🎉 Release 4.0.4 (#2338 )

* 🎉 Release 4.0.4 * 🎉 Release 4.0.4 * 🎉 Release 4.0.4 * 🎉 Release 4.0.4 * 🎉 Release 4.0.4
[stable-4.0] bump version 4.0.4 (#2546 )
2026-09-08 11:53:07 -04:00 · 2026-03-30 15:50:34 +02:00 · 2026-03-30 15:07:08 +02:00 · 2026-03-30 12:23:10 +02:00 · 2026-03-30 12:22:23 +02:00 · 2026-03-30 12:22:23 +02:00
4944 changed files with 160306 additions and 563125 deletions
@@ -1,118 +0,0 @@
---
-name: bumping-web
-description: Use when the user asks to bump, update, or upgrade the OpenCloud web assets/frontend to a specific version (e.g. "bump web to v7.0.0", "update web to v7.1.2"). Covers editing the version files, the single commit, and opening the PR against the right branch.
---
-
-# Bumping Web
-
-## Overview
-
-Bumping web updates the pinned OpenCloud web frontend (assets + UI-test runner) to a tagged release of [opencloud-eu/web](https://github.com/opencloud-eu/web). It touches exactly two files, lands as one commit, and ships as a PR whose body is the web changelog for that version.
-
-Template PR: https://github.com/opencloud-eu/opencloud/pull/2733
-
-## Prerequisites
-
- **`gh` (GitHub CLI), authenticated** — every lookup and the PR creation go through `gh api` / `gh pr`. Verify with `gh auth status`; if it fails, ask the user to run `gh auth login` (suggest `! gh auth login` so it runs in-session). Do not proceed without it.
- `gh` needs the system keyring, so run all `gh` commands with the sandbox disabled.
- `git` and `base64` (decoding the changelog) — standard on macOS/Linux.
-
-## What changes (exactly two files)
-
-| File                    | Variable             | New value                                        |
-| ----------------------- | -------------------- | ------------------------------------------------ |
-| `services/web/Makefile` | `WEB_ASSETS_VERSION` | the version tag, e.g. `v7.0.0`                   |
-| `services/web/Makefile` | `WEB_ASSETS_BRANCH`  | branch carrying the tag (`main` or `stable-X.Y`) |
-| `.woodpecker.env`       | `WEB_COMMITID`       | full commit sha the tag points to                |
-| `.woodpecker.env`       | `WEB_BRANCH`         | same branch as `WEB_ASSETS_BRANCH`               |
-
-`WEB_ASSETS_BRANCH` and `WEB_BRANCH` are always the same value.
-
-## Procedure
-
-Let `VERSION` be the requested tag (always normalize to a leading `v`, e.g. `v7.0.0`).
-
-### 1. Resolve the commit sha the tag points to
-
-```bash
-gh api repos/opencloud-eu/web/commits/$VERSION --jq '.sha'
-```
-
-This full sha is the new `WEB_COMMITID`.
-
-### 2. Determine the branch (`main` vs `stable-X.Y`)
-
-The branch is the line of development that carries the tag. Detect it:
-
-```bash
-gh api "repos/opencloud-eu/web/compare/main...$VERSION" --jq '.status'
-```
-
- `identical` or `behind` → the tagged commit is reachable from `main` → use **`main`**.
- `ahead` or `diverged` → the tag lives on a release line → use **`stable-X.Y`** matching the version's major.minor (e.g. `v7.1.2` → `stable-7.1`).
-
-Sanity-check that the stable branch actually exists:
-
-```bash
-gh api repos/opencloud-eu/web/branches --paginate --jq '.[].name' | grep -E 'main|stable'
-```
-
-Typically a freshly released minor (`v7.1.0`) still sits on `main`, while later patches on an older line (`v7.0.3` after `7.1` exists) sit on `stable-7.0`.
-
-### 3. Fetch the changelog for the PR body
-
-```bash
-gh api "repos/opencloud-eu/web/contents/CHANGELOG.md?ref=$VERSION" --jq '.content' | base64 -d
-```
-
-Take **only the section for this version**. Match the template: start the PR body at the first content heading (e.g. `### 💥 Breaking changes` / `### 📈 Enhancement`) and drop the `# Changelog` title, the `## [x.y.z] - date` header, and the `### ❤️ Thanks to all contributors!` block. Stop before the next `## [...]` version header.
-
-### 4. Apply the edits
-
-Edit `services/web/Makefile` (`WEB_ASSETS_VERSION`, `WEB_ASSETS_BRANCH`) and `.woodpecker.env` (`WEB_COMMITID`, `WEB_BRANCH`).
-
-### 5. Pick the target branch for the PR
-
- Major or minor release → target **`main`**.
- Patch release → may need to target a stable branch instead. If the user did not specify, **ask them** which branch to target before continuing.
-
-### 6. Confirm before committing
-
-Show the user the diff of both files and the target branch, and ask them to confirm. Do not commit until they approve.
-
-### 7. Commit, push, open PR
-
- Create a branch (do not commit on `main`).
- One commit, conventional-commits format, **empty body**:
-  ```
-  chore: bump web to v7.0.0
-  ```
- PR title: `[full-ci] chore: bump web to v7.0.0` (the commit message prefixed with `[full-ci] `).
- PR base: the branch chosen in step 5.
- PR body: the trimmed changelog from step 3.
- Add the label `Type:Dependencies`.
-
-```bash
-gh pr create --base <target-branch> \
-  --title "[full-ci] chore: bump web to $VERSION" \
-  --label "Type:Dependencies" \
-  --body-file <changelog-file>
-```
-
-(`gh` commands need the sandbox disabled — they require the system keyring.)
-
-## Quick reference
-
-```bash
-VERSION=v7.0.0
-gh api repos/opencloud-eu/web/commits/$VERSION --jq '.sha'                       # WEB_COMMITID
-gh api "repos/opencloud-eu/web/compare/main...$VERSION" --jq '.status'           # main vs stable
-gh api "repos/opencloud-eu/web/contents/CHANGELOG.md?ref=$VERSION" --jq '.content' | base64 -d  # changelog
-```
-
-## Common mistakes
-
- Reading `WEB_COMMITID` or the changelog from web `main` instead of from the version tag (`?ref=$VERSION`). Always pin to the tag.
- Leaving `WEB_ASSETS_BRANCH`/`WEB_BRANCH` on `main` for a patch that belongs on a stable line.
- Forgetting `[full-ci] ` in the PR title or adding a commit body.
- Committing before the user confirms the diff and target branch.
@@ -1,6 +0,0 @@
-{
-  "repoOwner": "opencloud-eu",
-  "repoName": "opencloud",
-  "targetBranchChoices": ["main", "stable-2.0", "stable-4.0"],
-  "fork": false
-}
@@ -83,11 +83,11 @@ $(PIGEON): $(BINGO_DIR)/pigeon.mod
 	@echo "(re)installing $(GOBIN)/pigeon-v1.3.0"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=pigeon.mod -o=$(GOBIN)/pigeon-v1.3.0 "github.com/mna/pigeon"

-PROTOC_GEN_GO_GRPC := $(GOBIN)/protoc-gen-go-grpc-v1.6.2
-$(PROTOC_GEN_GO_GRPC): $(BINGO_DIR)/protoc-gen-go-grpc.mod
+PROTOC_GEN_DOC := $(GOBIN)/protoc-gen-doc-v1.5.1
+$(PROTOC_GEN_DOC): $(BINGO_DIR)/protoc-gen-doc.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/protoc-gen-go-grpc-v1.6.2"
-	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=protoc-gen-go-grpc.mod -o=$(GOBIN)/protoc-gen-go-grpc-v1.6.2 "google.golang.org/grpc/cmd/protoc-gen-go-grpc"
+	@echo "(re)installing $(GOBIN)/protoc-gen-doc-v1.5.1"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=protoc-gen-doc.mod -o=$(GOBIN)/protoc-gen-doc-v1.5.1 "github.com/pseudomuto/protoc-gen-doc/cmd/protoc-gen-doc"

 PROTOC_GEN_GO := $(GOBIN)/protoc-gen-go-v1.28.1
 $(PROTOC_GEN_GO): $(BINGO_DIR)/protoc-gen-go.mod
@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.17
+
+require github.com/pseudomuto/protoc-gen-doc v1.5.1 // cmd/protoc-gen-doc
@@ -0,0 +1,169 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/Masterminds/semver v1.4.2 h1:WBLTQ37jOCzSLtXNdoo8bNM8876KhNqOKvrlGITgsTc=
+github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/sprig v2.15.0+incompatible h1:0gSxPGWS9PAr7U2NsQ2YQg6juRDINkUyuvbb4b2Xm8w=
+github.com/Masterminds/sprig v2.15.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/aokoli/goutils v1.0.1 h1:7fpzNGoJ3VA8qcrm++XEE1QUe0mIwNeLa02Nwq7RDkg=
+github.com/aokoli/goutils v1.0.1/go.mod h1:SijmP0QR8LtwsmDs8Yii5Z/S4trXFGFC2oO5g9DP+DQ=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v0.3.0-java h1:bV5JGEB1ouEzZa0hgVDFFiClrUEuGWRaAc/3mxR2QK0=
+github.com/envoyproxy/protoc-gen-validate v0.3.0-java/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/gogo/protobuf v1.1.1 h1:72R+M5VuhED/KujmZVcIquuo8mBgX4oVda//DQb3PXo=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/uuid v0.0.0-20161128191214-064e2069ce9c h1:jWtZjFEUE/Bz0IeIhqCnyZ3HG6KRXSntXe4SjtuTH7c=
+github.com/google/uuid v0.0.0-20161128191214-064e2069ce9c/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
+github.com/huandu/xstrings v1.0.0 h1:pO2K/gKgKaat5LdpAhxhluX2GPQMaI3W5FUz/I/UnWk=
+github.com/huandu/xstrings v1.0.0/go.mod h1:4qWG/gcEcfX4z/mBDHJ++3ReCw9ibxbsNJbcucJdbSo=
+github.com/imdario/mergo v0.3.4 h1:mKkfHkZWD8dC7WxKx3N9WCF0Y+dLau45704YQmY6H94=
+github.com/imdario/mergo v0.3.4/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/mwitkow/go-proto-validators v0.0.0-20180403085117-0950a7990007 h1:28i1IjGcx8AofiB4N3q5Yls55VEaitzuEPkFJEVgGkA=
+github.com/mwitkow/go-proto-validators v0.0.0-20180403085117-0950a7990007/go.mod h1:m2XC9Qq0AlmmVksL6FktJCdTYyLk7V3fKyp0sl1yWQo=
+github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/pseudomuto/protoc-gen-doc v1.5.0 h1:pHZp0MEiT68jrZV8js8BS7E9ZEnlSLegoQbbtXj5lfo=
+github.com/pseudomuto/protoc-gen-doc v1.5.0/go.mod h1:exDTOVwqpp30eV/EDPFLZy3Pwr2sn6hBC1WIYH/UbIg=
+github.com/pseudomuto/protoc-gen-doc v1.5.1 h1:Ah259kcrio7Ix1Rhb6u8FCaOkzf9qRBqXnvAufg061w=
+github.com/pseudomuto/protoc-gen-doc v1.5.1/go.mod h1:XpMKYg6zkcpgfpCfQ8GcWBDRtRxOmMR5w7pz4Xo+dYM=
+github.com/pseudomuto/protokit v0.2.0 h1:hlnBDcy3YEDXH7kc9gV+NLaN0cDzhDvD1s7Y6FZ8RpM=
+github.com/pseudomuto/protokit v0.2.0/go.mod h1:2PdH30hxVHsup8KpBTOXTBeMVhJZVio3Q8ViKSAXT0Q=
+github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v0.0.0-20170130113145-4d4bfba8f1d1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
+golang.org/x/crypto v0.0.0-20180501155221-613d6eafa307 h1:O5C+XK++apFo5B+Vq4ujc/LkLwHxg9fDdgjgoIikBdA=
+golang.org/x/crypto v0.0.0-20180501155221-613d6eafa307/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190412183630-56d357773e84/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20181107211654-5fc9ac540362 h1:b69RmkJsx8NyRJsKF2mQ/AF8s4BNxwNsT4rQ3wON1U0=
+google.golang.org/genproto v0.0.0-20181107211654-5fc9ac540362/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20210917145530-b395a37504d4 h1:ysnBoUyeL/H6RCvNRhWHjKoDEmguI+mPU+qHgK8qv/w=
+google.golang.org/genproto v0.0.0-20210917145530-b395a37504d4/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
+google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -1,5 +0,0 @@
-module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
-
-go 1.25.0
-
-require google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2
@@ -1,6 +0,0 @@
-google.golang.org/grpc v1.81.0 h1:W3G9N3KQf3BU+YuCtGKJk0CmxQNbAISICD/9AORxLIw=
-google.golang.org/grpc v1.81.0/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
@@ -30,7 +30,7 @@ MUTAGEN="${GOBIN}/mutagen-v0.18.1"

 PIGEON="${GOBIN}/pigeon-v1.3.0"

-PROTOC_GEN_GO_GRPC="${GOBIN}/protoc-gen-go-grpc-v1.6.2"
+PROTOC_GEN_DOC="${GOBIN}/protoc-gen-doc-v1.5.1"

 PROTOC_GEN_GO="${GOBIN}/protoc-gen-go-v1.28.1"

@@ -1 +0,0 @@
-../.agents/skills
@@ -8,22 +8,15 @@ exclude_paths:
  - 'docs/**'
  - '**/docs/**'
  - '**/pkg/proto/**'
-  - 'protogen/**'
-  - 'scripts/**'
  - 'idp/ui_config/**'
  - 'idp/scripts/**'
-  - 'idp/src/**'
-  - 'devtools/**'
+  - 'settings/rollup.config.js'
+  - 'accounts/rollup.config.js'
  - 'deployments/**'
  - 'tests/acceptance/expected-failures-*.md'
  - 'tests/acceptance/bootstrap/**'
  - 'tests/acceptance/TestHelpers/**'
  - 'tests/acceptance/scripts/run.sh'
  - 'vendor/**/*'
-  - 'vendor-bin/**'
  - 'tests/ocwrapper/vendor/**'
-  - '**/mocks/**'
-  - '**/pkg/config/**'
-  - '**/pkg/metrics/**'
-  - '**/pkg/revaconfig/**'
 ...
@@ -1 +0,0 @@
-github: opencloud-eu
@@ -4,12 +4,11 @@ updates:
    directory: "/"
    schedule:
      interval: "daily"
-    open-pull-requests-limit: 4
+    open-pull-requests-limit: 2

  - package-ecosystem: "npm"
    directory: "/services/idp"
    schedule:
-      interval: "daily"
-    open-pull-requests-limit: 4
-    cooldown:
-      default-days: 1
+      interval: "weekly"
+    open-pull-requests-limit: 2
+
@@ -3,83 +3,79 @@

 ### Prerequisites

-* [ ] DEV/QA: bump web version
-* [ ] DEV/QA: bump reva version
-* [ ] DEV/QA: DEV: Create rc tag `vx.y.z-rc.x`
-* [ ] DEV: update introductionVersion
-* [ ] DEV: add new production version
+* [ ] DEV/QA: Kickoff meeting [Kickoff meeting] (https://???)
+* [ ] DEV/QA: Define client versions and provide list of breaking changes for desktop/mobile team
+* [ ] DEV/QA: Check new strings and align with clients
+* [ ] DEV/DOCS: Create list of pending docs tasks 
+* [ ] DEV: Create branch `release-x.x.x-rc.x` -> CODEFREEZE
+  * [ ] DEV: bump opencloud version in necessary files
+  * [ ] DEV: `changelog/CHANGELOG.tmpl`
+  * [ ] DEV: `pkg/version/version.go`
+  * [ ] DEV: `sonar-project.properties` 
+  * [ ] DEV: prepare changelog folder in `changelog/x.x.x_????_??_??`
+* [ ] DEV: Check successful CI run on release branch
+* [ ] DEV: Create signed tag `vx.y.z-rc.x`
+* [ ] DEV: Check successful CI run on `vx.y.z-rc.x` tag / BLOCKING for all further activity
+* [ ] DEV: Merge back release branch
+* [ ] DEV: bump released deployments to `vx.y.z-rc.x`
+* [ ] DEV: https://cloud.opencloud.eu/
+  * [ ] DEV: needs snapshot and migration

 ### QA Phase

-* [ ] QA: Compatibility test with posix fs
-* [ ] QA: Compatibility test with decomposed fs
-* [ ] DEV/QA: Performance test
-  * [ ] STORAGE_USERS_DRIVER=posix
-    * [ ] 75vu's, 60m
-    * [ ] 75vu's, 60m
-  * [ ] STORAGE_USERS_DRIVER=decomposed
-    * [ ] 75vu's, 60m
-    * [ ] 75vu's, 60m
-* [ ] QA: documentation test
-  * [ ] QA: Review documentation
-  * [ ] QA: Verify all new features documented
-  * [ ] QA: Create upgrade documentation
-  * [ ] QA: Check installation guides
-
+* [ ] QA: Confirmatory testing (if needed)
+* [ ] QA: [Compatibility test](???)
+* [ ] QA: [Performance test](https://github.com/opencloud-eu/cdperf/tree/main/packages/k6-tests/src)
+* [ ] QA: Documentation test:
+  * [ ] QA: Single binary - setup
+  * [ ] QA: Docker - setup
+  * [ ] QA: Docker-compose - setup
+  * [ ] QA: helm/k8s - setup
+* [ ] QA: e2e with different deployment:
+  * [ ] QA: [wopi](???.works) 
+  * [ ] QA: [traefik](???.works)
+  * [ ] QA: [ldap](???.works)
 * [ ] QA: e2e with different storage:
-  * [ ] QA: decomposed
-  * [ ] QA: decomposeds3
-  * [ ] QA: posix
-  * [ ] QA: posix with enabled watch_fs
-* [ ] QA: e2e with different deployments deployments:
-  * [ ] QA: e2e tests agains opencloud-charts
-  * [ ] QA: binary 
-  * [ ] QA: multitanacy 
-  * [ ] QA: docker using [docker-compose_test_plan](https://github.com/opencloud-eu/qa/blob/main/.github/ISSUE_TEMPLATE/docker-compose_test_plan_template.md)
+  * [ ] QA: local
+  * [ ] QA: nfs
+  * [ ] QA: s3
 * [ ] QA: Different clients:
  * [ ] QA: desktop (define version) https://github.com/opencloud-eu/client/releases
-    * [ ] QA: against mac - exploratory testing
-    * [ ] QA: against windows - exploratory testing
+    * [ ] QA: against mac - smoke test
+    * [ ] QA: against windows - smoke test
    * [ ] QA: against linux (use auto tests)
  * [ ] QA: android (define version) https://github.com/opencloud-eu/android/releases
  * [ ] QA: ios (define version)
-* [ ] QA: check docs german translation
-  * [ ] QA: german translations desktop at 100%
-* [ ] QA: exploratory testing
+* [ ] QA: [Smoke test](???) on Web Office (Collabora, Onlyoffice, Microsoft office)
+* [ ] QA: Smoke test Hello extension
+* [ ] QA: [Smoke test](???) ldap
+* [ ] QA: Collecting errors found

-### Collected bugs
-* [ ] Please place all bugs found here
+### After QA Phase

-### After QA Phase (IT related)
+* [ ] Brief company-wide heads up via mail @tbsbdr
+* [ ] Create list of changed ENV vars and send to release-coordination@opencloud.eu
+  * [ ] Variable Name
+  * [ ] Introduced in version
+  * [ ] Default Value
+  * [ ] Description
+  * [ ] dependencies with user other components
+* [ ] DEV: Create branch `release-x.x.x`
+  * [ ] DEV: bump OpenCloud version in necessary files
+  * [ ] DEV: `pkg/version/version.go`
+  * [ ] DEV: `sonar-project.properties`
+  * [ ] DEV: released deployment versions
+  * [ ] DEV: prepare changelog folder in `changelog/x.x.x_???`
+* [ ] Release Notes + Breaking Changes @tbsbdr
+* [ ] Migration + Breaking Changes Admin Doc @???
+* [ ] DEV: Create final signed tag
+* [ ] DEV: Check successful CI run on `vx.y.z` tag / BLOCKING for all further activity
+* [ ] Merge release notes 

