardianManagementApi.password` |                              |
+|              |                    |            | Username  | `databases.keycloakExtension.username`   | `keycloak_extensions_user` |
-|                    | Keycloak           |           |                                               |                              |
+|              |                    |            | Password  | `databases.keycloakExtension.password`   |                            |
-|                    |                    | Type      | `databases.keycloak.type`                     | `postgresql`                 |
+| UMS          | Notifications API  | PostgreSQL |           |                                          |                            |
-|                    |                    | Name      | `databases.keycloak.name`                     | `keycloak`                   |
+|              |                    |            | Name      | `databases.umsNotificationsApi.name`     | `notificationsapi`         |
-|                    |                    | Host      | `databases.keycloak.host`                     | `postgresql`                 |
+|              |                    |            | Host      | `databases.umsNotificationsApi.host`     | `postgresql`               |
-|                    |                    | Port      | `databases.keycloak.port`                     | `5432`                       |
+|              |                    |            | Port      | `databases.umsNotificationsApi.port`     | `5432`                     |
-|                    |                    | Username  | `databases.keycloak.username`                 | `keycloak_user`              |
+|              |                    |            | Username  | `databases.umsNotificationsApi.username` | `notificationsapi_user`    |
-|                    |                    | Password  | `databases.keycloak.password`                 |                              |
+|              |                    |            | Password  | `databases.umsNotificationsApi.password` |                            |
-|                    | Keycloak Extension |           |                                               |                              |
+|              | Self Service       | PostgreSQL |           |                                          |                            |
-|                    |                    | Type      | `databases.keycloakExtension.type`            | `postgresql`                 |
+|              |                    |            | Name      | `databases.umsSelfservice.name`          | `selfservice`              |
-|                    |                    | Name      | `databases.keycloakExtension.name`            | `keycloak_extensions`        |
+|              |                    |            | Host      | `databases.umsSelfservice.host`          | `postgresql`               |
-|                    |                    | Host      | `databases.keycloakExtension.host`            | `postgresql`                 |
+|              |                    |            | Port      | `databases.umsSelfservice.port`          | `5432`                     |
-|                    |                    | Port      | `databases.keycloakExtension.port`            | `5432`                       |
+|              |                    |            | Username  | `databases.umsSelfservice.username`      | `selfservice_user`         |
-|                    |                    | Username  | `databases.keycloakExtension.username`        | `keycloak_extensions_user`   |
+|              |                    |            | Password  | `databases.umsSelfservice.password`      |                            |
-|                    |                    | Password  | `databases.keycloakExtension.password`        |                              |
+| Nextcloud    | Nextcloud          | MariaDB    |           |                                          |                            |
-|                    | Notifications API  |           |                                               |                              |
+|              |                    |            | Name      | `databases.nextcloud.name`               | `nextcloud`                |
-|                    |                    | Type      | `databases.umsNotificationsApi.type`          | `postgresql`                 |
+|              |                    |            | Host      | `databases.nextcloud.host`               | `mariadb`                  |
-|                    |                    | Name      | `databases.umsNotificationsApi.name`          | `notificationsapi`           |
+|              |                    |            | Username  | `databases.nextcloud.username`           | `nextcloud_user`           |
-|                    |                    | Host      | `databases.umsNotificationsApi.host`          | `postgresql`                 |
+|              |                    |            | Password  | `databases.nextcloud.password`           |                            |
-|                    |                    | Port      | `databases.umsNotificationsApi.port`          | `5432`                       |
+| OpenProject  | OpenProject        | PostgreSQL |           |                                          |                            |
-|                    |                    | Username  | `databases.umsNotificationsApi.username`      | `notificationsapi_user`      |
+|              |                    |            | Name      | `databases.openproject.name`             | `openproject`              |
-|                    |                    | Password  | `databases.umsNotificationsApi.password`      |                              |
+|              |                    |            | Host      | `databases.openproject.host`             | `postgresql`               |
-|                    | Self Service       |           |                                               |                              |
+|              |                    |            | Port      | `databases.openproject.port`             | `5432`                     |
-|                    |                    | Type      | `databases.umsSelfservice.type`               | `postgresql`                 |
+|              |                    |            | Username  | `databases.openproject.username`         | `openproject_user`         |
-|                    |                    | Name      | `databases.umsSelfservice.name`               | `selfservice`                |
+|              |                    |            | Password  | `databases.openproject.password`         |                            |
-|                    |                    | Host      | `databases.umsSelfservice.host`               | `postgresql`                 |
+| OX App Suite | OX App Suite       | MariaDB    |           |                                          |                            |
-|                    |                    | Port      | `databases.umsSelfservice.port`               | `5432`                       |
+|              |                    |            | Name      | `databases.oxAppSuite.name`              | `CONFIGDB`                 |
-|                    |                    | Username  | `databases.umsSelfservice.username`           | `selfservice_user`           |
+|              |                    |            | Host      | `databases.oxAppSuite.host`              | `mariadb`                  |
-|                    |                    | Password  | `databases.umsSelfservice.password`           |                              |
+|              |                    |            | Username  | `databases.oxAppSuite.username`          | `root`                     |
-| Nextcloud          | Nextcloud          |           |                                               |                              |
+|              |                    |            | Password  | `databases.oxAppSuite.password`          |                            |
-|                    |                    | Type      | `databases.nextcloud.type`                    | `mariadb`                    |
+| XWiki        | XWiki              | MariaDB    |           |                                          |                            |
-|                    |                    | Name      | `databases.nextcloud.name`                    | `nextcloud`                  |
+|              |                    |            | Name      | `databases.xwiki.name`                   | `xwiki`                    |
-|                    |                    | Host      | `databases.nextcloud.host`                    | `mariadb`                    |
+|              |                    |            | Host      | `databases.xwiki.host`                   | `mariadb`                  |
-|                    |                    | Port      | `databases.nextcloud.port`                    | `3306`                       |
+|              |                    |            | Username  | `databases.xwiki.username`               | `xwiki_user`               |
-|                    |                    | Username  | `databases.nextcloud.username`                | `nextcloud_user`             |
+|              |                    |            | Password  | `databases.xwiki.password`               |                            |
 |                    |                    | Password  | `databases.nextcloud.password`                |                              |
 | Notes              | Notes              |           |                                               |                              |
 |                    |                    | Type      | `databases.notes.type`                        | `postgresql`                 |
 |                    |                    | Name      | `databases.notes.name`                        | `notes`                      |
 |                    |                    | Host      | `databases.notes.host`                        | `postgresql`                 |
 |                    |                    | Port      | `databases.notes.port`                        | `5432`                       |
 |                    |                    | Username  | `databases.notes.username`                    | `notes_user`                 |
 |                    |                    | Password  | `databases.notes.password`                    |                              |
 | OpenProject        | OpenProject        |           |                                               |                              |
 |                    |                    | Type      | `databases.openproject.type`                  | `postgresql`                 |
 |                    |                    | Name      | `databases.openproject.name`                  | `openproject`                |
 |                    |                    | Host      | `databases.openproject.host`                  | `postgresql`                 |
 |                    |                    | Port      | `databases.openproject.port`                  | `5432`                       |
 |                    |                    | Username  | `databases.openproject.username`              | `openproject_user`           |
 |                    |                    | Password  | `databases.openproject.password`              |                              |
 | OX App Suite[^2]   | OX App Suite       |           |                                               |                              |
 |                    |                    | Type      | `databases.oxAppSuite.type`                   | `mariadb`                    |
 |                    |                    | Name      | `databases.oxAppSuite.name`                   | `openxchange`                |
 |                    |                    | Host      | `databases.oxAppSuite.host`                   | `mariadb`                    |
 |                    |                    | Port      | `databases.oxAppSuite.port`                   | `3306`                       |
 |                    |                    | Username  | `databases.oxAppSuite.username`               | `root`                       |
 |                    |                    | Password  | `databases.oxAppSuite.password`               |                              |
 | OX Dovecot Pro[^3] | ACLs               |           |                                               |                              |
 |                    |                    | Type      | `databases.dovecotACL.type`                   | `cassandra`                  |
 |                    |                    | Name      | `databases.dovecotACL.name`                   | `dovecot_acl`                |
 |                    |                    | Host      | `databases.dovecotACL.host`                   | `cassandra`                  |
 |                    |                    | Port      | `databases.dovecotACL.port`                   | `9042`                       |
 |                    |                    | Username  | `databases.dovecotACL.username`               | `dovecot_acl_user`           |
 |                    |                    | Password  | `databases.dovecotACL.password`               |                              |
 |                    | Dictmap            |           |                                               |                              |
 |                    |                    | Type      | `databases.dovecotDictmap.type`               | `cassandra`                  |
 |                    |                    | Name      | `databases.dovecotDictmap.name`               | `dovecot_dictmap`            |
 |                    |                    | Host      | `databases.dovecotDictmap.host`               | `cassandra`                  |
 |                    |                    | Port      | `databases.dovecotDictmap.port`               | `9042`                       |
 |                    |                    | Username  | `databases.dovecotDictmap.username`           | `dovecot_dictmap_user`       |
 |                    |                    | Password  | `databases.dovecotDictmap.password`           |                              |
 | XWiki[^4]          | XWiki              |           |                                               |                              |
 |                    |                    | Type      | `databases.xwiki.type`                        | `mariadb`                    |
 |                    |                    | Name      | `databases.xwiki.name`                        | `xwiki`                      |
 |                    |                    | Host      | `databases.xwiki.host`                        | `mariadb`                    |
 |                    |                    | Port      | `databases.xwiki.port`                        | `3306`                       |
 |                    |                    | Username  | `databases.xwiki.username`                    | `root`                       |
 |                    |                    | Password  | `databases.xwiki.password`                    |                              |
 # Object storage
 When deploying this suite to production, you need to configure the applications to use your production-grade object
 storage service.
-| Component   | Name        | Parameter       | Key                                      | Default            |
+| Component   | Name        | Parameter       | Key                                      | Default            |
 |-------------|-------------|-----------------|------------------------------------------|--------------------|
-| OpenProject | OpenProject |                 |                                          |                    |
+| OpenProject | OpenProject |                 |                                          |                    |
-|             |             | Backend         | `objectstores.openproject.backend`       | `minio`            |
+|             |             | Backend         | `objectstores.openproject.backend` | `minio` |
-|             |             | Bucket          | `objectstores.openproject.bucket`        | `openproject`      |
+|             |             | Bucket          | `objectstores.openproject.bucket` | `openproject` |
-|             |             | Endpoint        | `objectstores.openproject.endpoint`      |                    |
+|             |             | Endpoint        | `objectstores.openproject.endpoint` |                    |
-|             |             | Provider        | `objectstores.openproject.provider`      | `AWS`              |
+|             |             | Provider        | `objectstores.openproject.provider` | `AWS` |
-|             |             | Region          | `objectstores.openproject.region`        |                    |
+|             |             | Region          | `objectstores.openproject.region` |                    |
-|             |             | Secret          | `objectstores.openproject.secret`        |                    |
+|             |             | Secret          | `objectstores.openproject.secret` |                    |
-|             |             | Username        | `objectstores.openproject.username`      | `openproject_user` |
+|             |             | Username        | `objectstores.openproject.username` | `openproject_user` |
-|             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |
+|             |             | Use IAM profile | `objectstores.openproject.useIAMProfile` |                    |
 # Cache
 When deploying this suite to production, you need to configure the applications to use your production-grade cache
 service.
-| Component        | Name             | Type      | Parameter | Key                          | Default          |
+| Component        | Name             | Type      | Parameter | Key                          | Default          |
 |------------------|------------------|-----------|-----------|------------------------------|------------------|
-| Intercom Service | Intercom Service | Redis     |           |                              |                  |
+| Intercom Service | Intercom Service | Redis     |           |                              |                  |
-|                  |                  |           | Host      | `cache.intercomService.host` | `redis-headless` |
+|                  |                  |           | Host      | `cache.intercomService.host` | `redis-headless` |
-|                  |                  |           | Port      | `cache.intercomService.port` | `6379`           |
+|                  |                  |           | Port      | `cache.intercomService.port` | `6379` |
-| Nextcloud        | Nextcloud        | Redis     |           |                              |                  |
+| Nextcloud        | Nextcloud        | Redis     |           |                              |                  |
-|                  |                  |           | Host      | `cache.nextcloud.host`       | `redis-headless` |
+|                  |                  |           | Host      | `cache.nextcloud.host` | `redis-headless` |
-|                  |                  |           | Port      | `cache.nextcloud.port`       | `6379`           |
+|                  |                  |           | Port      | `cache.nextcloud.port` | `6379` |
-| OpenProject      | OpenProject      | Memcached |           |                              |                  |
+| OpenProject      | OpenProject      | Memcached |           |                              |                  |
-|                  |                  |           | Host      | `cache.openproject.host`     | `memcached`      |
+|                  |                  |           | Host      | `cache.openproject.host` | `memcached` |
-|                  |                  |           | Port      | `cache.openproject.port`     | `11211`          |
+|                  |                  |           | Port      | `cache.openproject.port` | `11211` |
-| UMS              | Self Service     | Memcached |           |                              |                  |
+| UMS              | Self Service     | Memcached |           |                              |                  |
-|                  |                  |           | Host      | `cache.umsSelfservice.host`  | `memcached`      |
+|                  |                  |           | Host      | `cache.umsSelfservice.host` | `memcached` |
-|                  |                  |           | Port      | `cache.umsSelfservice.port`  | `11211`          |
+|                  |                  |           | Port      | `cache.umsSelfservice.port` | `11211` |
 # Footnotes
 [^1] The upstream product provide some valuable information regarding database migrations:
 - Nextcloud: https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
 - XWiki:
  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Backup#HUsingtheXWikiExportfeature
  - https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/ImportExport
 [^2] OX App Suite only supports MariaDB and requires root access, as it manages its databases itself.
 [^3] openDesk Enterprise only.
 [^4] XWiki requires root access when using MariaDB as sub-wikis are using separate databases that are managed by XWiki. When using PostgreSQL with XWiki no root user is required as the sub-wikis are managed within multiple schemes within a single database.
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -101,34 +101,33 @@ All available apps and their default value are in `helmfile/environments/default
 | Component            | Name                        | Default | Description                    |
 | -------------------- | --------------------------- | ------- | ------------------------------ |
-| Certificates         | `apps.certificates.enabled`      | `true`  | TLS certificates               |
+| Certificates         | `certificates.enabled`      | `true`  | TLS certificates               |
-| ClamAV (Distributed) | `apps.clamavDistributed.enabled` | `false` | Antivirus engine               |
+| ClamAV (Distributed) | `clamavDistributed.enabled` | `false` | Antivirus engine               |
-| ClamAV (Simple)      | `apps.clamavSimple.enabled`      | `true`  | Antivirus engine               |
+| ClamAV (Simple)      | `clamavSimple.enabled`      | `true`  | Antivirus engine               |
-| Collabora            | `apps.collabora.enabled`         | `true`  | Weboffice                      |
+| Collabora            | `collabora.enabled`         | `true`  | Weboffice                      |
-| CryptPad             | `apps.cryptpad.enabled`          | `true`  | Weboffice                      |
+| CryptPad             | `cryptpad.enabled`          | `true`  | Weboffice                      |
-| dkimpy               | `apps.dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
+| dkimpy               | `dkimpy.enabled`            | `false` | Postfix milter for DKIM        |
-| Dovecot              | `apps.dovecot.enabled`           | `true`  | Mail backend                   |
+| Dovecot              | `dovecot.enabled`           | `true`  | Mail backend                   |
-| Element              | `apps.element.enabled`           | `true`  | Secure communications platform |
+| Element              | `element.enabled`           | `true`  | Secure communications platform |
-| Home                 | `apps.home.enabled`              | `true`  | Base domain portal redirect    |
+| Home                 | `home.enabled`              | `true`  | Base domain portal redirect    |
-| Jitsi                | `apps.jitsi.enabled`             | `true`  | Videoconferencing              |
+| Jitsi                | `jitsi.enabled`             | `true`  | Videoconferencing              |
-| MariaDB              | `apps.mariadb.enabled`           | `true`  | Database                       |
+| MariaDB              | `mariadb.enabled`           | `true`  | Database                       |
-| Memcached            | `apps.memcached.enabled`         | `true`  | Cache Database                 |
+| Memcached            | `memcached.enabled`         | `true`  | Cache Database                 |
-| MinIO                | `apps.minio.enabled`             | `true`  | Object Storage                 |
+| MinIO                | `minio.enabled`             | `true`  | Object Storage                 |
-| Nextcloud            | `apps.nextcloud.enabled`         | `true`  | File share                     |
+| Nextcloud            | `nextcloud.enabled`         | `true`  | File share                     |
-| Nubus                | `apps.nubus.enabled`             | `true`  | Identity Management & Portal   |
+| Nubus                | `nubus.enabled`             | `true`  | Identity Management & Portal   |
-| OpenProject          | `apps.openproject.enabled`       | `true`  | Project management             |
+| OpenProject          | `openproject.enabled`       | `true`  | Project management             |
-| OX App Suite         | `apps.oxAppSuite.enabled`        | `true`  | Groupware                      |
+| OX App Suite         | `oxAppSuite.enabled`        | `true`  | Groupware                      |
-| Postfix              | `apps.postfix.enabled`           | `true`  | MTA                            |
+| Postfix              | `postfix.enabled`           | `true`  | MTA                            |
-| PostgreSQL           | `apps.postgresql.enabled`        | `true`  | Database                       |
+| PostgreSQL           | `postgresql.enabled`        | `true`  | Database                       |
-| Redis                | `apps.redis.enabled`             | `true`  | Cache Database                 |
+| Redis                | `redis.enabled`             | `true`  | Cache Database                 |
-| XWiki                | `apps.xwiki.enabled`             | `true`  | Knowledge management           |
+| XWiki                | `xwiki.enabled`             | `true`  | Knowledge management           |
 Exemplary, Jitsi can be disabled like:
 ```yaml
-apps:
+jitsi:
-  jitsi:
+  enabled: false
    enabled: false
 ```
 ## Private registries
@@ -305,10 +304,8 @@ Enabling DKIM signing of emails helps to reduce spam and increases trust.
 openDesk ships dkimpy-milter as Postfix milter for signing emails.
 ```yaml
-apps:
+dkimpy:
-  dkimpy:
+  enable: true
    enabled: true
 smtp:
  dkim:
    key:
      value: "HzZs08QF1O7UiAkcM9T3U7rePPECtSFvWZIvyKqdg8E="
@@ -340,9 +337,8 @@ secret named `opendesk-certificates-tls` must be present in the application name
 turn off `Certificate` resource creation by:
 ```yaml
-apps:
+certificates:
-  certificates:
+  enabled: false
    enabled: false
 ```
 If you want to leverage the `cert-manager.io` to handle certificates, like `Let's encrypt`, you need to provide the
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -8,29 +8,23 @@ SPDX-License-Identifier: Apache-2.0
 <!-- TOC -->
 * [Disclaimer](#disclaimer)
 * [Automated migrations - Overview and mandatory upgrade path](#automated-migrations---overview-and-mandatory-upgrade-path)
-* [Manual checks/actions](#manual-checksactions)
+* [Manual update steps](#manual-update-steps)
-  * [From v1.1.1](#from-v111)
+  * [From v1.1.0: Manual checks/steps](#from-v110-manual-checkssteps)
-    * [Pre-upgrade from v1.1.1](#pre-upgrade-from-v111)
+    * [Pre-upgrade](#pre-upgrade)
      * [Helmfile feature update: App settings wrapped in `apps.` element](#helmfile-feature-update-app-settings-wrapped-in-apps-element)
  * [From v1.1.0](#from-v110)
    * [Pre-upgrade from v1.1.0](#pre-upgrade-from-v110)
      * [Helmfile feature update: Component specific `storageClassName`](#helmfile-feature-update-component-specific-storageclassname)
      * [Helmfile new secret: `secrets.nubus.masterpassword`](#helmfile-new-secret-secretsnubusmasterpassword)
-  * [From v1.0.0](#from-v100)
+  * [From v1.0.0: Manual checks/steps](#from-v100-manual-checkssteps)
-    * [Pre-upgrade from v1.0.0](#pre-upgrade-from-v100)
+    * [Pre-upgrade](#pre-upgrade-1)
-      * [Helmfile cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
+      * [Helmfile Cleanup: Restructured `/helmfile/files/theme` folder](#helmfile-cleanup-restructured-helmfilefilestheme-folder)
-      * [Helmfile cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
+      * [Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`](#helmfile-cleanup-consistent-use-of-yamlgotmpl)
-      * [Helmfile cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
+      * [Helmfile Cleanup: Prefixing certain app directories with `opendesk-`](#helmfile-cleanup-prefixing-certain-app-directories-with-opendesk-)
-      * [Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
+      * [Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services](#helmfile-cleanup-helmfile-cleanup-splitting-external-vs-opendesk-services)
      * [Helmfile cleanup: Streamlining `openxchange` and `oxAppSuite` attribute names](#helmfile-cleanup-streamlining-openxchange-and-oxappsuite-attribute-names)
      * [Helmfile feature update: Dicts to define `customization.release`](#helmfile-feature-update-dicts-to-define-customizationrelease)
      * [openDesk defaults (new): Enforce login](#opendesk-defaults-new-enforce-login)
      * [openDesk defaults (changed): Jitsi room history enabled](#opendesk-defaults-changed-jitsi-room-history-enabled)
      * [External requirements: Redis 7.4](#external-requirements-redis-74)
-    * [Post-upgrade from v1.0.0](#post-upgrade-from-v100)
+  * [From v0.9.0: Manual checks/steps](#from-v090-manual-checkssteps)
-      * [XWiki fix-ups](#xwiki-fix-ups)
+    * [Pre-upgrade: Manual steps](#pre-upgrade-manual-steps)
  * [From v0.9.0](#from-v090)
    * [Pre-upgrade from v0.9.0](#pre-upgrade-from-v090)
      * [Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus](#configuration-cleanup-removal-of-unnecessary-ox-profiles-in-nubus)
      * [Configuration Cleanup: Updated `global.imagePullSecrets`](#configuration-cleanup-updated-globalimagepullsecrets)
      * [Changed openDesk defaults: Matrix presence status disabled](#changed-opendesk-defaults-matrix-presence-status-disabled)
@@ -38,17 +32,17 @@ SPDX-License-Identifier: Apache-2.0
      * [Changed openDesk defaults: File-share configurability](#changed-opendesk-defaults-file-share-configurability)
      * [Changed openDesk defaults: Updated default subdomains in `global.hosts`](#changed-opendesk-defaults-updated-default-subdomains-in-globalhosts)
      * [Changed openDesk defaults: Dedicated group for access to the UDM REST API](#changed-opendesk-defaults-dedicated-group-for-access-to-the-udm-rest-api)
-    * [Post-upgrade from v0.9.0](#post-upgrade-from-v090)
+    * [Post-upgrade](#post-upgrade)
      * [Configuration Improvement: Separate user permission for using Video Conference component](#configuration-improvement-separate-user-permission-for-using-video-conference-component)
      * [Optional Cleanup](#optional-cleanup)
-  * [From v0.8.1](#from-v081)
+  * [From v1.1.0: Manual checks/steps](#from-v110-manual-checkssteps-1)
-    * [Pre-upgrade from v0.8.1](#pre-upgrade-from-v081)
+    * [Pre-upgrade](#pre-upgrade-2)
      * [Updated `cluster.networking.cidr`](#updated-clusternetworkingcidr)
      * [Updated customizable template attributes](#updated-customizable-template-attributes)
      * [`migrations` S3 bucket](#migrations-s3-bucket)
 * [Automated migrations - Details](#automated-migrations---details)
-  * [From v1.0.0 (automated)](#from-v100-automated)
+  * [From v1.1.0: Automated migrations](#from-v110-automated-migrations)
-  * [From v0.9.0 (automated)](#from-v090-automated)
+  * [From v0.9.0: Automated migrations](#from-v090-automated-migrations)
  * [Related components and artifacts](#related-components-and-artifacts)
  * [Development](#development)
 <!-- TOC -->
@@ -85,105 +79,27 @@ To upgrade existing deployments, you cannot skip any version mentioned in the co
 When interested in more details about the automated migrations, please read section [Automated migrations - Details](#automated-migrations---details).