-* [ ] QA:bump version in pkg/version.go
-* [ ] QA: Run CI
-* [ ] DEV/QA: create final tag
-* [ ] QA: observe CI Run on tag
-* [ ] DEV/QA: Create a new `stable-*` branch
-  * [ ] (opencloud)[https://github.com/opencloud-eu/opencloud/branches]
-  * [ ] (web)[https://github.com/opencloud-eu/web/branches]
-  * [ ] (reva)[https://github.com/opencloud-eu/reva/branches]
-  * [ ] (opencloud-compose)[https://github.com/opencloud-eu/opencloud-compose/branches]
-* [ ] DEV/QA:: publish release notes to the docs
-* [ ] DEV/QA:: update (demo.opencloud.eu)[https://demo.opencloud.eu/]
-
-### After QA Phase ( Marketing / Product / Sales related )
-
-* [ ] notify marketing that the release is ready @tbsbdr
-* [ ] announce in the public channel (matrix channel)[https://matrix.to/#/#opencloud:matrix.org]
-* [ ] press information @AnneGo137
-  * [ ] press information @AnneGo137
-  * [ ] Blogentry @AnneGo137
-  * [ ] Internal meeting (Groupe Pre-Webinar) @db-ot
-  * [ ] Partner briefing (Partner should be informed about features, new) @matthias
-* [ ] Webinar DE & EN @AnneGo137
-  * [ ] Präsentation DE @tbsbdr / @db-ot
-  * [ ] Präsentation EN @tbsbdr / @db-ot
-* [ ] Website ergänzen @AnneGo137
-  * [ ] Features @AnneGo137
-  * [ ] Service & Support - New Enterprise Features @tbsbdr
-  * [ ] OpenCloud_Benefits.pdf updates @AnneGo137
-  * [ ] Welcome Files: Features as media @tbsbdr
-* [ ] Flyer update @AnneGo137
-* [ ] Sales presentation @matthias
+### Post-release communication
+* [ ] DEV: Create a `docs-stable-x.y` branch based on the docs folder in the OpenCloud repo @micbar 
+* [ ] DEV/QA: Ping documentation in RC about the new release tag (for opencloud/helm chart version bump in docs)
+* [ ] DEV/QA: Ping marketing to update all download links (download mirrors are updated at the full hour, wait with ping until download is actually available)
+* [ ] DEV/QA: Ping @??? once the demo instances are running this release
+* [ ] DEV: Merge back release branch
+* [ ] DEV: Create stable-x.y branch in the OpenCloud repo from final tag
@@ -1,30 +0,0 @@
-### Rolling release template
-[Release Template](https://github.com/opencloud-eu/opencloud/blob/main/.github/rolling_release_template.md)
-
-## Prerequisites
-* [ ] web release
-  * [ ] bump web version
-  * [ ] squash and merge the web release PR
-  * [ ] bump web v.x.y.z in opencloud
-
-* [ ] reva release
-  * [ ] squash and merge the reva Release PR
-  * [ ] bump reva and update opencloud version in `pkg/version.go`
-
-## QA Phase
-* [ ] bump `opencloud_commitid` in web and run all working tests in CI
-* [ ] compatibility test
-* [ ] n8n integration QA
-* [ ] confirmatory testing, if needed
-
-## Collected bugs
-
-## After QA Phase
-* [ ] replace `%%NEXT%%` wuth the release version
-* [ ] squash and merge Release PR
-* [ ] publish release notes to the docs
-* [ ] add migration guide to changelog with prefix `**ACTION REQUIRED:**`, if needed.  
-* [ ] add release notes from web and reva to opencloud changelog
-* [ ] update the public matrix channel topic
-* [ ] update https://update.opencloud.eu/server.json
-* [ ] update the version on demo.opencloud.eu
@@ -1,2 +1,4 @@
 _extends: gh-labels

+
+
@@ -65,4 +65,4 @@ go.work.sum
 .DS_Store

 # example deployments
-**/opencloud-sandbox-*
+**/opencloud-sandbox-*
@@ -113,7 +113,7 @@ debug-linux-docker-amd64: release-dirs
 	GOARCH=amd64 \
 	go build \
        -gcflags="all=-N -l" \
-		-tags 'netgo,$(TAGS)' \
+		-tags 'netgo $(TAGS)' \
 		-buildmode=exe \
 		-trimpath \
 		-ldflags '-extldflags "-static" $(DEBUG_LDFLAGS) $(DOCKER_LDFLAGS)' \
@@ -125,7 +125,7 @@ debug-linux-docker-arm64: release-dirs
 	GOARCH=arm64 \
 	go build \
        -gcflags="all=-N -l" \
-		-tags 'netgo,$(TAGS)' \
+		-tags 'netgo $(TAGS)' \
 		-buildmode=exe \
 		-trimpath \
 		-ldflags '-extldflags "-static" $(DEBUG_LDFLAGS) $(DOCKER_LDFLAGS)' \
@@ -10,8 +10,8 @@ protoc-deps: $(BINGO)
 	@cd ../.. && GOPATH="" GOBIN=".bingo" $(BINGO) get -l github.com/go-micro/generator/cmd/protoc-gen-micro
 	@cd ../.. && GOPATH="" GOBIN=".bingo" $(BINGO) get -l github.com/owncloud/protoc-gen-microweb
 	@cd ../.. && GOPATH="" GOBIN=".bingo" $(BINGO) get -l github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2
+	@cd ../.. && GOPATH="" GOBIN=".bingo" $(BINGO) get -l github.com/pseudomuto/protoc-gen-doc/cmd/protoc-gen-doc
 	@cd ../.. && GOPATH="" GOBIN=".bingo" $(BINGO) get -l github.com/favadi/protoc-go-inject-tag
-	@cd ../.. && GOPATH="" GOBIN=".bingo" $(BINGO) get -l google.golang.org/grpc/cmd/protoc-gen-go-grpc

 .PHONY: buf-generate
 buf-generate: $(SHA1_LOCK_FILE)
@@ -36,7 +36,7 @@
        // demo users
        "IDM_CREATE_DEMO_USERS": "true",
        // OC_RUN_SERVICES allows to start a subset of services even in the supervised mode
-        //"OC_RUN_SERVICES": "settings,storage-system,graph,idp,idm,ocs,store,thumbnails,web,webdav,frontend,gateway,users,groups,auth-basic,storage-authmachine,storage-users,storage-shares,storage-publiclink,storage-system,app-provider,sharing,proxy",
+        //"OC_RUN_SERVICES": "settings,storage-system,graph,idp,idm,ocs,store,thumbnails,web,webdav,frontend,gateway,users,groups,auth-basic,storage-authmachine,storage-users,storage-shares,storage-publiclink,storage-system,app-provider,sharing,proxy,ocdav",

        /*
         * Keep secrets and passwords in one block to allow easy uncommenting
@@ -76,157 +76,6 @@
        "OC_SERVICE_ACCOUNT_SECRET": "service-account-secret"
      }
    },
-    {
-      "name": "OpenCloud server with Groupware",
-      "type": "go",
-      "request": "launch",
-      "mode": "debug",
-      "buildFlags": [
-        // "-tags", "enable_vips"
-      ],
-      "program": "${workspaceFolder}/opencloud/cmd/opencloud",
-      "args": ["server"],
-      "env": {
-        // log settings for human developers
-        "OC_LOG_LEVEL": "info",
-        "OC_LOG_PRETTY": "true",
-        "OC_LOG_COLOR": "true",
-        // set insecure options because we don't have valid certificates in dev environments
-        "OC_INSECURE": "true",
-        // enable basic auth for dev setup so that we can use curl for testing
-        "PROXY_ENABLE_BASIC_AUTH": "true",
-        // demo users
-        "IDM_CREATE_DEMO_USERS": "true",
-        // OC_RUN_SERVICES allows to start a subset of services even in the supervised mode
-        //"OC_RUN_SERVICES": "settings,storage-system,graph,idp,idm,ocs,store,thumbnails,web,webdav,frontend,gateway,users,groups,auth-basic,storage-authmachine,storage-users,storage-shares,storage-publiclink,storage-system,app-provider,sharing,proxy,ocdav",
-
-        /*
-         * Keep secrets and passwords in one block to allow easy uncommenting
-         */
-        // user id of "admin", for user creation and admin role assignement
-        "OC_ADMIN_USER_ID": "some-admin-user-id-0000-000000000000", // FIXME currently must have the length of a UUID, see reva/pkg/storage/utils/decomposedfs/spaces.go:228
-        // admin user default password
-        "IDM_ADMIN_PASSWORD": "admin",
-        // system user
-        "OC_SYSTEM_USER_ID": "some-system-user-id-000-000000000000", // FIXME currently must have the length of a UUID, see reva/pkg/storage/utils/decomposedfs/spaces.go:228
-        "OC_SYSTEM_USER_API_KEY": "some-system-user-machine-auth-api-key",
-        // set some hardcoded secrets
-        "OC_JWT_SECRET": "some-opencloud-jwt-secret",
-        "OC_MACHINE_AUTH_API_KEY": "some-opencloud-machine-auth-api-key",
-        "OC_TRANSFER_SECRET": "some-opencloud-transfer-secret",
-        // collaboration
-        "COLLABORATION_WOPIAPP_SECRET": "some-wopi-secret",
-        // idm ldap
-        "IDM_SVC_PASSWORD": "some-ldap-idm-password",
-        "GRAPH_LDAP_BIND_PASSWORD": "some-ldap-idm-password",
-        // reva ldap
-        "IDM_REVASVC_PASSWORD": "some-ldap-reva-password",
-        "GROUPS_LDAP_BIND_PASSWORD": "some-ldap-reva-password",
-        "USERS_LDAP_BIND_PASSWORD": "some-ldap-reva-password",
-        "AUTH_BASIC_LDAP_BIND_PASSWORD": "some-ldap-reva-password",
-        // idp ldap
-        "IDM_IDPSVC_PASSWORD": "some-ldap-idp-password",
-        "IDP_LDAP_BIND_PASSWORD": "some-ldap-idp-password",
-        // storage users mount ID
-        "GATEWAY_STORAGE_USERS_MOUNT_ID": "storage-users-1",
-        "STORAGE_USERS_MOUNT_ID": "storage-users-1",
-        // graph application ID
-        "GRAPH_APPLICATION_ID": "application-1",
-
-        // service accounts
-        "OC_SERVICE_ACCOUNT_ID": "service-account-id",
-        "OC_SERVICE_ACCOUNT_SECRET": "service-account-secret",
-
-        "OC_ADD_RUN_SERVICES": "auth-api,groupware",
-        
-        "GROUPWARE_LOG_LEVEL": "trace",
-        "GROUPWARE_HTTP_TRACE_REQUESTS": "true",
-        "GROUPWARE_HTTP_TRACE_MAX_REQUEST_BODY_SIZE": "8192",
-        "GROUPWARE_HTTP_TRACE_RESPONSES": "true",
-        "GROUPWARE_HTTP_TRACE_MAX_RESPONSE_BODY_SIZE": "8192",
-        "GROUPWARE_JMAP_MASTER_USERNAME": "admin@example.org",
-        "GROUPWARE_JMAP_MASTER_PASSWORD": "admin",
-        "GROUPWARE_SEND_DURATIONS_RESPONSE": "true",
-        "GROUPWARE_TLS_INSECURE": "true",
-        "GROUPWARE_ENABLE_MOCK_DATA": "true",
-        "GROUPWARE_DEBUG_ADDR": "0.0.0.0:9203",
-
-        "AUTHAPI_HTTP_ADDR": "0.0.0.0:10000",
-        "AUTHAPI_AUTH_REQUIRE_SHARED_SECRET": "true",
-        "AUTHAPI_AUTH_SHARED_SECRETS": "stalwart=maethaR9eiXaiph8ahn8ohH6dahPiequ;unused=eeyaigh6hae1zo5ahGeete6oohaiquei",
-
-        "WEB_ASSET_CORE_PATH": "${workspaceFolder}/../web/dist",
-        "WEB_UI_CONFIG_FILE": "${workspaceFolder}/../web/dev/docker/opencloud.web.config.json",
-        "FRONTEND_GROUPWARE_ENABLED": "true"
-      }
-    },
-    {
-      "name": "OpenCloud server with external services",
-      "type": "go",
-      "request": "launch",
-      "mode": "debug",
-      "buildFlags": [
-        // "-tags", "enable_vips"
-      ],
-      "program": "${workspaceFolder}/opencloud/cmd/opencloud",
-      "args": ["server"],
-      "env": {
-        "OC_URL": "https://localhost:9200/",
-        "PROXY_DEBUG_ADDR": "0.0.0.0:9205",
-        "OC_BASE_DATA_PATH": "${env:HOME}/.opencloud-with-external",
-        "OC_CONFIG_DIR": "${env:HOME}/.opencloud-with-external/config",
-        "GROUPWARE_LOG_LEVEL": "trace",
-        "OC_LOG_LEVEL": "info",
-        "OC_LOG_PRETTY": "true",
-        "OC_LOG_COLOR": "true",
-        "OC_INSECURE": "true",
-        "PROXY_ENABLE_BASIC_AUTH": "false",
-        "IDM_CREATE_DEMO_USERS": "false",
-        "OC_LDAP_URI": "ldaps://localhost:636",
-        "OC_LDAP_INSECURE": "true",
-        "OC_LDAP_BIND_DN": "cn=admin,dc=opencloud,dc=eu",
-        "OC_LDAP_BIND_PASSWORD": "admin",
-        "OC_LDAP_GROUP_BASE_DN": "ou=groups,dc=opencloud,dc=eu",
-        "OC_LDAP_GROUP_SCHEMA_ID": "entryUUID",
-        "OC_LDAP_USER_BASE_DN": "ou=users,dc=opencloud,dc=eu",
-        "OC_LDAP_USER_FILTER": "(objectclass=inetOrgPerson)",
-        "OC_LDAP_USER_SCHEMA_ID": "entryUUID",
-        "OC_LDAP_DISABLE_USER_MECHANISM": "none",
-        "OC_LDAP_SERVER_WRITE_ENABLED": "false",
-        "OC_EXCLUDE_RUN_SERVICES": "idm",
-        "OC_ADD_RUN_SERVICES": "notifications,groupware",
-        "NATS_NATS_HOST": "0.0.0.0",
-        "NATS_NATS_PORT": "9233",
-        "FRONTEND_ARCHIVER_MAX_SIZE": "10000000000",
-        "MICRO_REGISTRY_ADDRESS": "127.0.0.1:9233",
-        "NOTIFICATIONS_SMTP_HOST": "localhost",
-        "NOTIFICATIONS_SMTP_PORT": "2500",
-        "NOTIFICATIONS_SMTP_SENDER": "OpenCloud notifications <notifications@cloud.opencloud.test>",
-        "NOTIFICATIONS_SMTP_USERNAME": "notifications@cloud.opencloud.test",
-        "NOTIFICATIONS_SMTP_INSECURE": "true",
-        "NOTIFICATIONS_SMTP_PASSWORD": "",
-        "NOTIFICATIONS_SMTP_AUTHENTICATION": "",
-        "NOTIFICATIONS_SMTP_ENCRYPTION": "none",
-        "PROXY_AUTOPROVISION_ACCOUNTS": "false",
-        "PROXY_ROLE_ASSIGNMENT_DRIVER": "oidc",
-        "OC_OIDC_ISSUER": "https://keycloak.opencloud.test/realms/openCloud",
-        "PROXY_OIDC_REWRITE_WELLKNOWN": "true",
-        "WEB_OIDC_CLIENT_ID": "web",
-        "PROXY_USER_OIDC_CLAIM": "uuid",
-        "PROXY_USER_CS3_CLAIM": "userid",
-        "WEB_OPTION_ACCOUNT_EDIT_LINK_HREF": "https://keycloak.opencloud.test/realms/openCloud/account",
-        "OC_ADMIN_USER_ID": "",
-        "SETTINGS_SETUP_DEFAULT_ASSIGNMENTS": "false",
-        "GRAPH_ASSIGN_DEFAULT_USER_ROLE": "false",
-        "GRAPH_USERNAME_MATCH": "none",
-        "KEYCLOAK_DOMAIN": "keycloak.opencloud.test",
-        "IDM_ADMIN_PASSWORD": "admin",
-        "GRAPH_LDAP_SERVER_UUID": "true",
-        "GRAPH_LDAP_GROUP_CREATE_BASE_DN": "ou=custom,ou=groups,dc=opencloud,dc=eu",
-        "GRAPH_LDAP_REFINT_ENABLED": "true",
-        "GATEWAY_GRPC_ADDR": "0.0.0.0:9142",
-      }
-    },
    {
      "name": "Fed OpenCloud server",
      "type": "go",
@@ -280,6 +129,8 @@
        "IDP_HTTP_ADDR": "127.0.0.1:10130",
        "NATS_DEBUG_ADDR": "127.0.0.1:10234",
        "NATS_NATS_PORT": "10233",
+        "OCDAV_HTTP_ADDR": "127.0.0.1:10350",
+        "OCDAV_DEBUG_ADDR": "127.0.0.1:10163",
        "OCM_DEBUG_ADDR": "127.0.0.1:10281",
        "OCM_HTTP_ADDR": "127.0.0.1:10280",
        "OCM_GRPC_ADDR": "127.0.0.1:10282",
@@ -1,3 +1,4 @@
 # The test runner source for UI tests
-WEB_COMMITID=47a1cfb1dbda4479b88e831d089bfa54b1f4bb8d
-WEB_BRANCH=main
+WEB_COMMITID=50e3fff6a518361d59cba864a927470f313b6f91
+WEB_BRANCH=stable-4.2
+
@@ -1,438 +1,67 @@
 # Changelog

-## [7.1.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.1.0) - 2026-06-02
+## [4.0.4](https://github.com/opencloud-eu/opencloud/releases/tag/v4.0.4) - 2026-03-30

 ### ❤️ Thanks to all contributors! ❤️

-@ScharfViktor, @aduffeck, @dragonchaser, @kulmann, @micbar, @rhafer
+@ScharfViktor, @aduffeck, @dragonchaser, @rhafer, @saw-jan

 ### 🐛 Bug Fixes

- Prevent personal space creation for service- and lightweight users [[#2876](https://github.com/opencloud-eu/opencloud/pull/2876)]
- chore: bump reva to 2.46.1 [[#2869](https://github.com/opencloud-eu/opencloud/pull/2869)]
- fix: Send SSE events for SpaceCreated/-Disabled/-Deleted [[#2851](https://github.com/opencloud-eu/opencloud/pull/2851)]
- Only try to limit search to spaces if there's a space id to limit to [[#2834](https://github.com/opencloud-eu/opencloud/pull/2834)]
- fix(init): Only log admin password if it was generated [[#2839](https://github.com/opencloud-eu/opencloud/pull/2839)]
- fix: translations for activities and others [[#2836](https://github.com/opencloud-eu/opencloud/pull/2836)]
- fix-2824. run tests without remote.php [[#2826](https://github.com/opencloud-eu/opencloud/pull/2826)]
-
-### 📈 Enhancement
-
- chore: bump web to v7.1.0 [[#2870](https://github.com/opencloud-eu/opencloud/pull/2870)]
-
-### 📚 Documentation
-
- docs(adr): Remove erroneous mention of kanidm [[#2783](https://github.com/opencloud-eu/opencloud/pull/2783)]
+- Backport bleve batch fix [[#2527](https://github.com/opencloud-eu/opencloud/pull/2527)]
+- Backport backchannel logout [[#2407](https://github.com/opencloud-eu/opencloud/pull/2407)]

 ### 📦️ Dependencies

- build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.43.0 to 1.44.0 [[#2855](https://github.com/opencloud-eu/opencloud/pull/2855)]
- build(deps-dev): bump license-checker-rseidelsohn from 4.4.2 to 5.0.1 in /services/idp [[#2854](https://github.com/opencloud-eu/opencloud/pull/2854)]
- build(deps-dev): bump cldr from 7.9.0 to 8.0.0 in /services/idp [[#2853](https://github.com/opencloud-eu/opencloud/pull/2853)]
- build(deps): bump i18next from 26.1.0 to 26.3.0 in /services/idp [[#2849](https://github.com/opencloud-eu/opencloud/pull/2849)]
- build(deps-dev): bump sass-loader from 16.0.8 to 17.0.0 in /services/idp [[#2845](https://github.com/opencloud-eu/opencloud/pull/2845)]
- build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.1 [[#2848](https://github.com/opencloud-eu/opencloud/pull/2848)]
- build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.68.0 to 0.69.0 [[#2847](https://github.com/opencloud-eu/opencloud/pull/2847)]
- build(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /services/idp [[#2846](https://github.com/opencloud-eu/opencloud/pull/2846)]
- build(deps-dev): bump postcss-loader from 4.3.0 to 8.2.1 in /services/idp [[#2830](https://github.com/opencloud-eu/opencloud/pull/2830)]
- build(deps): bump github.com/riandyrn/otelchi from 0.12.2 to 0.12.3 [[#2814](https://github.com/opencloud-eu/opencloud/pull/2814)]
- build(deps-dev): bump workbox-webpack-plugin from 7.4.0 to 7.4.1 in /services/idp [[#2781](https://github.com/opencloud-eu/opencloud/pull/2781)]
+- [stable-4.0] Bump some go dependencies [[#2544](https://github.com/opencloud-eu/opencloud/pull/2544)]

-## [7.0.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.0.0) - 2026-05-21
+## [4.0.3](https://github.com/opencloud-eu/opencloud/releases/tag/v4.0.3) - 2026-02-05

 ### ❤️ Thanks to all contributors! ❤️

-@AlexAndBear, @SAY-5, @ScharfViktor, @Svanvith, @butonic, @dragonchaser, @dschmidt, @fschade, @micbar, @michaelstingl, @rhafer
-
-### 💥 Breaking changes
-
- Persist space memberships in share manager [[#2760](https://github.com/opencloud-eu/opencloud/pull/2760)]
- [feature/guest-links] bump reva, add service user config to "sharing" service [[#2735](https://github.com/opencloud-eu/opencloud/pull/2735)]
-
-### 🔒 Security
-
- fix: disallow thumbnails for tiff and jpeg2000 images [[#2758](https://github.com/opencloud-eu/opencloud/pull/2758)]
+@aduffeck

 ### 🐛 Bug Fixes

- fix(notifications): don't re-escape email vars for each recipient [[#2805](https://github.com/opencloud-eu/opencloud/pull/2805)]
- fix: remove unnecessary error log it the oidc access token verify method is set to none [[#2795](https://github.com/opencloud-eu/opencloud/pull/2795)]
- fix(debug): drop duplicate service field from probe fallback log [[#2786](https://github.com/opencloud-eu/opencloud/pull/2786)]
- No registry lookup in cli [[#2755](https://github.com/opencloud-eu/opencloud/pull/2755)]
- fix(webdav): register chi REPORT method in init to avoid race with settings [[#2712](https://github.com/opencloud-eu/opencloud/pull/2712)]
- fix: use runner to start activitylog service [[#2748](https://github.com/opencloud-eu/opencloud/pull/2748)]
- docs(search): fix force-rescan flag name in README [[#2747](https://github.com/opencloud-eu/opencloud/pull/2747)]
+- Bump reva 2.40.3 [[#2275](https://github.com/opencloud-eu/opencloud/pull/2275)]
+
+## [4.0.2](https://github.com/opencloud-eu/opencloud/releases/tag/v4.0.2) - 2026-02-05
+
+### ❤️ Thanks to all contributors! ❤️
+
+@ScharfViktor, @aduffeck, @fschade, @kulmann, @micbar, @prashant-gurung899, @saw-jan

 ### ✅ Tests

- [full-ci] preview-tests. update fixtures for different processors [[#2767](https://github.com/opencloud-eu/opencloud/pull/2767)]
- test: modify exclude list and add coverage upload [[#2762](https://github.com/opencloud-eu/opencloud/pull/2762)]
- fix: cleaner debounce timer test [[#2743](https://github.com/opencloud-eu/opencloud/pull/2743)]
-
-### 📚 Documentation
-
- Update README with LDAP certificate details [[#2759](https://github.com/opencloud-eu/opencloud/pull/2759)]
-
-### 📈 Enhancement
-
- feat(graph): populate driveItem.webUrl per Libre Graph spec [[#2744](https://github.com/opencloud-eu/opencloud/pull/2744)]
-
-### 📦️ Dependencies
-
- build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 [[#2798](https://github.com/opencloud-eu/opencloud/pull/2798)]
- build(deps): bump golang.org/x/image from 0.38.0 to 0.40.0 [[#2740](https://github.com/opencloud-eu/opencloud/pull/2740)]
- build(deps): bump github.com/tidwall/gjson from 1.18.0 to 1.19.0 [[#2750](https://github.com/opencloud-eu/opencloud/pull/2750)]
- build(deps-dev): bump dotenv-expand from 12.0.3 to 13.0.0 in /services/idp [[#2710](https://github.com/opencloud-eu/opencloud/pull/2710)]
- build(deps): bump github.com/onsi/ginkgo/v2 from 2.28.1 to 2.28.3 [[#2739](https://github.com/opencloud-eu/opencloud/pull/2739)]
-
-## [6.2.0](https://github.com/opencloud-eu/opencloud/releases/tag/v6.2.0) - 2026-05-11
-
-### ❤️ Thanks to all contributors! ❤️
-
-@JammingBen, @ScharfViktor, @Sweeistaken, @aduffeck, @dragonchaser, @dschmidt, @fschade, @pedropintosilva, @rhafer, @schweigisito
-
-### 📈 Enhancement
-
- feat: enable EnableRemoteLinkPicker WOPI flag for Collabora Online [[#2663](https://github.com/opencloud-eu/opencloud/pull/2663)]
- feat(kql): support dotted keys in property restrictions [[#2632](https://github.com/opencloud-eu/opencloud/pull/2632)]
+- [tests-only] port tests to stable #2087 #2039 [[#2185](https://github.com/opencloud-eu/opencloud/pull/2185)]
+- [full-ci][tests-only] port test fixes [[#2017](https://github.com/opencloud-eu/opencloud/pull/2017)]
+- [stable-4.0] Port #2011 [[#2018](https://github.com/opencloud-eu/opencloud/pull/2018)]

 ### 🐛 Bug Fixes

- Set new defaults for caches and stores [[#2702](https://github.com/opencloud-eu/opencloud/pull/2702)]
- fix: remove typo in error message [[#2701](https://github.com/opencloud-eu/opencloud/pull/2701)]
- fix(search): preserve value case for non-lowercased bleve fields [[#2633](https://github.com/opencloud-eu/opencloud/pull/2633)]
- More graceful shutdown fixes [[#2690](https://github.com/opencloud-eu/opencloud/pull/2690)]
- Hotfix for https://github.com/opencloud-eu/opencloud/issues/2282 [[#2631](https://github.com/opencloud-eu/opencloud/pull/2631)]
- fix(search): read --force-rescan flag with its registered name [[#2639](https://github.com/opencloud-eu/opencloud/pull/2639)]
- fix(search): parse tika xmpDM:duration as a float [[#2638](https://github.com/opencloud-eu/opencloud/pull/2638)]
+- [stable-4.0] fix: build time edition channels #2001 [[#2010](https://github.com/opencloud-eu/opencloud/pull/2010)]
+- [stable-4.0] fix: enforce trailing slash for server url [[#2002](https://github.com/opencloud-eu/opencloud/pull/2002)]
+- [stable-4.0] fix: enhance resource creation with detailed process information (#1978) [[#2000](https://github.com/opencloud-eu/opencloud/pull/2000)]
+
+### 📦️ Dependencies
+
+- Bump reva [[#2274](https://github.com/opencloud-eu/opencloud/pull/2274)]
+
+## [4.0.1](https://github.com/opencloud-eu/opencloud/releases/tag/v4.0.1) - 2025-12-15
+
+### ❤️ Thanks to all contributors! ❤️
+
+@ScharfViktor, @fschade, @kulmann, @micbar, @prashant-gurung899

 ### ✅ Tests

- [api-tests] delete PROPATCH favorite tests [[#2689](https://github.com/opencloud-eu/opencloud/pull/2689)]
-
-### 📚 Documentation
-
- enhancement: increase display size of graph flow diagram [[#2620](https://github.com/opencloud-eu/opencloud/pull/2620)]
-
-### 📦️ Dependencies
-
- build(deps): bump go.opentelemetry.io/contrib/zpages from 0.67.0 to 0.68.0 [[#2666](https://github.com/opencloud-eu/opencloud/pull/2666)]
- build(deps): bump @types/node from 22.19.17 to 25.6.0 in /services/idp [[#2687](https://github.com/opencloud-eu/opencloud/pull/2687)]
- build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.42.0 to 1.43.0 [[#2601](https://github.com/opencloud-eu/opencloud/pull/2601)]
- build(deps): bump github.com/davidbyttow/govips/v2 from 2.17.0 to 2.18.0 [[#2656](https://github.com/opencloud-eu/opencloud/pull/2656)]
- build(deps): bump i18next from 25.10.10 to 26.0.4 in /services/idp [[#2609](https://github.com/opencloud-eu/opencloud/pull/2609)]
- build(deps): bump github.com/testcontainers/testcontainers-go/modules/opensearch from 0.41.0 to 0.42.0 [[#2645](https://github.com/opencloud-eu/opencloud/pull/2645)]
- build(deps): bump github.com/open-policy-agent/opa from 1.15.1 to 1.15.2 [[#2602](https://github.com/opencloud-eu/opencloud/pull/2602)]
-
-## [6.1.0](https://github.com/opencloud-eu/opencloud/releases/tag/v6.1.0) - 2026-04-20
-
-### ❤️ Thanks to all contributors! ❤️
-
-@JammingBen, @ScharfViktor, @aduffeck, @dragonchaser, @pedropintosilva, @rhafer
-
-### 📚 Documentation
-
- Update CI badge URL in README.md [[#2614](https://github.com/opencloud-eu/opencloud/pull/2614)]
+- [stable-4.0] Port #2011 [[#2018](https://github.com/opencloud-eu/opencloud/pull/2018)]

 ### 🐛 Bug Fixes

- Add a flag to the reindex command to force a full reindex [[#2606](https://github.com/opencloud-eu/opencloud/pull/2606)]
-
-### 📈 Enhancement
-
- proxy: Allow mapping from an external tenant id to the internal id [[#2569](https://github.com/opencloud-eu/opencloud/pull/2569)]
- feat: enable EnableInsertRemoteFile WOPI flag for Collabora [[#2555](https://github.com/opencloud-eu/opencloud/pull/2555)]
- feat(multi-tenancy): verify tenant via OIDC claim [[#2559](https://github.com/opencloud-eu/opencloud/pull/2559)]
-
-### 📦️ Dependencies
-
- Bump reva  [[#2611](https://github.com/opencloud-eu/opencloud/pull/2611)]
- chore(idp): clean up js dependencies [[#2607](https://github.com/opencloud-eu/opencloud/pull/2607)]
- build(deps-dev): bump dotenv from 16.4.7 to 17.4.2 in /services/idp [[#2603](https://github.com/opencloud-eu/opencloud/pull/2603)]
- chore: bump IDP javascript dependencies [[#2600](https://github.com/opencloud-eu/opencloud/pull/2600)]
- build(deps): bump github.com/nats-io/nats.go from 1.49.0 to 1.50.0 [[#2587](https://github.com/opencloud-eu/opencloud/pull/2587)]
- build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.42.0 to 1.43.0 [[#2586](https://github.com/opencloud-eu/opencloud/pull/2586)]
- chore: bump reva to latest main [[#2584](https://github.com/opencloud-eu/opencloud/pull/2584)]
- build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0 [[#2581](https://github.com/opencloud-eu/opencloud/pull/2581)]
- build(deps-dev): bump css-minimizer-webpack-plugin from 7.0.4 to 8.0.0 in /services/idp [[#2551](https://github.com/opencloud-eu/opencloud/pull/2551)]
- build(deps): bump github.com/go-ldap/ldap/v3 from 3.4.12 to 3.4.13 [[#2526](https://github.com/opencloud-eu/opencloud/pull/2526)]
- build(deps): bump github.com/open-policy-agent/opa from 1.14.1 to 1.15.0 [[#2535](https://github.com/opencloud-eu/opencloud/pull/2535)]
-
-## [6.0.0](https://github.com/opencloud-eu/opencloud/releases/tag/v6.0.0) - 2026-03-30
-
-### ❤️ Thanks to all contributors! ❤️
-
-@ScharfViktor, @aduffeck, @dragonchaser, @micbar, @pascalwengerter, @smoothscholar
-
-### 💥 Breaking changes
-
- Improve opensearch highlighting, fix favorites [[#2514](https://github.com/opencloud-eu/opencloud/pull/2514)]
-
-### 📈 Enhancement
-
- feat: add userid to spans [[#2536](https://github.com/opencloud-eu/opencloud/pull/2536)]
- feat: add openFilesInNewTab web config option [[#2522](https://github.com/opencloud-eu/opencloud/pull/2522)]
- Always enable favorites, remove FRONTEND_ENABLE_FAVORITES flag [[#2494](https://github.com/opencloud-eu/opencloud/pull/2494)]
- Implement favorites [[#2454](https://github.com/opencloud-eu/opencloud/pull/2454)]
-
-### 🐛 Bug Fixes
-
- Fix bleve batches [[#2524](https://github.com/opencloud-eu/opencloud/pull/2524)]
-
-### ✅ Tests
-
- api-tests: search for favorites [[#2487](https://github.com/opencloud-eu/opencloud/pull/2487)]
- [test-only] favorites tests [[#2474](https://github.com/opencloud-eu/opencloud/pull/2474)]
-
-### 📦️ Dependencies
-
- build(deps): bump github.com/nats-io/nats-server/v2 from 2.12.5 to 2.12.6 [[#2525](https://github.com/opencloud-eu/opencloud/pull/2525)]
- build(deps-dev): bump postcss-preset-env from 10.1.3 to 11.2.0 in /services/idp [[#2392](https://github.com/opencloud-eu/opencloud/pull/2392)]
- build(deps): bump github.com/tus/tusd/v2 from 2.8.0 to 2.9.2 [[#2485](https://github.com/opencloud-eu/opencloud/pull/2485)]
- build(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 [[#2519](https://github.com/opencloud-eu/opencloud/pull/2519)]
- build(deps): bump github.com/nats-io/nats-server/v2 from 2.12.4 to 2.12.5 [[#2499](https://github.com/opencloud-eu/opencloud/pull/2499)]
- build(deps): bump github.com/russellhaering/goxmldsig from 1.5.0 to 1.6.0 [[#2503](https://github.com/opencloud-eu/opencloud/pull/2503)]
- build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0 [[#2472](https://github.com/opencloud-eu/opencloud/pull/2472)]
- build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.65.0 to 0.67.0 [[#2473](https://github.com/opencloud-eu/opencloud/pull/2473)]
- build(deps): bump github.com/olekukonko/tablewriter from 1.1.3 to 1.1.4 [[#2468](https://github.com/opencloud-eu/opencloud/pull/2468)]
- build(deps): bump go.opentelemetry.io/contrib/zpages from 0.65.0 to 0.67.0 [[#2467](https://github.com/opencloud-eu/opencloud/pull/2467)]
- build(deps): bump github.com/testcontainers/testcontainers-go/modules/opensearch from 0.40.0 to 0.41.0 [[#2458](https://github.com/opencloud-eu/opencloud/pull/2458)]
- build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.41.0 to 1.42.0 [[#2459](https://github.com/opencloud-eu/opencloud/pull/2459)]
- build(deps): bump github.com/testcontainers/testcontainers-go from 0.40.0 to 0.41.0 [[#2453](https://github.com/opencloud-eu/opencloud/pull/2453)]
- build(deps): bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 [[#2452](https://github.com/opencloud-eu/opencloud/pull/2452)]
- build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.40.0 to 1.42.0 [[#2441](https://github.com/opencloud-eu/opencloud/pull/2441)]
- build(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.65.0 to 0.67.0 [[#2442](https://github.com/opencloud-eu/opencloud/pull/2442)]
-
-## [5.2.0](https://github.com/opencloud-eu/opencloud/releases/tag/v5.2.0) - 2026-03-09
-
-### ❤️ Thanks to all contributors! ❤️
-
-@AlexAndBear, @JammingBen, @MahdiBaghbani, @ScharfViktor, @aduffeck, @butonic, @dragonchaser, @dragotin, @fschade, @pat-s, @rhafer
-
-### 📚 Documentation
-
- update links and references in CONTRIBUTING.md [[#2411](https://github.com/opencloud-eu/opencloud/pull/2411)]
- adr(webfinger): Align example config with implementation [[#2353](https://github.com/opencloud-eu/opencloud/pull/2353)]
-
-### 📈 Enhancement
-
- feat(graph/education): Add support of 'eq' filters on users [[#2421](https://github.com/opencloud-eu/opencloud/pull/2421)]
- feat(web): change surface colors to more modern ones [[#2377](https://github.com/opencloud-eu/opencloud/pull/2377)]
- Add openCloudEducationExternalId to user [[#2357](https://github.com/opencloud-eu/opencloud/pull/2357)]
- feat: app-registry adjust default mime-types [[#2354](https://github.com/opencloud-eu/opencloud/pull/2354)]
- feat: support desktop and mobile specific  `client_id` and `scopes` [[#2072](https://github.com/opencloud-eu/opencloud/pull/2072)]
-
-### 🐛 Bug Fixes
-
- [SKIP CI] Fix simple install script, use admin-password switch [[#2413](https://github.com/opencloud-eu/opencloud/pull/2413)]
- resolve logout token subject:sessions for the idp backchannel logout [[#2328](https://github.com/opencloud-eu/opencloud/pull/2328)]
- fix(oidc_auth): Fix userinfo cache expiration logic [[#2360](https://github.com/opencloud-eu/opencloud/pull/2360)]
-
-### 📦️ Dependencies
-
- build(deps): bump github.com/open-policy-agent/opa from 1.13.2 to 1.14.0 [[#2427](https://github.com/opencloud-eu/opencloud/pull/2427)]
- build(deps): bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 [[#2425](https://github.com/opencloud-eu/opencloud/pull/2425)]
- build(deps): bump github.com/davidbyttow/govips/v2 from 2.16.0 to 2.17.0 [[#2420](https://github.com/opencloud-eu/opencloud/pull/2420)]
- build(deps): bump github.com/nats-io/nats.go from 1.48.0 to 1.49.0 [[#2390](https://github.com/opencloud-eu/opencloud/pull/2390)]
- build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 [[#2412](https://github.com/opencloud-eu/opencloud/pull/2412)]
- build(deps): bump github.com/kovidgoyal/imaging from 1.8.19 to 1.8.20 [[#2391](https://github.com/opencloud-eu/opencloud/pull/2391)]
- build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.7 to 2.28.0 [[#2375](https://github.com/opencloud-eu/opencloud/pull/2375)]
- build(deps): bump github.com/open-policy-agent/opa from 1.13.1 to 1.13.2 [[#2374](https://github.com/opencloud-eu/opencloud/pull/2374)]
- build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1 [[#2362](https://github.com/opencloud-eu/opencloud/pull/2362)]
- build(deps): bump github.com/onsi/ginkgo/v2 from 2.28.0 to 2.28.1 [[#2366](https://github.com/opencloud-eu/opencloud/pull/2366)]
- build(deps): bump go.opentelemetry.io/contrib/zpages from 0.64.0 to 0.65.0 [[#2363](https://github.com/opencloud-eu/opencloud/pull/2363)]
- build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0 [[#2356](https://github.com/opencloud-eu/opencloud/pull/2356)]
- build(deps): bump github.com/go-resty/resty/v2 from 2.17.1 to 2.17.2 [[#2355](https://github.com/opencloud-eu/opencloud/pull/2355)]
- build(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.64.0 to 0.65.0 [[#2321](https://github.com/opencloud-eu/opencloud/pull/2321)]
- build(deps): bump github.com/open-policy-agent/opa from 1.12.3 to 1.13.1 [[#2350](https://github.com/opencloud-eu/opencloud/pull/2350)]
-
-## [5.1.0](https://github.com/opencloud-eu/opencloud/releases/tag/v5.1.0) - 2026-02-16
-
-### ❤️ Thanks to all contributors! ❤️
-
-@ScharfViktor, @VicDeo, @aduffeck, @dragonchaser, @individual-it, @kulmann, @micbar, @rhafer, @schweigisito
-
-### 🐛 Bug Fixes
-
- [full-ci] Bump reva v2.42.4 [[#2348](https://github.com/opencloud-eu/opencloud/pull/2348)]
- fix: fix typo in variable description [[#2333](https://github.com/opencloud-eu/opencloud/pull/2333)]
- fix: include sessionID in sse logout event [[#2327](https://github.com/opencloud-eu/opencloud/pull/2327)]
- fix: fix typo in gateway service documentation [[#2332](https://github.com/opencloud-eu/opencloud/pull/2332)]
- Sanitize web config only once [[#2286](https://github.com/opencloud-eu/opencloud/pull/2286)]
-
-### 📈 Enhancement
-
- external tenant id [[#2258](https://github.com/opencloud-eu/opencloud/pull/2258)]
-
-### 📚 Documentation
-
- fix: make file urls [[#2304](https://github.com/opencloud-eu/opencloud/pull/2304)]
-
-### 📦️ Dependencies
-
- build(deps): bump github.com/gabriel-vasile/mimetype from 1.4.12 to 1.4.13 [[#2316](https://github.com/opencloud-eu/opencloud/pull/2316)]
- build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.39.0 to 1.40.0 [[#2279](https://github.com/opencloud-eu/opencloud/pull/2279)]
- update reva after merge #514 [[#2309](https://github.com/opencloud-eu/opencloud/pull/2309)]
- build(deps): bump github.com/go-chi/chi/v5 from 5.2.4 to 5.2.5 [[#2278](https://github.com/opencloud-eu/opencloud/pull/2278)]
-
-## [5.0.2](https://github.com/opencloud-eu/opencloud/releases/tag/v5.0.2) - 2026-02-05
-
-### ❤️ Thanks to all contributors! ❤️
-
-@AlexAndBear, @ScharfViktor, @flimmy, @individual-it, @rhafer, @saw-jan
-
-### 🐛 Bug Fixes
-
- [full-ci] reva-bump-2.42.3 [[#2276](https://github.com/opencloud-eu/opencloud/pull/2276)]
-
-### ✅ Tests
-
- adapt test for #514 [[#2255](https://github.com/opencloud-eu/opencloud/pull/2255)]
- api-test: upload-rename-download file with back slash [[#2239](https://github.com/opencloud-eu/opencloud/pull/2239)]
- [full-ci][tests-only] test: add hook failures to the test failures list [[#2041](https://github.com/opencloud-eu/opencloud/pull/2041)]
-
-### 📚 Documentation
-
- docs(proxy): Clarify PROXY_OIDC_USERINFO_CACHE_TTL value [[#2256](https://github.com/opencloud-eu/opencloud/pull/2256)]
-
-### 📦️ Dependencies
-
- [full-ci] reva-bump-2.42.2 [[#2270](https://github.com/opencloud-eu/opencloud/pull/2270)]
- build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.5 to 2.27.6 [[#2238](https://github.com/opencloud-eu/opencloud/pull/2238)]
-
-## [5.0.1](https://github.com/opencloud-eu/opencloud/releases/tag/v5.0.1) - 2026-01-28
-
-### ❤️ Thanks to all contributors! ❤️
-
-@ScharfViktor, @aduffeck, @saw-jan
-
-### 🐛 Bug Fixes
-
- Do not ever set a TTL for the ID cache. It's not supposed to expire. [[#2223](https://github.com/opencloud-eu/opencloud/pull/2223)]
-
-### ✅ Tests
-
- test(api): wait for web-office readiness by checking discovery endpoint [[#2217](https://github.com/opencloud-eu/opencloud/pull/2217)]
-
-### 📦️ Dependencies
-
- reva-bump-2.42.1 [[#2225](https://github.com/opencloud-eu/opencloud/pull/2225)]
-
-## [5.0.0](https://github.com/opencloud-eu/opencloud/releases/tag/v5.0.0) - 2026-01-26
-
-### ❤️ Thanks to all contributors! ❤️
-
-@ScharfViktor, @butonic, @dragonchaser, @flimmy, @fschade, @micbar, @rhafer, @saw-jan
-
-### 💥 Breaking changes
-
- merge ocdav into frontend [[#1958](https://github.com/opencloud-eu/opencloud/pull/1958)]
-
-### ✅ Tests
-
- [test-only] replace exception to assertions [[#2196](https://github.com/opencloud-eu/opencloud/pull/2196)]
- test(api): auto-generate test virus files before test run [[#2191](https://github.com/opencloud-eu/opencloud/pull/2191)]
- test(api): remove accountsHashDifficulty test suite [[#2190](https://github.com/opencloud-eu/opencloud/pull/2190)]
- test(api): update without-remotephp expected-failures list [[#2184](https://github.com/opencloud-eu/opencloud/pull/2184)]
- [full-ci] test: use single command to run the containers and the API tests [[#2169](https://github.com/opencloud-eu/opencloud/pull/2169)]
- [tests-only] test: setup for running wopi API tests locally [[#2139](https://github.com/opencloud-eu/opencloud/pull/2139)]
- fix flaky #2145 [[#2161](https://github.com/opencloud-eu/opencloud/pull/2161)]
- Run wopi validator tests localy [[#2151](https://github.com/opencloud-eu/opencloud/pull/2151)]
- ci: fix unwanted workflow skip in the cron pipelines [[#2117](https://github.com/opencloud-eu/opencloud/pull/2117)]
- [POC] ci: skip previously passed workflows on pipeline restart [[#2099](https://github.com/opencloud-eu/opencloud/pull/2099)]
- [tests-only] test: wait post-processing to finish for MKCOL requests [[#2092](https://github.com/opencloud-eu/opencloud/pull/2092)]
- [tests-only] test: fix API tests [[#2087](https://github.com/opencloud-eu/opencloud/pull/2087)]
- [full-ci] use graph api in the enforcePasswordPublicLink.feature [[#2050](https://github.com/opencloud-eu/opencloud/pull/2050)]
- [full-ci][tests-only] test: check last email content with retries as emails can be delayed [[#2038](https://github.com/opencloud-eu/opencloud/pull/2038)]
- skip collaborativePosix tests in CI [[#2039](https://github.com/opencloud-eu/opencloud/pull/2039)]
-
-### 📚 Documentation
-
- Update release template [[#2182](https://github.com/opencloud-eu/opencloud/pull/2182)]
- Clarify what the two requests are used for [[#2179](https://github.com/opencloud-eu/opencloud/pull/2179)]
- fix: markdown links formatting [[#2143](https://github.com/opencloud-eu/opencloud/pull/2143)]
-
-### 🐛 Bug Fixes
-
- fix: Show username in unprivileged search results [[#2104](https://github.com/opencloud-eu/opencloud/pull/2104)]
- fix(thumbnailer): missing font panic [[#2097](https://github.com/opencloud-eu/opencloud/pull/2097)]
- Remove sub-service binary entrypoints and fix antivirus only server cmd [[#2043](https://github.com/opencloud-eu/opencloud/pull/2043)]
- fix(thumbnailer): respect image boundaries and text wrappings [[#2062](https://github.com/opencloud-eu/opencloud/pull/2062)]
- fix: cobra viper flags and env [[#2047](https://github.com/opencloud-eu/opencloud/pull/2047)]
- fix service name in suture logs [[#2052](https://github.com/opencloud-eu/opencloud/pull/2052)]
-
-### 📈 Enhancement
-
- benchmark client enhancements [[#1856](https://github.com/opencloud-eu/opencloud/pull/1856)]
- allow http2 connections to proxy [[#2040](https://github.com/opencloud-eu/opencloud/pull/2040)]
- migrate from urfave/cli to spf13/cobra [[#1954](https://github.com/opencloud-eu/opencloud/pull/1954)]
-
-### 📦️ Dependencies
-
- reva-bump-2.42.0 [[#2215](https://github.com/opencloud-eu/opencloud/pull/2215)]
- build(deps): bump github.com/olekukonko/tablewriter from 1.1.2 to 1.1.3 [[#2186](https://github.com/opencloud-eu/opencloud/pull/2186)]
- build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.4 to 2.27.5 [[#2204](https://github.com/opencloud-eu/opencloud/pull/2204)]
- build(deps): bump github.com/go-resty/resty/v2 from 2.7.0 to 2.17.1 [[#2197](https://github.com/opencloud-eu/opencloud/pull/2197)]
- build(deps): bump github.com/open-policy-agent/opa from 1.11.1 to 1.12.3 [[#2166](https://github.com/opencloud-eu/opencloud/pull/2166)]
- build(deps): bump github.com/kovidgoyal/imaging from 1.8.18 to 1.8.19 [[#2167](https://github.com/opencloud-eu/opencloud/pull/2167)]
- build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.3 to 2.27.4 [[#2164](https://github.com/opencloud-eu/opencloud/pull/2164)]
- build(deps): bump github.com/sirupsen/logrus from 1.9.4-0.20230606125235-dd1b4c2e81af to 1.9.4 [[#2163](https://github.com/opencloud-eu/opencloud/pull/2163)]
- build(deps): bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.4 [[#2162](https://github.com/opencloud-eu/opencloud/pull/2162)]
- build(deps): bump go.opentelemetry.io/contrib/zpages from 0.63.0 to 0.64.0 [[#2158](https://github.com/opencloud-eu/opencloud/pull/2158)]
- build(deps): bump github.com/blevesearch/bleve/v2 from 2.5.5 to 2.5.7 [[#2157](https://github.com/opencloud-eu/opencloud/pull/2157)]
- build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.38.0 to 1.39.0 [[#2154](https://github.com/opencloud-eu/opencloud/pull/2154)]
- build(deps): bump golang.org/x/image from 0.34.0 to 0.35.0 [[#2153](https://github.com/opencloud-eu/opencloud/pull/2153)]
- build(deps): bump github.com/nats-io/nats.go from 1.47.0 to 1.48.0 [[#2147](https://github.com/opencloud-eu/opencloud/pull/2147)]
- build(deps): bump github.com/onsi/ginkgo/v2 from 2.27.2 to 2.27.5 [[#2148](https://github.com/opencloud-eu/opencloud/pull/2148)]
- build(deps): bump github.com/olekukonko/tablewriter from 1.1.1 to 1.1.2 [[#2144](https://github.com/opencloud-eu/opencloud/pull/2144)]
- build(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 [[#2141](https://github.com/opencloud-eu/opencloud/pull/2141)]
- build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 [[#2140](https://github.com/opencloud-eu/opencloud/pull/2140)]
- build(deps): bump github.com/onsi/gomega from 1.38.2 to 1.39.0 [[#2133](https://github.com/opencloud-eu/opencloud/pull/2133)]
- build(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 [[#2132](https://github.com/opencloud-eu/opencloud/pull/2132)]
- build(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.63.0 to 0.64.0 [[#2109](https://github.com/opencloud-eu/opencloud/pull/2109)]
- build(deps): bump github.com/kovidgoyal/imaging from 1.8.17 to 1.8.18 [[#2107](https://github.com/opencloud-eu/opencloud/pull/2107)]
- build(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0 [[#2106](https://github.com/opencloud-eu/opencloud/pull/2106)]
- build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 [[#2069](https://github.com/opencloud-eu/opencloud/pull/2069)]
- build(deps): bump github.com/opensearch-project/opensearch-go/v4 from 4.5.0 to 4.6.0 [[#2068](https://github.com/opencloud-eu/opencloud/pull/2068)]
- build(deps): bump github.com/testcontainers/testcontainers-go/modules/opensearch from 0.39.0 to 0.40.0 [[#1967](https://github.com/opencloud-eu/opencloud/pull/1967)]
- build(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 [[#2061](https://github.com/opencloud-eu/opencloud/pull/2061)]
- build(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.11.0 [[#1930](https://github.com/opencloud-eu/opencloud/pull/1930)]
-
-## [4.1.0](https://github.com/opencloud-eu/opencloud/releases/tag/v4.1.0) - 2025-12-15
-
-### ❤️ Thanks to all contributors! ❤️
-
-@JammingBen, @ScharfViktor, @Svanvith, @butonic, @flimmy, @fschade, @individual-it, @kulmann, @micbar, @prashant-gurung899, @saw-jan
-
-### 📚 Documentation
-
- fix typo [[#2024](https://github.com/opencloud-eu/opencloud/pull/2024)]
- [docs] update policies link [[#1996](https://github.com/opencloud-eu/opencloud/pull/1996)]
- fix the link in quickstart script for itself [[#1956](https://github.com/opencloud-eu/opencloud/pull/1956)]
-
-### ✅ Tests
-
- [full-ci][tests-only] test: fix some test flakiness [[#2003](https://github.com/opencloud-eu/opencloud/pull/2003)]
- [tests-only] Skip test related pipelines for ready-release-go PRs [[#2011](https://github.com/opencloud-eu/opencloud/pull/2011)]
- [full-ci][tests-only] test: add test to check mismatch offset during TUS upload [[#1993](https://github.com/opencloud-eu/opencloud/pull/1993)]
- [full-ci][tests-only] test: proper resource existence check [[#1990](https://github.com/opencloud-eu/opencloud/pull/1990)]
- check propfing after renaming data in file system [[#1809](https://github.com/opencloud-eu/opencloud/pull/1809)]
- fix-get-attribute-test [[#1974](https://github.com/opencloud-eu/opencloud/pull/1974)]
-
-### 📈 Enhancement
-
- Show edition in opencloud version command [[#2019](https://github.com/opencloud-eu/opencloud/pull/2019)]
-
-### 🐛 Bug Fixes
-
- fix: enforce trailing slash for server url [[#1995](https://github.com/opencloud-eu/opencloud/pull/1995)]
- fix: enhance resource creation with detailed process information [[#1978](https://github.com/opencloud-eu/opencloud/pull/1978)]
-
-### 📦️ Dependencies
-
- chore: bump web to v4.3.0 [[#2030](https://github.com/opencloud-eu/opencloud/pull/2030)]
- reva-bump-2.41.0 [[#2032](https://github.com/opencloud-eu/opencloud/pull/2032)]
- build(deps): bump github.com/testcontainers/testcontainers-go from 0.39.0 to 0.40.0 [[#1931](https://github.com/opencloud-eu/opencloud/pull/1931)]
+- [stable-4.0] fix: build time edition channels #2001 [[#2010](https://github.com/opencloud-eu/opencloud/pull/2010)]
+- [stable-4.0] fix: enforce trailing slash for server url [[#2002](https://github.com/opencloud-eu/opencloud/pull/2002)]
+- [stable-4.0] fix: enhance resource creation with detailed process information (#1978) [[#2000](https://github.com/opencloud-eu/opencloud/pull/2000)]