-# Manual checks/actions
+# Manual update steps
 Be sure you check all the sections for the releases your are going to update your current deployment from.
-## From v1.1.1
+## From v1.1.0: Manual checks/steps
-### Pre-upgrade from v1.1.1
+### Pre-upgrade
 #### Helmfile feature update: App settings wrapped in `apps.` element
 We require now [Helmfile v1.0.0-rc.8](https://github.com/helmfile/helmfile/releases/tag/v1.0.0-rc.8) for the deployment. This enables openDesk to lay the foundation for some significant cleanups where the information for the different apps especially on their `enabled` state is needed.
 Therefore it was required to introduce the `apps` level in [`opendesk_main.yaml.gotmpl`](../helmfile/environments/default/opendesk_main.yaml.gotmpl).
 If you have a deployment where you specify settings that can be found in the aforementioned file, usually to disable components or enable others, please ensure you insert the top-level attribute `apps` like shown in the following example:
 So a setting of:
 ```
 certificates:
  enabled: false
 notes:
  enabled: true
 ```
 needs to be changed to:
 ```
 apps:
  certificates:
    enabled: false
  notes:
    enabled: true
 ```
 ## From v1.1.0
 ### Pre-upgrade from v1.1.0
 #### Helmfile feature update: Component specific `storageClassName`
 With openDesk 1.1.1 we support component specific `storageClassName` definitions beside the global ones, but we had to adapt the structure that can be found in `persistence.yaml.gotmpl` to achieve this in a clean manner.
 If you have set custom `persistence.size.*`-values for your deployment, please continue reading as you need to adapt your `persistence` settings to the new structure.
 When comparing the [old 1.1.0 structure](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.0/helmfile/environments/default/persistence.yaml.gotmpl) with the [new one](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/blob/v1.1.1/helmfile/environments/default/persistence.yaml.gotmpl) you can spot the changes:
 - We replaced `persistence.size` with `persistence.storages`.
 - Below each component you can define now the `size` and the optional component specific `storageClassName`.
 - We streamlined all components to be on the same level, as Nubus had an additional level of nesting before.
 So a setting of:
 ```yaml
 persistence:
  size:
    synapse: "1Gi"
 ```
 needs to be changed to:
 ```yaml
 persistence:
  storages:
    synapse:
      size: "1Gi"
 ```
 or for the Nubus related entries, the following:
 ```yaml
 persistence:
  size:
    nubus:
      ldapServerData: "1Gi"
 ```
 needs to be changed to:
 ```yaml
 persistence:
  storages:
    nubusLdapServerData:
      size: "1Gi"
 ```
 #### Helmfile new secret: `secrets.nubus.masterpassword`
 A not yet templated secret was discovered in the Nubus deployment that is now defined in [`secrets.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl) with the key `secrets.nubus.masterpassword`. If you define your own secrets, please be sure this new secret is set to the value of the `MASTER_PASSWORD` environment variable used in your deployment.
-## From v1.0.0
+## From v1.0.0: Manual checks/steps
-### Pre-upgrade from v1.0.0
+### Pre-upgrade
-#### Helmfile cleanup: Restructured `/helmfile/files/theme` folder
+#### Helmfile Cleanup: Restructured `/helmfile/files/theme` folder
 If you make use of the [theme folder](../helmfile/files/theme/) or the [`theme.yaml.gotmpl`](../helmfile/environments/default/theme.yaml.gotmpl), e.g. to applying your own imagery, please ensure you adhere to the new structure of the folder and the yaml-file.
-#### Helmfile cleanup: Consistent use of `*.yaml.gotmpl`
+#### Helmfile Cleanup: Consistent use of `*.yaml.gotmpl`
 In v1.0.0 the files in [`/helmfile/environments/default`](../helmfile/environments/default/) had mixed extensions,
 we have streamlined them to consistently use `*.yaml.gotmpl`.
@@ -193,7 +109,7 @@ This change requires manual action likely in two situations:
 1. You are referencing our upstream files from the aforementioned directory, e.g. in your Argo CD deployment. Please update your references to use the filenames with the new extension.
 2. You have custom files containing configuration information that are named just `*.yaml`: Please rename them to `*.yaml.gotmpl`.
-#### Helmfile cleanup: Prefixing certain app directories with `opendesk-`
+#### Helmfile Cleanup: Prefixing certain app directories with `opendesk-`
 To make it more obvious that some elements from below the [`apps`](../helmfile/apps/) directory are completely
 provided by openDesk, we have prefixed these app directories with `opendesk-`.
@@ -208,7 +124,7 @@ The described changes most likely require manual action in the following situati
 - You are referencing our upstream files e.g. in your Argo CD deployment, please update your references to use the new directory names.
-#### Helmfile cleanup: Helmfile cleanup: Splitting external vs. openDesk services
+#### Helmfile Cleanup: Helmfile Cleanup: Splitting external vs. openDesk services
 In v1.0.0 there was a directory `/helmfile/apps/services` that was intended to contain all the services an operator had to provide externally for production deployments.
@@ -338,34 +254,9 @@ The update from openDesk 1.0.0 contains Redis 7.4.1, like the other openDesk bun
 Please ensure for the Redis you are using that it is updated to at least 7.4 to support the requirement of OX App Suite.
-### Post-upgrade from v1.0.0
+## From v0.9.0: Manual checks/steps
-#### XWiki fix-ups
+### Pre-upgrade: Manual steps
 Unfortunately XWiki does not upgrade itself as expected. A bug with the supplier has already been filed. The following additional steps are required:
 1. To enforce re-indexing of the now fixed full-text search access the XWiki Pod and run the following commands to delete two search related directories. To complete this you need to restart the XWiki Pod, but that is anyway part of the next step:
   ```
   rm -rf /usr/local/xwiki/data/store/solr/search_9
   rm -rf /usr/local/xwiki/data/cache/solr/search_9
   ```
 2. This is necessary if the openDesk single sign-on does not longer work and you get a standard XWiki login dialogue instead.
   - Find the XWiki ConfigMap `xwiki-init-scripts` and find in its `entrypoint` key data the lines beginning with `xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg"`
   - Before those lines add the following line, of course setting `<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>` to a value you are happy with.
     ```
         xwiki_replace_or_add "/usr/local/xwiki/data/xwiki.cfg" 'xwiki.superadminpassword' '<YOUR_TEMPORARY_SUPERADMIN_PASSWORD>'
     ```
   - Restart the XWiki Pod.
   - Access XWiki's web UI and login with `superadmin` and the above set password.
   - Once XWiki UI is fully rendered, remove the line with the temporary `superadmin` password from the aforementioned ConfigMap.
   - Restart the XWiki Pod.
 You should have now a properly working XWiki instance with single sign-on and full-text search.
 ## From v0.9.0
 ### Pre-upgrade from v0.9.0
 #### Configuration Cleanup: Removal of unnecessary OX-Profiles in Nubus
@@ -549,7 +440,7 @@ The IAMs admin account `Administrator` is a member of this group by default, but
 If you need other accounts to use the API, please assign them to the aforementioned group.
-### Post-upgrade from v0.9.0
+### Post-upgrade
 #### Configuration Improvement: Separate user permission for using Video Conference component
@@ -579,9 +470,9 @@ kubectl -n ${NAMESPACE} delete pvc shared-run-ums-ldap-server-0
 kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
 ```
-## From v0.8.1
+## From v1.1.0: Manual checks/steps
-### Pre-upgrade from v0.8.1
+### Pre-upgrade
 #### Updated `cluster.networking.cidr`
@@ -604,7 +495,7 @@ kubectl -n ${NAMESPACE} delete pvc ox-connector-ox-contexts-ox-connector-0
 # Automated migrations - Details
-## From v1.0.0 (automated)
+## From v1.1.0: Automated migrations
 With openDesk v1.1.0 the IAM stack supports HA LDAP primary as well as scalable LDAP secondary pods.
@@ -615,7 +506,7 @@ creating the config map with the mentioned label.
 > **Note**<br>
 > Details can be found in [run_3.py](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-migrations/-/blob/main/odmigs-python/odmigs_runs/run_3.py).
-## From v0.9.0 (automated)
+## From v0.9.0: Automated migrations
 The `migrations-pre` and `migrations-post` jobs in the openDesk deployment address the automated migration tasks.
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -16,7 +16,6 @@ This section covers the internal system requirements and external service requir
 * [Certificate management](#certificate-management)
 * [External services](#external-services)
 * [Deployment](#deployment)
 * [Footnotes](#footnotes)
 <!-- TOC -->
 # tl;dr
@@ -25,14 +24,12 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
 - K8s cluster >= 1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
- Ingress controller (Ingress NGINX) == [4.11.x/1.11.x](https://github.com/kubernetes/ingress-nginx/releases) - tested with 1.11.1 up to 1.11.4
+- Ingress controller (Ingress NGINX)
  - **Note**: We are working on support for more recent versions, as issues have been reported with 1.12.x.
 - [Helm](https://helm.sh/) >= v3.9.0
- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc8**
+- [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= **v1.0.0-rc5**
 - [HelmDiff](https://github.com/databus23/helm-diff) >= 3.6.0
 - Volume provisioner supporting RWO (read-write-once)
 - Certificate handling with [cert-manager](https://cert-manager.io/)
 - [OpenKruise](https://openkruise.io/)[^1] >= 1.6
 # Hardware
@@ -87,20 +84,19 @@ For the development and evaluation of openDesk, we bundle some services. Be awar
 deployments, you need to make use of your own production-grade services; see the
 [external-services.md](./external-services.md) for configuration details.
-| Group    | Type                | Version | Tested against        |
+| Group    | Type                | Version | Tested against        |
 | -------- | ------------------- | ------- | --------------------- |
-| Cache    | Memcached           | `1.6.x` | Memcached             |
+| Cache    | Memcached           | `1.6.x` | Memcached             |
-|          | Redis               | `7.x.x` | Redis                 |
+|          | Redis               | `7.x.x` | Redis                 |
-| Database | Cassandra[^1]       | `5.0.x` | Cassandra             |
+| Database | MariaDB             | `10.x` | MariaDB               |
-|          | MariaDB             | `10.x`  | MariaDB               |
+|          | PostgreSQL          | `15.x` | PostgreSQL            |
-|          | PostgreSQL          | `15.x`  | PostgreSQL            |
+| Mail     | Mail Transfer Agent |         | Postfix               |
-| Mail     | Mail Transfer Agent |         | Postfix               |
+|          | PKI/CI (S/MIME)     |         |                       |
-|          | PKI/CI (S/MIME)     |         |                       |
+| Security | AntiVirus/ICAP      |         | ClamAV                |
-| Security | AntiVirus/ICAP      |         | ClamAV                |
+| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
-| Storage  | K8s ReadWriteOnce   |         | Ceph / Cloud specific |
+|          | K8s ReadWriteMany   |         | Ceph / NFS            |
-|          | K8s ReadWriteMany   |         | Ceph / NFS            |
+|          | Object Storage      |         | MinIO                 |
-|          | Object Storage      |         | MinIO                 |
+| Voice    | TURN                |         | Coturn                |
 | Voice    | TURN                |         | Coturn                |
 # Deployment
@@ -108,7 +104,3 @@ The deployment of each component is [Helm](https://helm.sh/) based. The 35+ Helm
 templated via [Helmfile](https://helmfile.readthedocs.io/en/latest/) to provide a streamlined deployment experience.
 Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare the desired against the deployed state.
 # Footnotes
 [^1]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
--- a/docs/security-context.md
+++ b/docs/security-context.md
@@ -1,7 +1,8 @@
 <!--
-SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 -->
 <h1>Kubernetes Security Context</h1>
 <!-- TOC -->
@@ -62,7 +63,7 @@ containerSecurityContext:
 ## privileged
-Privileged Pods eliminate most security mechanisms and must be disallowed.
+Privileged Pods disable most security mechanisms and must be disallowed.
 ```yaml
 containerSecurityContext:
@@ -92,7 +93,7 @@ containerSecurityContext:
 ## seccompProfile
-The seccompProfile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
+Seccomp profile must be explicitly set to one of the allowed values. An unconfined profile and the complete absence of the profile are prohibited.
 ```yaml
 containerSecurityContext:
@@ -112,7 +113,7 @@ containerSecurityContext:
 ## readOnlyRootFilesystem
-Containers should have an immutable file systems, so that attackers can not modify application code or download malicious code.
+Containers should have an immutable file systems, so that attackers could not modify application code or download malicious code.
 ```yaml
 containerSecurityContext:
@@ -132,10 +133,10 @@ containerSecurityContext:
 # Status quo
-openDesk aims to ensure that all security relevant settings are explicitly templated and comply with security recommendations.
+openDesk aims to achieve that all security relevant settings are explicitly templated and comply with security recommendations.
-The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are properly templated by the Helm charts.
+The rendered manifests are also validated against Kyverno [policies](/.kyverno/policies) in CI to ensure that the provided values inside openDesk are also properly templated by the given Helm charts.
 This list gives you an overview of templated security settings and if they comply with security standards:
@@ -143,11 +144,11 @@ This list gives you an overview of templated security settings and if they compl
 - **yes**: Value is set to `true`
 - **no**: Value is set to `false`
- - **n/a**: Not explicitly templated in openDesk; default is used.
+ - **n/a**: No explicitly templated in openDesk and default is used.
 | process | status | allowPrivilegeEscalation | privileged | readOnlyRootFilesystem | runAsNonRoot | runAsUser | runAsGroup | seccompProfile | capabilities |
 | ------- | ------ | ------------------------ | ---------- | ---------------------- | ------------ | --------- | ---------- | -------------- | ------------ |
-| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","FOWNER","SYS_CHROOT"] |
+| **collabora**/collabora-online | :x: | yes | no | no | yes | 100 | 101 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT","MKNOD"] |
 | **cryptpad**/cryptpad | :x: | no | no | no | yes | 4001 | 4001 | yes | yes |
 | **element**/matrix-neoboard-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
 | **element**/matrix-neochoice-widget | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
@@ -163,41 +164,14 @@ This list gives you an overview of templated security settings and if they compl
 | **jitsi**/jitsi | :white_check_mark: | no | no | yes | yes | 1993 | 1993 | yes | yes |
 | **jitsi**/jitsi/jitsi/jibri | :x: | n/a | n/a | n/a | n/a | n/a | n/a | n/a | no ["SYS_ADMIN"] |
 | **jitsi**/jitsi/jitsi/jicofo | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/jigasi | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/jvb | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/prosody | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/jitsi/web | :x: | no | no | no | no | 0 | 0 | yes | no |
 | **jitsi**/jitsi/patchJVB | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 101 | 101 | yes | yes |
+| **nextcloud**/opendesk-nextcloud-management | :x: | no | no | no | yes | 65532 | 65532 | yes | yes |
-| **nextcloud**/opendesk-nextcloud/aio | :white_check_mark: | no | no | yes | yes | 101 | 101 | yes | yes |
+| **nextcloud**/opendesk-nextcloud/apache2 | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
 | **nextcloud**/opendesk-nextcloud/exporter | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
-| **notes**/impress/backend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **nextcloud**/opendesk-nextcloud/php | :white_check_mark: | no | no | yes | yes | 65532 | 65532 | yes | yes |
 | **notes**/impress/frontend | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **notes**/impress/yProvider | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **nubus**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/intercom-service/provisioning | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
 | **nubus**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/keycloak | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusGuardian/authorizationApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusGuardian/managementApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusGuardian/managementUi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusGuardian/openPolicyAgent | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusKeycloakBootstrap | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusKeycloakExtensions/handler | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
 | **nubus**/ums/nubusKeycloakExtensions/proxy | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
 | **nubus**/ums/nubusLdapNotifier | :x: | no | n/a | yes | yes | 101 | 102 | yes | yes |
 | **nubus**/ums/nubusNotificationsApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusPortalConsumer | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
 | **nubus**/ums/nubusPortalFrontend | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusPortalServer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusProvisioning | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusProvisioning/nats | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusSelfServiceConsumer | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusStackDataUms | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusUdmListener | :x: | no | n/a | yes | yes | 102 | 65534 | yes | yes |
 | **nubus**/ums/nubusUdmRestApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusUmcGateway | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusUmcServer | :x: | no | n/a | yes | no | 0 | 0 | yes | yes |
 | **open-xchange**/dovecot | :x: | no | n/a | yes | n/a | n/a | n/a | yes | no ["CHOWN","DAC_OVERRIDE","KILL","NET_BIND_SERVICE","SETGID","SETUID","SYS_CHROOT"] |
 | **open-xchange**/open-xchange/appsuite/core-documentconverter | :x: | no | no | no | yes | 987 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/appsuite/core-guidedtours | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
@@ -209,26 +183,34 @@ This list gives you an overview of templated security settings and if they compl
 | **open-xchange**/open-xchange/appsuite/guard-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/nextcloud-integration-ui | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/open-xchange/public-sector-ui | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **open-xchange**/opendesk-open-xchange-bootstrap | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **opendesk-migrations-post**/opendesk-migrations-post | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **opendesk-migrations-pre**/opendesk-migrations-pre | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **opendesk-openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **opendesk-services**/opendesk-static-files | :x: | no | n/a | yes | yes | 101 | 101 | yes | yes |
 | **openproject**/openproject | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **services-external**/cassandra | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **openproject-bootstrap**/opendesk-openproject-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **services-external**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
+| **open-xchange**/ox-connector | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
-| **services-external**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/clamav | :x: | no | no | yes | no | 0 | 0 | yes | no |
-| **services-external**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/clamav-simple | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services-external**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/clamav/clamd | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services-external**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/clamav/freshclam | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services-external**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
+| **services**/clamav/icap | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services-external**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services**/clamav/milter | :white_check_mark: | no | no | yes | yes | 100 | 101 | yes | yes |
-| **services-external**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services**/mariadb | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services-external**/minio | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services**/memcached | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services-external**/opendesk-dkimpy-milter | :x: | yes | no | yes | yes | 1000 | 1000 | yes | no |
+| **services**/minio | :x: | no | no | no | yes | 1000 | 0 | yes | yes |
-| **services-external**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
+| **services**/postfix | :x: | yes | yes | no | no | 0 | 0 | yes | no |
-| **services-external**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services**/postgresql | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
-| **services-external**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
+| **services**/redis/master | :white_check_mark: | no | no | yes | yes | 1001 | 1001 | yes | yes |
 | **univention-management-stack**/intercom-service | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/opendesk-keycloak-bootstrap | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak-bootstrap | :x: | no | no | no | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak-extensions/handler | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/keycloak-extensions/proxy | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **univention-management-stack**/ums/ldap-notifier | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
 | **univention-management-stack**/ums/portal-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums/selfservice-listener | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums/stack-data-swp | :x: | no | no | no | no | 0 | 0 | yes | yes |
 | **univention-management-stack**/ums/stack-gateway | :x: | no | no | no | yes | 1001 | 0 | yes | yes |
 | **univention-management-stack**/ums/umc-gateway | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **univention-management-stack**/ums/umc-server | :x: | no | no | no | no | 0 | 0 | yes | no ["CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","SETGID","SETUID","SETPCAP","NET_BIND_SERVICE","NET_RAW","SYS_CHROOT"] |
 | **xwiki**/xwiki | :x: | no | no | no | yes | 100 | 101 | yes | yes |
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -1,141 +0,0 @@
 <!--
 SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 -->
 <h1>Testing</h1>
 <!-- TOC -->
 * [Overview](#overview)
 * [Test concept](#test-concept)
  * [Rely on upstream applications QA](#rely-on-upstream-applications-qa)
  * [Run minimal functional QA (end-to-end tests)](#run-minimal-functional-qa-end-to-end-tests)
  * [Run extensive load- and performance tests](#run-extensive-load--and-performance-tests)
    * [Base performance testing](#base-performance-testing)
    * [Load testing to saturation point](#load-testing-to-saturation-point)
    * [Load testing up to a defined user count](#load-testing-up-to-a-defined-user-count)
    * [Overload/recovery tests](#overloadrecovery-tests)
 * [Reporting and test results](#reporting-and-test-results)
  * [Allure TestOps](#allure-testops)
 <!-- TOC -->
 # Overview
 The following section provides an overview of the testing approach adopted to ensure the quality and reliability of openDesk. This concept balances leveraging existing quality assurance (QA) processes with targeted testing efforts tailored to the specific needs of openDesk. The outlined strategy focuses on three key areas:
 1. Relying on application QA: Utilizing the existing QA processes of the applications to ensure baseline functionality and quality standards.
 2. Minimal functional QA: Executing end-to-end tests to validate critical workflows and ensure that key functionalities operate as expected.
 3. Extensive load and performance testing: Conducting comprehensive load and performance tests to assess openDesk's scalability and response under varying usage conditions.
 These efforts are designed to complement each other, minimizing redundancy while ensuring robust testing coverage.
 # Test concept
 ## Rely on upstream applications QA
 openDesk contains applications from different suppliers, as a general approach, we rely on the testing
 conducted by these suppliers for their respective applications.
 We review the supplier's QA measures on a regular basis, to ensure a reliable and sufficient QA of the underlying applications.
 We receive the release notes early before a new application release is integrated into openDesk, so
 we are able to check the existence of a sufficient set of test scases.
 The suppliers create a set of test cases for each new functionality.
 ## Run minimal functional QA (end-to-end tests)
 To ensure the functioning of all applications, we run a minimal set of testcases to check the
 basic functionality of openDesk and all integrated applications.
 Furthermore, we analyze all features/usecases which are implemented by a set of more than one
 applications.
 All these features are not testable naturally by the suppliers, so we develop testcases
 for such features.
 The openDesk application owners prioritize then this list of end-to-end-testcases, and we
 implement these testcases in the [test automation framework](https://gitlab.opencode.de/bmi/opendesk/deployment/e2e-tests).