 ## [4.0.0](https://github.com/opencloud-eu/opencloud/releases/tag/v4.0.0) - 2025-12-01

@@ -40,7 +40,7 @@ but it should be easily transferable to other (sub)projects.

 > **Note:** Please don't file an issue to ask a question. You'll get faster results by using the resources below.

-For general questions, please refer to [OpenCloud's FAQs](https://docs.opencloud.eu/docs/admin/resources/faq/) or check the [project page](https://github.com/opencloud-eu) for communication channels.
+For general questions, please refer to [OpenCloud's FAQs](https://opencloud.eu/faq/) or check the [project page](https://github.com/opencloud-eu) for communication channels.

 ## What to know before getting started

@@ -55,7 +55,7 @@ The OpenCloud project follows the strict GitHub workflow of development as brief
 ### OpenCloud Company, Engineering Partners and Community

 OpenCloud is largely created by developers who are employed by the [OpenCloud company](https://opencloud.eu), which is located in Germany.
-It is providing support for OpenCloud for customers mainly in the EU. In addition, there are engineering partners who also work full-time on OpenCloud related code, for example, on the component [REVA](https://github.com/opencloud-eu/reva/).
+It is providing support for OpenCloud for customers mainly in the EU. In addition, there are engineering partners who also work full-time on OpenCloud related code, for example, on the component [REVA](https://github.com/cs3org/reva/).

 Because of that fact, the pace that the development is moving forward is sometimes high for people who are not willing and/or able to spend a comparable amount of time to contribute.
 Even though this can be a challenge, it should not scare anybody away. Here is our clear commitment that we feel honored by everybody who is interested in our work and improves it, no matter how big the contribution might be.
@@ -113,7 +113,7 @@ Explain the problem and include additional details to help maintainers reproduce
 Provide more context by answering these questions:

 *   **Did the problem start happening recently** (e.g. after updating to a new version) or was this always a problem?
-*   If the problem started happening recently, **can you reproduce the problem in an older version?** What's the most recent version in which the problem doesn't happen? You can find more information about how to set up in the [Getting Started guide](https://docs.opencloud.eu/docs/admin/getting-started).
+*   If the problem started happening recently, **can you reproduce the problem in an older version?** What's the most recent version in which the problem doesn't happen? You can find more information about how to set up [test environments](https://docs.opencloud.eu/devel/testing) in the [developer documentation](https://docs.opencloud.eu/docs/dev/intro).
 *   **Can you reliably reproduce the issue?** If not, provide details about how often the problem happens and under which conditions it normally happens.

 Include details about your configuration and environment as asked for in the template.
@@ -146,13 +146,15 @@ Enhancement suggestions are tracked as [GitHub issues](https://guides.github.com

 Unsure where to begin contributing to OpenCloud? You can start by looking through these `Needs-help` issues:

-*   The [Good first issue](https://github.com/opencloud-eu/opencloud/labels/Type%3Agood-first-issue) label marks good items to start with.
-*   The [Feature Request](https://github.com/opencloud-eu/opencloud/issues?q=state%3Aopen%20label%3AType%3AFeature-Request) label lists features the community would like to see implemented.
+*   The [Good first issue](https://github.com/opencloud-eu/opencloud/labels/Topic%3Agood-first-issue) label marks good items to start with.
+*   [Tests needed](https://github.com/opencloud-eu/opencloud/labels/Interaction%3ANeeds-tests) - issues which would benefit from a test.
+*   [Help wanted issues](https://github.com/opencloud-eu/opencloud/labels/Interaction%3ANeeds-help) - issues which should be a bit more involved.

 It is fine to pick one of the lists following personal preference.
 While not perfect, the number of comments is a reasonable proxy for the impact a given change will have.

-To find out how to set up OpenCloud for local development, please refer to the [Developer Documentation](https://docs.opencloud.eu/docs/dev/web/getting-started) for the web side, and the general server [README](https://github.com/opencloud-eu/opencloud/blob/main/README.md) for backend setup. Both contain information that will come in handy when starting to work on the project.
+To find out how to set up OpenCloud for local development, please refer to the [Developer Documentation](https://docs.opencloud.eu/docs/dev/web/getting-started).
+It contains a lot of information that will come in handy when starting to work on the project.

 ### Pull Requests

@@ -219,7 +221,7 @@ To help you find issues and pull requests, each label can be used in search link
 The labels are loosely grouped by their purpose, but it's not required that every issue has a label from every group or that an issue can't have more than one label from the same group.

 The list here contains all the more general categories of issues which are followed by a colon and a specific value.
-For example, severity 1 looks like `Priority:p1-urgent`.
+For example, severity 1 looks like `Severity:sev1-critical`.

 #### Platform

@@ -255,7 +257,7 @@ Categorizes the issue to also indicate the type of the issue.

 #### Status

-The status in the ticket life cycle. Keep an eye on that one, especially for the `Status:Needs-Review` tag which might indicate that the reporter is asked for feedback.
+The status in the ticket life cycle. Keep an eye on that one, especially for the `Waiting-for-Feedback` tag which might indicate that the reporter is asked for feedback.

 #### Interaction

@@ -14,21 +14,22 @@
 # is a lot faster than the build steps below.


-FROM quay.io/opencloudeu/nodejs-ci:24 AS generate
+FROM owncloudci/nodejs:18 AS generate

 COPY ./ /opencloud/

 WORKDIR /opencloud/opencloud
 RUN make node-generate-prod

-FROM quay.io/opencloudeu/golang-ci:1.25 AS build
+FROM golang:1.24-alpine AS build
+RUN apk add bash make git curl gcc musl-dev libc-dev binutils-gold inotify-tools vips-dev

 COPY --from=generate /opencloud /opencloud

 WORKDIR /opencloud/opencloud
 RUN make go-generate build ENABLE_VIPS=true

-FROM alpine:3.24
+FROM alpine:3.20

 RUN apk add --no-cache attr ca-certificates curl mailcap tree vips && \
 	echo 'hosts: files dns' >| /etc/nsswitch.conf
@@ -27,7 +27,6 @@ OC_MODULES = \
 	services/app-provider \
 	services/app-registry \
 	services/audit \
-	services/auth-api \
 	services/auth-app \
 	services/auth-basic \
 	services/auth-bearer \
@@ -40,12 +39,12 @@ OC_MODULES = \
 	services/gateway \
 	services/graph \
 	services/groups \
-	services/groupware \
 	services/idm \
 	services/idp \
 	services/invitations \
 	services/nats \
 	services/notifications \
+	services/ocdav \
 	services/ocm \
 	services/ocs \
 	services/policies \
@@ -85,7 +84,7 @@ help:
 	@echo "Please use 'make <target>' where <target> is one of the following:"
 	@echo
 	@echo -e "${GREEN}Testing with test suite natively installed:${RESET}\n"
-	@echo -e "${PURPLE}\ttests: https://github.com/opencloud-eu/opencloud/blob/main/tests/README.md#running-test-suite-in-local-environment${RESET}\n"
+	@echo -e "${PURPLE}\tdocs: https://opencloud.dev/opencloud/development/testing/#testing-with-test-suite-natively-installed${RESET}\n"
 	@echo -e "\tmake test-acceptance-api\t\t${BLUE}run API acceptance tests${RESET}"
 	@echo -e "\tmake clean-tests\t\t\t${BLUE}delete API tests framework dependencies${RESET}"
 	@echo
@@ -94,11 +93,17 @@ help:
 	@echo -e "${RED}You also should have a look at other available Makefiles:${RESET}"
 	@echo
 	@echo -e "${GREEN}opencloud:${RESET}\n"
-	@echo -e "${PURPLE}\tdocs: https://github.com/opencloud-eu/opencloud/blob/main/README.md#build-opencloud${RESET}\n"
+	@echo -e "${PURPLE}\tdocs: https://opencloud.dev/opencloud/development/build/${RESET}\n"
 	@echo -e "\tsee ./opencloud/Makefile"
+	@echo -e "\tor run ${YELLOW}make -C opencloud help${RESET}"
+	@echo
+	@echo -e "${GREEN}Documentation:${RESET}\n"
+	@echo -e "${PURPLE}\tdocs: https://opencloud.dev/opencloud/development/build-docs/${RESET}\n"
+	@echo -e "\tsee ./docs/Makefile"
+	@echo -e "\tor run ${YELLOW}make -C docs help${RESET}"
 	@echo
 	@echo -e "${GREEN}Testing with test suite in docker:${RESET}\n"
-	@echo -e "${PURPLE}\ttests: https://github.com/opencloud-eu/opencloud/blob/main/tests/README.md#running-test-suite-in-docker${RESET}\n"
+	@echo -e "${PURPLE}\tdocs: https://opencloud.dev/opencloud/development/testing/#testing-with-test-suite-in-docker${RESET}\n"
 	@echo -e "\tsee ./tests/acceptance/docker/Makefile"
 	@echo -e "\tor run ${YELLOW}make -C tests/acceptance/docker help${RESET}"
 	@echo
@@ -193,10 +198,6 @@ go-mod-tidy:
 test:
 	@go test -v -tags '$(TAGS)' -coverprofile coverage.out ./...

-.PHONY: test-with-race
-test-with-race:
-	@go test -race -v -tags '$(TAGS)' -coverprofile coverage.out ./...
-
 .PHONY: go-coverage
 go-coverage:
 	@if [ ! -f coverage.out ]; then $(MAKE) test  &>/dev/null; fi;
@@ -1,6 +1,6 @@
 ![OpenCloud logo](https://raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/opencloud_logo.png)

-[![status-badge](https://ci.opencloud.rocks/api/badges/3/status.svg)](https://ci.opencloud.rocks/repos/3)
+[![status-badge](https://ci.opencloud.eu/api/badges/3/status.svg)](https://ci.opencloud.eu/repos/3)
 [![Matrix](https://img.shields.io/matrix/opencloud%3Amatrix.org?logo=matrix)](https://app.element.io/#/room/#opencloud:matrix.org)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)

@@ -1,9 +0,0 @@
-Bugfix: Don't re-escape notification email vars for each recipient
-
-When a notification went to several recipients in one call (e.g. a group
-invite to a space), each recipient past the first got subjects and bodies
-with one extra layer of HTML escaping. escapeStringMap mutated its input
-map, and the recipient loop reused the same map across iterations. It now
-returns a new map.
-
-https://github.com/opencloud-eu/opencloud/issues/2804
@@ -2,7 +2,7 @@
  "name": "opencloud-eu/opencloud",
  "config": {
    "platform": {
-      "php": "8.3"
+      "php": "8.4"
    },
    "vendor-dir": "./vendor-php",
    "allow-plugins": {
@@ -11,7 +11,7 @@ set -euo pipefail
 #   OC_VERSION: Version to download, e.g. OC_VERSION="1.2.0"

 # Call this script directly from opencloud:
-# curl -L https://opencloud.eu/install | /bin/bash
+# curl -L https://opencloud.eu/quickinstall.sh | /bin/bash

 # This function is borrowed from openSUSEs /usr/bin/old, thanks.
 function backup_file () {
@@ -88,7 +88,7 @@ mkdir -p "$OC_CONFIG_DIR" "$OC_BASE_DATA_PATH"
 # to certain host names for example in WSL
 host="${OC_HOST:-localhost}"

-./${dlfile} init --insecure yes --admin-password admin
+./${dlfile} init --insecure yes --ap admin