 ## Run extensive load- and performance tests
 We want to deliver openDesk as an application-grade software with the ability to serve a large user base.
 We create and perform extensive load- and performance tests for every release of openDesk.
 Our approach consists of different layers of load testing.
 ### Base performance testing
 For these tests we define a set of "normal", not too complicated user-interactions with openDesk.
 For each testcase in this set, we measure the duration of the whole testcase (and steps inside the
 testcase) on a given, unloaded environment, installed with a predefined setup and openDesk release.
 As a result, we receive the total runtime of one iteration of the given testcase, the runtime of each
 step inside the testcase, the error rate and min/max/median runtimes.
 Most importantly, the environment should not be used by other users or background tasks, so it should
 be an environment being mostly in idle state.
 The results can be compared with the results of the previous release, so we can see if changes
 in software components improve or decrease the performance of a testcase.
 ### Load testing to saturation point
 These tests are performed to ensure the correct processing and user interactions even in
 high-load scenarios.
 We use the same test cases as in the base performance tests.
 Now we measure the duration on a well-defined environment while the system is being used
 by a predefined number of test users in parallel. This number will be scaled up.
 Our goal is to see constant runtimes of each testcase iteration, while the total throughput
 of requests increases consistently with the number of users in parallel usage of the system.
 At a distinct point, a further increase of the number of users leads to no more increase of the
 total throughput, but instead leads to an increase in the runtime of each testcase iteration.
 This point, the saturation point, is the load limit of the environment. Up to this point the
 environment and the installed software packages can handle the load. More load over this point
 leads to increased response times and increased error rates.
 ### Load testing up to a defined user count
 For interested partners, that are looking into large scale openDesk deployments,
 we offer a load testing analysis based on defined scenarios to be discussed together with the partner in a workshop.
 This way, we can help to decide on the appropriate sizing for the planned openDesk usage scenario.
 ### Overload/recovery tests
 If necessary, we perform overload tests, which will saturate the system with multiple
 test cases until no further increase in throughput is visible. Then we add even more load
 until the first HTTP requests run into timeouts or errors.
 After a few minutes, we reduce the load below the saturation point.
 Now we can check if the system is able to recover from the overload status.
 # Reporting and test results
 We perform testruns every night on every of our environments.
 For each environment, we define so called profiles, these contains the features enabled
 per environment.
 For example: Testing the email features in an environment without deployment of Open-Xchange makes no sense at all.
 Also we test the whole system via a browser with `language=DE` and another browser with `language=EN`.
 The test results will be saved in an [Allure TestOps](https://qameta.io/) server, so interested persons
 are able to view the test results in detail.
 ## Allure TestOps
 The Allure TestOps [server](https://testops.opendesk.run/) is currently only accessible to project members.
 The relevant project is called *opendesk*.
 To get an overview, click in the left symbol list onto the symbol "Rocket" to
 check all relevant launches.
 Now you can, e.g., see the launch #1733, and directly check for the success
 of this launch.
--- a/docs/workflow.md
+++ b/docs/workflow.md
@@ -143,16 +143,13 @@ As a standard, the openDesk platform development team uses [reuse.software](http
 openDesk uses Apache 2.0 as the license for their work. A typical reuse copyright and license header looks like this:
 ```
-# SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ```
 The way to mark the license header as a comment differs between the various file types. Please find matching examples for all types across the [deployment automation repository](https://gitlab.opencode.de/bmi/souveraener_arbeitsplatz/deployment/sovereign-workplace).
 > **Note**<br>
-> If a `SPDX-FileCopyrightText` already exists with the copyright owner described above but with an past year (e.g. 2024), please update this copyright header line to cover (up to and including) the current year, e.g. `2024-2025`.
+> If an `SPDX-FileCopyrightText` already exists, do not replace but add an additional line based on the above example.
 > **Note**<br>
 > If line(s) with `SPDX-FileCopyrightText` containing a different copyright owner exist in the file you are working on, do not replace existing one(s) but add an additional header above these.
 ## Development workflow
--- a/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
  # Collabora Controller - Enterprise Only
  # Source: https://github.com/CollaboraOnline/online
@@ -20,7 +20,7 @@ repositories:
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.collaboraController.registry }}/{{ .Values.charts.collaboraController.repository }}"
 releases:
  - name: "collabora-online"
@@ -28,24 +28,18 @@ releases:
    version: "{{ .Values.charts.collabora.version }}"
    values:
      - "values.yaml.gotmpl"
-      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{ range .Values.customization.release.collaboraOnline }}
      - "values-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.collaboraOnline }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.collabora.enabled }}
+    installed: {{ .Values.collabora.enabled }}
  - name: "collabora-controller"
    chart: "collabora-controller-repo/{{ .Values.charts.collaboraController.name }}"
    version: "{{ .Values.charts.collaboraController.version }}"
    values:
-      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{ range .Values.customization.release.collaboraController }}
      - "values-coco-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.collaboraController }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.collaboraController.enabled }}
+    installed: {{ .Values.collaboraController.enabled }}
 commonLabels:
  deployStage: "050-components"
--- a/helmfile/apps/collabora/helmfile.yaml.gotmpl
+++ b/helmfile/apps/collabora/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
+++ b/helmfile/apps/collabora/values-coco-enterprise.yaml.gotmpl
@@ -1,63 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 controller:
  enableHashmapParallelization: true
  ingressUrl: "https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
  namespacedRole: true
  # CoolController uses `app.kubernetes.io/name` label to find deployment resource
  # openDesk uses `fullnameOverride` in Collabora Deployment that updates `metadata.name` not the `app.kubernetes.io/name`
  # Therefore we use the default of `collabora-online` for the `resourceName`
  resourceName: "collabora-online"
  statsInterval: 2000
  watchNamespace: {{ (.Values.apps.collabora.namespace | default .Release.Namespace | quote) }}
  documentMigrator:
    enabled: true
    coolMemoryUtilization: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}
    coolMemoryLimit: {{ .Values.resources.collabora.limits.memory }}
  leaderElection:
    enabled: {{ if gt .Values.replicas.collaboraController 1 }}true{{ else }}false{{ end }}
 image:
  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collaboraController.registry }}/{{ .Values.images.collaboraController.repository }}"
  tag: {{ .Values.images.collaboraController.tag | quote }}
 imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
  - name: {{ . | quote }}
  {{- end }}
 ingress:
  enabled: {{ .Values.ingress.enabled }}
  className: {{ .Values.ingress.ingressClassName | quote }}
  hosts:
    - host: "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
      paths:
        - path: "/controller"
          pathType: "Prefix"
 podAnnotations: {}
 securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
    - ALL
  privileged: false
  readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsGroup: 2000
  runAsUser: 1000
  seccompProfile:
    type: "RuntimeDefault"
  seLinuxOptions:
 replicaCount: {{ .Values.replicas.collaboraController }}
 resources:
  {{ .Values.resources.collaboraController | toYaml | nindent 2 }}
 ...
--- a/helmfile/apps/collabora/values-enterprise.yaml.gotmpl
+++ b/helmfile/apps/collabora/values-enterprise.yaml.gotmpl
@@ -1,15 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
  repository: "{{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
 autoscaling:
  enabled: {{ .Values.apps.collaboraController.enabled }}
  minReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.minReplicas }}
  maxReplicas: {{ .Values.enterpriseFeatures.collabora.autoscaling.maxReplicas }}
  targetMemoryUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetMemoryUtilizationPercentage }}
  targetCPUUtilizationPercentage: {{ .Values.enterpriseFeatures.collabora.autoscaling.targetCPUUtilizationPercentage }}
  scaleDownDisabled: {{ .Values.enterpriseFeatures.collabora.autoscaling.scaleDownDisabled }}
 ...
--- a/helmfile/apps/collabora/values.yaml.gotmpl
+++ b/helmfile/apps/collabora/values.yaml.gotmpl
@@ -27,7 +27,7 @@ collabora:
    {{- else }}
    --o:logging.anonymize.anonymize_user_data=true
    {{- end }}
-    {{- if .Values.apps.collaboraController.enabled }}
+    {{- if .Values.collaboraController.enabled }}
    --o:indirection_endpoint.url=https://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/routeToken
    --o:monitors.monitor[0]=wss://{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}/controller/ws
    --o:monitors.monitor[0][@retryInterval]=5
@@ -49,7 +49,7 @@ imagePullSecrets:
 ingress:
  annotations:
-    {{- if .Values.apps.collaboraController.enabled }}
+    {{- if .Values.collaboraController.enabled }}
    nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_RouteToken"
    {{- else }}
    nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
--- a/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
 releases:
  - name: "cryptpad"
@@ -18,10 +18,10 @@ releases:
    version: "{{ .Values.charts.cryptpad.version }}"
    values:
      - "values.yaml.gotmpl"
-      {{- range .Values.customization.release.cryptpad }}
+      {{ range .Values.customization.release.cryptpad }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.cryptpad.enabled }}
+    installed: {{ .Values.cryptpad.enabled }}
 commonLabels:
  deployStage: "050-components"
--- a/helmfile/apps/cryptpad/helmfile.yaml.gotmpl
+++ b/helmfile/apps/cryptpad/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/element/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/element/helmfile-child.yaml.gotmpl
@@ -10,35 +10,35 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
  - name: "element-well-known-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.elementWellKnown.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
  - name: "synapse-web-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseWeb.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
  - name: "synapse-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapse.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
  - name: "synapse-create-account-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseCreateAccount.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
  # openDesk Matrix Widgets
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
@@ -48,35 +48,35 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixUserVerificationService.registry }}/{{ .Values.charts.matrixUserVerificationService.repository }}"
  - name: "matrix-neoboard-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neochoice-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
  - name: "matrix-neodatefix-widget-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
  - name: "matrix-neodatefix-bot-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
  # openDesk Enterprise Repositories
@@ -88,28 +88,28 @@ repositories:
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdmin.registry }}/{{ .Values.charts.synapseAdmin.repository }}"
  - name: "synapse-adminbot-web-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseAdminbotWeb.verify }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseAdminbotWeb.registry }}/{{ .Values.charts.synapseAdminbotWeb.repository }}"
  - name: "synapse-groupsync-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapseGroupsync.verify }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapseGroupsync.registry }}/{{ .Values.charts.synapseGroupsync.repository }}"
  - name: "synapse-pipe-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.synapsePipe.verify }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.synapsePipe.registry }}/{{ .Values.charts.synapsePipe.repository }}"
 releases:
  - name: "opendesk-element"
@@ -117,10 +117,10 @@ releases:
    version: "{{ .Values.charts.element.version }}"
    values:
      - "values-element.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskElement }}
+      {{ range .Values.customization.release.opendeskElement }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.element.enabled }}
+    installed: {{ .Values.element.enabled }}
    timeout: 900
  - name: "opendesk-well-known"
@@ -128,10 +128,10 @@ releases:
    version: "{{ .Values.charts.elementWellKnown.version }}"
    values:
      - "values-well-known.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskWellKnown }}
+      {{ range .Values.customization.release.opendeskWellKnown }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.element.enabled }}
+    installed: {{ .Values.element.enabled }}
    timeout: 900
  - name: "opendesk-synapse-web"
@@ -139,10 +139,10 @@ releases:
    version: "{{ .Values.charts.synapseWeb.version }}"
    values:
      - "values-synapse-web.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskSynapseWeb }}
+      {{ range .Values.customization.release.opendeskSynapseWeb }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.element.enabled }}
+    installed: {{ .Values.element.enabled }}
    timeout: 900
  - name: "opendesk-synapse"
@@ -150,10 +150,10 @@ releases:
    version: "{{ .Values.charts.synapse.version }}"
    values:
      - "values-synapse.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskSynapse }}
+      {{ range .Values.customization.release.opendeskSynapse }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.element.enabled }}
+    installed: {{ .Values.element.enabled }}
    timeout: 900
  - name: "opendesk-matrix-user-verification-service-bootstrap"
@@ -161,10 +161,7 @@ releases:
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
      - "values-matrix-user-verification-service-bootstrap.yaml.gotmpl"
-      {{- range .Values.customization.release.matrixUserVerificationServiceBootstrap }}
+    installed: {{ .Values.element.enabled }}
      - {{ . }}
      {{- end }}
    installed: {{ .Values.apps.element.enabled }}
    timeout: 900
  - name: "opendesk-matrix-user-verification-service"
@@ -172,10 +169,7 @@ releases:
    version: "{{ .Values.charts.matrixUserVerificationService.version }}"
    values:
      - "values-matrix-user-verification-service.yaml.gotmpl"
-      {{- range .Values.customization.release.matrixUserVerificationService }}
+    installed: {{ .Values.element.enabled }}
      - {{ . }}
      {{- end }}
    installed: {{ .Values.apps.element.enabled }}
    timeout: 900
  - name: "matrix-neoboard-widget"
@@ -183,21 +177,15 @@ releases:
    version: "{{ .Values.charts.matrixNeoboardWidget.version }}"
    values:
      - "values-matrix-neoboard-widget.yaml.gotmpl"
-      {{- range .Values.customization.release.matrixNeoboardWidget }}
+    installed: {{ .Values.element.enabled }}
      - {{ . }}
      {{- end }}
    installed: {{ .Values.apps.element.enabled }}
    timeout: 900
  - name: "matrix-neochoice-widget"
-    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiceWidget.name }}"
+    chart: "matrix-neochoice-widget-repo/{{ .Values.charts.matrixNeochoiseWidget.name }}"
-    version: "{{ .Values.charts.matrixNeochoiceWidget.version }}"
+    version: "{{ .Values.charts.matrixNeochoiseWidget.version }}"
    values:
      - "values-matrix-neochoice-widget.yaml.gotmpl"
-      {{- range .Values.customization.release.matrixNeochoiceWidget }}
+    installed: {{ .Values.element.enabled }}
      - {{ . }}
      {{- end }}
    installed: {{ .Values.apps.element.enabled }}
    timeout: 900
  - name: "matrix-neodatefix-widget"
@@ -205,10 +193,7 @@ releases:
    version: "{{ .Values.charts.matrixNeodatefixWidget.version }}"
    values:
      - "values-matrix-neodatefix-widget.yaml.gotmpl"
-      {{- range .Values.customization.release.matrixNeodatefixWidget }}
+    installed: {{ .Values.element.enabled }}
      - {{ . }}
      {{- end }}
    installed: {{ .Values.apps.element.enabled }}
    timeout: 900
  - name: "matrix-neodatefix-bot-bootstrap"
@@ -216,10 +201,7 @@ releases:
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
      - "values-matrix-neodatefix-bot-bootstrap.yaml.gotmpl"
-      {{- range .Values.customization.release.matrixNeodatefixBotBootstrap }}
+    installed: {{ .Values.element.enabled }}
      - {{ . }}
      {{- end }}
    installed: {{ .Values.apps.element.enabled }}
    timeout: 900
  - name: "matrix-neodatefix-bot"
@@ -227,10 +209,7 @@ releases:
    version: "{{ .Values.charts.matrixNeodatefixBot.version }}"
    values:
      - "values-matrix-neodatefix-bot.yaml.gotmpl"
-      {{- range .Values.customization.release.matrixNeodatefixBot }}
+    installed: {{ .Values.element.enabled }}
      - {{ . }}
      {{- end }}
    installed: {{ .Values.apps.element.enabled }}
    timeout: 900
  # openDesk Enterprise Releases
@@ -238,77 +217,70 @@ releases:
    chart: "synapse-admin-repo/{{ .Values.charts.synapseAdmin.name }}"
    version: "{{ .Values.charts.synapseAdmin.version }}"
    values:
-      - "values-synapse-admin.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskSynapseAdmin }}
      {{- range .Values.customization.release.opendeskSynapseAdmin }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.elementAdmin.enabled }}
+    installed: {{ .Values.elementAdmin.enabled }}
    timeout: 900
  - name: "opendesk-synapse-adminbot-bootstrap"
    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
-      - "values-synapse-adminbot-bootstrap.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
      {{- range .Values.customization.release.opendeskSynapseAdminbotBootstrap }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.elementAdmin.enabled }}
+    installed: {{ .Values.elementAdmin.enabled }}
    timeout: 900
  - name: "opendesk-synapse-adminbot-pipe"
    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
    version: "{{ .Values.charts.synapsePipe.version }}"
    values:
-      - "values-synapse-adminbot-pipe.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskSynapseAdminbotPipe }}
      {{- range .Values.customization.release.opendeskSynapseAdminbotPipe }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.elementAdmin.enabled }}
+    installed: {{ .Values.elementAdmin.enabled }}
    timeout: 900
  - name: "opendesk-synapse-adminbot-web"
    chart: "synapse-adminbot-web-repo/{{ .Values.charts.synapseAdminbotWeb.name }}"
    version: "{{ .Values.charts.synapseAdminbotWeb.version }}"
    values:
-      - "values-synapse-adminbot-web.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskSynapseAdminbotWeb }}
      {{- range .Values.customization.release.opendeskSynapseAdminbotWeb }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.elementAdmin.enabled }}
+    installed: {{ .Values.elementAdmin.enabled }}
    timeout: 900
  - name: "opendesk-synapse-auditbot-bootstrap"
    chart: "synapse-create-account-repo/{{ .Values.charts.synapseCreateAccount.name }}"
    version: "{{ .Values.charts.synapseCreateAccount.version }}"
    values:
-      - "values-synapse-auditbot-bootstrap.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
      {{- range .Values.customization.release.opendeskSynapseAuditbotBootstrap }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.elementAdmin.enabled }}
+    installed: {{ .Values.elementAdmin.enabled }}
    timeout: 900
  - name: "opendesk-synapse-auditbot-pipe"
    chart: "synapse-pipe-repo/{{ .Values.charts.synapsePipe.name }}"
    version: "{{ .Values.charts.synapsePipe.version }}"
    values:
-      - "values-synapse-auditbot-pipe.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskSynapseAuditbotPipe }}
      {{- range .Values.customization.release.opendeskSynapseAuditbotPipe }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.elementAdmin.enabled }}
+    installed: {{ .Values.elementAdmin.enabled }}
    timeout: 900
  - name: "opendesk-synapse-groupsync"
    chart: "synapse-groupsync-repo/{{ .Values.charts.synapseGroupsync.name }}"
    version: "{{ .Values.charts.synapseGroupsync.version }}"
    values:
-      - "values-synapse-groupsync.yaml.gotmpl"
+      {{ range .Values.customization.release.opendeskSynapseGroupsync }}
      {{- range .Values.customization.release.opendeskSynapseGroupsync }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.elementGroupsync.enabled }}
+    installed: {{ .Values.elementGroupsync.enabled }}
    timeout: 900
 commonLabels:
--- a/helmfile/apps/element/helmfile.yaml.gotmpl
+++ b/helmfile/apps/element/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/element/values-element.yaml.gotmpl
+++ b/helmfile/apps/element/values-element.yaml.gotmpl
@@ -98,7 +98,7 @@ configuration:
            - org.matrix.msc2762.receive.event:net.nordeck.meetings.sub_meetings.send_message
            - org.matrix.msc3973.user_directory_search
-  welcomeUserId: "@meetings-bot:{{ .Values.global.matrixDomain | default .Values.global.domain }}"
+  welcomeUserId: "@meetings-bot:{{ .Values.global.domain }}"
 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-neodatefix-bot.yaml.gotmpl
@@ -81,8 +81,8 @@ liveness sample:
  enabled: true
 persistence:
-  size: {{ .Values.persistence.storages.matrixNeoDateFixBot.size | quote }}
+  size: {{ .Values.persistence.size.matrixNeoDateFixBot | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.matrixNeoDateFixBot.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 podAnnotations: {}
--- a/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
+++ b/helmfile/apps/element/values-matrix-user-verification-service.yaml.gotmpl
@@ -12,9 +12,9 @@ containerSecurityContext:
  enabled: true
  privileged: false
  readOnlyRootFilesystem: false
-  runAsGroup: 1000
+  runAsGroup: 0
-  runAsNonRoot: true
+  runAsNonRoot: false
-  runAsUser: 1000
+  runAsUser: 0
  seccompProfile:
    type: "RuntimeDefault"
  seLinuxOptions:
--- a/helmfile/apps/element/values-synapse-admin.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-admin.yaml.gotmpl
@@ -1,87 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 configuration:
  adminBot:
    backupPhrase: {{ .Values.secrets.matrixAdminBot.backupPassphrase | quote }}
    #name: "adminbot"
    #secretName: "matrix-adminbot-account"
    #secretKey: "access_token"
  auditBot:
    backupPhrase: {{ .Values.secrets.matrixAuditBot.backupPassphrase | quote }}
    #name: "auditbot"
  database:
    host: {{ .Values.databases.synapse.host | quote }}
    port: {{ .Values.databases.synapse.port }}
    name: {{ .Values.databases.synapse.name | quote }}
    user: {{ .Values.databases.synapse.username | quote }}
    password:
      value: {{ .Values.databases.synapse.password | default .Values.secrets.postgresql.matrixUser | quote }}
    requireAuth: {{ .Values.databases.synapse.requireAuth }}
    channelBinding: {{ .Values.databases.synapse.channelBinding | quote }}
    connectTimeout: {{ .Values.databases.synapse.connectTimeout }}
    clientEncoding: {{ .Values.databases.synapse.clientEncoding | quote }}
    keepalives: {{ .Values.databases.synapse.keepalives }}
    keepalivesIdle: {{ .Values.databases.synapse.keepalivesIdle }}
    keepalivesInterval: {{ .Values.databases.synapse.keepalivesInterval }}
    keepalivesCount: {{ .Values.databases.synapse.keepalivesCount }}
    replication: {{ .Values.databases.synapse.replication }}
    gssencmode: {{ .Values.databases.synapse.gssencmode | quote }}
    sslmode: {{ .Values.databases.synapse.sslmode | quote }}
    sslcompression: {{ .Values.databases.synapse.sslcompression }}
    sslMinProtocolVersion: {{ .Values.databases.synapse.sslMinProtocolVersion | quote }}
    connectionPoolMin: {{ .Values.databases.synapse.connectionPoolMin }}
    connectionPoolMax: {{ .Values.databases.synapse.connectionPoolMax }}
  # Settings regarding homeserver.
  homeserver:
    # -- URL of synapse deployment. As default the url of synapse will be used.
    #baseUrl: ""
    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
  ldap:
    base: {{ .Values.ldap.baseDn | quote }}
    bind_dn: "uid=ldapsearch_element,cn=users,{{ .Values.ldap.baseDn }}"
    bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
    filter: "(memberOf=cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }})"
    uri: {{ printf "ldap://%s:389" .Values.ldap.host | quote }}
 cron:
  image:
    registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSyncAdmins.registry | quote }}
    repository: {{ .Values.images.elementSyncAdmins.repository | quote }}
    tag: {{ .Values.images.elementSyncAdmins.tag | quote }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 #fullnameOverride: "opendesk-synapse-admin"
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementSynapseAdmin.registry | quote }}
  repository: {{ .Values.images.elementSynapseAdmin.repository | quote }}
  tag: {{ .Values.images.elementSynapseAdmin.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 ingress:
  enabled: {{ .Values.ingress.enabled }}
  tls:
    secretName: {{ .Values.ingress.tls.secretName | quote }}
 {{- if .Values.certificate.selfSigned }}
 extraEnvVars:
  - name: "NODE_EXTRA_CA_CERTS"
    value: "/etc/ssl/certs/ca-certificates.crt"
 extraVolumes:
  - name: "trusted-cert-secret-volume"
    secret:
      secretName: "opendesk-certificates-ca-tls"
      items:
        - key: "ca.crt"
          path: "ca-certificates.crt"
 extraVolumeMounts:
  - name: "trusted-cert-secret-volume"
    mountPath: "/etc/ssl/certs/ca-certificates.crt"
    subPath: "ca-certificates.crt"
 {{- end }}
 ...