 echo '#!/bin/bash
 SCRIPT_DIR="$(dirname "$(readlink -f "${0}")")"
@@ -1,161 +0,0 @@
-## Basic Settings ##
-# Define the docker compose log driver used.
-# Defaults to local
-LOG_DRIVER=
-# If you're on an internet facing server, comment out following line.
-# It skips certificate validation for various parts of OpenCloud and is
-# needed when self signed certificates are used.
-INSECURE=true
-
-## Features ##
-COMPOSE_FILE=docker-compose.yml:traefik.yml:keycloak.yml:ldap-server.yml
-
-## Traefik Settings ##
-# Note: Traefik is always enabled and can't be disabled.
-# Serve Traefik dashboard.
-# Defaults to "false".
-TRAEFIK_DASHBOARD=
-# Domain of Traefik, where you can find the dashboard.
-# Defaults to "traefik.opencloud.test"
-TRAEFIK_DOMAIN=
-# Basic authentication for the traefik dashboard.
-# Defaults to user "admin" and password "admin" (written as: "admin:$2y$05$KDHu3xq92SPaO3G8Ybkc7edd51pPLJcG1nWk3lmlrIdANQ/B6r5pq").
-# To create user:password pair, it's possible to use this command:
-# echo $(htpasswd -nB user) | sed -e s/\\$/\\$\\$/g
-TRAEFIK_BASIC_AUTH_USERS=
-# Email address for obtaining LetsEncrypt certificates.
-# Needs only be changed if this is a public facing server.
-TRAEFIK_ACME_MAIL=
-# Set to the following for testing to check the certificate process:
-# "https://acme-staging-v02.api.letsencrypt.org/directory"
-# With staging configured, there will be an SSL error in the browser.
-# When certificates are displayed and are emitted by # "Fake LE Intermediate X1",
-# the process went well and the envvar can be reset to empty to get valid certificates.
-TRAEFIK_ACME_CASERVER=
-# Enable the Traefik ACME (Automatic Certificate Management Environment) for automatic SSL certificate management.
-TRAEFIK_SERVICES_TLS_CONFIG="tls.certresolver=letsencrypt"
-# Enable Traefik to use local certificates.
-#TRAEFIK_SERVICES_TLS_CONFIG="tls=true"
-# You also need to provide a config file in ./config/traefik/dynamic/certs.yml
-# Example:
-# cat ./config/traefik/dynamic/certs.yml
-# tls:
-#   certificates:
-#     - certFile: /certs/opencloud.test.crt
-#       keyFile: /certs/opencloud.test.key
-#     stores:
-#       - default
-#
-# The certificates need to copied into ./certs/, the absolute path inside the container is /certs/.
-# You can also use TRAEFIK_CERTS_DIR=/path/on/host to set the path to the certificates directory.
-# Enable the access log for Traefik by setting the following variable to true.
-TRAEFIK_ACCESS_LOG=
-# Configure the log level for Traefik.
-# Possible values are "TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL" and "PANIC". Default is "ERROR".
-TRAEFIK_LOG_LEVEL=
-
-
-## OpenCloud Settings ##
-# The opencloud container image.
-# For production releases: "opencloudeu/opencloud"
-# For rolling releases:    "opencloudeu/opencloud-rolling"
-# Defaults to production if not set otherwise
-OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling
-# The openCloud container version.
-# Defaults to "latest" and points to the latest stable tag.
-OC_DOCKER_TAG=
-# Domain of openCloud, where you can find the frontend.
-# Defaults to "cloud.opencloud.test"
-OC_DOMAIN=
-# Demo users should not be created on a production instance,
-# because their passwords are public. Defaults to "false".
-# If demo users is set to "true", the following user accounts are created automatically:
-# alan, mary, margaret, dennis and lynn - the password is 'demo' for all.
-DEMO_USERS=
-# Admin Password for the OpenCloud admin user.
-# NOTE: This is only needed when using the built-in LDAP server (idm).
-# If you are using an external LDAP server, the admin password is managed by the LDAP server.
-# NOTE: This variable needs to be set before the first start of OpenCloud. Changes to this variable after the first start will be IGNORED.
-# If not set, opencloud will not work properly. The container will be restarting.
-# After the first initialization, the admin password can only be changed via the OpenCloud User Settings UI or by using the OpenCloud CLI.
-# Documentation: https://docs.opencloud.eu/docs/admin/resources/common-issues#-change-admin-password-set-in-env
-INITIAL_ADMIN_PASSWORD=
-# Define the openCloud loglevel used.
-#
-LOG_LEVEL=
-# Define the kind of logging.
-# The default log can be read by machines.
-# Set this to true to make the log human readable.
-# LOG_PRETTY=true
-#
-# Define the openCloud storage location. Set the paths for config and data to a local path.
-# Ensure that the configuration and data directories are owned by the user and group with ID 1000:1000.
-# This matches the default user inside the container and avoids permission issues when accessing files.
-# Note that especially the data directory can grow big.
-# Leaving it default stores data in docker internal volumes.
-# OC_CONFIG_DIR=/your/local/opencloud/config
-# OC_DATA_DIR=/your/local/opencloud/data
-
-### Compose Configuration ###
-# Path separator for supplemental compose files specified in COMPOSE_FILE.
-COMPOSE_PATH_SEPARATOR=:
-
-### Ldap Settings ###
-# LDAP is always needed for OpenCloud to store user data as there is no relational database.
-# The built-in LDAP server should used for testing purposes or small installations only.
-# For production installations, it is recommended to use an external LDAP server.
-# We are using OpenLDAP as the default LDAP server because it is proven to be stable and reliable.
-# This LDAP configuration is known to work with OpenCloud and provides a blueprint for
-# configuring an external LDAP server based on other products like Microsoft Active Directory or other LDAP servers.
-#
-# Password of LDAP bind user "cn=admin,dc=opencloud,dc=eu". Defaults to "admin"
-LDAP_BIND_PASSWORD=
-# The LDAP server also creates an openCloud admin user dn: uid=admin,ou=users,dc=opencloud,dc=eu
-# The initial password for this user is "admin"
-# NOTE: This password can only be set once, if you want to change it later, you have to use the OpenCloud User Settings UI.
-# If you changed the password and lost it, you need to execute the following LDAP query to reset it:
-# enter the ldap-server container with `docker compose exec ldap-server sh`
-# and run the following command to change the password:
-# ldappasswd -H ldap://127.0.0.1:1389 -D "cn=admin,dc=opencloud,dc=eu" -W "uid=admin,ou=users,dc=opencloud,dc=eu"
-# You will be prompted for the LDAP bind password.
-# The output should provide you a new password for the admin user.
-
-
-### Keycloak Settings ###
-# Keycloak is an open-source identity and access management solution.
-# We are using Keycloak as the default identity provider on production installations.
-# It can be used to federate authentication with other identity providers like
-# Microsoft Entra ID, ADFS or other SAML/OIDC providers.
-# The use of Keycloak as bridge between OpenCloud and other identity providers creates more control over the
-# authentication process, the allowed clients and the session management.
-# Keycloak also manages the Role Based Access Control (RBAC) for OpenCloud.
-# Keycloak can be used in two different modes:
-# 1. Autoprovisioning: New users are automatically created in openCloud when they log in for the first time.
-# 2. Shared User Directory: Users are created in Keycloak and can be used in OpenCloud immediately
-# because the LDAP server is connected to both Keycloak and OpenCloud.
-# Only use one of the two modes at a time.
-
-## Autoprovisioning Mode ##
-# Use together with idm/external-idp.yml
-# If you want to use a keycloak for local testing, you can use testing/external-keycloak.yml and testing/ldap-manager.yml
-# Domain of your Identity Provider.
-IDP_DOMAIN=
-# IdP Issuer URL, which is used to identify the Identity Provider.
-# We need the complete URL, including the protocol (http or https) and the realm.
-# Example: "https://keycloak.opencloud.test/realms/openCloud"
-IDP_ISSUER_URL=
-# Url of the account edit page from your Identity Provider.
-IDP_ACCOUNT_URL=
-
-## Shared User Directory Mode ##
-# Use together with idm/ldap-keycloak.yml and traefik/ldap-keycloak.yml
-# Domain for Keycloak. Defaults to "keycloak.opencloud.test".
-KEYCLOAK_DOMAIN=
-# Admin user login name. Defaults to "kcadmin".
-KEYCLOAK_ADMIN=
-# Admin user login password. Defaults to "admin".
-KEYCLOAK_ADMIN_PASSWORD=
-# Keycloak Database username. Defaults to "keycloak".
-KC_DB_USERNAME=
-# Keycloak Database password. Defaults to "keycloak".
-KC_DB_PASSWORD=
@@ -1,49 +0,0 @@
-# Development/Test Deployment for a multi-tenacy setup
-
-The docker compose files in this directory are derived from the
-opencloud-compose project and can be used to deploy a Development or Testing
-environment for a multi-tenancy setup of OpenCloud. It consists of the
-following services:
-
-* `provisioning`: The OpenCloud graph service deployed in a standalone mode. It
-  is configured to provide the libregraph education API for managing tenants
-  and users. The `ldap-server`service (see below) is used to store the tenants
-  and users.
-* `ldap-server`: An OpenLDAP server that is used by the provisioning service to
-  store tenants and users. Used by the OpenCloud services as the user directory
-  (for looking up users and searching for sharees).
-* `keycloak`: The OpenID Connect Provider used for authenticating users. The
-  pre-loaded realm is configured to add `tenantid` claim into the identity and
-  access tokens. It's also currently consuming user from the `ldap-server`
-  (this federation will likely go away in the future and is optional for future
-  configurations).
-* `opencloud`: The OpenCloud configured so that is hides users from different
-  tenants from each other.
-
-To deploy the setup, run:
-
-```bash
-docker compose -f docker-compose.yml -f keycloak.yml -f ldap-server.yml -f traefik.yml up
-```
-
-Once deployed you can use the `initialize_users.go` to create a couple of example
-tenants and some users in each tenant:
-
-* Tenant `Famous Coders` with users `dennis` and `grace`
-* Tenant `Scientists` with users `einstein` and `marie`
-
-The passwords for the users is set to `demo` in keycloak
-
-```
-> go run initialize_users.go
-Created tenant: Famous Coders with id fc58e19a-3a2a-4afc-90ec-8f94986db340
-Created user: Dennis Ritchie with id ee1e14e7-b00b-4eec-8b03-a6bf0e29c77c
-Created user: Grace Hopper with id a29f3afd-e4a3-4552-91e8-cc99e26bffce
-Created tenant: Scientists with id 18406c53-e2d6-4e83-98b6-a55880eef195
-Created user: Albert Einstein with id 12023d37-d6ce-4f19-a318-b70866f265ba
-Created user: Marie Curie with id 30c3c825-c37d-4e85-8195-0142e4884872
-Setting password for user: grace
-Setting password for user: marie
-Setting password for user: dennis
-Setting password for user: einstein
-```
@@ -1,63 +0,0 @@
-{
-  "clientId": "OpenCloudAndroid",
-  "name": "OpenCloud Android App",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "redirectUris": [
-    "oc://android.opencloud.eu"
-  ],
-  "webOrigins": [],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": true,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "post.logout.redirect.uris": "oc://android.opencloud.eu",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
@@ -1,64 +0,0 @@
-{
-  "clientId": "OpenCloudDesktop",
-  "name": "OpenCloud Desktop Client",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "redirectUris": [
-    "http://127.0.0.1",
-    "http://localhost"
-  ],
-  "webOrigins": [],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": true,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "post.logout.redirect.uris": "+",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
@@ -1,63 +0,0 @@
-{
-  "clientId": "OpenCloudIOS",
-  "name": "OpenCloud iOS App",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "redirectUris": [
-    "oc://ios.opencloud.eu"
-  ],
-  "webOrigins": [],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": true,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "post.logout.redirect.uris": "oc://ios.opencloud.eu",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
@@ -1,66 +0,0 @@
-{
-  "clientId": "Cyberduck",
-  "name": "Cyberduck",
-  "description": "File transfer utility client",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "redirectUris": [
-    "x-cyberduck-action:oauth",
-    "x-mountainduck-action:oauth"
-  ],
-  "webOrigins": [],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": true,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "oauth2.device.authorization.grant.enabled": "false",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "oidc.ciba.grant.enabled": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
@@ -1,74 +0,0 @@
-{
-  "clientId": "web",
-  "name": "OpenCloud Web App",
-  "description": "",
-  "rootUrl": "{{OC_URL}}",
-  "adminUrl": "{{OC_URL}}",
-  "baseUrl": "",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "redirectUris": [
-    "{{OC_URL}}/",
-    "{{OC_URL}}/oidc-callback.html",
-    "{{OC_URL}}/oidc-silent-redirect.html"
-  ],
-  "webOrigins": [
-    "{{OC_URL}}"
-  ],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": true,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "post.logout.redirect.uris": "+",
-    "oauth2.device.authorization.grant.enabled": "false",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "oidc.ciba.grant.enabled": "false",
-    "backchannel.logout.url": "{{OC_URL}}/backchannel_logout",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
@@ -1,8 +0,0 @@
-#!/bin/bash
-printenv
-# replace openCloud domain and LDAP password in keycloak realm import
-mkdir /opt/keycloak/data/import
-sed -e "s/cloud.opencloud.test/${OC_DOMAIN}/g" -e "s/ldap-admin-password/${LDAP_ADMIN_PASSWORD:-admin}/g" /opt/keycloak/data/import-dist/openCloud-realm.json > /opt/keycloak/data/import/openCloud-realm.json
-
-# run original docker-entrypoint
-/opt/keycloak/bin/kc.sh "$@"
@@ -1,38 +0,0 @@
-:root {
-    --pf-global--primary-color--100: #e2baff;
-    --pf-global--primary-color--200: #e2baff;
-    --pf-global--primary-color--dark-100: #e2baff;
-    --pf-global--Color--light-100: #20434f;
-}
-
-@font-face {
-    font-family: OpenCloud;
-    src: url('../fonts/OpenCloud500-Regular.woff2') format('woff2');
-    font-weight: normal;
-    font-style: normal;
-}
-
-@font-face {
-    font-family: OpenCloud;
-    src: url('../fonts/OpenCloud750-Bold.woff2') format('woff2');
-    font-weight: bold;
-    font-style: normal;
-}
-
-body {
-    font-family: "OpenCloud", "Open Sans", Helvetica, Arial, sans-serif;
-    background: url(../img/background.png) no-repeat center !important;
-    background-size: cover !important;
-}
-
-.kc-logo-text {
-    background-image: url(../img/logo.svg) !important;
-    background-size: contain;
-    width: 400px;
-    margin: 0 !important;
-}
-
-#kc-header-wrapper{
-    display: flex;
-    justify-content: center;
-}
@@ -1,19 +0,0 @@
-document.addEventListener("DOMContentLoaded", function () {
-    const setLogoUrl = (url) => {
-        const logoTextSelector = document.querySelector(".kc-logo-text");
-
-        if (!logoTextSelector) {
-            return
-        }
-
-        const link = document.createElement("a");
-        link.href = url;
-        link.target = "_blank";
-
-        const parent = logoTextSelector.parentNode;
-        parent.insertBefore(link, logoTextSelector);
-        link.appendChild(logoTextSelector);
-    }
-
-    setLogoUrl('https://opencloud.eu')
-});
@@ -1,5 +0,0 @@
-parent=keycloak
-import=common/keycloak
-
-styles=css/login.css css/theme.css
-scripts=js/script.js
@@ -1,9 +0,0 @@
-#!/bin/bash
-echo "Running custom LDAP entrypoint script..."
-
-if [ ! -f /opt/bitnami/openldap/share/openldap.key ]
-then	
-	openssl req -x509 -newkey rsa:4096 -keyout /opt/bitnami/openldap/share/openldap.key -out /opt/bitnami/openldap/share/openldap.crt -sha256 -days 365 -batch -nodes
-fi
-# run original docker-entrypoint
-/opt/bitnami/scripts/openldap/entrypoint.sh "$@"
@@ -1,20 +0,0 @@
-dn: dc=opencloud,dc=eu
-objectClass: organization
-objectClass: dcObject
-dc: opencloud
-o: openCloud
-
-dn: ou=users,dc=opencloud,dc=eu
-objectClass: organizationalUnit
-ou: users
-
-dn: cn=admin,dc=opencloud,dc=eu
-objectClass: inetOrgPerson
-objectClass: person
-cn: admin
-sn: admin
-uid: ldapadmin
-
-dn: ou=tenants,dc=opencloud,dc=eu
-objectClass: organizationalUnit
-ou: tenants
@@ -1,20 +0,0 @@
-dn: uid=admin,ou=users,dc=opencloud,dc=eu
-objectClass: inetOrgPerson
-objectClass: organizationalPerson
-objectClass: person
-objectClass: top
-uid: admin
-givenName: Admin
-sn: Admin
-cn: admin
-displayName: Admin
-description: An admin for this OpenCloud instance.
-mail: admin@example.org
-userPassword:: e1NTSEF9UWhmaFB3dERydTUydURoWFFObDRMbzVIckI3TkI5Nmo==
-
-dn: cn=administrators,ou=groups,dc=opencloud,dc=eu
-objectClass: groupOfNames
-objectClass: top
-cn: administrators
-description: OpenCloud Administrators
-member: uid=admin,ou=users,dc=opencloud,dc=eu
@@ -1,47 +0,0 @@
-directives:
-  child-src:
-    - '''self'''
-  connect-src:
-    - '''self'''
-    - 'blob:'
-    - 'https://${COMPANION_DOMAIN|companion.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
-    - 'wss://${COMPANION_DOMAIN|companion.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
-    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
-    - 'https://${IDP_DOMAIN|keycloak.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
-    - 'https://update.opencloud.eu/'
-  default-src:
-    - '''none'''
-  font-src:
-    - '''self'''
-  frame-ancestors:
-    - '''self'''
-  frame-src:
-    - '''self'''
-    - 'blob:'
-    - 'https://embed.diagrams.net/'
-    # In contrary to bash and docker the default is given after the | character
-    - 'https://${COLLABORA_DOMAIN|collabora.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
-    # This is needed for the external-sites web extension when embedding sites
-    - 'https://docs.opencloud.eu'
-  img-src:
-    - '''self'''
-    - 'data:'
-    - 'blob:'
-    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
-    - 'https://tile.openstreetmap.org/'
-    # In contrary to bash and docker the default is given after the | character
-    - 'https://${COLLABORA_DOMAIN|collabora.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
-  manifest-src:
-    - '''self'''
-  media-src:
-    - '''self'''
-  object-src:
-    - '''self'''
-    - 'blob:'
-  script-src:
-    - '''self'''
-    - '''unsafe-inline'''
-    - 'https://${IDP_DOMAIN|keycloak.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
-  style-src:
-    - '''self'''
-    - '''unsafe-inline'''
@@ -1,40 +0,0 @@
-# This adds four additional routes to the proxy. Forwarding
-# request on '/carddav/', '/caldav/' and the respective '/.well-knwown'
-# endpoints to the radicale container and setting the required headers.
-additional_policies:
-  - name: default
-    routes:
-      - endpoint: /caldav/
-        backend: http://radicale:5232
-        remote_user_header: X-Remote-User
-        skip_x_access_token: true
-        additional_headers:
-          - X-Script-Name: /caldav
-      - endpoint: /.well-known/caldav
-        backend: http://radicale:5232
-        remote_user_header: X-Remote-User
-        skip_x_access_token: true
-        additional_headers:
-          - X-Script-Name: /caldav
-      - endpoint: /carddav/
-        backend: http://radicale:5232
-        remote_user_header: X-Remote-User
-        skip_x_access_token: true
-        additional_headers:
-          - X-Script-Name: /carddav
-      - endpoint: /.well-known/carddav
-        backend: http://radicale:5232
-        remote_user_header: X-Remote-User
-        skip_x_access_token: true
-        additional_headers:
-          - X-Script-Name: /carddav
-# To enable the radicale web UI add this rule.
-# "unprotected" is True because the Web UI itself ask for
-# the password.
-# Also set "type" to "internal" in the config/radicale/config
-#      - endpoint: /caldav/.web/
-#        backend: http://radicale:5232/
-#        unprotected: true
-#        skip_x_access_token: true
-#        additional_headers:
-#          - X-Script-Name: /caldav
@@ -1,72 +0,0 @@
-set -e
-
-printenv
-# Function to add arguments to the command
-add_arg() {
-    TRAEFIK_CMD="$TRAEFIK_CMD $1"
-}
-
-# Initialize the base command
-TRAEFIK_CMD="traefik"
-
-# Base Traefik arguments (from your existing configuration)
-add_arg "--log.level=${TRAEFIK_LOG_LEVEL:-ERROR}"
-# enable dashboard
-add_arg "--api.dashboard=true"
-# define entrypoints
-add_arg "--entryPoints.http.address=:80"
-add_arg "--entryPoints.http.http.redirections.entryPoint.to=https"
-add_arg "--entryPoints.http.http.redirections.entryPoint.scheme=https"
-add_arg "--entryPoints.https.address=:443"
-# change default timeouts for long-running requests
-# this is needed for webdav clients that do not support the TUS protocol
-add_arg "--entryPoints.https.transport.respondingTimeouts.readTimeout=12h"
-add_arg "--entryPoints.https.transport.respondingTimeouts.writeTimeout=12h"
-add_arg "--entryPoints.https.transport.respondingTimeouts.idleTimeout=3m"
-# docker provider (get configuration from container labels)
-add_arg "--providers.docker.endpoint=unix:///var/run/docker.sock"
-add_arg "--providers.docker.exposedByDefault=false"
-# access log
-add_arg "--accessLog=${TRAEFIK_ACCESS_LOG:-false}"
-add_arg "--accessLog.format=json"
-add_arg "--accessLog.fields.headers.names.X-Request-Id=keep"
-
-# Add Let's Encrypt configuration if enabled
-if [ "${TRAEFIK_SERVICES_TLS_CONFIG}" = "tls.certresolver=letsencrypt" ]; then
-    echo "Configuring Traefik with Let's Encrypt..."
-    add_arg "--certificatesResolvers.letsencrypt.acme.email=${TRAEFIK_ACME_MAIL:-example@example.org}"
-    add_arg "--certificatesResolvers.letsencrypt.acme.storage=/certs/acme.json"
-    add_arg "--certificatesResolvers.letsencrypt.acme.httpChallenge.entryPoint=http"
-    add_arg "--certificatesResolvers.letsencrypt.acme.caserver=${TRAEFIK_ACME_CASERVER:-https://acme-v02.api.letsencrypt.org/directory}"
-fi
-
-# Add local certificate configuration if enabled
-if [ "${TRAEFIK_SERVICES_TLS_CONFIG}" = "tls=true" ]; then
-    echo "Configuring Traefik with local certificates..."
-    add_arg "--providers.file.directory=/etc/traefik/dynamic"
-    add_arg "--providers.file.watch=true"
-fi
-
-# Warning if neither certificate method is enabled
-if [ "${TRAEFIK_SERVICES_TLS_CONFIG}" != "tls=true" ] && [ "${TRAEFIK_SERVICES_TLS_CONFIG}" != "tls.certresolver=letsencrypt" ]; then
-    echo "WARNING: Neither Let's Encrypt nor local certificates are enabled."
-    echo "HTTPS will not work properly without certificate configuration."
-fi
-
-# Add any custom arguments from environment variable
-if [ -n "${TRAEFIK_CUSTOM_ARGS}" ]; then
-    echo "Adding custom Traefik arguments: ${TRAEFIK_CUSTOM_ARGS}"
-    TRAEFIK_CMD="$TRAEFIK_CMD $TRAEFIK_CUSTOM_ARGS"
-fi
-
-# Add any additional arguments passed to the script
-for arg in "$@"; do
-    add_arg "$arg"
-done
-
-# Print the final command for debugging
-echo "Starting Traefik with command:"
-echo "$TRAEFIK_CMD"
-
-# Execute Traefik
-exec $TRAEFIK_CMD
@@ -1,119 +0,0 @@
---
-services:
-  # OpenCloud instance configured for multi-tenancy using keycloak as identity provider
-  # The graph service is setup to consume users via the CS3 API.
-  opencloud:
-    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-latest}
-    # changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog
-    # release notes: https://docs.opencloud.eu/opencloud_release_notes.html
-    networks:
-      opencloud-net:
-    entrypoint:
-      - /bin/sh
-    # run opencloud init to initialize a configuration file with random secrets
-    # it will fail on subsequent runs, because the config file already exists
-    # therefore we ignore the error and then start the opencloud server
-    command: ["-c", "opencloud init || true; opencloud server"]
-    environment:
-      OC_MULTI_TENANT_ENABLED: "true"
-      # enable services that are not started automatically
-      OC_URL: https://${OC_DOMAIN:-cloud.opencloud.test}
-      OC_LOG_LEVEL: ${LOG_LEVEL:-info}
-      OC_LOG_COLOR: "${LOG_PRETTY:-false}"
-      OC_LOG_PRETTY: "${LOG_PRETTY:-false}"
-      OC_EXCLUDE_RUN_SERVICES: idm,idp
-      PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"
-      OC_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}/realms/openCloud
-      PROXY_OIDC_REWRITE_WELLKNOWN: "true"
-      WEB_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID:-web}
-      PROXY_USER_OIDC_CLAIM: "uuid"
-      PROXY_USER_CS3_CLAIM: "userid"
-      WEB_OPTION_ACCOUNT_EDIT_LINK_HREF: "https://${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}/realms/openCloud/account"
-      # admin and demo accounts must be created in Keycloak
-      OC_ADMIN_USER_ID: ""
-      SETTINGS_SETUP_DEFAULT_ASSIGNMENTS: "false"
-      GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
-      GRAPH_USERNAME_MATCH: "none"
-      GROUPS_DRIVER: "null"
-      # This is needed to set the correct CSP rules for OpenCloud
-      IDP_DOMAIN: ${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}
-      # do not use SSL between the reverse proxy and OpenCloud
-      PROXY_TLS: "false"
-      # INSECURE: needed if OpenCloud / reverse proxy is using self generated certificates
-      OC_INSECURE: "${INSECURE:-false}"
-      # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
-      PROXY_ENABLE_BASIC_AUTH: "false"
-      GRAPH_IDENTITY_BACKEND: "cs3"
-      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
-      OC_LDAP_URI: ldaps://ldap-server:1636
-      OC_LDAP_INSECURE: "true"
-      OC_LDAP_BIND_DN: "cn=admin,dc=opencloud,dc=eu"
-      OC_LDAP_BIND_PASSWORD: ${LDAP_BIND_PASSWORD:-admin}
-      OC_LDAP_USER_BASE_DN: "ou=users,dc=opencloud,dc=eu"
-      OC_LDAP_USER_SCHEMA_TENANT_ID: "openCloudMemberOfSchool"
-      PROXY_LOG_LEVEL: "debug"
-    volumes:
-      - ./config/opencloud/csp.yaml:/etc/opencloud/csp.yaml
-      # configure the .env file to use own paths instead of docker internal volumes
-      - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud
-      - ${OC_DATA_DIR:-opencloud-data}:/var/lib/opencloud
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: always
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.opencloud.entrypoints=https"
-      - "traefik.http.routers.opencloud.rule=Host(`${OC_DOMAIN:-cloud.opencloud.test}`)"
-      - "traefik.http.routers.opencloud.service=opencloud"
-      - "traefik.http.services.opencloud.loadbalancer.server.port=9200"
-      - "traefik.http.routers.opencloud.${TRAEFIK_SERVICES_TLS_CONFIG}"
-  # Stand-alone instance of the 'graph' service to serve the provisioning API
-  provsioning:
-    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-latest}
-    networks:
-      opencloud-net:
-    entrypoint:
-      - /bin/sh
-    # run opencloud init to initialize a configuration file with random secrets
-    # it will fail on subsequent runs, because the config file already exists
-    # therefore we ignore the error and then start the opencloud server
-    command: ["-c", "opencloud init || true; opencloud graph server"]
-    environment:
-      OC_LOG_LEVEL: "debug"
-      OC_LOG_COLOR: "${LOG_PRETTY:-false}"
-      OC_LOG_PRETTY: "${LOG_PRETTY:-false}"
-      # This just runs the standalone graph service we don't need access to the registry
-      MICRO_REGISTRY: "memory"
-      # INSECURE: needed if OpenCloud / reverse proxy is using self generated certificates
-      OC_INSECURE: "${INSECURE:-false}"
-      GRAPH_HTTP_ADDR: "0.0.0.0:9120"
-      GRAPH_HTTP_API_TOKEN: "${PROVISIONING_API_TOKEN:-changeme}"
-      # disable listening for events
-      GRAPH_EVENTS_ENDPOINT: ""
-      GRAPH_STORE_NODES: ""
-      GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
-      GRAPH_USERNAME_MATCH: "none"
-      GRAPH_LDAP_EDUCATION_RESOURCES_ENABLED: "true"
-      GRAPH_LDAP_SCHOOL_BASE_DN: "ou=tenants,dc=opencloud,dc=eu"
-      OC_LDAP_URI: ldaps://ldap-server:1636
-      OC_LDAP_INSECURE: "true"
-      OC_LDAP_BIND_DN: "cn=admin,dc=opencloud,dc=eu"
-      OC_LDAP_BIND_PASSWORD: ${LDAP_BIND_PASSWORD:-admin}
-      OC_LDAP_USER_BASE_DN: "ou=users,dc=opencloud,dc=eu"
-      OC_LDAP_USER_FILTER: "(objectclass=inetOrgPerson)"
-    volumes:
-      # configure the .env file to use own paths instead of docker internal volumes
-      - ${PROVISIONING_CONFIG_DIR:-provisioning-config}:/etc/opencloud
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: always
-    ports:
-      - "9120:9120"
-
-volumes:
-  opencloud-config:
-  opencloud-data:
-  provisioning-config:
-
-networks:
-  opencloud-net:
@@ -1,175 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/tls"
-	"fmt"
-
-	"github.com/Nerzal/gocloak/v13"
-	"github.com/go-resty/resty/v2"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-)
-
-const (
-	provisioningAPIURL    = "http://localhost:9120/graph"
-	provisioningAuthToken = "changeme"
-)
-
-type tenantWithUsers struct {
-	tenant libregraph.EducationSchool
-	users  []libregraph.EducationUser
-}
-
-var demoTenants = []tenantWithUsers{
-	{
-		tenant: libregraph.EducationSchool{
-			DisplayName: libregraph.PtrString("Famous Coders"),
-			ExternalId:  libregraph.PtrString("famouscodersExternalID"),
-		},
-		users: []libregraph.EducationUser{
-			{
-				DisplayName:              libregraph.PtrString("Dennis Ritchie"),
-				OnPremisesSamAccountName: libregraph.PtrString("dennis"),
-				Mail:                     libregraph.PtrString("dennis@example.org"),
-				ExternalId:               libregraph.PtrString("ExternalID1"),
-			},
-			{
-				DisplayName:              libregraph.PtrString("Grace Hopper"),
-				OnPremisesSamAccountName: libregraph.PtrString("grace"),
-				Mail:                     libregraph.PtrString("grace@example.org"),
-				ExternalId:               libregraph.PtrString("ExternalID2"),
-			},
-		},
-	},
-	{
-		tenant: libregraph.EducationSchool{
-			DisplayName: libregraph.PtrString("Scientists"),
-			ExternalId:  libregraph.PtrString("scientistsExternalID"),
-		},
-		users: []libregraph.EducationUser{
-			{
-				DisplayName:              libregraph.PtrString("Albert Einstein"),
-				OnPremisesSamAccountName: libregraph.PtrString("einstein"),
-				Mail:                     libregraph.PtrString("einstein@example.org"),
-				ExternalId:               libregraph.PtrString("ExternalID3"),
-			},
-			{
-				DisplayName:              libregraph.PtrString("Marie Curie"),
-				OnPremisesSamAccountName: libregraph.PtrString("marie"),
-				Mail:                     libregraph.PtrString("marie@example.org"),
-				ExternalId:               libregraph.PtrString("ExternalID4"),
-			},
-		},
-	},
-}
-
-func main() {
-	lgconf := libregraph.NewConfiguration()
-	lgconf.Servers = libregraph.ServerConfigurations{
-		{
-			URL: provisioningAPIURL,
-		},
-	}
-	lgconf.DefaultHeader = map[string]string{"Authorization": "Bearer " + provisioningAuthToken}
-	lgclient := libregraph.NewAPIClient(lgconf)
-
-	for _, tenant := range demoTenants {
-		tenantid, err := createTenant(lgclient, tenant.tenant)
-		if err != nil {
-			fmt.Printf("Failed to create tenant: %s\n", err)
-			continue
-		}
-		for _, user := range tenant.users {
-			userid1, err := createUser(lgclient, user)
-			if err != nil {
-				fmt.Printf("Failed to create user: %s\n", err)
-				continue
-			}
-			_, err = lgclient.EducationSchoolApi.AddUserToSchool(context.TODO(), tenantid).EducationUserReference(libregraph.EducationUserReference{
-				OdataId: libregraph.PtrString(fmt.Sprintf("%s/education/users/%s", provisioningAPIURL, userid1)),
-			}).Execute()
-			if err != nil {
-				fmt.Printf("Failed to add user to tenant: %s\n", err)
-				continue
-			}
-		}
-	}
-
-	resetAllUserPasswords()
-	setUserRoles()
-}
-
-func createUser(client *libregraph.APIClient, user libregraph.EducationUser) (string, error) {
-	newUser, _, err := client.EducationUserApi.CreateEducationUser(context.TODO()).EducationUser(user).Execute()
-	if err != nil {
-		fmt.Printf("Failed to create user: %s\n", err)
-		return "", err
-	}
-	fmt.Printf("Created user: %s with id %s\n", newUser.GetDisplayName(), newUser.GetId())
-	return newUser.GetId(), nil
-}
-
-func createTenant(client *libregraph.APIClient, tenant libregraph.EducationSchool) (string, error) {
-	newTenant, _, err := client.EducationSchoolApi.CreateSchool(context.TODO()).EducationSchool(tenant).Execute()
-	if err != nil {
-		fmt.Printf("Failed to create tenant: %s\n", err)
-		return "", err
-	}
-	fmt.Printf("Created tenant: %s with id %s\n", newTenant.GetDisplayName(), newTenant.GetId())
-	return newTenant.GetId(), nil
-}
-
-func setUserRoles() {
-	tls := tls.Config{InsecureSkipVerify: true}
-	restyClient := resty.New().SetTLSClientConfig(&tls)
-	client := gocloak.NewClient("https://keycloak.opencloud.test")
-	client.SetRestyClient(restyClient)
-	ctx := context.Background()
-	token, err := client.LoginAdmin(ctx, "kcadmin", "admin", "master")
-	if err != nil {
-		fmt.Printf("Failed to login: %s\n", err)
-		panic("Something wrong with the credentials or url")
-	}
-
-	role, _ := client.GetRealmRole(ctx, token.AccessToken, "openCloud", "opencloudUser")
-	users, err := client.GetUsers(ctx, token.AccessToken, "openCloud", gocloak.GetUsersParams{})
-	if err != nil {
-		fmt.Printf("%s\n", err)
-		panic("Oh no!, failed to list users :(")
-	}
-	for _, user := range users {
-		err := client.AddRealmRoleToUser(ctx, token.AccessToken, "openCloud", *user.ID, []gocloak.Role{
-			*role,
-		})
-		if err != nil {
-			fmt.Printf("Failed to assign role to user %s: %s\n", *user.Username, err)
-		}
-	}
-}
-
-func resetAllUserPasswords() {
-	tls := tls.Config{InsecureSkipVerify: true}
-	restyClient := resty.New().SetTLSClientConfig(&tls)
-	client := gocloak.NewClient("https://keycloak.opencloud.test")
-	client.SetRestyClient(restyClient)
-	ctx := context.Background()
-	token, err := client.LoginAdmin(ctx, "kcadmin", "admin", "master")
-	if err != nil {
-		fmt.Printf("Failed to login: %s\n", err)
-		panic("Something wrong with the credentials or url")
-	}
-
-	users, err := client.GetUsers(ctx, token.AccessToken, "openCloud", gocloak.GetUsersParams{})
-	if err != nil {
-		fmt.Printf("%s\n", err)
-		panic("Oh no!, failed to list users :(")
-	}
-	for _, user := range users {
-		fmt.Printf("Setting password for user: %s\n", *user.Username)
-		err = client.SetPassword(ctx, token.AccessToken, *user.ID, "openCloud", "demo", false)
-		if err != nil {
-			fmt.Printf("Failed to set password for user %s: %s\n", *user.Username, err)
-		}
-	}
-
-}
@@ -1,55 +0,0 @@
---
-services:
-  opencloud:
-    environment:
-  postgres:
-    image: postgres:alpine
-    networks:
-      opencloud-net:
-    volumes:
-      - keycloak_postgres_data:/var/lib/postgresql/data
-    environment:
-      POSTGRES_DB: keycloak
-      POSTGRES_USER: ${KC_DB_USERNAME:-keycloak}
-      POSTGRES_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: always
-
-  keycloak:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.keycloak.entrypoints=https"
-      - "traefik.http.routers.keycloak.rule=Host(`${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}`)"
-      - "traefik.http.routers.keycloak.${TRAEFIK_SERVICES_TLS_CONFIG}"
-      - "traefik.http.routers.keycloak.service=keycloak"
-      - "traefik.http.services.keycloak.loadbalancer.server.port=8080"
-    image: quay.io/keycloak/keycloak:26.4
-    networks:
-      opencloud-net:
-    command: [ "start", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm" ]
-    entrypoint: [ "/bin/sh", "/opt/keycloak/bin/docker-entrypoint-override.sh" ]
-    volumes:
-      - "./config/keycloak/docker-entrypoint-override.sh:/opt/keycloak/bin/docker-entrypoint-override.sh"
-      - "./config/keycloak/openCloud-realm.dist.json:/opt/keycloak/data/import-dist/openCloud-realm.json"
-      - "./config/keycloak/themes/opencloud:/opt/keycloak/themes/opencloud"
-    environment:
-      OC_DOMAIN: ${OC_DOMAIN:-cloud.opencloud.test}
-      KC_HOSTNAME: ${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}
-      KC_DB: postgres
-      KC_DB_URL: "jdbc:postgresql://postgres:5432/keycloak"
-      KC_DB_USERNAME: ${KC_DB_USERNAME:-keycloak}
-      KC_DB_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
-      KC_FEATURES: impersonation
-      KC_PROXY_HEADERS: xforwarded
-      KC_HTTP_ENABLED: true
-      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-kcadmin}
-      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
-    depends_on:
-      - postgres
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: always
-
-volumes:
-  keycloak_postgres_data:
@@ -1,32 +0,0 @@
---
-services:
-  ldap-server:
-    image: bitnamilegacy/openldap:2.6
-    networks:
-      opencloud-net:
-    entrypoint: [ "/bin/sh", "/opt/bitnami/scripts/openldap/docker-entrypoint-override.sh", "/opt/bitnami/scripts/openldap/run.sh" ]
-    environment:
-      BITNAMI_DEBUG: true
-      LDAP_TLS_VERIFY_CLIENT: never
-      LDAP_ENABLE_TLS: "yes"
-      LDAP_TLS_CA_FILE: /opt/bitnami/openldap/share/openldap.crt
-      LDAP_TLS_CERT_FILE: /opt/bitnami/openldap/share/openldap.crt
-      LDAP_TLS_KEY_FILE: /opt/bitnami/openldap/share/openldap.key
-      LDAP_ROOT: "dc=opencloud,dc=eu"
-      LDAP_ADMIN_PASSWORD: ${LDAP_BIND_PASSWORD:-admin}
-    ports:
-      - "127.0.0.1:389:1389"
-      - "127.0.0.1:636:1636"
-    volumes:
-      # Only use the base ldif file to create the base structure
-      - ./config/ldap/ldif/10_base.ldif:/ldifs/10_base.ldif
-      # Use the custom schema from opencloud because we are in full control of the ldap server
-      - ../shared/config/ldap/schemas/10_opencloud_schema.ldif:/schemas/10_opencloud_schema.ldif
-      - ../shared/config/ldap/schemas/20_opencloud_education_schema.ldif:/schemas/20_opencloud_education_schema.ldif
-      - ./config/ldap/docker-entrypoint-override.sh:/opt/bitnami/scripts/openldap/docker-entrypoint-override.sh
-      - ${LDAP_CERTS_DIR:-ldap-certs}:/opt/bitnami/openldap/share
-      - ${LDAP_DATA_DIR:-ldap-data}:/bitnami/openldap
-
-volumes:
-  ldap-certs:
-  ldap-data:
@@ -1,24 +0,0 @@
---
-# This file can be used to be added to the opencloud_full example
-# to browse the LDAP server with a web interface.
-# This is not a production ready setup.
-services:
-  ldap-manager:
-    image: phpldapadmin/phpldapadmin:latest
-    networks:
-      opencloud-net:
-    environment:
-      LDAP_HOST: ldap-server
-      LDAP_PORT: 1389
-      LDAP_LOGIN_OBJECTCLASS: "inetOrgPerson"
-      APP_URL: "https://${LDAP_MANAGER_DOMAIN:-ldap.opencloud.test}"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.ldap-manager.entrypoints=https"
-      - "traefik.http.routers.ldap-manager.rule=Host(`${LDAP_MANAGER_DOMAIN:-ldap.opencloud.test}`)"
-      - "traefik.http.routers.ldap-manager.${TRAEFIK_SERVICES_TLS_CONFIG}"
-      - "traefik.http.routers.ldap-manager.service=ldap-manager"
-      - "traefik.http.services.ldap-manager.loadbalancer.server.port=8080"
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: always
@@ -1,45 +0,0 @@
---
-services:
-  opencloud:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.opencloud.entrypoints=https"
-      - "traefik.http.routers.opencloud.rule=Host(`${OC_DOMAIN:-cloud.opencloud.test}`)"
-      - "traefik.http.routers.opencloud.service=opencloud"
-      - "traefik.http.services.opencloud.loadbalancer.server.port=9200"
-      - "traefik.http.routers.opencloud.${TRAEFIK_SERVICES_TLS_CONFIG}"
-  traefik:
-    image: traefik:v3.6.7
-    # release notes: https://github.com/traefik/traefik/releases
-    networks:
-      opencloud-net:
-        aliases:
-          - ${OC_DOMAIN:-cloud.opencloud.test}
-          - ${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}
-    entrypoint: [ "/bin/sh", "/opt/traefik/bin/docker-entrypoint-override.sh"]
-    environment:
-      - "TRAEFIK_SERVICES_TLS_CONFIG=${TRAEFIK_SERVICES_TLS_CONFIG:-tls.certresolver=letsencrypt}"
-      - "TRAEFIK_ACME_MAIL=${TRAEFIK_ACME_MAIL:-example@example.org}"
-      - "TRAEFIK_ACME_CASERVER=${TRAEFIK_ACME_CASERVER:-https://acme-v02.api.letsencrypt.org/directory}"
-      - "TRAEFIK_LOG_LEVEL=${TRAEFIK_LOG_LEVEL:-ERROR}"
-      - "TRAEFIK_ACCESS_LOG=${TRAEFIK_ACCESS_LOG:-false}"
-    ports:
-      - "80:80"
-      - "443:443"
-    volumes:
-      - "${DOCKER_SOCKET_PATH:-/var/run/docker.sock}:/var/run/docker.sock:ro"
-      - "./config/traefik/docker-entrypoint-override.sh:/opt/traefik/bin/docker-entrypoint-override.sh"
-      - "${TRAEFIK_CERTS_DIR:-./certs}:/certs"
-      - "./config/traefik/dynamic:/etc/traefik/dynamic"
-    labels:
-      - "traefik.enable=${TRAEFIK_DASHBOARD:-false}"
-      # defaults to admin:admin
-      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS:-admin:$$apr1$$4vqie50r$$YQAmQdtmz5n9rEALhxJ4l.}"
-      - "traefik.http.routers.traefik.entrypoints=https"
-      - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN:-traefik.opencloud.test}`)"
-      - "traefik.http.routers.traefik.middlewares=traefik-auth"
-      - "traefik.http.routers.traefik.${TRAEFIK_SERVICES_TLS_CONFIG}"
-      - "traefik.http.routers.traefik.service=api@internal"
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: always
@@ -305,21 +305,8 @@ KEYCLOAK_ADMIN_PASSWORD=
 # Leaving it default stores data in docker internal volumes.
 #RADICALE_DATA_DIR=/your/local/radicale/data