--- a/helmfile/apps/element/values-synapse-adminbot-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-adminbot-bootstrap.yaml.gotmpl
@@ -1,33 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 configuration:
  username: "adminbot"
  pod: "opendesk-synapse-0"
  secretName: "matrix-adminbot-account"
  password: {{ .Values.secrets.matrixAdminBot.password | quote }}
  pipeConfig:
    enabled: true
    type: "admin"
    secretName: "matrix-adminbot-config"
    asToken: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
    hsToken: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
    serviceUrl: "http://opendesk-synapse-web:8008"
    backupPassphrase: {{ .Values.secrets.matrixAdminBot.backupPassphrase | quote }}
    homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
 image:
  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
  url: {{ .Values.images.synapseCreateUser.repository | quote }}
  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 fullnameOverride: "matrix-adminbot-bootstrap"
 ...
--- a/helmfile/apps/element/values-synapse-adminbot-pipe.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-adminbot-pipe.yaml.gotmpl
@@ -1,21 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 configuration:
  secretName: "matrix-adminbot-config"
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
  url: {{ .Values.images.elementPipe.repository | quote }}
  tag: {{ .Values.images.elementPipe.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 fullnameOverride: "opendesk-synapse-adminbot-pipe"
 ...
--- a/helmfile/apps/element/values-synapse-adminbot-web.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-adminbot-web.yaml.gotmpl
@@ -1,25 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 configuration:
  homeserver:
    serverName: {{ .Values.global.matrixDomain | default .Values.global.domain }}
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementAdminBot.registry | quote }}
  repository: {{ .Values.images.elementAdminBot.repository | quote }}
  tag: {{ .Values.images.elementAdminBot.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 ingress:
  enabled: {{ .Values.ingress.enabled }}
  tls:
    secretName: {{ .Values.ingress.tls.secretName | quote }}
 ...
--- a/helmfile/apps/element/values-synapse-auditbot-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-auditbot-bootstrap.yaml.gotmpl
@@ -1,33 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 configuration:
  username: "auditbot"
  pod: "opendesk-synapse-0"
  secretName: "matrix-auditbot-account"
  password: {{ .Values.secrets.matrixAuditBot.password | quote }}
  pipeConfig:
    enabled: true
    type: "admin"
    secretName: "matrix-auditbot-config"
    asToken: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
    hsToken: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
    serviceUrl: "http://opendesk-synapse-web:8008"
    backupPassphrase: {{ .Values.secrets.matrixAuditBot.backupPassphrase | quote }}
    homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
 image:
  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.synapseCreateUser.registry | quote }}
  url: {{ .Values.images.synapseCreateUser.repository | quote }}
  tag: {{ .Values.images.synapseCreateUser.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 fullnameOverride: "matrix-auditbot-bootstrap"
 ...
--- a/helmfile/apps/element/values-synapse-auditbot-pipe.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-auditbot-pipe.yaml.gotmpl
@@ -1,21 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 configuration:
  secretName: "matrix-auditbot-config"
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementPipe.registry | quote }}
  url: {{ .Values.images.elementPipe.repository | quote }}
  tag: {{ .Values.images.elementPipe.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 fullnameOverride: "opendesk-synapse-auditbot-pipe"
 ...
--- a/helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse-groupsync.yaml.gotmpl
@@ -1,56 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
    {{ .Values.global.hosts | toYaml | nindent 4 }}
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 configuration:
  asToken: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
  dryRun: false
  hsToken: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
  id: "gps"
  homeserverName: {{ .Values.global.matrixDomain | default .Values.global.domain | quote }}
  registrationSharedSecret: {{ .Values.secrets.synapse.registrationSharedSecret | quote }}
  runOnce: false
  username: "groupsyncbot"
  ldap:
    attributes:
      name: "description"
      uid: "uid"
    base: {{ .Values.ldap.baseDn | quote }}
    bind_dn: "uid=ldapsearch_element,cn=users,{{ .Values.ldap.baseDn }}"
    bind_password: {{ .Values.secrets.nubus.ldapSearch.element | quote }}
    check_interval_seconds: 60
    type: mapped-ldap
    uri: "ldap://ums-ldap-server:389"
  spaces:
    - groups:
        - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
          powerLevel: 50
        - externalId: "cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}"
      id: "c3122e32-4e05-4bf8-8a5d-66679076ed36"
      name: "openDesk"
      subspaces:
        - groups:
            - externalId: "cn=managed-by-attribute-LivecollaborationAdmin,cn=groups,{{ .Values.ldap.baseDn }}"
              powerLevel: 50
          id: "e7889d96-5baa-4e21-be6e-12c66b2e9565"
          name: "openDesk Element Admins"
  provisionerDefaultRooms:
    - id: "c3122e32-4e05-4bf8-8a5d-66679076ed36"
      properties:
        name: "openDesk"
  # Name of group sync service (default opendesk-synapse-groupsync)
  groupSyncService: "opendesk-synapse-groupsync"
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.elementGroupsync.registry | quote }}
  url: {{ .Values.images.elementGroupsync.repository | quote }}
  tag: {{ .Values.images.elementGroupsync.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 ...
--- a/helmfile/apps/element/values-synapse.yaml.gotmpl
+++ b/helmfile/apps/element/values-synapse.yaml.gotmpl
@@ -69,60 +69,6 @@ configuration:
              regex: "@.*"
        url: null
        sender_localpart: ox-appsuite
    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
      {{- if .Values.apps.elementAdmin.enabled }}
      - as_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
        hs_token: {{ .Values.secrets.matrixAdminBot.synapseAsToken | quote }}
        id: "element-adminbot-pipe"
        namespaces:
          rooms:
            - exclusive: false
              regex: "!.*:{{ .Values.global.domain }}"
          users:
            - exclusive: false
              regex: "@.*:.*"
            - exclusive: true
              regex: "@adminbot:{{ .Values.global.domain }}"
        de.sorunome.msc2409.push_ephemeral: true
        org.matrix.msc3202: true
        url: "http://opendesk-synapse-adminbot-pipe:9995"
        rate_limited: false
        sender_localpart: "adminbot-sendernotinuse"
      - as_token: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
        hs_token: {{ .Values.secrets.matrixAuditBot.synapseAsToken | quote }}
        id: "element-auditbot-pipe"
        namespaces:
          rooms:
            - exclusive: false
              regex: "!.*:{{ .Values.global.domain }}"
          users:
            - exclusive: false
              regex: "@.*:.*"
            - exclusive: true
              regex: "@auditbot:{{ .Values.global.domain }}"
        de.sorunome.msc2409.push_ephemeral: true
        org.matrix.msc3202: true
        url: "http://opendesk-synapse-auditbot-pipe:9995"
        rate_limited: false
        sender_localpart: "auditbot-sendernotinuse"
      {{- end }}
      {{- if .Values.apps.elementGroupsync.enabled }}
      - as_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
        hs_token: {{ .Values.secrets.matrixGroupsync.synapseAsToken | quote }}
        id: "gps"
        namespaces:
          rooms:
            - exclusive: false
              regex: "!.*:{{ .Values.global.domain }}"
          users:
            - exclusive: false
              regex: '@.*:{{ .Values.global.domain }}'
        url: "http://opendesk-synapse-groupsync:10010"
        rate_limited: false
        sender_localpart: "groupsyncbot"
      {{- end }}
    registrationSharedSecret: {{ .Values.secrets.synapse.registrationSharedSecret | quote }}
    {{- end }}
    presence:
      enabled: {{ .Values.functional.dataProtection.matrixPresence.enabled }}
@@ -132,12 +78,12 @@ configuration:
    smtp:
      senderAddress: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
-      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
      port: 25
      tls: false
      starttls: false
-      username: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+      username: ""
-      password: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+      password: ""
    oidc:
      clientId: "opendesk-matrix"
@@ -208,8 +154,6 @@ extraVolumeMounts:
 federation:
  enabled: {{ .Values.functional.externalServices.matrix.federation.enabled }}
  domainAllowList:
    {{ .Values.functional.externalServices.matrix.federation.domainAllowList | toYaml | nindent 4 }}
  ingress:
    host: "{{ .Values.global.hosts.synapseFederation }}.{{ .Values.global.domain }}"
    enabled: {{ .Values.ingress.enabled }}
@@ -232,8 +176,8 @@ image:
  tag: {{ .Values.images.synapse.tag | quote }}
 persistence:
-  size: {{ .Values.persistence.storages.synapse.size | quote }}
+  size: {{ .Values.persistence.size.synapse | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.synapse.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 podAnnotations: {}
--- a/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
 releases:
  - name: "jitsi"
@@ -18,10 +18,10 @@ releases:
    version: "{{ .Values.charts.jitsi.version }}"
    values:
      - "values-jitsi.yaml.gotmpl"
-      {{- range .Values.customization.release.jitsi }}
+      {{ range .Values.customization.release.jitsi }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.jitsi.enabled }}
+    installed: {{ .Values.jitsi.enabled }}
    timeout: 900
 commonLabels:
--- a/helmfile/apps/jitsi/helmfile.yaml.gotmpl
+++ b/helmfile/apps/jitsi/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
+++ b/helmfile/apps/jitsi/values-jitsi.yaml.gotmpl
@@ -49,7 +49,6 @@ extraVolumeMounts:
 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
 image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
@@ -86,7 +85,7 @@ jitsi:
        - secretName: {{ .Values.ingress.tls.secretName | quote }}
          hosts:
            - "{{ .Values.global.hosts.jitsi }}.{{ .Values.global.domain }}"
-    extraConfig:
+    extraConfigJs:
      doNotStoreRoom: {{ not .Values.functional.dataProtection.jitsiRoomHistory.enabled }}
    extraEnvs:
      TURN_ENABLE: "1"
@@ -139,8 +138,8 @@ jitsi:
    resources:
      {{ .Values.resources.prosody | toYaml | nindent 6 }}
    persistence:
-      size: {{ .Values.persistence.storages.prosody.size | quote }}
+      size: {{ .Values.persistence.size.prosody | quote }}
-      storageClassName: {{ coalesce .Values.persistence.storages.prosody.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+      storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: {}
@@ -176,35 +175,6 @@ jitsi:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
  jigasi:
    replicaCount: {{ .Values.replicas.jigasi }}
    enabled: {{ .Values.sip.jigasi.enabled }}
    image:
      repository: "{{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.jigasi.registry }}/{{ .Values.images.jigasi.repository }}"
      tag: {{ .Values.images.jigasi.tag | quote }}
      pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    extraEnvs:
      JIGASI_SIP_PASSWORD: {{ .Values.sip.jigasi.password | quote }}
      JIGASI_SIP_PORT: {{ .Values.sip.jigasi.port | quote }}
      JIGASI_SIP_SERVER: {{ .Values.sip.jigasi.server | quote }}
      JIGASI_SIP_TRANSPORT: {{ .Values.sip.jigasi.transport | quote }}
      JIGASI_SIP_URI: {{ .Values.sip.jigasi.uri | quote }}
    xmpp:
      password: {{ .Values.secrets.jitsi.jigasiXmppPassword | quote }}
    resources:
      {{ .Values.resources.jigasi | toYaml | nindent 6 }}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: {}
      privileged: false
      readOnlyRootFilesystem: false
      runAsGroup: 0
      runAsNonRoot: false
      runAsUser: 0
      seccompProfile:
        type: "RuntimeDefault"
      seLinuxOptions:
        {{ .Values.seLinuxOptions.jigasi | toYaml | nindent 8 }}
  jvb:
    replicaCount: {{ .Values.replicas.jvb }}
    # The `useNodeIP` option provided by the upstream charts does not support all relevant scenarios, but since
@@ -220,7 +190,7 @@ jitsi:
    resources:
      {{ .Values.resources.jvb | toYaml | nindent 6 }}
    service:
-      type: {{ coalesce .Values.service.type.jitsiVideoBridge .Values.cluster.service.type | quote }}
+      type: {{ .Values.cluster.service.type | quote }}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: {}
--- a/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile-child.yaml.gotmpl
@@ -10,14 +10,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
  - name: "nextcloud-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.nextcloud.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
 releases:
  - name: "opendesk-nextcloud-management"
@@ -25,30 +25,24 @@ releases:
    version: "{{ .Values.charts.nextcloudManagement.version }}"
    values:
      - "values-nextcloud-mgmt.yaml.gotmpl"
-      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{ range .Values.customization.release.opendeskNextcloudManagement }}
      - "values-nextcloud-mgmt-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.opendeskNextcloudManagement }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
    waitForJobs: true
    wait: true
-    installed: {{ .Values.apps.nextcloud.enabled }}
+    installed: {{ .Values.nextcloud.enabled }}
    timeout: 900
  - name: "opendesk-nextcloud"
    chart: "nextcloud-repo/{{ .Values.charts.nextcloud.name }}"
    version: "{{ .Values.charts.nextcloud.version }}"
    values:
      - "values-nextcloud.yaml.gotmpl"
-      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{ range .Values.customization.release.opendeskNextcloud }}
      - "values-nextcloud-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.opendeskNextcloud }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
    needs:
      - "opendesk-nextcloud-management"
-    installed: {{ .Values.apps.nextcloud.enabled }}
+    installed: {{ .Values.nextcloud.enabled }}
 commonLabels:
  deployStage: "050-components"
--- a/helmfile/apps/nextcloud/helmfile.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/nextcloud/values-nextcloud-enterprise.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-enterprise.yaml.gotmpl
@@ -1,9 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 aio:
  image:
    registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
 ...
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt-enterprise.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt-enterprise.yaml.gotmpl
@@ -1,12 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.nextcloud.registry | quote }}
 configuration:
  enterprise:
    subscriptionKey: {{ if .Values.enterpriseKeys.nextcloud.subscriptionKey }}{{ .Values.enterpriseKeys.nextcloud.subscriptionKey | quote }}{{ end }}
    subscriptionData: {{ if .Values.enterpriseKeys.nextcloud.subscriptionData}}{{ .Values.enterpriseKeys.nextcloud.subscriptionData | quote }}{{ end }}
 ...
--- a/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
@@ -16,8 +16,6 @@ additionalAnnotations:
 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 configuration:
  administrator:
@@ -27,20 +25,18 @@ configuration:
      value: "nextcloud"
    password:
      value: {{ .Values.secrets.nextcloud.adminPassword | quote }}
  antivirus:
    {{- if .Values.antivirus.icap.host }}
    host: {{ .Values.antivirus.icap.host | quote }}
    port: {{ .Values.antivirus.icap.port | quote }}
    {{- else }}
-    {{- if .Values.apps.clamavDistributed.enabled }}
+    {{- if .Values.clamavDistributed.enabled }}
    host: "clamav-icap"
-    {{- else if .Values.apps.clamavSimple.enabled }}
+    {{- else if .Values.clamavSimple.enabled }}
    host: "clamav-simple"
    {{- end }}
    port: 1344
    {{- end }}
  cache:
    auth:
      enabled: true
@@ -51,36 +47,10 @@ configuration:
    host: {{ .Values.cache.nextcloud.host | quote }}
    port: {{ .Values.cache.nextcloud.port | quote }}
    tls: {{ .Values.cache.nextcloud.tls }}
  feature:
    apps:
      contacts:
        enabled: false
      cryptpad:
        enabled: {{ .Values.apps.cryptpad.enabled }}
      filesZip:
        enabled: true
      groupfolders:
        enabled: true
      integrationOpenproject:
        enabled: {{ .Values.apps.openproject.enabled }}
      spreed:
        enabled: true
    circles:
      enabled: false
  collabora:
    # internalWopiUrl: ""
    wopiAllowlist: {{ join ", " ( concat .Values.cluster.networking.cidr .Values.cluster.networking.incomingCIDR ) | quote }}
  database:
    {{ if eq .Values.databases.nextcloud.type "mariadb" }}
    type: "mysql"
    {{ else if eq .Values.databases.nextcloud.type "postgresql" }}
    type: "pgsql"
    {{ else }}
    {{ .Values.databases.nextcloud.type | quote }}
    {{ end }}
    host: {{ .Values.databases.nextcloud.host | quote }}
    port: {{ .Values.databases.nextcloud.port | quote }}
    name: {{ .Values.databases.nextcloud.name | quote }}
@@ -88,20 +58,12 @@ configuration:
      username:
        value: {{ .Values.databases.nextcloud.username | quote }}
      password:
        {{- if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
        value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
        {{- else if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
        value: {{ .Values.databases.nextcloud.password | default .Values.secrets.postgresql.nextcloudUser | quote }}
        {{- else }}
        value: {{ .Values.databases.nextcloud.password | quote }}
        {{- end }}
  ldap:
    host: {{ .Values.ldap.host | quote }}
    password:
      value: {{ .Values.secrets.nubus.ldapSearch.nextcloud | quote }}
    adminGroupName: "managed-by-attribute-FileshareAdmin"
  objectstore:
    auth:
      accessKey:
@@ -115,22 +77,16 @@ configuration:
    port: {{ .Values.objectstores.nextcloud.port | quote }}
    pathStyle: {{ .Values.objectstores.nextcloud.pathStyle | quote }}
    useSSL: {{ .Values.objectstores.nextcloud.useSSL | quote }}
  oidc:
    username:
      value: "opendesk-nextcloud"
    password:
      value: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
  opendeskIntegration:
-    centralNavigation:
+    username:
-      username:
+      value: "opendesk_username"
-        value: "opendesk_username"
+    password:
-      password:
+      value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
        value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
    oxAppSuite:
      enabled: {{ .Values.apps.oxAppSuite.enabled }}
  sharing:
    allowLinks: {{ .Values.functional.filestore.sharing.external.enabled }}
    allowMailNotification: {{ .Values.functional.filestore.sharing.external.enabled }}
@@ -144,21 +100,19 @@ configuration:
    defaultExternalExpireEnforced: {{ .Values.functional.filestore.sharing.external.expiry.enforced }}
    defaultExternalExpireDays: {{ .Values.functional.filestore.sharing.external.expiry.defaultDays | quote }}
    sendPasswordMail: {{ .Values.functional.filestore.sharing.external.sendPasswordMail | quote }}
  smtp:
    auth:
-      enabled: true
+      enabled: false
      username:
-        value: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+        value: ""
      password:
-        value: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+        value: ""
-    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
-    port: 587
+    port: 25
    fromAddress: {{ .Values.smtp.localpartNoReply | quote }}
    mailDomain: "{{ .Values.global.domain }}"
-    security: "tls"
+    security: ""
    skipVerifyPeer: true
  quota:
    default: "{{ .Values.functional.filestore.quota.default }} GB"
    retentionObligation:
@@ -166,8 +120,7 @@ configuration:
      versions: {{ .Values.functional.filestore.nextcloud.retentionObligation.versions | quote }}
  serverinfo:
-    token:
+    token: {{ .Values.secrets.nextcloud.metricsToken | quote }}
      value: {{ .Values.secrets.nextcloud.metricsToken | quote }}
 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
+++ b/helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
@@ -63,13 +63,6 @@ aio:
      port: {{ .Values.cache.nextcloud.port | quote }}
      tls: {{ .Values.cache.nextcloud.tls }}
    database:
      {{ if eq .Values.databases.nextcloud.type "mariadb" }}
      type: "mysql"
      {{ else if eq .Values.databases.nextcloud.type "postgresql" }}
      type: "pgsql"
      {{ else }}
      {{ .Values.databases.nextcloud.type | quote }}
      {{ end }}
      host: {{ .Values.databases.nextcloud.host | quote }}
      port: {{ .Values.databases.nextcloud.port | quote }}
      name: {{ .Values.databases.nextcloud.name | quote }}
@@ -77,13 +70,7 @@ aio:
        username:
          value: {{ .Values.databases.nextcloud.username | quote }}
        password:
          {{- if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
          {{- else if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
          value: {{ .Values.databases.nextcloud.password | default .Values.secrets.postgresql.nextcloudUser | quote }}
          {{- else }}
          value: {{ .Values.databases.nextcloud.password | quote }}
          {{- end }}
    trustedProxy: {{ join " " .Values.cluster.networking.cidr | quote }}
  containerSecurityContext:
    allowPrivilegeEscalation: false
@@ -102,9 +89,6 @@ aio:
      {{ .Values.seLinuxOptions.nextcloud | toYaml | nindent 6 }}
  cron:
    successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
    resources:
      {{ .Values.resources.nextcloudCron | toYaml | nindent 6 }}
  debug:
    loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"2"{{ end }}
  {{- if .Values.certificate.selfSigned }}
--- a/helmfile/apps/notes/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/notes/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.notes.registry }}/{{ .Values.charts.notes.repository }}"
 releases:
  - name: "impress"
@@ -19,10 +19,10 @@ releases:
    wait: true
    values:
      - "values.yaml.gotmpl"
-      {{- range .Values.customization.release.notes }}
+      {{ range .Values.customization.release.notes }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.notes.enabled }}
+    installed: {{ .Values.notes.enabled }}
    timeout: 1800
 commonLabels:
--- a/helmfile/apps/notes/helmfile.yaml.gotmpl
+++ b/helmfile/apps/notes/helmfile.yaml.gotmpl
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/notes/values.yaml.gotmpl
+++ b/helmfile/apps/notes/values.yaml.gotmpl
@@ -168,9 +168,6 @@ backend:
    DJANGO_EMAIL_HOST: "postfix"
    DJANGO_EMAIL_PORT: 25
    DJANGO_EMAIL_USE_SSL: False
    DJANGO_EMAIL_HOST_USER: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
    DJANGO_EMAIL_HOST_PASSWORD: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
    DJANGO_EMAIL_USE_TLS: False
    OIDC_RP_CLIENT_ID: "opendesk-notes"
    OIDC_RP_CLIENT_SECRET: {{ .Values.secrets.keycloak.clientSecret.notes | quote }}
    OIDC_OP_JWKS_ENDPOINT: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
--- a/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url:
-      "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
+      "{{ .Values.global.helmRegistry | default .Values.charts.nubus.registry }}/{{ .Values.charts.nubus.repository }}"
  # Intercom Service
  # Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
  - name: "intercom-service-repo"
@@ -19,7 +19,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
  # openDesk Keycloak Bootstrap Chart
  - name: "opendesk-keycloak-bootstrap-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
@@ -27,7 +27,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
  # NGINX S3 Gateway Chart
  - name: "nginx-s3-gateway-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
@@ -35,7 +35,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.nginxS3Gateway.registry }}/{{ .Values.charts.nginxS3Gateway.repository }}"
 releases:
  # Univention Management Stack Umbrella Chart
@@ -44,10 +44,10 @@ releases:
    version: "{{ .Values.charts.nubus.version }}"
    values:
      - "values-nubus.yaml.gotmpl"
-      {{- range .Values.customization.release.ums }}
+      {{ range .Values.customization.release.ums }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.nubus.enabled }}
+    installed: {{ .Values.nubus.enabled }}
    timeout: 900
  # Intercom-Service
  - name: "intercom-service"
@@ -55,10 +55,10 @@ releases:
    version: "{{ .Values.charts.intercomService.version }}"
    values:
      - "values-intercom-service.yaml.gotmpl"
-      {{- range .Values.customization.release.intercomService }}
+      {{ range .Values.customization.release.intercomService }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.nubus.enabled }}
+    installed: {{ .Values.nubus.enabled }}
  # openDesk Keycloak Bootstrap Chart
  - name: "opendesk-keycloak-bootstrap"
@@ -66,12 +66,12 @@ releases:
    version: "{{ .Values.charts.opendeskKeycloakBootstrap.version }}"
    values:
      - "values-opendesk-keycloak-bootstrap.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskKeycloakBootstrap }}
+      {{ range .Values.customization.release.opendeskKeycloakBootstrap }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
    needs:
      - "ums"
-    installed: {{ .Values.apps.nubus.enabled }}
+    installed: {{ .Values.nubus.enabled }}
    timeout: 900
  # NGINX S3 Gateway (when cluster minio is not used)
@@ -80,10 +80,10 @@ releases:
    version: "{{ .Values.charts.nginxS3Gateway.version }}"
    values:
      - "values-nginx-s3-gateway.yaml.gotmpl"
-      {{- range .Values.customization.release.nginxS3Gateway }}
+      {{ range .Values.customization.release.nginxS3Gateway }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ not .Values.apps.minio.enabled }}
+    installed: {{ not .Values.minio.enabled }}
    timeout: 900
 commonLabels:
--- a/helmfile/apps/nubus/helmfile.yaml.gotmpl
+++ b/helmfile/apps/nubus/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -42,12 +42,6 @@ global:
        repository: {{ .Values.images.nubusOpendeskExtension.repository }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
        tag: {{ .Values.images.nubusOpendeskExtension.tag }}
    - name: "opendesk-a2g-mapper"
      image:
        registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusOpendeskExtensionA2gMapper.registry | quote }}
        repository: {{ .Values.images.nubusOpendeskExtensionA2gMapper.repository }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy }}
        tag: {{ .Values.images.nubusOpendeskExtensionA2gMapper.tag }}
  # -- Allows to configure the system extensions to load. This is intended for
  # internal usage, prefer to use `global.extensions` for user configured
@@ -105,7 +99,7 @@ global:
        show: "false"
      login:
        password-complexity-message:
-          de: "Das Passwort muss mindestens 8 Zeichen lang sein und darf keine Zahlenabfolge oder ganze Worte enthalten, wie '1234Test'."
+          de: "Das Passwort muss mindestens 8 Zeichen lang sein und darf keine Zahlenabfolge oder ganze Worte enthalten, wie  '1234Test'."
          en: "Password must be at least 8 characters long and cannot include a number series or regular words, like '1234Test'."
      module:
        udm:
@@ -125,7 +119,7 @@ global:
 ingress:
  # temporary fix
-  {{- if not .Values.apps.minio.enabled }}
+  {{- if not .Values.minio.enabled }}
  enabled: false
  {{- end }}
  certManager:
@@ -383,7 +377,6 @@ nubusGuardian:
      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 nubusNotificationsApi:
  enabled: false
  additionalAnnotations:
    intents.otterize.com/service-name: "ums-notifications-api"
  containerSecurityContext:
@@ -522,7 +515,6 @@ nubusKeycloakExtensions:
    connection:
      host: {{ .Values.databases.keycloakExtension.host | quote }}
      port: {{ .Values.databases.keycloakExtension.port | quote }}
      ssl: {{ .Values.databases.keycloakExtension.ssl | quote }}
    auth:
      database: {{ .Values.databases.keycloakExtension.name | quote }}
      username: {{ .Values.databases.keycloakExtension.username | quote }}
@@ -532,21 +524,19 @@ nubusKeycloakExtensions:
          password: "umcKeycloakExtensionsDatabasePassword"
  smtp:
    connection:
-      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+      host: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
      port: 25
      ssl: false
      starttls: false
    auth:
-      enabled: true
+      enabled: false
-      username: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+      username: ""
      password: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
      existingSecret:
        name: "ums-keycloak-extensions-smtp-opendesk-credentials"
        keyMapping:
          password: "umcKeycloakExtensionsSmtpPassword"
  handler:
    appConfig:
      newDeviceLoginNotificationEnable: {{ if .Values.functional.authentication.newDeviceLoginNotification.enabled }}"True"{{ else }}"False"{{ end }}
      logLevel: {{ if .Values.debug.enabled }}"DEBUG"{{ else }}"WARN"{{ end }}
      newDeviceLoginSubject: "New device login on your {{ .Values.theme.texts.productName }} account"
      mailFrom: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
@@ -573,13 +563,7 @@ nubusPortalListener:
 nubusPortalConsumer:
  enabled: true
  extraEnvVars:
    - name: "AWS_DEFAULT_REGION"
      value: "failthis"
  portalConsumer:
    extraEnvVars:
      - name: "AWS_DEFAULT_REGION"
        value: "failthis"
    image:
      registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.nubusPortalConsumer.registry | quote }}
      repository: {{ .Values.images.nubusPortalConsumer.repository }}
@@ -597,8 +581,8 @@ nubusPortalConsumer:
      accessKey: {{ .Values.objectstores.nubus.username | quote }}
      secretKey: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
  persistence:
-    size: {{ .Values.persistence.storages.nubusPortalConsumer.size | quote }}
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-    storageClass: {{ coalesce .Values.persistence.storages.nubusPortalConsumer.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.portalConsumer | quote }}
  podAnnotations:
    intents.otterize.com/service-name: "ums-portal-consumer"
  provisioningApi:
@@ -622,9 +606,6 @@ nubusPortalConsumer:
      tag: {{ .Values.images.nubusWaitForDependency.tag }}
      imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  {{- if .Values.certificate.selfSigned }}
    extraEnvVars:
      - name: "AWS_DEFAULT_REGION"
        value: "failthis"
  extraVolumes:
    - name: "trusted-cert-secret-volume"
      secret:
@@ -649,8 +630,6 @@ nubusPortalConsumer:
        mountPath: "/usr/local/lib/python3.11/dist-packages/certifi/cacert.pem"
        subPath: "cacert.pem"
    extraEnvVars:
      - name: "AWS_DEFAULT_REGION"
        value: "failthis"
      - name: "REQUESTS_CA_BUNDLE"
        value: "/etc/ssl/certs/ca-certificates.crt"
      - name: "DEFAULT_CA_BUNDLE_PATH"
@@ -681,9 +660,6 @@ nubusPortalServer:
    repository: {{ .Values.images.nubusPortalServer.repository }}
    tag: {{ .Values.images.nubusPortalServer.tag }}
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  extraEnvVars:
    - name: "AWS_DEFAULT_REGION"
      value: "failthis"
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
  ingress:
@@ -706,9 +682,6 @@ nubusPortalServer:
    centralNavigation:
      enabled: true
      authenticatorSecretName: "ums-opendesk-portal-server-central-navigation"
    extraEnvVars:
      - name: "AWS_DEFAULT_REGION"
        value: "failthis"
  replicaCount: {{ .Values.replicas.umsPortalServer }}
  resources:
    {{ .Values.resources.umsPortalServer | toYaml | nindent 4 }}
@@ -763,7 +736,6 @@ nubusUdmRestApi:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
  ingress:
    enabled: {{ .Values.functional.externalServices.nubus.udmRestApi.enabled }}
    certManager:
      enabled: false
    tls:
@@ -839,13 +811,12 @@ nubusLdapServer:
        tag: {{ .Values.images.nubusLdapServerLeaderElector.tag }}
        pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
  persistence:
-    size: {{ .Values.persistence.storages.nubusLdapServerData.size | quote }}
+    storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-    storageClass: {{ coalesce .Values.persistence.storages.nubusLdapServerData.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+    size: {{ .Values.persistence.size.nubus.ldapServerData | quote }}
  replicaCountPrimary: {{ .Values.replicas.umsLdapServerPrimary }}
  replicaCountSecondary: {{ .Values.replicas.umsLdapServerSecondary }}
  replicaCountProxy: {{ .Values.replicas.umsLdapServerProxy }}
-  resourcesPrimary: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
+  resources: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
  resourcesSecondary: {{ .Values.resources.umsLdapServer | toYaml | nindent 4 }}
  serviceAccount:
    create: true
  waitForDependency:
@@ -943,8 +914,7 @@ nubusProvisioning:
        tag: {{ .Values.images.nubusNatsBox.tag }}
        imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
    persistence:
-      size: {{ .Values.persistence.storages.nubusProvisioningNats.size }}
+      size: {{ .Values.persistence.size.nubus.provisioningNats }}
      storageClass: {{ coalesce .Values.persistence.storages.nubusProvisioningNats.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
    reloader:
      image:
        registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.nubusNatsReloader.registry | quote }}
@@ -1124,19 +1094,15 @@ nubusStackDataUms:
    umcMemcachedUsername: ""
    externalMailDomain: {{ .Values.global.mailDomain | default .Values.global.domain }}
    umcHtmlTitle: "Portal - {{ .Values.theme.texts.productName }}"
-    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+    smtpHost: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
    smtpPort: 25
-    smtpUser: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+    smtpUser: ""
    smtpStartTls: false
    ldapBase: {{ .Values.ldap.baseDn }}
  templateContext:
    initialPasswordDefaultAdmin: {{ .Values.secrets.nubus.defaultAccounts.adminPassword | quote }}
    initialPasswordDefaultUser: {{ .Values.secrets.nubus.defaultAccounts.userPassword | quote }}
    initialPasswordAdministrator: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote }}
    apps: {{ .Values.apps | toYaml | nindent 6 }}
    defaultGroupOtherObjects: "cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}"
    opendeskEnterprise: {{ env "OPENDESK_ENTERPRISE" }}
    opendeskAdminAttributes: true
    opendeskGroupAttributes: true
    opendeskUserAttributes: true
    portalEnforceLogin: {{ .Values.functional.portal.enforceLogin }}
    portalHeaderLogo: {{ toYaml .Values.theme.imagery.logoHeaderSvgB64 | quote }}
    portalTiles: {{ toYaml .Values.theme.imagery.portalTiles | nindent 6 }}
@@ -1149,10 +1115,9 @@ nubusStackDataUms:
    portalNotesLinkBase: {{ printf "https://%s.%s" .Values.global.hosts.notes .Values.global.domain }}
    portalTitleDE: "Portal - {{ .Values.theme.texts.productName }}"
    portalTitleEN: "Portal - {{ .Values.theme.texts.productName }}"
    portalLinkLegalNotice: {{ .Values.functional.portal.linkLegalNotice }}
    portalLinkPrivacyStatement: {{ .Values.functional.portal.linkPrivacyStatement }}
    oxDefaultContext: "1"
-    oxContextHidden: true
+    componentEnabled:
      notes: {{ .Values.notes.enabled }}
    ldapSearchUsers:
      {{- range $username, $password := .Values.secrets.nubus.ldapSearch }}
      - username: {{ printf "ldapsearch_%s" $username | quote }}
@@ -1161,42 +1126,36 @@ nubusStackDataUms:
      {{- end }}
    ldapSystemUsers: []
    portaltileGroupUserStandard:
-      - "cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupUserAdmin:
-      - "cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
-      - "cn=Support,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=Support,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupUserAll:
-      - "cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=Domain Admins,cn=groups,{{ .Values.ldap.baseDn }}'
-      - "cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupGroupware:
-      - "cn=managed-by-attribute-Groupware,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=managed-by-attribute-Groupware,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupFileshare:
-      - "cn=managed-by-attribute-Fileshare,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=managed-by-attribute-Fileshare,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupManagementProject:
-      - "cn=managed-by-attribute-Projectmanagement,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=managed-by-attribute-Projectmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupManagementKnowledge:
-      - "cn=managed-by-attribute-Knowledgemanagement,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=managed-by-attribute-Knowledgemanagement,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupManagementLearn:
-      - "cn=managed-by-attribute-Learnmanagement,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=managed-by-attribute-Learnmanagement,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupLiveCollaboration:
-      - "cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=managed-by-attribute-Livecollaboration,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupVideoconference:
-      - "cn=managed-by-attribute-Videoconference,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=managed-by-attribute-Videoconference,cn=groups,{{ .Values.ldap.baseDn }}'
    portaltileGroupNotes:
-      - "cn=managed-by-attribute-Notes,cn=groups,{{ .Values.ldap.baseDn }}"
+      - 'cn=managed-by-attribute-Notes,cn=groups,{{ .Values.ldap.baseDn }}'
    systemInformation:
-      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}{{ if eq (env "OPENDESK_ENTERPRISE") "true" }}-ee{{ end }}"
+      releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
      {{- if .Values.functional.admin.portal.deploymentTimestamp.enabled }}
      deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
      {{- else }}
      deployDate: false
      {{- end }}
    # executes a list of UDM commands as step `03-custom-initializer.yaml` of the opendesk-nubus customization
    # Ref. https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/tree/main/udm/udm-data-loader
    udmCustomInitializer: []
    # executes a list of UDM commands as step `97-custom-finalizer.yaml` of the opendesk-nubus customization
    # Ref. https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images/opendesk-nubus/-/tree/main/udm/udm-data-loader
    udmCustomFinalizer: []
 nubusUmcServer:
  additionalAnnotations:
@@ -1354,6 +1313,8 @@ nubusUmcGateway:
  replicaCount: {{ .Values.replicas.umsUmcGateway }}
  resources:
    {{ .Values.resources.umsUmcGateway | toYaml | nindent 4 }}
  umcGateway:
    umcHtmlTitle: "Portal - {{ .Values.theme.texts.productName }}"
 nubusKeycloakBootstrap:
  additionalAnnotations:
@@ -1432,7 +1393,7 @@ extraSecrets:
      umcKeycloakExtensionsDatabasePassword: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
  - name: "ums-keycloak-extensions-smtp-opendesk-credentials"
    stringData:
-      umcKeycloakExtensionsSmtpPassword: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+      umcKeycloakExtensionsSmtpPassword: ""
  - name: "ums-keycloak-bootstrap-ldap-opendesk-credentials"
    stringData:
      password: {{ .Values.secrets.nubus.ldapSearch.keycloak | quote }}
@@ -1442,7 +1403,7 @@ extraSecrets:
      secret-key-id: {{ .Values.objectstores.nubus.secretKey | default .Values.secrets.minio.umsUser | quote }}
  - name: "ums-umc-server-smtp-credentials-custom"
    stringData:
-      password: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+      password: ""
  - name: "ums-provisioning-ox-credentials"
    stringData:
      ox-connector.json: "{ \"name\": \"ox-connector\", \"realms_topics\": [{\"realm\": \"udm\", \"topic\": \"oxmail/oxcontext\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/accessprofile\"}, {\"realm\": \"udm\", \"topic\": \"users/user\"}, {\"realm\": \"udm\", \"topic\": \"oxresources/oxresources\"}, {\"realm\": \"udm\", \"topic\": \"groups/group\"}, {\"realm\": \"udm\", \"topic\": \"oxmail/functional_account\"}], \"request_prefill\": true, \"password\": \"{{ .Values.secrets.oxConnector.provisioningApiPassword }}\" }"
--- a/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-opendesk-keycloak-bootstrap.yaml.gotmpl
@@ -18,98 +18,28 @@ image:
 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 config:
-  clientAccessRestrictions:
+  componentEnabled:
-    {{- if .Values.apps.element.enabled }}
+    notes: {{ .Values.notes.enabled }}
    matrix:
      client: "opendesk-matrix"
      scope: "opendesk-matrix-scope"
      role: "opendesk-matrix-access-control"
      group: "managed-by-attribute-Livecollaboration"
    {{- end }}
    {{- if .Values.apps.jitsi.enabled }}
    jitsi:
      client: "opendesk-jitsi"
      scope: "opendesk-jitsi-scope"
      role: "opendesk-jitsi-access-control"
      group: "managed-by-attribute-Videoconference"
    {{- end }}
    {{- if .Values.apps.xwiki.enabled }}
    xwiki:
      client: "opendesk-xwiki"
      scope: "opendesk-xwiki-scope"
      role: "opendesk-xwiki-access-control"
      group: "managed-by-attribute-Knowledgemanagement"
    {{- end }}
    {{- if .Values.apps.openproject.enabled }}
    openproject:
      client: "opendesk-openproject"
      scope: "opendesk-openproject-scope"
      role: "opendesk-openproject-access-control"
      group: "managed-by-attribute-Projectmanagement"
    {{- end }}
    {{- if .Values.apps.nextcloud.enabled }}
    nextcloud:
      client: "opendesk-nextcloud"
      scope: "opendesk-nextcloud-scope"
      role: "opendesk-nextcloud-access-control"
      group: "managed-by-attribute-Fileshare"
    {{- end }}
    {{- if .Values.apps.oxAppSuite.enabled }}
    oxAppSuite:
      client: "opendesk-oxappsuite"
      scope: "opendesk-oxappsuite-scope"
      role: "opendesk-oxappsuite-access-control"
      group: "managed-by-attribute-Groupware"
    dovecot:
      client: "opendesk-dovecot"
      scope: "opendesk-dovecot-scope"
      role: "opendesk-dovecot-access-control"
      group: "managed-by-attribute-Groupware"
    {{- end }}
    {{- if .Values.apps.notes.enabled }}
    notes:
      client: "opendesk-notes"
      scope: "opendesk-notes-scope"
      role: "opendesk-notes-access-control"
      group: "managed-by-attribute-Notes"
    {{- end }}
  custom:
    clientScopes:
      {{ .Values.functional.authentication.oidc.clientScopes | toYaml | nindent 6 }}
    clients:
      {{ .Values.functional.authentication.oidc.clients | toYaml | nindent 6 }}
  managed:
-    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list',
+    clientScopes: [ 'acr', 'web-origins', 'email', 'profile', 'microprofile-jwt', 'role_list', 'offline_access', 'roles', 'address', 'phone' ]
-                    'offline_access', 'roles', 'address', 'phone' ]
+    clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}', '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}', '${client_security-admin-console}' ]
    clients: [ 'guardian-management-api', 'guardian-scripts', 'guardian-ui', 'UMC', '${client_account}',
               '${client_account-console}', '${client_admin-cli}', '${client_broker}', '${client_realm-management}',
               '${client_security-admin-console}' ]
  keycloak:
-    admin:
+    adminUser: "kcadmin"
-      values:
+    adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
        username: "kcadmin"
        password: {{ .Values.secrets.keycloak.adminPassword | quote }}
    realm: {{ .Values.platform.realm | quote }}
    intraCluster:
      enabled: true
      internalBaseUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
  twoFactorSettings:
    additionalGroups: {{ .Values.functional.authentication.twoFactor.groups }}
  precreateGroups: [ 'Domain Admins', 'Domain Users', '2fa-users', 'IAM API - Full Access',
                     {{ if .Values.apps.nextcloud.enabled }}'managed-by-attribute-Fileshare', 'managed-by-attribute-FileshareAdmin',{{ end }}
                     {{ if .Values.apps.xwiki.enabled }}'managed-by-attribute-Knowledgemanagement', 'managed-by-attribute-KnowledgemanagementAdmin',{{ end }}
                     {{ if .Values.apps.element.enabled }}'managed-by-attribute-Livecollaboration', 'managed-by-attribute-LivecollaborationAdmin',{{ end }}
                     {{ if .Values.apps.openproject.enabled }}'managed-by-attribute-Projectmanagement', 'managed-by-attribute-ProjectmanagementAdmin',{{ end }}
                     {{ if .Values.apps.jitsi.enabled }}'managed-by-attribute-Videoconference',{{ end }}
                     {{ if .Values.apps.oxAppSuite.enabled }}'managed-by-attribute-Groupware',{{ end }}
                     {{ if .Values.apps.notes.enabled }}'managed-by-attribute-Notes',{{ end }}
                      ]
  opendesk:
    # We use client specific scopes as we bind them to Keycloak role membership which itself is linked
    # to LDAP group membership to ensure a user cannot access an application without the required
@@ -119,7 +49,6 @@ config:
        protocol: "openid-connect"
      - name: "write_contacts"
        protocol: "openid-connect"
      {{ if .Values.apps.openproject.enabled }}
      - name: "opendesk-openproject-scope"
        description: "Scope for the claims required by openDesk's OpenProject instance."
        protocol: "openid-connect"
@@ -193,8 +122,6 @@ config:
              access.token.claim: true
              claim.name: "family_name"
              jsonType.label: "String"
      {{ end }}
      {{ if .Values.apps.jitsi.enabled }}
      - name: "opendesk-jitsi-scope"
        description: "Scope for the claims required by openDesk's Jitsi instance."
        protocol: "openid-connect"
@@ -242,8 +169,6 @@ config:
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
      {{ end }}
      {{ if .Values.apps.nextcloud.enabled }}
      - name: "opendesk-nextcloud-scope"
        description: "Scope for the claims required by openDesk's Nextcloud instance."
        protocol: "openid-connect"
@@ -293,8 +218,6 @@ config:
              access.token.claim: true
              claim.name: "context"
              jsonType.label: "String"
      {{ end }}
      {{ if .Values.apps.element.enabled }}
      - name: "opendesk-matrix-scope"
        description: "Scope for the claims required by openDesk's Matrix instance."
        protocol: "openid-connect"
@@ -342,8 +265,6 @@ config:
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
      {{ end }}
      {{ if .Values.apps.xwiki.enabled }}
      - name: "opendesk-xwiki-scope"
        description: "Scope for the claims required by openDesk's XWiki instance."
        protocol: "openid-connect"
@@ -391,8 +312,6 @@ config:
              access.token.claim: true
              claim.name: "email"
              jsonType.label: "String"
      {{ end }}
      {{ if .Values.apps.oxAppSuite.enabled }}
      - name: "opendesk-dovecot-scope"
        description: "Scope for the claims required by openDesk's Dovecot instance."
        protocol: "openid-connect"
@@ -456,8 +375,7 @@ config:
              access.token.claim: true
              claim.name: "opendesk_username"
              jsonType.label: "String"
-      {{ end }}
+{{ if .Values.notes.enabled }}
      {{ if .Values.apps.notes.enabled }}
      - name: "opendesk-notes-scope"
        description: "Scope for the claims required by openDesk's Notes instance."