-### Stalwart Settings ###
-# Note: the leading colon is required to enable the service.
-#STALWART=:stalwart.yml
-# Domain of Stalwart
-# Defaults to "stalwart.opencloud.test"
-STALWART_DOMAIN=
-# LDAP configuration to use for Stalwart:
-# Can either be either
-# - idmldap: for the built-in IDP/IDM, using Master Authentication between Groupware and Stalwart, and LDAP in Stalwart
-# - idmoidc: built-in IDP/IDM, using OIDC Userinfo between Groupware and Stalwart
-# - ldap: when using KeyCloak and OpenLDAP, with Master Authentication between Groupware and Stalwart, and LDAP in Stalwart
-STALWART_AUTH_DIRECTORY=idmldap
-
 ## IMPORTANT ##
 # This MUST be the last line as it assembles the supplemental compose files to be used.
 # ALL supplemental configs must be added here, whether commented or not.
 # Each var must either be empty or contain :path/file.yml
-COMPOSE_FILE=docker-compose.yml${OPENCLOUD:-}${TIKA:-}${DECOMPOSEDS3:-}${DECOMPOSEDS3_MINIO:-}${DECOMPOSED:-}${COLLABORA:-}${MONITORING:-}${IMPORTER:-}${CLAMAV:-}${INBUCKET:-}${EXTENSIONS:-}${UNZIP:-}${DRAWIO:-}${JSONVIEWER:-}${PROGRESSBARS:-}${EXTERNALSITES:-}${KEYCLOAK:-}${LDAP:-}${KEYCLOAK_AUTOPROVISIONING:-}${LDAP_MANAGER:-}${RADICALE:-}${STALWART:-}
+COMPOSE_FILE=docker-compose.yml${OPENCLOUD:-}${TIKA:-}${DECOMPOSEDS3:-}${DECOMPOSEDS3_MINIO:-}${DECOMPOSED:-}${COLLABORA:-}${MONITORING:-}${IMPORTER:-}${CLAMAV:-}${INBUCKET:-}${EXTENSIONS:-}${UNZIP:-}${DRAWIO:-}${JSONVIEWER:-}${PROGRESSBARS:-}${EXTERNALSITES:-}${KEYCLOAK:-}${LDAP:-}${KEYCLOAK_AUTOPROVISIONING:-}${LDAP_MANAGER:-}${RADICALE:-}
@@ -1,26 +0,0 @@
-dn: ou=policies,dc=opencloud,dc=eu
-objectClass: organizationalUnit
-objectClass: top
-ou: policies
-
-dn: cn=default,ou=policies,dc=opencloud,dc=eu
-cn: default
-objectClass: pwdPolicy
-objectClass: person
-objectClass: top
-pwdAllowUserChange: TRUE
-pwdAttribute: userPassword
-pwdCheckQuality: 0
-pwdExpireWarning: 600
-pwdFailureCountInterval: 30
-pwdGraceAuthNLimit: 5
-pwdInHistory: 5
-pwdLockout: FALSE
-pwdLockoutDuration: 0
-pwdMaxAge: 0
-pwdMaxFailure: 5
-pwdMinAge: 0
-pwdMinLength: 1
-pwdMustChange: FALSE
-pwdSafeModify: FALSE
-sn: default
@@ -1,2 +0,0 @@
-/*.crt
-/*.key
@@ -1,21 +0,0 @@
-# Stalwart Configuration
-
-The mechanics are currently to mount a different configuration file depending on the environment, as we support two scenarios that are described in [`services/groupware/DEVELOPER.md`](../../../../../services/groupware/DEVELOPER.md):
-
- * &laquo;production&raquo; setup, with OpenLDAP and Keycloak containers
- * &laquo;homelab&raquo; setup, with the built-in IDM (LDAP) and IDP that run as part of the `opencloud` container
-
-The Docker Compose setup (in [`stalwart.yml`](../../stalwart.yml)) mounts either [`idmldap.toml`](./idmldap.toml) or [`ldap.toml`](./ldap.toml) depending on how the variable `STALWART_AUTH_DIRECTORY` is set, which is either `idmldap` for the homelab setup, or `ldap` for the production setup.
-
-This is thus all done automatically, but whenever changes are performed to Stalwart configuration files, they must be reflected across those two files, to keep them in sync, as the only entry that should differ is this one:
-
-```ruby
-storage.directory = "ldap"
-```
-
-or this:
-
-```ruby
-storage.directory = "idmldap"
-```
-
@@ -1 +0,0 @@
-{"@type":"RocksDb","path":"/var/lib/stalwart/","blobSize":16834,"bufferSize":134217728,"poolWorkers":null}
@@ -1,110 +0,0 @@
-authentication.fallback-admin.secret = "$6$4qPYDVhaUHkKcY7s$bB6qhcukb9oFNYRIvaDZgbwxrMa2RvF5dumCjkBFdX19lSNqrgKltf3aPrFMuQQKkZpK2YNuQ83hB1B3NiWzj."
-authentication.fallback-admin.user = "mailadmin"
-authentication.master.secret = "$6$4qPYDVhaUHkKcY7s$bB6qhcukb9oFNYRIvaDZgbwxrMa2RvF5dumCjkBFdX19lSNqrgKltf3aPrFMuQQKkZpK2YNuQ83hB1B3NiWzj."
-authentication.master.user = "master"
-directory.idmldap.attributes.class = "objectClass"
-directory.idmldap.attributes.description = "displayName"
-directory.idmldap.attributes.email = "mail"
-directory.idmldap.attributes.groups = "memberOf"
-directory.idmldap.attributes.name = "uid"
-directory.idmldap.attributes.secret = "userPassword"
-directory.idmldap.base-dn = "o=libregraph-idm"
-directory.idmldap.bind.auth.method = "default"
-directory.idmldap.bind.dn = "uid=reva,ou=sysusers,o=libregraph-idm"
-directory.idmldap.bind.secret = "admin"
-directory.idmldap.cache.size = 1048576
-directory.idmldap.cache.ttl.negative = "10m"
-directory.idmldap.cache.ttl.positive = "1h"
-directory.idmldap.filter.email = "(&(|(objectClass=person)(objectClass=groupOfNames))(mail=?))"
-directory.idmldap.filter.name = "(&(|(objectClass=person)(objectClass=groupOfNames))(uid=?))"
-directory.idmldap.timeout = "15s"
-directory.idmldap.tls.allow-invalid-certs = true
-directory.idmldap.tls.enable = true
-directory.idmldap.type = "ldap"
-directory.idmldap.url = "ldaps://opencloud:9235"
-directory.keycloak.auth.method = "user-token"
-directory.keycloak.cache.size = 1048576
-directory.keycloak.cache.ttl.negative = "10m"
-directory.keycloak.cache.ttl.positive = "1h"
-directory.keycloak.endpoint.method = "introspect"
-directory.keycloak.endpoint.url = "http://keycloak:8080/realms/openCloud/protocol/openid-connect/userinfo"
-directory.keycloak.fields.email = "email"
-directory.keycloak.fields.full-name = "name"
-directory.keycloak.fields.username = "preferred_username"
-directory.keycloak.timeout = "15s"
-directory.keycloak.type = "oidc"
-directory.ldap.attributes.class = "objectClass"
-directory.ldap.attributes.description = "displayName"
-directory.ldap.attributes.email = "mail"
-directory.ldap.attributes.email-alias = "mailAlias"
-directory.ldap.attributes.groups = "memberOf"
-directory.ldap.attributes.name = "uid"
-directory.ldap.attributes.secret = "userPassword"
-directory.ldap.attributes.secret-changed = "pwdChangedTime"
-directory.ldap.base-dn = "dc=opencloud,dc=eu"
-directory.ldap.bind.auth.dn = "cn=?,ou=users,dc=opencloud,dc=eu"
-directory.ldap.bind.auth.enable = true
-directory.ldap.bind.auth.search = true
-directory.ldap.bind.dn = "cn=admin,dc=opencloud,dc=eu"
-directory.ldap.bind.secret = "admin"
-directory.ldap.cache.ttl.negative = "10m"
-directory.ldap.cache.ttl.positive = "1h"
-directory.ldap.filter.email = "(&(|(objectClass=person)(objectClass=groupOfNames))(|(uid=?)(mail=?)(mailAlias=?)(cn=?)))"
-directory.ldap.filter.name = "(&(|(objectClass=person)(objectClass=groupOfNames))(|(uid=?)(cn=?)))"
-directory.ldap.timeout = "5s"
-directory.ldap.tls.allow-invalid-certs = true
-directory.ldap.tls.enable = true
-directory.ldap.type = "ldap"
-directory.ldap.url = "ldap://ldap-server:1389"
-http.allowed-endpoint = 200
-http.hsts = true
-http.permissive-cors = false
-http.url = "'https://' + config_get('server.hostname')"
-http.use-x-forwarded = true
-metrics.prometheus.auth.secret = "secret"
-metrics.prometheus.auth.username = "metrics"
-metrics.prometheus.enable = true
-server.listener.http.bind = "0.0.0.0:8080"
-server.listener.http.protocol = "http"
-server.listener.https.bind = "0.0.0.0:443"
-server.listener.https.protocol = "http"
-server.listener.https.tls.implicit = true
-server.listener.imap.bind = "0.0.0.0:143"
-server.listener.imap.protocol = "imap"
-server.listener.imaptls.bind = "0.0.0.0:993"
-server.listener.imaptls.protocol = "imap"
-server.listener.imaptls.tls.implicit = true
-server.listener.pop3.bind = "0.0.0.0:110"
-server.listener.pop3.protocol = "pop3"
-server.listener.pop3s.bind = "0.0.0.0:995"
-server.listener.pop3s.protocol = "pop3"
-server.listener.pop3s.tls.implicit = true
-server.listener.sieve.bind = "0.0.0.0:4190"
-server.listener.sieve.protocol = "managesieve"
-server.listener.smtp.bind = "0.0.0.0:25"
-server.listener.smtp.protocol = "smtp"
-server.listener.submission.bind = "0.0.0.0:587"
-server.listener.submission.protocol = "smtp"
-server.listener.submissions.bind = "0.0.0.0:465"
-server.listener.submissions.protocol = "smtp"
-server.listener.submissions.tls.implicit = true
-server.max-connections = 8192
-server.socket.backlog = 1024
-server.socket.nodelay = true
-server.socket.reuse-addr = true
-server.socket.reuse-port = true
-storage.blob = "rocksdb"
-storage.data = "rocksdb"
-storage.directory = "%{env:STALWART_AUTH_DIRECTORY}%"
-storage.fts = "rocksdb"
-storage.lookup = "rocksdb"
-store.rocksdb.compression = "lz4"
-store.rocksdb.path = "/opt/stalwart/data"
-store.rocksdb.type = "rocksdb"
-tracer.console.ansi = true
-tracer.console.buffered = true
-tracer.console.enable = true
-tracer.console.level = "trace"
-tracer.console.lossy = false
-tracer.console.multiline = false
-tracer.console.type = "stdout"
@@ -1,67 +0,0 @@
-authentication.fallback-admin.secret = "$6$4qPYDVhaUHkKcY7s$bB6qhcukb9oFNYRIvaDZgbwxrMa2RvF5dumCjkBFdX19lSNqrgKltf3aPrFMuQQKkZpK2YNuQ83hB1B3NiWzj."
-authentication.fallback-admin.user = "mailadmin"
-authentication.master.secret = "$6$4qPYDVhaUHkKcY7s$bB6qhcukb9oFNYRIvaDZgbwxrMa2RvF5dumCjkBFdX19lSNqrgKltf3aPrFMuQQKkZpK2YNuQ83hB1B3NiWzj."
-authentication.master.user = "master"
-directory.oidc.cache.size = 1048576
-directory.oidc.cache.ttl.negative = "10m"
-directory.oidc.cache.ttl.positive = "1h"
-directory.oidc.endpoint.method = "userinfo"
-directory.oidc.endpoint.url = "http://172.17.0.1:10000/auth/maethaR9eiXaiph8ahn8ohH6dahPiequ"
-directory.oidc.fields.email = "email"
-directory.oidc.fields.full-name = "name"
-directory.oidc.fields.username = "preferred_username"
-directory.oidc.timeout = "15s"
-directory.oidc.type = "oidc"
-http.allowed-endpoint = 200
-http.hsts = true
-http.permissive-cors = false
-http.url = "'https://' + config_get('server.hostname')"
-http.use-x-forwarded = true
-metrics.prometheus.auth.secret = "secret"
-metrics.prometheus.auth.username = "metrics"
-metrics.prometheus.enable = true
-server.listener.http.bind = "0.0.0.0:8080"
-server.listener.http.protocol = "http"
-server.listener.https.bind = "0.0.0.0:443"
-server.listener.https.protocol = "http"
-server.listener.https.tls.implicit = true
-server.listener.imap.bind = "0.0.0.0:143"
-server.listener.imap.protocol = "imap"
-server.listener.imaptls.bind = "0.0.0.0:993"
-server.listener.imaptls.protocol = "imap"
-server.listener.imaptls.tls.implicit = true
-server.listener.pop3.bind = "0.0.0.0:110"
-server.listener.pop3.protocol = "pop3"
-server.listener.pop3s.bind = "0.0.0.0:995"
-server.listener.pop3s.protocol = "pop3"
-server.listener.pop3s.tls.implicit = true
-server.listener.sieve.bind = "0.0.0.0:4190"
-server.listener.sieve.protocol = "managesieve"
-server.listener.smtp.bind = "0.0.0.0:25"
-server.listener.smtp.protocol = "smtp"
-server.listener.submission.bind = "0.0.0.0:587"
-server.listener.submission.protocol = "smtp"
-server.listener.submissions.bind = "0.0.0.0:465"
-server.listener.submissions.protocol = "smtp"
-server.listener.submissions.tls.implicit = true
-server.max-connections = 8192
-server.socket.backlog = 1024
-server.socket.nodelay = true
-server.socket.reuse-addr = true
-server.socket.reuse-port = true
-sharing.allow-directory-query = false
-storage.blob = "rocksdb"
-storage.data = "rocksdb"
-storage.directory = "oidc"
-storage.fts = "rocksdb"
-storage.lookup = "rocksdb"
-store.rocksdb.compression = "lz4"
-store.rocksdb.path = "/opt/stalwart/data"
-store.rocksdb.type = "rocksdb"
-tracer.console.ansi = true
-tracer.console.buffered = true
-tracer.console.enable = true
-tracer.console.level = "trace"
-tracer.console.lossy = false
-tracer.console.multiline = false
-tracer.console.type = "stdout"
@@ -1,110 +0,0 @@
-authentication.fallback-admin.secret = "$6$4qPYDVhaUHkKcY7s$bB6qhcukb9oFNYRIvaDZgbwxrMa2RvF5dumCjkBFdX19lSNqrgKltf3aPrFMuQQKkZpK2YNuQ83hB1B3NiWzj."
-authentication.fallback-admin.user = "mailadmin"
-authentication.master.secret = "$6$4qPYDVhaUHkKcY7s$bB6qhcukb9oFNYRIvaDZgbwxrMa2RvF5dumCjkBFdX19lSNqrgKltf3aPrFMuQQKkZpK2YNuQ83hB1B3NiWzj."
-authentication.master.user = "master"
-directory.idmldap.attributes.class = "objectClass"
-directory.idmldap.attributes.description = "displayName"
-directory.idmldap.attributes.email = "mail"
-directory.idmldap.attributes.groups = "memberOf"
-directory.idmldap.attributes.name = "uid"
-directory.idmldap.attributes.secret = "userPassword"
-directory.idmldap.base-dn = "o=libregraph-idm"
-directory.idmldap.bind.auth.method = "default"
-directory.idmldap.bind.dn = "uid=reva,ou=sysusers,o=libregraph-idm"
-directory.idmldap.bind.secret = "admin"
-directory.idmldap.cache.size = 1048576
-directory.idmldap.cache.ttl.negative = "10m"
-directory.idmldap.cache.ttl.positive = "1h"
-directory.idmldap.filter.email = "(&(|(objectClass=person)(objectClass=groupOfNames))(mail=?))"
-directory.idmldap.filter.name = "(&(|(objectClass=person)(objectClass=groupOfNames))(uid=?))"
-directory.idmldap.timeout = "15s"
-directory.idmldap.tls.allow-invalid-certs = true
-directory.idmldap.tls.enable = true
-directory.idmldap.type = "ldap"
-directory.idmldap.url = "ldaps://opencloud:9235"
-directory.keycloak.auth.method = "user-token"
-directory.keycloak.cache.size = 1048576
-directory.keycloak.cache.ttl.negative = "10m"
-directory.keycloak.cache.ttl.positive = "1h"
-directory.keycloak.endpoint.method = "introspect"
-directory.keycloak.endpoint.url = "http://keycloak:8080/realms/openCloud/protocol/openid-connect/userinfo"
-directory.keycloak.fields.email = "email"
-directory.keycloak.fields.full-name = "name"
-directory.keycloak.fields.username = "preferred_username"
-directory.keycloak.timeout = "15s"
-directory.keycloak.type = "oidc"
-directory.ldap.attributes.class = "objectClass"
-directory.ldap.attributes.description = "displayName"
-directory.ldap.attributes.email = "mail"
-directory.ldap.attributes.email-alias = "mailAlias"
-directory.ldap.attributes.groups = "memberOf"
-directory.ldap.attributes.name = "uid"
-directory.ldap.attributes.secret = "userPassword"
-directory.ldap.attributes.secret-changed = "pwdChangedTime"
-directory.ldap.base-dn = "dc=opencloud,dc=eu"
-directory.ldap.bind.auth.dn = "cn=?,ou=users,dc=opencloud,dc=eu"
-directory.ldap.bind.auth.enable = true
-directory.ldap.bind.auth.search = true
-directory.ldap.bind.dn = "cn=admin,dc=opencloud,dc=eu"
-directory.ldap.bind.secret = "admin"
-directory.ldap.cache.ttl.negative = "10m"
-directory.ldap.cache.ttl.positive = "1h"
-directory.ldap.filter.email = "(&(|(objectClass=person)(objectClass=groupOfNames))(|(uid=?)(mail=?)(mailAlias=?)(cn=?)))"
-directory.ldap.filter.name = "(&(|(objectClass=person)(objectClass=groupOfNames))(|(uid=?)(cn=?)))"
-directory.ldap.timeout = "5s"
-directory.ldap.tls.allow-invalid-certs = true
-directory.ldap.tls.enable = true
-directory.ldap.type = "ldap"
-directory.ldap.url = "ldap://ldap-server:1389"
-http.allowed-endpoint = 200
-http.hsts = true
-http.permissive-cors = false
-http.url = "'https://' + config_get('server.hostname')"
-http.use-x-forwarded = true
-metrics.prometheus.auth.secret = "secret"
-metrics.prometheus.auth.username = "metrics"
-metrics.prometheus.enable = true
-server.listener.http.bind = "0.0.0.0:8080"
-server.listener.http.protocol = "http"
-server.listener.https.bind = "0.0.0.0:443"
-server.listener.https.protocol = "http"
-server.listener.https.tls.implicit = true
-server.listener.imap.bind = "0.0.0.0:143"
-server.listener.imap.protocol = "imap"
-server.listener.imaptls.bind = "0.0.0.0:993"
-server.listener.imaptls.protocol = "imap"
-server.listener.imaptls.tls.implicit = true
-server.listener.pop3.bind = "0.0.0.0:110"
-server.listener.pop3.protocol = "pop3"
-server.listener.pop3s.bind = "0.0.0.0:995"
-server.listener.pop3s.protocol = "pop3"
-server.listener.pop3s.tls.implicit = true
-server.listener.sieve.bind = "0.0.0.0:4190"
-server.listener.sieve.protocol = "managesieve"
-server.listener.smtp.bind = "0.0.0.0:25"
-server.listener.smtp.protocol = "smtp"
-server.listener.submission.bind = "0.0.0.0:587"
-server.listener.submission.protocol = "smtp"
-server.listener.submissions.bind = "0.0.0.0:465"
-server.listener.submissions.protocol = "smtp"
-server.listener.submissions.tls.implicit = true
-server.max-connections = 8192
-server.socket.backlog = 1024
-server.socket.nodelay = true
-server.socket.reuse-addr = true
-server.socket.reuse-port = true
-storage.blob = "rocksdb"
-storage.data = "rocksdb"
-storage.directory = "ldap"
-storage.fts = "rocksdb"
-storage.lookup = "rocksdb"
-store.rocksdb.compression = "lz4"
-store.rocksdb.path = "/opt/stalwart/data"
-store.rocksdb.type = "rocksdb"
-tracer.console.ansi = true
-tracer.console.buffered = true
-tracer.console.enable = true
-tracer.console.level = "trace"
-tracer.console.lossy = false
-tracer.console.multiline = false
-tracer.console.type = "stdout"
@@ -1,7 +0,0 @@
---
-services:
-
-  opencloud:
-    command: [ "-c", "opencloud init || true; dlv --listen=:40000 --headless=true --check-go-version=false --api-version=2 --accept-multiclient exec /usr/bin/opencloud server" ]
-    ports:
-      - 40000:40000
@@ -1,7 +1,7 @@
 ---
 services:
  traefik:
-    image: traefik:v3.7.5
+    image: traefik:v3.3.1
    # release notes: https://github.com/traefik/traefik/releases
    networks:
      opencloud-net:
@@ -19,11 +19,6 @@ services:
      - "--entryPoints.http.http.redirections.entryPoint.to=https"
      - "--entryPoints.http.http.redirections.entryPoint.scheme=https"
      - "--entryPoints.https.address=:443"
-      # http2 optimizations
-      - "--entryPoints.https.http2.maxConcurrentStreams=512"
-      - "--serversTransport.maxIdleConnsPerHost=100"
-      # allow self signed certificate from OpenCloud
-      - "--serversTransport.insecureSkipVerify=true"
      # change default timeouts for long-running requests
      # this is needed for webdav clients that do not support the TUS protocol
      - "--entryPoints.https.transport.respondingTimeouts.readTimeout=12h"
@@ -36,9 +31,6 @@ services:
      - "--accessLog=true"
      - "--accessLog.format=json"
      - "--accessLog.fields.headers.names.X-Request-Id=keep"
-      - "--accessLog.fields.headers.names.Trace-Id=keep"
-      # enable the ping endpoint for monitoring
-      - "--ping=true"
    ports:
      - "80:80"
      - "443:443"
@@ -57,12 +49,6 @@ services:
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always
-    healthcheck:
-      test: ["CMD", "traefik", "healthcheck", "--ping=true"]
-      interval: 10s
-      retries: 5
-      start_period: 3s
-      timeout: 3s