        protocol: "openid-connect"
@@ -498,7 +416,7 @@ config:
              access.token.claim: true
              claim.name: "family_name"
              jsonType.label: "String"
-      {{ end }}
+{{ end }}
    clients:
      - name: "opendesk-intercom"
        clientId: "opendesk-intercom"
@@ -548,7 +466,7 @@ config:
              jsonType.label: "String"
        defaultClientScopes:
          - "offline_access"
-      {{ if .Values.apps.notes.enabled }}
+{{ if .Values.notes.enabled }}
      - name: "opendesk-notes"
        clientId: "opendesk-notes"
        protocol: "openid-connect"
@@ -586,8 +504,7 @@ config:
          user.info.response.signature.alg: "RS256"
        defaultClientScopes:
          - "opendesk-notes-scope"
-      {{ end }}
+{{ end }}
      {{ if .Values.apps.oxAppSuite.enabled }}
      - name: "opendesk-dovecot"
        clientId: "opendesk-dovecot"
        protocol: "openid-connect"
@@ -601,28 +518,6 @@ config:
          backchannel.logout.session.required: false
        defaultClientScopes:
          - "opendesk-dovecot-scope"
      - name: "opendesk-oxappsuite"
        clientId: "opendesk-oxappsuite"
        protocol: "openid-connect"
        clientAuthenticatorType: "client-secret"
        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
        authorizationServicesEnabled: false
        attributes:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-oxappsuite-scope"
          - "read_contacts"
          - "write_contacts"
      {{ end }}
      {{ if .Values.apps.jitsi.enabled }}
      - name: "opendesk-jitsi"
        clientId: "opendesk-jitsi"
        protocol: "openid-connect"
@@ -636,8 +531,6 @@ config:
        authorizationServicesEnabled: false
        defaultClientScopes:
          - "opendesk-jitsi-scope"
      {{ end }}
      {{ if .Values.apps.element.enabled }}
      - name: "opendesk-matrix"
        clientId: "opendesk-matrix"
        protocol: "openid-connect"
@@ -660,8 +553,6 @@ config:
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-matrix-scope"
      {{ end }}
      {{ if .Values.apps.nextcloud.enabled }}
      - name: "opendesk-nextcloud"
        clientId: "opendesk-nextcloud"
        protocol: "openid-connect"
@@ -682,8 +573,6 @@ config:
          - "opendesk-nextcloud-scope"
          - "read_contacts"
          - "write_contacts"
      {{ end }}
      {{ if .Values.apps.openproject.enabled }}
      - name: "opendesk-openproject"
        clientId: "opendesk-openproject"
        protocol: "openid-connect"
@@ -703,8 +592,26 @@ config:
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-openproject-scope"
-      {{ end }}
+      - name: "opendesk-oxappsuite"
-      {{ if .Values.apps.xwiki.enabled }}
+        clientId: "opendesk-oxappsuite"
        protocol: "openid-connect"
        clientAuthenticatorType: "client-secret"
        secret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
        redirectUris:
          - "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*"
          - "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        consentRequired: false
        frontchannelLogout: false
        publicClient: false
        authorizationServicesEnabled: false
        attributes:
          backchannel.logout.session.required: true
          backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/ajax/oidc/backchannel_logout"
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-oxappsuite-scope"
          - "read_contacts"
          - "write_contacts"
      - name: "opendesk-xwiki"
        clientId: "opendesk-xwiki"
        protocol: "openid-connect"
@@ -723,7 +630,6 @@ config:
          post.logout.redirect.uris: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/*"
        defaultClientScopes:
          - "opendesk-xwiki-scope"
      {{ end }}
 containerSecurityContext:
  allowPrivilegeEscalation: false
--- a/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile-child.yaml.gotmpl
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+# SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 # SPDX-License-Identifier: Apache-2.0
 ---
 repositories:
@@ -7,31 +7,19 @@ repositories:
  - name: "dovecot-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.dovecot.verify }}
    oci: true
  {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
  {{- else }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
+    oci: true
-  {{- end }}
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
  # Open-Xchange
  - name: "open-xchange-repo"
    keyring: "../../files/gpg-pubkeys/open-xchange-com.gpg"
    verify: {{ .Values.charts.oxAppSuite.verify }}
    oci: true
  {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
    username: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_ENTERPRISE_PRIVATE_REGISTRY_PASSWORD" | quote }}
    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDeEnterprise .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
  {{- else }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
+    oci: true
-  {{- end }}
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuite.registry }}/{{ .Values.charts.oxAppSuite.repository }}"
  # openDesk Open-Xchange Bootstrap
  # Source:
@@ -42,24 +30,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxAppSuiteBootstrap.registry }}/{{ .Values.charts.oxAppSuiteBootstrap.repository }}"
  # OX Connector
  - name: "ox-connector-repo"
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
  # openDesk Postfix
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
  - name: "postfix-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.postfix.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
 releases:
  - name: "dovecot"
@@ -67,24 +45,10 @@ releases:
    version: "{{ .Values.charts.dovecot.version }}"
    values:
      - "values-dovecot.yaml.gotmpl"
-      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{ range .Values.customization.release.dovecot }}
      - "values-dovecot-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.dovecot }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.dovecot.enabled }}
+    installed: {{ .Values.dovecot.enabled }}
    timeout: 900
  - name: "postfix-ox"
    chart: "postfix-repo/{{ .Values.charts.postfix.name }}"
    version: "{{ .Values.charts.postfix.version }}"
    values:
      - "values-postfix.yaml.gotmpl"
      {{- range .Values.customization.release.postfix }}
      - {{ . }}
      {{- end }}
    installed: {{ .Values.apps.postfix.enabled }}
    timeout: 900
  - name: "open-xchange"
@@ -92,14 +56,11 @@ releases:
    version: "{{ .Values.charts.oxAppSuite.version }}"
    values:
      - "values-openxchange.yaml.gotmpl"
-      - "values-openxchange-contact-picker.yaml.gotmpl"
+      - "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
-      {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
+      {{ range .Values.customization.release.openxchange }}
      - "values-openxchange-enterprise.yaml.gotmpl"
      {{- end }}
      {{- range .Values.customization.release.openxchange }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.oxAppSuite.enabled }}
+    installed: {{ .Values.oxAppSuite.enabled }}
    timeout: 900
  - name: "opendesk-open-xchange-bootstrap"
@@ -107,10 +68,10 @@ releases:
    version: "{{ .Values.charts.oxAppSuiteBootstrap.version }}"
    values:
      - "values-openxchange-bootstrap.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskOpenxchangeBootstrap }}
+      {{ range .Values.customization.release.opendeskOpenxchangeBootstrap }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.oxAppSuite.enabled }}
+    installed: {{ .Values.oxAppSuite.enabled }}
    timeout: 900
  - name: "ox-connector"
@@ -118,10 +79,10 @@ releases:
    version: "{{ .Values.charts.oxConnector.version }}"
    values:
      - "values-oxconnector.yaml.gotmpl"
-      {{- range .Values.customization.release.oxConnector }}
+      {{ range .Values.customization.release.oxConnector }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.oxAppSuite.enabled }}
+    installed: {{ .Values.oxAppSuite.enabled }}
    needs:
      - "open-xchange"
--- a/helmfile/apps/open-xchange/helmfile.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
@@ -1,45 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.dovecot.registry | quote }}
  repository: {{ .Values.images.dovecot.repository | quote }}
  tag: {{ .Values.images.dovecot.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 imageInitCassandra:
  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandra.registry | quote }}
  repository: {{ .Values.images.cassandra.repository | quote }}
  tag: {{ .Values.images.cassandra.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 imagePullSecrets:
  {{ .Values.global.imagePullSecrets | toYaml | nindent 2 }}
 dovecot:
  dictmap:
    enabled: true
    host: {{ .Values.databases.dovecotDictmap.host | quote }}
    port: {{ .Values.databases.dovecotDictmap.port }}
    username: {{ .Values.databases.dovecotDictmap.username | quote }}
    password: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
    keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
  sharedMailboxes:
    enabled: false
    host: {{ .Values.databases.dovecotACL.host | quote }}
    port: {{ .Values.databases.dovecotACL.port }}
    username: {{ .Values.databases.dovecotACL.username | quote }}
    password: {{ .Values.secrets.cassandra.dovecotACLUser | quote }}
    keyspace: {{ .Values.databases.dovecotACL.name | quote }}
  objectStorage:
    encryption:
      privateKey:
        value: {{ env "DOVECOT_CRYPT_PRIVATE_KEY" | quote }}
      publicKey:
        value: {{ env "DOVECOT_CRYPT_PUBLIC_KEY" | quote }}
    fqdn: {{ .Values.objectstores.dovecot.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
    username: {{ .Values.objectstores.dovecot.username | quote }}
    password: {{ .Values.secrets.minio.dovecotUser | quote }}
 ...
--- a/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot.yaml.gotmpl
@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -23,8 +23,8 @@ dovecot:
    enabled: true
    host: {{ .Values.ldap.host | quote }}
    port: 389
-    base: "{{ .Values.ldap.baseDn }}"
+    base: "dc=swp-ldap,dc=internal"
-    dn: "uid=ldapsearch_dovecot,cn=users,{{ .Values.ldap.baseDn }}"
+    dn: "uid=ldapsearch_dovecot,cn=users,dc=swp-ldap,dc=internal"
    password: {{ .Values.secrets.nubus.ldapSearch.dovecot | quote }}
  oidc:
    enabled: true
@@ -34,10 +34,11 @@ dovecot:
    introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
    usernameAttribute: "opendesk_username"
  loginTrustedNetworks: {{ join " " .Values.cluster.networking.cidr | quote }}
  submission:
    enabled: true
    ssl: "no"
-    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
+    host: "{{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain }}:25"
 certificate:
  secretName: {{ .Values.ingress.tls.secretName | quote }}
@@ -91,23 +92,23 @@ podSecurityContext:
 persistence:
  {{- if .Values.cluster.persistence.readWriteMany.enabled }}
-  storageClassName: {{ coalesce .Values.persistence.storages.dovecot.storageClassName .Values.persistence.storageClassNames.RWX | quote }}
+  storageClassName: {{ .Values.persistence.storageClassNames.RWX | quote }}
  accessModes:
    - "ReadWriteMany"
  {{- else }}
-  storageClassName: {{ coalesce .Values.persistence.storages.dovecot.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClassName: {{ .Values.persistence.storageClassNames.RWO | quote }}
  accessModes:
    - "ReadWriteOnce"
  {{- end }}
-  size: {{ .Values.persistence.storages.dovecot.size | quote }}
+  size: {{ .Values.persistence.size.dovecot | quote }}
 resources:
  {{ .Values.resources.dovecot | toYaml | nindent 2 }}
-{{- if or (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "NodePort") (eq (coalesce .Values.service.type.dovecot .Values.cluster.service.type) "LoadBalancer") }}
+{{- if or (eq .Values.cluster.service.type "NodePort") (eq .Values.cluster.service.type "LoadBalancer") }}
 service:
  external:
    enabled: true
-    type: {{ coalesce .Values.service.type.dovecot .Values.cluster.service.type | quote }}
+    type: {{ .Values.cluster.service.type | quote }}
 {{- end }}
 ...
--- a/helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-enterprise-contact-picker.yaml.gotmpl
@@ -25,7 +25,7 @@ appsuite:
          auth:
            type: "adminDN"
            adminDN:
-              dn: "uid=ldapsearch_ox,cn=users,{{ .Values.ldap.baseDn }}"
+              dn: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
              password: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}
    uiSettings:
--- a/helmfile/apps/open-xchange/values-openxchange-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange-enterprise.yaml.gotmpl
@@ -1,19 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 appsuite:
  plugins-ui:
    enabled: false
  core-mw:
    global:
      extras:
        monitoring:
          enabled: true
    image:
      registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
    update:
      image:
        registry: {{ coalesce .Values.repositories.image.registryOpencodeDeEnterprise .Values.global.imageRegistry .Values.images.openxchangeCoreMW.registry | quote }}
 ...
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -13,14 +13,10 @@ global:
  mysql:
    host: {{ .Values.databases.oxAppSuite.host | quote }}
    database: {{ .Values.databases.oxAppSuite.name | quote }}
    readHost: {{ .Values.databases.oxAppSuite.readHost | quote }}
    readDatabase: {{ .Values.databases.oxAppSuite.name | quote }}
    auth:
      user: {{ .Values.databases.oxAppSuite.username | quote }}
      password: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
      rootPassword: {{ .Values.databases.oxAppSuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
      readUser: {{ .Values.databases.oxAppSuite.readUser | default .Values.databases.oxAppSuite.username | quote }}
      readPassword: {{ .Values.databases.oxAppSuite.readPassword | default .Values.databases.oxAppSuite.password | quote}}
 nextcloud-integration-ui:
  image:
@@ -119,7 +115,7 @@ appsuite:
    asConfig:
      default:
        host: "all"
-        productName: {{ .Values.theme.texts.productName | quote }}
+        pageHeaderPrefix: "as8.souvap App Suite"
        oidcLogin: true
        oidcPath: "/oidc"
    masterAdmin: "admin"
@@ -241,7 +237,7 @@ appsuite:
      com.openexchange.mail.mailServer: "dovecot"
      com.openexchange.mail.mailServerSource: "global"
      com.openexchange.mail.transport.authType: "xoauth2"
-      com.openexchange.mail.transportServer: "postfix-ox"
+      com.openexchange.mail.transportServer: "postfix"
      com.openexchange.mail.transportServerSource: "global"
      # Requirements for OX-Connector
      com.openexchange.user.enforceUniqueDisplayName: "false"
@@ -280,19 +276,14 @@ appsuite:
      com.openexchange.conference.element.enabled: "true"
      com.openexchange.conference.element.meetingHostUrl: http://matrix-neodatefix-bot
      com.openexchange.conference.element.matrixLoginUrl: http://opendesk-synapse-web:8008/_matrix/client/v3/login
-      com.openexchange.conference.element.matrixUuidClaimName: {{ if .Values.functional.chat.matrix.profile.useImmutableIdentifierForLocalpart }}"opendesk_useruuid"{{ else }}"opendesk_username"{{ end }}
+      com.openexchange.conference.element.matrixUuidClaimName: opendesk_useruuid
      # GDPR
      com.openexchange.gdpr.dataexport.enabled: "false"
      com.openexchange.gdpr.dataexport.active: "false"
      # Guard
      com.openexchange.guard.storage.file.fileStorageType: "file"
      com.openexchange.guard.storage.file.uploadDirectory: "/opt/open-xchange/guard-files/"
      com.openexchange.guard.guestSMTPMailFrom: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
      com.openexchange.guard.guestSMTPPassword: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
      com.openexchange.guard.guestSMTPPort: "25"
      com.openexchange.guard.guestSMTPServer: "postfix"
      com.openexchange.guard.guestSMTPUsername: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
      com.openexchange.guard.useStartTLS: "false"
      # S/MIME
      # Usage (in browser console after login):
      # http = (await import('./io.ox/core/http.js')).default
@@ -339,8 +330,8 @@ appsuite:
      /opt/open-xchange/etc/system.properties:
        SERVER_NAME: "oxserver"
      /opt/open-xchange/etc/ldapauth.properties:
-        java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/{{ .Values.ldap.baseDn }}"
+        java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/dc=swp-ldap,dc=internal"
-        bindDN: "uid=ldapsearch_ox,cn=users,{{ .Values.ldap.baseDn }}"
+        bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
        bindDNPassword: {{ .Values.secrets.nubus.ldapSearch.ox | quote }}
        bindOnly: "false"
      /opt/open-xchange/etc/antivirus.properties:
@@ -349,9 +340,9 @@ appsuite:
        com.openexchange.antivirus.server: {{ .Values.antivirus.icap.host | quote }}
        com.openexchange.antivirus.port: {{ .Values.antivirus.icap.port | quote }}
        {{- else }}
-        {{- if .Values.apps.clamavDistributed.enabled }}
+        {{- if .Values.clamavDistributed.enabled }}
        com.openexchange.antivirus.server: "clamav-icap"
-        {{- else if .Values.apps.clamavSimple.enabled }}
+        {{- else if .Values.clamavSimple.enabled }}
        com.openexchange.antivirus.server: "clamav-simple"
        {{- end }}
        com.openexchange.antivirus.port: "1344"
--- a/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-oxconnector.yaml.gotmpl
@@ -66,28 +66,35 @@ resourcesWaitForDependency:
  {{ .Values.resources.oxConnector | toYaml | nindent 2 }}
 persistence:
-  size: {{ .Values.persistence.storages.oxConnector.size | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
  storageClass: {{ coalesce .Values.persistence.storages.oxConnector.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
 podAnnotations: {}
 replicaCount: {{ .Values.replicas.oxConnector }}
 podSecurityContext:
  fsGroup: 1000
 securityContext:
  privileged: false
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - "ALL"
-  readOnlyRootFilesystem: true
+    add:
-  runAsNonRoot: true
+      - "CHOWN"
-  runAsUser: 1000
+      - "DAC_OVERRIDE"
-  runAsGroup: 1000
+      - "FOWNER"
      - "FSETID"
      - "KILL"
      - "SETGID"
      - "SETUID"
      - "SETPCAP"
      - "NET_BIND_SERVICE"
      - "SYS_CHROOT"
  privileged: false
  seccompProfile:
    type: "RuntimeDefault"
  runAsUser: 0
  runAsGroup: 0
  runAsNonRoot: false
  readOnlyRootFilesystem: false
  seLinuxOptions:
    {{ .Values.seLinuxOptions.oxConnector | toYaml | nindent 4 }}
--- a/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
@@ -1,100 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 certificate:
  secretName: {{ .Values.ingress.tls.secretName | quote }}
  request:
    enabled: false
 containerSecurityContext:
  allowPrivilegeEscalation: true
  capabilities: {}
  enabled: true
  seccompProfile:
    type: "RuntimeDefault"
  readOnlyRootFilesystem: true
  runAsNonRoot: false
  runAsUser: 0
  runAsGroup: 0
  privileged: true
  seLinuxOptions:
    {{ .Values.seLinuxOptions.postfix | toYaml | nindent 4 }}
 global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 image:
  registry: {{ coalesce .Values.repositories.image.registryOpencodeDe .Values.global.imageRegistry .Values.images.postfix.registry | quote }}
  repository: {{ .Values.images.postfix.repository | quote }}
  tag: {{ .Values.images.postfix.tag | quote }}
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 persistence:
  size: {{ .Values.persistence.storages.postfix.size | quote }}
  storageClass: {{ coalesce .Values.persistence.storages.postfix.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
 podSecurityContext:
  enabled: true
  fsGroup: 101
 postfix:
  amavisHost: ""
  amavisPortIn: ""
  domain: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  hostname: "postfix"
  inetProtocols: "ipv4"
  milterDefaultAction: "tempfail"
  overrides:
    - fileName: "sasl_passwd.map"
      content:
        - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
  {{- if .Values.apps.dkimpy.enabled }}
  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
  {{- end }}
  rspamdHost: ""
  relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
  relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
  smtpSASLAuthEnable: "yes"
  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
  smtpTLSSecurityLevel: "encrypt"
  smtpdSASLAuthEnable: "yes"
  smtpdSASLSecurityOptions: "noanonymous"
  smtpdSASLType: "dovecot"
  smtpdTLSSecurityLevel: "encrypt"
  smtpdTLSCertFile: "/etc/tls/tls.crt"
  smtpdKeyFile: "/etc/tls/tls.key"
  smtpdSASLPath: "inet:dovecot:3659"
  staticAuthDB:
    enabled: false
  {{- if .Values.antivirus.milter.host }}
  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
  {{- else }}
  {{- if .Values.apps.clamavDistributed.enabled }}
  smtpdMilters: "inet:clamav-milter:7357"
  {{- else if .Values.apps.clamavSimple.enabled }}
  smtpdMilters: "inet:clamav-simple:7357"
  {{- end }}
  {{- end }}
  virtualMailboxDomains: {{ if .Values.global.additionalMailDomains }}{{ printf "%s,%s" (.Values.global.mailDomain | default .Values.global.domain) .Values.global.additionalMailDomains }}{{ else }}{{ .Values.global.mailDomain | default .Values.global.domain | quote }}{{ end }}
  virtualTransport: "lmtps:dovecot:24"
 podAnnotations: {}
 replicaCount: {{ .Values.replicas.postfix }}
 resources:
  {{ .Values.resources.postfix | toYaml | nindent 2 }}
 {{- if or (eq (coalesce .Values.service.type.postfix .Values.cluster.service.type) "NodePort") (eq (coalesce .Values.service.type.postfix .Values.cluster.service.type) "LoadBalancer") }}
 service:
  external:
    enabled: true
    type: {{ coalesce .Values.service.type.postfix .Values.cluster.service.type | quote }}
 {{- end }}
 ...
--- a/helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-post/helmfile-child.yaml.gotmpl
@@ -4,27 +4,27 @@
 repositories:
  # openDesk Migrations
  # Source:
-  - name: "opendesk-migrations-repo"
+  - name: "openproject-migrations-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.migrations.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
 releases:
  - name: "opendesk-migrations-post"
-    chart: "opendesk-migrations-repo/{{ .Values.charts.migrations.name }}"
+    chart: "openproject-migrations-repo/{{ .Values.charts.migrations.name }}"
    version: "{{ .Values.charts.migrations.version }}"
    wait: true
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
-      {{- range .Values.customization.release.migrationsPost }}
+      {{ range .Values.customization.release.migrationsPost }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.migrations.enabled }}
+    installed: {{ .Values.migrations.enabled }}
    timeout: 900
 commonLabels:
--- a/helmfile/apps/opendesk-migrations-post/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-post/helmfile.yaml.gotmpl
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-pre/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.migrations.registry }}/{{ .Values.charts.migrations.repository }}"
 releases:
  - name: "opendesk-migrations-pre"
@@ -21,10 +21,10 @@ releases:
    values:
      - "values.yaml.gotmpl"
      - "../../shared/migrations.yaml.gotmpl"
-      {{- range .Values.customization.release.migrationsPre }}
+      {{ range .Values.customization.release.migrationsPre }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.migrations.enabled }}
+    installed: {{ .Values.migrations.enabled }}
    timeout: 900
 commonLabels:
--- a/helmfile/apps/opendesk-migrations-pre/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-migrations-pre/helmfile.yaml.gotmpl
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
 releases:
  - name: "opendesk-openproject-bootstrap"
@@ -20,10 +20,10 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskOpenprojectBootstrap }}
+      {{ range .Values.customization.release.opendeskOpenprojectBootstrap }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.openproject.enabled }}
+    installed: {{ .Values.openproject.enabled }}
    timeout: 900
 commonLabels:
--- a/helmfile/apps/opendesk-openproject-bootstrap/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl
+++ b/helmfile/apps/opendesk-openproject-bootstrap/values.yaml.gotmpl
@@ -13,7 +13,6 @@ global:
 cleanup:
  deletePodsOnSuccess: {{ .Values.debug.cleanup.deletePodsOnSuccess }}
  deletePodsOnSuccessTimeout: {{ .Values.debug.cleanup.deletePodsOnSuccessTimeout }}
  keepPVCOnDelete: {{ .Values.debug.cleanup.keepPVCOnDelete }}
 config:
--- a/helmfile/apps/opendesk-services/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
  # openDesk Home
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-home
@@ -20,7 +20,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.home.registry }}/{{ .Values.charts.home.repository }}"
  # openDesk Certificates
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
@@ -30,7 +30,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
    # openDesk Alerts
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-alerts
@@ -40,7 +40,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskAlerts.registry }}/{{ .Values.charts.opendeskAlerts.repository }}"
    # openDesk Grafana Dashboards
    # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dashboards
@@ -50,7 +50,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskDashboards.registry }}/{{ .Values.charts.opendeskDashboards.repository }}"
    # openDesk Static Files
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-static-files
@@ -60,7 +60,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.opendeskStaticFiles.registry }}/{{ .Values.charts.opendeskStaticFiles.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.opendeskStaticFiles.registry }}/{{ .Values.charts.opendeskStaticFiles.repository }}"
 releases:
  - name: "opendesk-otterize"
@@ -68,9 +68,9 @@ releases:
    version: "{{ .Values.charts.otterize.version }}"
    values:
      - "values-otterize.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskOtterize }}
+      {{ range .Values.customization.release.opendeskOtterize }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
    installed: {{ .Values.security.otterizeIntents.enabled }}
    timeout: 900
@@ -79,20 +79,20 @@ releases:
    version: "{{ .Values.charts.home.version }}"
    values:
      - "values-home.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskHome }}
+      {{ range .Values.customization.release.opendeskHome }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.home.enabled }}
+    installed: {{ .Values.home.enabled }}
  - name: "opendesk-certificates"
    chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
    version: "{{ .Values.charts.certificates.version }}"
    values:
      - "values-certificates.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskCertificates }}
+      {{ range .Values.customization.release.opendeskCertificates }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.certificates.enabled }}
+    installed: {{ .Values.certificates.enabled }}
    timeout: 900
  - name: "opendesk-alerts"
@@ -100,9 +100,9 @@ releases:
    version: "{{ .Values.charts.opendeskAlerts.version }}"
    values:
      - "values-opendesk-alerts.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskAlerts }}
+      {{ range .Values.customization.release.opendeskAlerts}}
      - {{ . }}
-      {{- end }}
+      {{ end }}
    installed: {{ .Values.monitoring.prometheus.prometheusRules.enabled }}
    timeout: 900
@@ -111,9 +111,7 @@ releases:
    version: "{{ .Values.charts.opendeskDashboards.version }}"
    values:
      - "values-opendesk-dashboards.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskDashboards }}
+      - {{ .Values.customization.release.opendeskDashboards | default "additionalValues: false" }}
      - {{ . }}
      {{- end }}
    installed: {{ .Values.monitoring.grafana.dashboards.enabled }}
    timeout: 900
@@ -122,10 +120,8 @@ releases:
    version: "{{ .Values.charts.opendeskStaticFiles.version }}"
    values:
      - "values-opendesk-static-files.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskStaticFiles }}
+      - {{ .Values.customization.release.opendeskStaticFiles | default "additionalValues: false" }}
-      - {{ . }}
+    installed: {{ .Values.staticFiles.enabled }}
      {{- end }}
    installed: {{ .Values.apps.staticFiles.enabled }}
    timeout: 900
 commonLabels:
--- a/helmfile/apps/opendesk-services/helmfile.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-certificates.yaml.gotmpl
@@ -7,13 +7,13 @@ SPDX-License-Identifier: Apache-2.0
 global:
  domain: {{ .Values.global.domain | quote }}
  hosts:
-    {{- if .Values.apps.collabora.enabled }}
+    {{- if .Values.collabora.enabled }}
    collabora: {{ .Values.global.hosts.collabora }}
    {{- end }}
-    {{- if .Values.apps.cryptpad.enabled }}
+    {{- if .Values.cryptpad.enabled }}
    cryptpad: {{ .Values.global.hosts.cryptpad }}
    {{- end }}
-    {{- if .Values.apps.element.enabled }}
+    {{- if .Values.element.enabled }}
    element: {{ .Values.global.hosts.element }}
    matrixNeoBoardWidget: {{ .Values.global.hosts.matrixNeoBoardWidget }}
    matrixNeoChoiceWidget: {{ .Values.global.hosts.matrixNeoChoiceWidget }}
@@ -23,36 +23,32 @@ global:
    synapseFederation: {{ .Values.global.hosts.synapseFederation }}
    whiteboard: {{ .Values.global.hosts.whiteboard }}
    {{- end }}
-    {{- if .Values.apps.nubus.enabled }}
+    {{- if .Values.nubus.enabled }}
    intercomService: {{ .Values.global.hosts.intercomService }}
    {{- end }}
-    {{- if .Values.apps.jitsi.enabled }}
+    {{- if .Values.jitsi.enabled }}
    jitsi: {{ .Values.global.hosts.jitsi }}
    {{- end }}
-    {{- if .Values.apps.minio.enabled }}
+    {{- if .Values.minio.enabled }}
    minioApi: {{ .Values.global.hosts.minioApi }}
    minioConsole: {{ .Values.global.hosts.minioConsole }}
    {{- end }}
-    {{- if .Values.apps.nextcloud.enabled }}
+    {{- if .Values.nextcloud.enabled }}
    nextcloud: {{ .Values.global.hosts.nextcloud }}
    {{- end }}
-    {{- if .Values.apps.openproject.enabled }}
+    {{- if .Values.openproject.enabled }}
    openproject: {{ .Values.global.hosts.openproject }}
    {{- end }}
-    {{- if .Values.apps.oxAppSuite.enabled }}
+    {{- if .Values.oxAppSuite.enabled }}
    openxchange: {{ .Values.global.hosts.openxchange }}
    {{- end }}
-    {{- if .Values.apps.nubus.enabled }}
+    {{- if .Values.nubus.enabled }}
    keycloak: {{ .Values.global.hosts.keycloak }}
    nubus: {{ .Values.global.hosts.nubus }}
    {{- end }}
-    {{- if .Values.apps.xwiki.enabled }}
+    {{- if .Values.xwiki.enabled }}
    xwiki: {{ .Values.global.hosts.xwiki }}
    {{- end }}
    {{- if .Values.apps.notes.enabled }}
    notes: {{ .Values.global.hosts.notes }}
    {{- end }}
 issuerRef:
  name: {{ .Values.certificate.issuerRef.name | quote }}
--- a/helmfile/apps/opendesk-services/values-opendesk-alerts.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-opendesk-alerts.yaml.gotmpl
@@ -10,43 +10,43 @@ additionalLabels:
 config:
  collabora:
-    enable: {{ .Values.apps.collabora.enabled }}
+    enable: {{ .Values.collabora.enabled }}
    selectors:
-      namespace: {{ .Values.apps.collabora.namespace | quote }}
+      namespace: {{ .Values.collabora.namespace | quote }}
  matrix:
-    enable: {{ .Values.apps.element.enabled }}
+    enable: {{ .Values.element.enabled }}
    selectors:
-      namespace: {{ .Values.apps.element.namespace | quote }}
+      namespace: {{ .Values.element.namespace | quote }}
  diagrams:
-    enable: {{ .Values.apps.cryptpad.enabled }}
+    enable: {{ .Values.cryptpad.enabled }}
    selectors:
-      namespace: {{ .Values.apps.cryptpad.namespace | quote }}
+      namespace: {{ .Values.cryptpad.namespace | quote }}
  nextcloud:
-    enable: {{ .Values.apps.nextcloud.enabled }}
+    enable: {{ .Values.nextcloud.enabled }}
    selectors:
-      namespace: {{ .Values.apps.nextcloud.namespace | quote }}
+      namespace: {{ .Values.nextcloud.namespace | quote }}
  openXChange:
-    enable: {{ .Values.apps.oxAppSuite.enabled }}
+    enable: {{ .Values.oxAppSuite.enabled }}
    selectors:
-      namespace: {{ .Values.apps.oxAppSuite.namespace | quote }}
+      namespace: {{ .Values.oxAppSuite.namespace | quote }}
  xwiki:
-    enable: {{ .Values.apps.xwiki.enabled }}
+    enable: {{ .Values.xwiki.enabled }}
    selectors:
-      namespace: {{ .Values.apps.xwiki.namespace | quote }}
+      namespace: {{ .Values.xwiki.namespace | quote }}
  nubus:
-    enable: {{ .Values.apps.nubus.enabled }}
+    enable: {{ .Values.nubus.enabled }}
    selectors:
-      namespace: {{ .Values.apps.nubus.namespace | quote }}
+      namespace: {{ .Values.nubus.namespace | quote }}
  openProject:
-    enable: {{ .Values.apps.openproject.enabled }}
+    enable: {{ .Values.openproject.enabled }}
    selectors:
-      namespace: {{ .Values.apps.openproject.namespace | quote }}
+      namespace: {{ .Values.openproject.namespace | quote }}
  jitsi:
-    enable: {{ .Values.apps.jitsi.enabled }}
+    enable: {{ .Values.jitsi.enabled }}
    selectors:
-      namespace: {{ .Values.apps.jitsi.namespace | quote }}
+      namespace: {{ .Values.jitsi.namespace | quote }}
  collabora:
-    enable: {{ .Values.apps.collabora.enabled }}
+    enable: {{ .Values.collabora.enabled }}
    selectors:
-      namespace: {{ .Values.apps.collabora.namespace | quote }}
+      namespace: {{ .Values.collabora.namespace | quote }}
--- a/helmfile/apps/opendesk-services/values-opendesk-dashboards.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-opendesk-dashboards.yaml.gotmpl
@@ -12,43 +12,43 @@ additionalLabels:
 config:
  apps:
    collabora:
-      enable: {{ .Values.apps.collabora.enabled }}
+      enable: {{ .Values.collabora.enabled }}
      selectors:
-        namespace: {{ .Values.apps.collabora.namespace | quote }}
+        namespace: {{ .Values.collabora.namespace | quote }}
    matrixElement:
-      enable: {{ .Values.apps.element.enabled }}
+      enable: {{ .Values.element.enabled }}
      selectors:
-        namespace: {{ .Values.apps.element.namespace | quote }}
+        namespace: {{ .Values.element.namespace | quote }}
    diagrams:
-      enable: {{ .Values.apps.cryptpad.enabled }}
+      enable: {{ .Values.cryptpad.enabled }}
      selectors:
-        namespace: {{ .Values.apps.cryptpad.namespace | quote }}
+        namespace: {{ .Values.cryptpad.namespace | quote }}
    nextcloud:
-      enable: {{ .Values.apps.nextcloud.enabled }}
+      enable: {{ .Values.nextcloud.enabled }}
      selectors:
-        namespace: {{ .Values.apps.nextcloud.namespace | quote }}
+        namespace: {{ .Values.nextcloud.namespace | quote }}
    openxchange:
-      enable: {{ .Values.apps.oxAppSuite.enabled }}
+      enable: {{ .Values.oxAppSuite.enabled }}
      selectors:
-        namespace: {{ .Values.apps.oxAppSuite.namespace | quote }}
+        namespace: {{ .Values.oxAppSuite.namespace | quote }}
    xwiki:
-      enable: {{ .Values.apps.xwiki.enabled }}
+      enable: {{ .Values.xwiki.enabled }}
      selectors:
-        namespace: {{ .Values.apps.xwiki.namespace | quote }}
+        namespace: {{ .Values.xwiki.namespace | quote }}
    nubus:
-      enable: {{ .Values.apps.nubus.enabled }}
+      enable: {{ .Values.nubus.enabled }}
      selectors:
-        namespace: {{ .Values.apps.nubus.namespace | quote }}
+        namespace: {{ .Values.nubus.namespace | quote }}
    openproject:
-      enable: {{ .Values.apps.openproject.enabled }}
+      enable: {{ .Values.openproject.enabled }}
      selectors:
-        namespace: {{ .Values.apps.openproject.namespace | quote }}
+        namespace: {{ .Values.openproject.namespace | quote }}
    jitsi:
-      enable: {{ .Values.apps.jitsi.enabled }}
+      enable: {{ .Values.jitsi.enabled }}
      selectors:
-        namespace: {{ .Values.apps.jitsi.namespace | quote }}
+        namespace: {{ .Values.jitsi.namespace | quote }}
    collabora:
-      enable: {{ .Values.apps.collabora.enabled }}
+      enable: {{ .Values.collabora.enabled }}
      selectors:
-        namespace: {{ .Values.apps.collabora.namespace | quote }}
+        namespace: {{ .Values.collabora.namespace | quote }}
 ...
--- a/helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl
+++ b/helmfile/apps/opendesk-services/values-otterize.yaml.gotmpl
@@ -10,47 +10,47 @@ global:
 apps:
  clamavDistributed:
-    enabled: {{ .Values.apps.clamavDistributed.enabled }}
+    enabled: {{ .Values.clamavDistributed.enabled }}
  clamavSimple:
-    enabled: {{ .Values.apps.clamavSimple.enabled }}
+    enabled: {{ .Values.clamavSimple.enabled }}
  collabora:
-    enabled: {{ .Values.apps.collabora.enabled }}
+    enabled: {{ .Values.collabora.enabled }}
  cryptpad:
-    enabled: {{ .Values.apps.cryptpad.enabled }}
+    enabled: {{ .Values.cryptpad.enabled }}
  dkimpy:
-    enabled: {{ .Values.apps.dkimpy.enabled }}
+    enabled: {{ .Values.dkimpy.enabled }}
  dovecot:
-    enabled: {{ .Values.apps.dovecot.enabled }}
+    enabled: {{ .Values.dovecot.enabled }}
  element:
-    enabled: {{ .Values.apps.element.enabled }}
+    enabled: {{ .Values.element.enabled }}
  jitsi:
-    enabled: {{ .Values.apps.jitsi.enabled }}
+    enabled: {{ .Values.jitsi.enabled }}
  mariadb:
-    enabled: {{ .Values.apps.mariadb.enabled }}
+    enabled: {{ .Values.mariadb.enabled }}
  memcached:
-    enabled: {{ .Values.apps.memcached.enabled }}
+    enabled: {{ .Values.memcached.enabled }}
  migrations:
-    enabled: {{ .Values.apps.migrations.enabled }}
+    enabled: {{ .Values.migrations.enabled }}
  minio:
-    enabled: {{ .Values.apps.minio.enabled }}
+    enabled: {{ .Values.minio.enabled }}
  nextcloud:
-    enabled: {{ .Values.apps.nextcloud.enabled }}
+    enabled: {{ .Values.nextcloud.enabled }}
  notes:
-    enabled: {{ .Values.apps.notes.enabled }}
+    enabled: {{ .Values.notes.enabled }}
  nubus:
-    enabled: {{ .Values.apps.nubus.enabled }}
+    enabled: {{ .Values.nubus.enabled }}
  openproject:
-    enabled: {{ .Values.apps.openproject.enabled }}
+    enabled: {{ .Values.openproject.enabled }}
  oxAppsuite:
-    enabled: {{ .Values.apps.oxAppSuite.enabled }}
+    enabled: {{ .Values.oxAppSuite.enabled }}
  postfix:
-    enabled: {{ .Values.apps.postfix.enabled }}
+    enabled: {{ .Values.postfix.enabled }}
  postgresql:
-    enabled: {{ .Values.apps.postgresql.enabled }}
+    enabled: {{ .Values.postgresql.enabled }}
  redis:
-    enabled: {{ .Values.apps.redis.enabled }}
+    enabled: {{ .Values.redis.enabled }}
  xwiki:
-    enabled: {{ .Values.apps.xwiki.enabled }}
+    enabled: {{ .Values.xwiki.enabled }}
 ingressController:
  {{ .Values.security.ingressController | toYaml | nindent 2 }}
--- a/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
 releases:
  - name: "openproject"
@@ -20,10 +20,10 @@ releases:
    waitForJobs: true
    values:
      - "values.yaml.gotmpl"
-      {{- range .Values.customization.release.openproject }}
+      {{ range .Values.customization.release.openproject }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.openproject.enabled }}
+    installed: {{ .Values.openproject.enabled }}
    timeout: 1800
 commonLabels:
--- a/helmfile/apps/openproject/helmfile.yaml.gotmpl
+++ b/helmfile/apps/openproject/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/openproject/values.yaml.gotmpl
+++ b/helmfile/apps/openproject/values.yaml.gotmpl
@@ -38,9 +38,6 @@ dbInit:
    {{ .Values.resources.openprojectDbInit | toYaml | nindent 4 }}
 environment:
  {{- if and (eq (env "OPENDESK_ENTERPRISE") "true") .Values.enterpriseKeys.openproject.token }}
  OPENPROJECT_SEED__ENTERPRISE__TOKEN: {{ .Values.enterpriseKeys.openproject.token | quote }}
  {{- end }}
 # For more details and more options see
 # https://www.openproject.org/docs/installation-and-operations/configuration/environment/
  OPENPROJECT_APP__TITLE: "Projekte - {{ .Values.theme.texts.productName }}"
@@ -56,8 +53,8 @@ environment:
  OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
  OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.nubus.ldapSearch.openproject | quote }}
  OPENPROJECT_SEED_LDAP_OPENDESK_SECURITY: "plain_ldap"
-  OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,{{ .Values.ldap.baseDn }}"
+  OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,dc=swp-ldap,dc=internal"
-  OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "{{ .Values.ldap.baseDn }}"
+  OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "dc=swp-ldap,dc=internal"
  OPENPROJECT_SEED_LDAP_OPENDESK_FILTER:
    "(&(objectClass=opendeskProjectmanagementUser)(opendeskProjectmanagementEnabled=TRUE))"
  OPENPROJECT_SEED_LDAP_OPENDESK_SYNC__USERS: "true"
@@ -66,7 +63,7 @@ environment:
  OPENPROJECT_SEED_LDAP_OPENDESK_LASTNAME__MAPPING: "sn"
  OPENPROJECT_SEED_LDAP_OPENDESK_MAIL__MAPPING: "mailPrimaryAddress"
  OPENPROJECT_SEED_LDAP_OPENDESK_ADMIN__MAPPING: "opendeskProjectmanagementAdmin"
-  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_BASE: "{{ .Values.ldap.baseDn }}"
+  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_BASE: "dc=swp-ldap,dc=internal"
  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_FILTER:
    "(&(objectClass=opendeskProjectmanagementGroup)(opendeskProjectmanagementEnabled=TRUE))"
  OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_SYNC__USERS: "true"
@@ -76,28 +73,18 @@ environment:
  OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
  OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.nubus }}.{{ .Values.global.domain }}"
  OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
-  OPENPROJECT_SMTP__USER__NAME: {{ printf "%s@%s" "opendesk-system" ( .Values.global.mailDomain | default .Values.global.domain ) }}
+  OPENPROJECT_SMTP__USER__NAME: ""
-  OPENPROJECT_SMTP__PASSWORD: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
+  OPENPROJECT_SMTP__PASSWORD: ""
-  OPENPROJECT_SMTP__PORT: 587
+  OPENPROJECT_SMTP__PORT: 25
  OPENPROJECT_SMTP__SSL: "false" # (default=false)
-  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.apps.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
+  OPENPROJECT_SMTP__ADDRESS: {{ printf "%s.%s.svc.%s" "postfix" (.Values.postfix.namespace | default .Release.Namespace) .Values.cluster.networking.domain | quote }}
-  OPENPROJECT_SMTP__AUTHENTICATION: "cram_md5"
+  OPENPROJECT_SMTP__AUTHENTICATION: "none"
-  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
+  OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "false"
  OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "none"
  OPENPROJECT_MAIL__FROM: "{{ .Values.smtp.localpartNoReply }}@{{ .Values.global.domain }}"
  OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.nubus .Values.global.domain | quote }}
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
  OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
  OPENPROJECT_SEED_DESIGN_PRIMARY__BUTTON__COLOR: {{ .Values.theme.colors.primary | quote }}
  OPENPROJECT_SEED_DESIGN_ACCENT__COLOR: {{ .Values.theme.colors.primary | quote }}
  OPENPROJECT_SEED_DESIGN_HEADER__BG__COLOR: {{ .Values.theme.colors.white | quote }}
  OPENPROJECT_SEED_DESIGN_HEADER__ITEM__BG__HOVER__COLOR: {{ .Values.theme.colors.secondaryGreyLight | quote }}
  OPENPROJECT_SEED_DESIGN_MAIN__MENU__BG__COLOR: {{ .Values.theme.colors.white | quote }}
  OPENPROJECT_SEED_DESIGN_MAIN__MENU__BG__SELECTED__BACKGROUND: {{ .Values.theme.colors.primary | quote }}
  OPENPROJECT_SEED_DESIGN_MAIN__MENU__BG__HOVER__BACKGROUND: {{ .Values.theme.colors.secondaryGreyLight | quote }}
  OPENPROJECT_SEED_DESIGN_LOGO: "data:image/svg+xml;base64,{{ .Values.theme.imagery.logoHeaderSvgB64 }}"
  OPENPROJECT_SEED_DESIGN_FAVICON: "data:image/svg+xml;base64,{{ .Values.theme.imagery.projects.faviconSvg }}"
  {{- if .Values.certificate.selfSigned }}
  SSL_CERT_FILE: "/etc/ssl/certs/ca-certificates.crt"
  {{- end }}
--- a/helmfile/apps/services-external/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/services-external/helmfile-child.yaml.gotmpl
@@ -10,7 +10,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
  # openDesk MariaDB
  # Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
@@ -20,7 +20,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
  # openDesk dkimpy-milter
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-dkimpy-milter
@@ -30,7 +30,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.dkimpy.registry }}/{{ .Values.charts.dkimpy.repository }}"
  # openDesk Postfix
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
@@ -40,7 +40,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
  # openDesk ClamAV
  # https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
@@ -50,14 +50,14 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
  - name: "clamav-simple-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.clamavSimple.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
  # VMWare Bitnami
  # Source: https://github.com/bitnami/charts/
@@ -67,21 +67,21 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
  - name: "redis-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.redis.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
  - name: "minio-repo"
    keyring: "../../files/gpg-pubkeys/opencode.gpg"
    verify: {{ .Values.charts.minio.verify }}
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
  # openDesk Enterprise
  # Cassandra
@@ -92,7 +92,7 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.cassandra.registry }}/{{ .Values.charts.cassandra.repository }}"
 releases:
  - name: "redis"
@@ -100,10 +100,10 @@ releases:
    version: "{{ .Values.charts.redis.version }}"
    values:
      - "values-redis.yaml.gotmpl"
-      {{- range .Values.customization.release.redis }}
+      {{ range .Values.customization.release.redis }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.redis.enabled }}
+    installed: {{ .Values.redis.enabled }}
    timeout: 900
  - name: "memcached"
@@ -111,10 +111,10 @@ releases:
    version: "{{ .Values.charts.memcached.version }}"
    values:
      - "values-memcached.yaml.gotmpl"
-      {{- range .Values.customization.release.memcached }}
+      {{ range .Values.customization.release.memcached }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.memcached.enabled }}
+    installed: {{ .Values.memcached.enabled }}
    timeout: 900
  - name: "postgresql"
@@ -122,10 +122,10 @@ releases:
    version: "{{ .Values.charts.postgresql.version }}"
    values:
      - "values-postgresql.yaml.gotmpl"
-      {{- range .Values.customization.release.postgresql }}
+      {{ range .Values.customization.release.postgresql }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.postgresql.enabled }}
+    installed: {{ .Values.postgresql.enabled }}
    timeout: 900
  - name: "mariadb"
@@ -133,10 +133,10 @@ releases:
    version: "{{ .Values.charts.mariadb.version }}"
    values:
      - "values-mariadb.yaml.gotmpl"
-      {{- range .Values.customization.release.mariadb }}
+      {{ range .Values.customization.release.mariadb }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.mariadb.enabled }}
+    installed: {{ .Values.mariadb.enabled }}
    timeout: 900
  - name: "postfix"
@@ -144,10 +144,10 @@ releases:
    version: "{{ .Values.charts.postfix.version }}"
    values:
      - "values-postfix.yaml.gotmpl"
-      {{- range .Values.customization.release.postfix }}
+      {{ range .Values.customization.release.postfix }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.postfix.enabled }}
+    installed: {{ .Values.postfix.enabled }}
    timeout: 900
  - name: "opendesk-dkimpy-milter"
@@ -155,10 +155,10 @@ releases:
    version: "{{ .Values.charts.dkimpy.version }}"
    values:
      - "values-dkimpy.yaml.gotmpl"
-      {{- range .Values.customization.release.opendeskDkimpyMilter }}
+      {{ range .Values.customization.release.opendeskDkimpyMilter }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.dkimpy.enabled }}
+    installed: {{ .Values.dkimpy.enabled }}
    timeout: 900
  - name: "clamav"
@@ -166,10 +166,10 @@ releases:
    version: "{{ .Values.charts.clamav.version }}"
    values:
      - "values-clamav-distributed.yaml.gotmpl"
-      {{- range .Values.customization.release.clamav }}
+      {{ range .Values.customization.release.clamav }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.clamavDistributed.enabled }}
+    installed: {{ .Values.clamavDistributed.enabled }}
    timeout: 900
  - name: "clamav-simple"
@@ -177,10 +177,10 @@ releases:
    version: "{{ .Values.charts.clamavSimple.version }}"
    values:
      - "values-clamav-simple.yaml.gotmpl"
-      {{- range .Values.customization.release.clamavSimple }}
+      {{ range .Values.customization.release.clamavSimple }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.clamavSimple.enabled }}
+    installed: {{ .Values.clamavSimple.enabled }}
    timeout: 900
  - name: "minio"
@@ -188,10 +188,10 @@ releases:
    version: "{{ .Values.charts.minio.version }}"
    values:
      - "values-minio.yaml.gotmpl"
-      {{- range .Values.customization.release.minio }}
+      {{ range .Values.customization.release.minio }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.minio.enabled }}
+    installed: {{ .Values.minio.enabled }}
    timeout: 900
  # openDesk Enterprise Releases
@@ -199,11 +199,10 @@ releases:
    chart: "cassandra-repo/{{ .Values.charts.cassandra.name }}"
    version: "{{ .Values.charts.cassandra.version }}"
    values:
-      - "values-cassandra.yaml.gotmpl"
+      {{ range .Values.customization.release.cassandra }}
      {{- range .Values.customization.release.cassandra }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.cassandra.enabled }}
+    installed: {{ .Values.cassandra.enabled }}
    timeout: 900
 commonLabels:
--- a/helmfile/apps/services-external/helmfile.yaml.gotmpl
+++ b/helmfile/apps/services-external/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/helmfile/apps/services-external/values-cassandra.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-cassandra.yaml.gotmpl
@@ -1,102 +0,0 @@
 {{/*
 SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-License-Identifier: Apache-2.0
 */}}
 ---
 containerSecurityContext:
  enabled: true
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - "ALL"
  privileged: false
  readOnlyRootFilesystem: true
  runAsGroup: 1001
  runAsNonRoot: true
  runAsUser: 1001
  seccompProfile:
    type: "RuntimeDefault"
  seLinuxOptions:
    {{ .Values.seLinuxOptions.cassandra | toYaml | nindent 4 }}
 dbUser:
  user: "root"
  password: {{ .Values.secrets.cassandra.rootPassword | quote }}
 global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
 image:
  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandra.registry | quote }}
  repository: {{ .Values.images.cassandra.repository | quote }}
  tag: {{ .Values.images.cassandra.tag | quote }}
  pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 initDB:
  initUserData.cql: >
    CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
    CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotDictmap.username | quote }};
    ALTER ROLE {{ .Values.databases.dovecotDictmap.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotDictmapUser "''" | squote }} AND LOGIN = true;
    GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotDictmap.name | quote }} TO {{ .Values.databases.dovecotDictmap.username | quote }};
    CREATE KEYSPACE IF NOT EXISTS {{ .Values.databases.dovecotACL.name | quote }} WITH REPLICATION = { 'class' : 'SimpleStrategy', 'replication_factor' : 1 };
    CREATE ROLE IF NOT EXISTS {{ .Values.databases.dovecotACL.username | quote }};
    ALTER ROLE {{ .Values.databases.dovecotACL.username | quote }} WITH PASSWORD = {{ regexReplaceAll "'" .Values.secrets.cassandra.dovecotACLUser "''" | squote }} AND LOGIN = true;
    GRANT ALL ON KEYSPACE {{ .Values.databases.dovecotACL.name | quote }} TO {{ .Values.databases.dovecotACL.username | quote }};
 # Will print a warning if unset but is automatically calculated:
 jvm:
  maxHeapSize: ""
  newHeapSize: ""
 livenessProbe:
  enabled: true
  initialDelaySeconds: 60
  periodSeconds: 30
  timeoutSeconds: 30
  successThreshold: 1
  failureThreshold: 5
 metrics:
  enabled: false
  image:
    registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.cassandraExporter.registry | quote }}
    repository: {{ .Values.images.cassandraExporter.repository | quote }}
    tag: {{ .Values.images.cassandraExporter.tag | quote }}
    pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 persistence:
  commitLogsize: {{ .Values.persistence.storages.cassandra.commitLogsize | quote }}
  size: {{ .Values.persistence.storages.cassandra.size | quote }}
  storageClass: {{ coalesce .Values.persistence.storages.cassandra.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
 podAnnotations: {}
 podSecurityContext:
  enabled: true
  fsGroup: 1001
  fsGroupChangePolicy: "Always"
  supplementalGroups: []
  sysctls: []
 readinessProbe:
  enabled: true
  initialDelaySeconds: 60
  periodSeconds: 10
  timeoutSeconds: 30
  successThreshold: 1
  failureThreshold: 5
 replicaCount: {{ .Values.replicas.cassandra }}
 resources:
  {{ .Values.resources.cassandra | toYaml | nindent 2 }}
 startupProbe:
  enabled: false
  initialDelaySeconds: 0
  periodSeconds: 10
  timeoutSeconds: 5
  successThreshold: 1
  failureThreshold: 60
 ...
--- a/helmfile/apps/services-external/values-clamav-distributed.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-clamav-distributed.yaml.gotmpl
@@ -152,6 +152,6 @@ milter:
    {{ .Values.resources.milter | toYaml | nindent 4 }}
 persistence:
-  size: {{ .Values.persistence.storages.clamav.size | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWX | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.clamav.storageClassName .Values.persistence.storageClassNames.RWX | quote }}
+  size: {{ .Values.persistence.size.clamav | quote }}
 ...
--- a/helmfile/apps/services-external/values-clamav-simple.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-clamav-simple.yaml.gotmpl
@@ -37,8 +37,8 @@ image:
    imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 persistence:
-  size: {{ .Values.persistence.storages.clamav.size | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.clamav.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.clamav | quote }}
 podAnnotations: {}
--- a/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-mariadb.yaml.gotmpl
@@ -39,40 +39,40 @@ job:
  retries: 10
  wait: 30
  users:
    - username: "openxchange_user"
      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
      connectionLimit: {{ .Values.databases.oxAppSuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
 {{ if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
    - username: {{ .Values.databases.nextcloud.username | quote }}
      password: {{ .Values.secrets.mariadb.nextcloudUser | quote}}
      connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
-{{ end }}
+    # OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
-{{ if eq .Values.databases.xwiki.type "mariadb" }}
+    # users for the moment.
    - username: "openxchange_user"
    # - username: {{ .Values.databases.xwiki.username | quote }}
      password: {{ .Values.secrets.mariadb.openxchangeUser | quote }}
      connectionLimit: {{ .Values.databases.oxAppSuite.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
    - username: "xwiki_user"
    # - username: {{ .Values.databases.oxAppSuite.username | quote }}
      password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
 {{ end }}
  databases:
    # OX uses root user and auto automanages the database, we add a dummy user and create a dummy/empty database.
    - name: "openxchange_dummy"
      user: "openxchange_user"
 {{ if or (eq .Values.databases.nextcloud.type "mariadb") (eq .Values.databases.nextcloud.type "mysql") }}
    - name: {{ .Values.databases.nextcloud.name | quote }}
      user: {{ .Values.databases.nextcloud.username | quote }}
-{{ end }}
+    # OX and XWiki are using the db's `root` users (see `database.yaml.gotmpl`). So we are statically referencing their dedicated
-{{ if eq .Values.databases.xwiki.type "mariadb" }}
+    # users for the moment.
-    # XWiki uses root user to create new subwiki databases, we add a dummy user.
+    - name: "openxchange"
-    - name: {{ .Values.databases.xwiki.name | quote }}
+      user: "openxchange_user"
    # - name: {{ .Values.databases.oxAppSuite.name | quote }}
    #   user: {{ .Values.databases.oxAppSuite.username | quote }}
    - name: "xwiki"
      user: "xwiki_user"
-{{ end }}
+    # - name: {{ .Values.databases.xwiki.name | quote }}
    #   user: {{ .Values.databases.xwiki.username | quote }}
 mariadb:
  rootPassword:
    value: {{ .Values.secrets.mariadb.rootPassword | quote }}
 persistence:
-  size: {{ .Values.persistence.storages.mariadb.size | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.mariadb.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.mariadb | quote }}
 podAnnotations:
  argocd.argoproj.io/hook: "PostSync"
--- a/helmfile/apps/services-external/values-minio.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-minio.yaml.gotmpl
@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -90,8 +90,8 @@ podSecurityContext:
  fsGroup: 1001
 persistence:
-  size: {{ .Values.persistence.storages.minio.size | quote }}
+  storageClass: "{{ .Values.persistence.storageClassNames.RWO }}"
-  storageClass: {{ coalesce .Values.persistence.storages.minio.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  size: "{{ .Values.persistence.size.minio }}"
 provisioning:
  enabled: true
@@ -116,11 +116,6 @@ provisioning:
    - name: {{ .Values.objectstores.nubus.bucket | quote }}
      versioning: "Suspended"
      withLock: false
    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
    - name: {{ .Values.objectstores.dovecot.bucket | quote }}
      versioning: "Suspended"
      withLock: false
    {{- end }}
  policies:
    - name: "migrations-bucket-policy"
      statements:
@@ -182,20 +177,6 @@ provisioning:
          effect: "Allow"
          actions:
            - "s3:*"
    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
    - name: "dovecot-bucket-policy"
      statements:
        - resources:
            - "arn:aws:s3:::dovecot"
          effect: "Allow"
          actions:
            - "s3:*"
        - resources:
            - "arn:aws:s3:::dovecot/*"
          effect: "Allow"
          actions:
            - "s3:*"
    {{- end }}
  users:
    - username: {{ .Values.objectstores.migrations.username | quote }}
      password: {{ .Values.secrets.minio.migrationsUser | quote }}
@@ -227,14 +208,6 @@ provisioning:
      policies:
        - "ums-bucket-policy"
      setPolicies: true
    {{- if eq (env "OPENDESK_ENTERPRISE") "true" }}
    - username: {{ .Values.objectstores.dovecot.username | quote }}
      password: {{ .Values.secrets.minio.dovecotUser | quote }}
      disabled: false
      policies:
        - "dovecot-bucket-policy"
      setPolicies: true
    {{- end }}
  resources:
    {{ .Values.resources.minio | toYaml | nindent 4 }}
--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -1,5 +1,5 @@
 {{/*
-SPDX-FileCopyrightText: 2024-2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
+SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
 SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
 SPDX-License-Identifier: Apache-2.0
 */}}
@@ -15,7 +15,7 @@ containerSecurityContext:
  enabled: true
  seccompProfile:
    type: "RuntimeDefault"
-  readOnlyRootFilesystem: true
+  readOnlyRootFilesystem: false
  runAsNonRoot: false
  runAsUser: 0
  runAsGroup: 0
@@ -34,8 +34,8 @@ image:
  imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
 persistence:
-  size: {{ .Values.persistence.storages.postfix.size | quote }}
+  size: {{ .Values.persistence.size.postfix | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.postfix.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 podSecurityContext:
  enabled: true
@@ -52,7 +52,7 @@ postfix:
    - fileName: "sasl_passwd.map"
      content:
        - {{ printf "%s %s:%s" .Values.smtp.host .Values.smtp.username .Values.smtp.password | quote }}
-  {{- if .Values.apps.dkimpy.enabled }}
+  {{- if .Values.dkimpy.enabled }}
  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
  {{- end }}
  rspamdHost: ""
@@ -60,34 +60,25 @@ postfix:
  relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
  smtpSASLAuthEnable: "yes"
  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
-  smtpTLSSecurityLevel: "encrypt"
+  smtpUseTLS: "yes"
-  smtpdSASLAuthEnable: "yes"
+  smtpdSASLAuthEnable: "no"
  smtpdSASLSecurityOptions: "noanonymous"
-  smtpdSASLType: "cyrus"
+  smtpdSASLType: "dovecot"
-  smtpdTLSSecurityLevel: "may"
+  smtpdUseTLS: "yes"
  smtpdTLSCertFile: "/etc/tls/tls.crt"
  smtpdKeyFile: "/etc/tls/tls.key"
-  smtpdSASLPath: "smtpd"
+  smtpdSASLPath: "inet:dovecot:3659"
  staticAuthDB:
    enabled: true
    username: "opendesk-system"
    password: {{ .Values.secrets.postfix.opendeskSystemPassword | quote }}
  {{- if .Values.antivirus.milter.host }}
  smtpdMilters: "inet:{{ .Values.antivirus.milter.host }}:{{ .Values.antivirus.milter.port }}"
  {{- else }}
-  {{- if .Values.apps.clamavDistributed.enabled }}
+  {{- if .Values.clamavDistributed.enabled }}
  smtpdMilters: "inet:clamav-milter:7357"
-  {{- else if .Values.apps.clamavSimple.enabled }}
+  {{- else if .Values.clamavSimple.enabled }}
  smtpdMilters: "inet:clamav-simple:7357"
  {{- end }}
  {{- end }}
-  # Only deliver mail to Dovecot, if it is available
+  virtualMailboxDomains: {{ .Values.global.mailDomain | default .Values.global.domain | quote }}
  {{- if .Values.apps.oxAppSuite.enabled }}
  virtualMailboxDomains: {{ if .Values.global.additionalMailDomains }}{{ printf "%s,%s" (.Values.global.mailDomain | default .Values.global.domain) .Values.global.additionalMailDomains }}{{ else }}{{ .Values.global.mailDomain | default .Values.global.domain | quote }}{{ end }}
  virtualTransport: "lmtps:dovecot:24"
  {{- end }}
 podAnnotations: {}
@@ -96,7 +87,10 @@ replicaCount: {{ .Values.replicas.postfix }}
 resources:
  {{ .Values.resources.postfix | toYaml | nindent 2 }}
 {{- if or (eq .Values.cluster.service.type "NodePort") (eq .Values.cluster.service.type "LoadBalancer") }}
 service:
  external:
-    enabled: false
+    enabled: true
    type: {{ .Values.cluster.service.type | quote }}
 {{- end }}
 ...
--- a/helmfile/apps/services-external/values-postgresql.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postgresql.yaml.gotmpl
@@ -69,16 +69,6 @@ job:
    - username: {{ .Values.databases.umsSelfservice.username | quote }}
      password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
      connectionLimit: {{ .Values.databases.umsSelfservice.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
 {{ if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
    - username: {{ .Values.databases.nextcloud.username | quote }}
      password: {{ .Values.secrets.postgresql.nextcloudUser | quote }}
      connectionLimit: {{ .Values.databases.nextcloud.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
 {{ end }}
 {{ if eq .Values.databases.xwiki.type "postgresql" }}
    - username: {{ .Values.databases.xwiki.username | quote }}
      password: {{ .Values.secrets.postgresql.xwikiUser | quote }}
      connectionLimit: {{ .Values.databases.xwiki.connectionLimit | default .Values.databases.defaults.userConnectionLimit }}
 {{ end }}
  databases:
    - name: {{ .Values.databases.keycloak.name | quote }}
      user: {{ .Values.databases.keycloak.username | quote }}
@@ -97,19 +87,10 @@ job:
      user: {{ .Values.databases.umsNotificationsApi.username | quote }}
    - name: {{ .Values.databases.umsSelfservice.name | quote }}
      user: {{ .Values.databases.umsSelfservice.username | quote }}
 {{ if or (eq .Values.databases.nextcloud.type "postgresql") (eq .Values.databases.nextcloud.type "psql") }}
    - name: {{ .Values.databases.nextcloud.name | quote }}
      user: {{ .Values.databases.nextcloud.username | quote }}
 {{ end }}
 {{ if eq .Values.databases.xwiki.type "postgresql" }}
    - name: {{ .Values.databases.xwiki.name | quote }}
      user: {{ .Values.databases.xwiki.username | quote }}
      additionalParams: "ENCODING 'UNICODE' template=template0"
 {{ end }}
 persistence:
-  size: {{ .Values.persistence.storages.postgresql.size | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
-  storageClass: {{ coalesce .Values.persistence.storages.postgresql.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  size: {{ .Values.persistence.size.postgresql | quote }}
 podAnnotations:
  argocd.argoproj.io/hook: "PostSync"
--- a/helmfile/apps/services-external/values-redis.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-redis.yaml.gotmpl
@@ -12,7 +12,7 @@ auth:
 global:
  imagePullSecrets:
    {{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
-  storageClass: {{ coalesce .Values.persistence.storages.redis.storageClassName .Values.persistence.storageClassNames.RWO | quote }}
+  storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
 image:
  registry: {{ coalesce .Values.repositories.image.dockerHub .Values.global.imageRegistry .Values.images.redis.registry | quote }}
@@ -37,7 +37,7 @@ master:
      {{ .Values.seLinuxOptions.redis | toYaml | nindent 6 }}
  count: {{ .Values.replicas.redis }}
  persistence:
-    size: {{ .Values.persistence.storages.redis.size | quote }}
+    size: {{ .Values.persistence.size.redis | quote }}
  podAnnotations: {}
  resources:
    {{ .Values.resources.redis | toYaml | nindent 4 }}
--- a/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
+++ b/helmfile/apps/xwiki/helmfile-child.yaml.gotmpl
@@ -10,8 +10,8 @@ repositories:
    username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
    password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
    oci: true
-    url: "{{ coalesce .Values.repositories.helm.registryOpencodeDe .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
+    url: "{{ .Values.global.helmRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
-
+    
 releases:
  - name: "xwiki"
    chart: "xwiki-repo/{{ .Values.charts.xwiki.name }}"
@@ -19,10 +19,10 @@ releases:
    wait: true
    values:
      - "values.yaml.gotmpl"
-      {{- range .Values.customization.release.xwiki }}
+      {{ range .Values.customization.release.xwiki }}
      - {{ . }}
-      {{- end }}
+      {{ end }}
-    installed: {{ .Values.apps.xwiki.enabled }}
+    installed: {{ .Values.xwiki.enabled }}
    timeout: 1800
 commonLabels:
--- a/helmfile/apps/xwiki/helmfile.yaml.gotmpl
+++ b/helmfile/apps/xwiki/helmfile.yaml.gotmpl
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
 bases:
-  - "../../bases/environments.yaml.gotmpl"
+  - "../../bases/environments.yaml"
 ---
 helmfiles:
  - path: "./helmfile-child.yaml.gotmpl"
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jaime Conde	483db34bb6	fix(intercom): Converge sessions to a working state	2025-01-16 10:37:31 +01:00
Oliver Günther	b2eefbab83	fix(openproject): Update to 15.1.1	2025-01-15 07:15:59 +01:00
René Fischer	381b4e7988	fix(docs): Add permissions.md	2025-01-14 16:57:04 +01:00
Norbert Tretkowski	6d300304ee	fix(docs): Fix debug option	2025-01-09 10:41:25 +01:00
Thorsten Roßner	da79f3b286	fix(static-files): Update Helm chart to v4.0.1 to support longer domain names	2025-01-09 07:05:49 +01:00
Philip Gaber	ed5bf231cc	docs: Fixed typos and incompatible characters in table	2025-01-08 14:52:58 +01:00
Thorsten Roßner	f4faebaf68	fix(nubus): Template `secrets.nubus.masterpassword`	2025-01-08 07:52:43 +01:00
Michael Weimann	574acb5976	docs(element): Add Matrix Modules and Widget API Co-Authored-By: Kim Brose <kim.brose@nordeck.net>	2025-01-07 10:36:57 +01:00
René Fischer	44d5e5a2b5	fix(docs): Fix doc link and missing TOC annotation	2025-01-06 15:21:37 +01:00
Thorsten Roßner	984b23c73b	fix(open-xchange): Add missing `registryOpencodeDe` to OX-Connector's `waitForDependency` image	2025-01-06 11:30:42 +01:00
Thorsten Roßner	abca53d02f	fix(nubus): Update customizations for group cleanup	2025-01-03 19:24:39 +00:00
Thorsten Roßner	a159724abd	fix(nubus): Fix `pullPolicy` setting for `ldapServer.leaderElector` to satisfy Kyverno linter	2025-01-03 19:24:39 +00:00
Thorsten Roßner	8c1b0802a0	fix(nubus): Remove `extra` settings from ldapServer needed for 1.0 LDAP migration	2025-01-03 19:24:39 +00:00
openDesk Bot	000af5a604	fix(helmfile): Update upstream images for k8s/kubectl to v1.32.0	2025-01-03 09:19:34 +01:00
Thorsten Roßner	ba9560d14b	fix(element): Update Element to v1.11.89 and Synapse to v1.121.1	2025-01-02 06:26:12 +00:00