 volumes:
  certs:
@@ -57,8 +57,6 @@ services:
      KC_FEATURES: impersonation
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN_USER:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
-    ports:
-      - "8080:8080"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.keycloak.entrypoints=https"
@@ -24,7 +24,6 @@ services:
      OC_LDAP_SERVER_WRITE_ENABLED: "false" # assuming the external ldap is not writable
      # OC_RUN_SERVICES specifies to start all services except glauth, idm and accounts. These are replaced by external services
      OC_EXCLUDE_RUN_SERVICES: idm
-      STALWART_AUTH_DIRECTORY: "ldap"

  ldap-server:
    image: bitnamilegacy/openldap:2.6
@@ -40,9 +39,6 @@ services:
      LDAP_TLS_KEY_FILE: /opt/bitnami/openldap/share/openldap.key
      LDAP_ROOT: "dc=opencloud,dc=eu"
      LDAP_ADMIN_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin}
-      LDAP_CONFIGURE_PPOLICY: "yes"
-      LDAP_PPOLICY_USE_LOCKOUT: "no"
-      LDAP_PPOLICY_HASH_CLEARTEXT: "no"
    ports:
      - "127.0.0.1:389:1389"
      - "127.0.0.1:636:1636"
@@ -21,11 +21,11 @@ services:
      # enable services that are not started automatically
      OC_ADD_RUN_SERVICES: ${START_ADDITIONAL_SERVICES}
      OC_URL: https://${OC_DOMAIN:-cloud.opencloud.test}
-      OC_LOG_LEVEL: "${LOG_LEVEL:-info}"
+      OC_LOG_LEVEL: ${LOG_LEVEL:-info}
      OC_LOG_COLOR: "${LOG_PRETTY:-false}"
      OC_LOG_PRETTY: "${LOG_PRETTY:-false}"
      # do not use SSL between Traefik and OpenCloud
-      PROXY_TLS: "true"
+      PROXY_TLS: "false"
      # make the REVA gateway accessible to the app drivers
      GATEWAY_GRPC_ADDR: 0.0.0.0:9142
      # INSECURE: needed if OpenCloud / Traefik is using self generated certificates
@@ -58,23 +58,10 @@ services:
      COMPANION_DOMAIN: ${COMPANION_DOMAIN:-companion.opencloud.test}
      # enable to allow using the banned passwords list
      OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
-      IDM_REVASVC_PASSWORD: "admin"
-      AUTH_BASIC_LDAP_BIND_PASSWORD: "admin"
-      USERS_LDAP_BIND_PASSWORD: "admin"
-      GROUPS_LDAP_BIND_PASSWORD: "admin"
-      IDM_LDAPS_ADDR: 0.0.0.0:9235
-      IDM_LDAPS_CERT: /etc/opencloud/certs/ldaps.crt
-      IDM_LDAPS_KEY: /etc/opencloud/certs/ldaps.key
-      OC_LDAP_CACERT: /etc/opencloud/certs/ldaps.crt
-      GROUPWARE_JMAP_BASE_URL: https://${STALWART_DOMAIN:-stalwart.opencloud.test}
-      GROUPWARE_JMAP_MASTER_USERNAME: "admin@example.org"
-      GROUPWARE_JMAP_MASTER_PASSWORD: "admin"
-      GROUPWARE_TLS_INSECURE: "true"
    volumes:
      - ./config/opencloud/app-registry.yaml:/etc/opencloud/app-registry.yaml
      - ./config/opencloud/csp.yaml:/etc/opencloud/csp.yaml
      - ./config/opencloud/banned-password-list.txt:/etc/opencloud/banned-password-list.txt
-      - ./config/opencloud/certs:/etc/opencloud/certs
      # configure the .env file to use own paths instead of docker internal volumes
      - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud
      - ${OC_DATA_DIR:-opencloud-data}:/var/lib/opencloud
@@ -85,31 +72,9 @@ services:
      - "traefik.http.routers.opencloud.tls.certresolver=http"
      - "traefik.http.routers.opencloud.service=opencloud"
      - "traefik.http.services.opencloud.loadbalancer.server.port=9200"
-      - "traefik.http.services.opencloud.loadbalancer.server.scheme=https"
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always
-    healthcheck:
-      test: ["CMD-SHELL", "test $(curl -sSf http://localhost:9104/healthz) == 'OK'"]
-      interval: 10s
-      retries: 5
-      start_period: 3s
-      timeout: 3s
-
-  opencloud-certs:
-    image: alpine/openssl:latest
-    environment:
-      CERTS: /certs
-    entrypoint: ["/bin/sh", "-c"]
-    command:
-      - |
-        if [ ! -f "$$CERTS/ldaps.key" ]; then
-          mkdir -p "$$CERTS"
-          /usr/bin/openssl req -subj '/CN=opencloud.test' -x509 -newkey rsa:4096 -sha256 -days 3650 -batch -nodes -keyout "$$CERTS/ldaps.key" -out "$$CERTS/ldaps.crt"
-        fi
-        chmod 666 "$$CERTS"/ldaps.*
-    volumes:
-      - ./config/opencloud/certs:/certs

 volumes:
  opencloud-config:
@@ -1,27 +0,0 @@
-#!/bin/bash
-# Snapshots the current configuration of a Stalwart >= 0.16 server.
-# Requires having stalwart-cli installed.
-set -euo pipefail
-exec stalwart-cli -k --url 'https://stalwart.opencloud.test' --user admin --password secret snapshot \
-  --include-secrets \
-  Tenant \
-  Domain \
-  Directory \
-  Authentication \
-  DkimSignature \
-  AcmeProvider \
-  Certificate \
-  DnsServer \
-  Role \
-  Authentication \
-  Account \
-  NetworkListener \
-  Tracer \
-  Sharing \
-  SystemSettings \
-  DataRetention \
-  BlobStore \
-  InMemoryStore \
-  SearchStore \
-  --allow-unresolved PublicKey \
-  "$@"
@@ -1,64 +0,0 @@
-#!/usr/bin/env node
-// Processes a Stalwart snapshot JSON file to perform the following:
-// - replace masked passwords with their correct value
-// - replace the defaultHostname system setting
-
-import * as fs from 'node:fs'
-import readline from 'node:readline'
-
-const args = process.argv.slice(2)
-const inputs = args.length > 0 ? args.map((file) => fs.createReadStream(file)) : [process.stdin]
-
-async function processLines() {
-  for (const stream of inputs) {
-    const rl = readline.createInterface({
-      input: stream,
-      crlfDelay: Infinity
-    })
-
-    for await (const line of rl) {
-      const trimmed = line.trim()
-      if (!trimmed) continue
-
-      const item = JSON.parse(trimmed)
-      const t = item['@type']
-      const o = item['object']
-
-      if (t === 'create' && o === 'Account') {
-        const value = item['value'] || {}
-        for (const [id, account] of Object.entries(value)) {
-          const name = account['name']
-          if (name === 'master' || name === 'admin') {
-            const credentials = account['credentials'] || {}
-            for (const [cid, creds] of Object.entries(credentials)) {
-              if (creds['@type'] === 'Password') {
-                creds['secret'] = 'supersecret1234'
-              }
-            }
-          }
-        }
-      }
-
-      if (t === 'create' && o === 'Directory') {
-        const value = item['value'] || {}
-        for (const [id, dir] of Object.entries(value)) {
-          if (dir['@type'] === 'Ldap') {
-            if (dir['bindSecret']) {
-              dir['bindSecret']['secret'] = 'admin'
-            }
-          }
-        }
-      }
-
-      if (t === 'update' && o === 'SystemSettings') {
-        if (item['value']) {
-          item['value']['defaultHostname'] = 'stalwart.opencloud.test'
-        }
-      }
-
-      console.log(JSON.stringify(item))
-    }
-  }
-}
-
-processLines()
@@ -1,116 +0,0 @@
---
-services:
-  traefik:
-    networks:
-      opencloud-net:
-        aliases:
-          - ${STALWART_DOMAIN:-stalwart.opencloud.test}
-
-  stalwart:
-    image: ghcr.io/stalwartlabs/stalwart:v0.16.12-alpine
-    hostname: ${STALWART_DOMAIN:-stalwart.opencloud.test}
-    networks:
-      - opencloud-net
-    ports:
-      - "127.0.0.1:8443:443"
-      - "127.0.0.1:8080:8080"
-      - "127.0.0.1:143:143"
-      - "127.0.0.1:993:993"
-      - "127.0.0.1:1465:465"
-    volumes:
-      - ./config/stalwart/config.json:/etc/stalwart/config.json
-      - stalwart-data:/var/lib/stalwart
-    environment:
-      STALWART_RECOVERY_ADMIN: "admin:secret"
-      STALWART_PUBLIC_URL: "https://${STALWART_DOMAIN:-stalwart.opencloud.test}"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.stalwart.entrypoints=https"
-      - "traefik.http.routers.stalwart.rule=Host(`${STALWART_DOMAIN:-stalwart.opencloud.test}`)"
-      - "traefik.http.routers.stalwart.tls.certresolver=http"
-      - "traefik.http.routers.stalwart.service=stalwart"
-      - "traefik.http.services.stalwart.loadbalancer.server.port=8080"
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: unless-stopped
-    entrypoint: ["/bin/sh", "-c"]
-    command:
-      - |
-        if [ ! -f /var/lib/stalwart/.initialized ]; then
-          echo "Not initialized, starting in recovery mode"
-          STALWART_RECOVERY_MODE=1 /usr/local/bin/stalwart --config /etc/stalwart/config.json &
-          pid=$$!
-          while [ ! -f /var/lib/stalwart/.initialized ]; do sleep 1; done
-          echo "Initialized, stopping recovery mode"
-          kill -TERM $$pid
-          wait $$pid
-        fi
-        echo "Starting Stalwart in production mode"
-        exec /usr/local/bin/stalwart --config /etc/stalwart/config.json
-
-    healthcheck:
-      test: ["CMD-SHELL", "curl -LsSf http://localhost:8080/healthz/live|grep -q '\"status\":200'"]
-      interval: 10m
-      retries: 3
-      start_period: 5s
-      timeout: 3s
-
-  stalwart-import:
-    build:
-      context: ./config/stalwart/
-      args:
-        VERSION: "1.0.8"
-      dockerfile_inline: |
-        FROM alpine:latest AS downloader
-        ARG VERSION
-        RUN apk add --no-cache curl tar xz wget
-        RUN arch=$(apk --print-arch) && \
-            mkdir /cli && \
-            curl --proto '=https' --tlsv1.2 -LsSf \
-              https://github.com/stalwartlabs/cli/releases/download/v$${VERSION}/stalwart-cli-$${arch}-unknown-linux-musl.tar.xz \
-              | tar xJf - --strip-components=1 -C /cli
-        RUN mv /cli/stalwart-cli /stalwart-cli && rm -rf /cli/
-        CMD ["/stalwart-cli"]
-
-    networks:
-      - opencloud-net
-    volumes:
-      - ./config/stalwart/${STALWART_AUTH_DIRECTORY:-idmldap}.json:/snapshot.json:ro
-      - stalwart-data:/var/lib/stalwart
-    environment:
-      STALWART_URL: "http://stalwart:8080"
-      STALWART_USER: "admin"
-      STALWART_PASSWORD: "secret"
-    entrypoint: ["/bin/sh", "-c"]
-    command:
-      - |
-        if [ -f /var/lib/stalwart/.initialized ]; then
-          echo "Already initialized, skipping stalwart-cli."
-          exit 0
-        fi
-        echo "Waiting for the Stalwart recovery API to become live"
-        until wget -qO- $$STALWART_URL/healthz/live >/dev/null 2>&1; do sleep 1; done
-        echo "Applying configuration"
-        /stalwart-cli --debug apply --file /snapshot.json
-        touch /var/lib/stalwart/.initialized
-        echo "Successfully initialized"
-
-    depends_on:
-      - stalwart
-
-  stalwart-reset:
-    image: alpine:latest
-    profiles:
-      - maintenance
-    volumes:
-      - stalwart-data:/var/lib/stalwart
-    entrypoint: ["/bin/sh", "-c"]
-    command:
-      - |
-        if [ -f /var/lib/stalwart/.initialized ]; then
-          rm -f /var/lib/stalwart/.initialized
-          echo "Success: Lockfile removed. Next time 'stalwart' boots, it will run in recovery mode."
-        fi
-
-volumes:
-  stalwart-data:
@@ -32,7 +32,7 @@ olcObjectClasses: ( openCloudOid:1.2.3 NAME 'openCloudEducationUser'
  DESC 'OpenCloud education user objectclass'
  SUP openCloudUser
  AUXILIARY
-  MAY ( openCloudEducationExternalId $ userClass $ openCloudMemberOfSchool ) )
+  MAY ( userClass $ openCloudMemberOfSchool ) )
 olcObjectClasses: ( openCloudOid:1.2.4 NAME 'openCloudEducationClass'
  DESC 'OpenCloud education class objectclass'
  SUP openCloudObject
@@ -42,4 +42,4 @@ olcObjectClasses: ( openCloudOid:1.2.5 NAME 'openCloudEducationSchool'
  DESC 'OpenCloud education school objectclass'
  SUP openCloudObject
  AUXILIARY
-  MAY ( openCloudEducationSchoolNumber $ openCloudEducationSchoolTerminationTimestamp $ openCloudEducationExternalId) )
+  MAY ( openCloudEducationSchoolNumber $ openCloudEducationSchoolTerminationTimestamp ) )
@@ -1,343 +0,0 @@
---
-title: "Authentication with Stalwart"
---
-
-* Status: draft
-
-## Context
-
-In a groupware environment, not every user will always use the OpenCloud UI to read their emails, some will resort to other [MUAs (Mail User Agents)](https://en.wikipedia.org/wiki/Email_client) that support a subset of features, use older protocols (IMAP, POP, SMTP, CalDAV, CardDAV) and lesser authentication methods (basic authentication). Those email clients will talk to Stalwart directly, as opposed to the OpenCloud UI which will make use of APIs of the OpenCloud Groupware service, since those protocols are provided by Stalwart and implementing them in OpenCloud would offer very little benefits, but definitely a lot of (almost completely) unnecessary effort.
-
-Those protocols and operations that bypass the OpenCloud UI also need to be authenticated, this in and by Stalwart, and we need to find the best fitting approach that fulfills most or all of the following constraints:
-
-### Single Provisioning
-
-We want to avoid multiple provisioning of users, groups, passwords and other resources as much as possible.
-While it is possible to have e.g. OpenCloud's user management also perform [Management API](https://stalw.art/docs/category/management-api/) calls, one still inevitably ends up in situations where users, user passwords, or other resources are not in sync, which becomes complex to debug and fix, and should thus be avoided if possible.
-
-To do so, we should strive to have a single source of truth regarding users, their passwords, and similar resources and attributes such as groups, roles, application passwords, etc...
-
-### Attack Detection
-
-Coordinated attacks such as [denial of service](https://en.wikipedia.org/wiki/Denial-of-service_attack) attempts don't necessarily focus on a single protocol but are commonly multi-pronged, e.g. by brute forcing the [OIDC API](https://www.keycloak.org/docs/latest/authorization_services/index.html#token-endpoint), the OpenCloud Groupware API, IMAP and SMTP, \*DAV protocols, etc...
-
-In order to detect those as well as to quickly react by blacklisting clients that are identified to attempt such attacks, it is useful to have a single authentication service for all the components of the system, all protocols, all clients (e.g. [PowerDNS Weakforced](https://github.com/PowerDNS/weakforced), [Nauthilus](https://nauthilus.org/), ...)
-
-Furthermore, such services typically make use of [DNSBL/RBL services](https://en.wikipedia.org/wiki/Domain_Name_System_blocklist) that allow IP addresses of botnets to be blocked across many services of many providers as a shared defense mechanism.
-
-As a bonus, a centralized authentication component can also provide metrics and observability capabilities across all those protocols.
-
-### Custom Authentication Implementations
-
-Some customers might want custom authentication implementations to integrate with their environment, in which case we would want those to be done once and in the technology stack we're all most familiar with (thus as a service in Go in the OpenCloud framework, and not e.g. a Lua script in Nauthilus, or a Rust plugin in Stalwart, etc...)
-
-## Decision Drivers
-
-TODO
-
-* 
-
-## Considered Options
-
-First off, here is a brief explanation of each of the scenarios that we potentially or absolutely need to support, which we will explore for each implementation option:
-
-* MUAs with basic authentication
-  * these are external mail clients (Thunderbird, Apple Mail, ...) with which users authenticate using legacy protocols (IMAP, POP3, SMTP) and their primary username and password in clear text (encrypted through the mandatory use of TLS)
-* MUAs with application password authentication
-  * these are external mail clients (Thunderbird, Apple Mail, ...) with which users authenticate using legacy protocols (IMAP, POP3, SMTP) and one of the application passwords that they created in the OpenCloud UI, which is a useful security mechanism as it reduces the attack surface when one such password is leaked or discovered
-* MUAs with SASL bearer token authentication
-  * these are more modern external mail clients (Thunderbird) with which users authenticate using legacy protocols (IMAP, POP3, SMTP) but more secure OIDC token based authentication (SASL OAUTHBEARER or SASL XOAUTH2), which closely resembles the OIDC authentication used by the OpenCloud UI towards the OpenCloud backends
-* JMAP clients with basic authentication
-  * modern mail clients (Thunderbird) that speak the JMAP protocol over HTTP and authenticate using their primary username and password in clear text (encrypted through the use of HTTPS)
-* JMAP clients with bearer token authentication
-  * modern mail clients (Thunderbird) that speak the JMAP protocol over HTTP and authenticate using an OIDC token (JWT) obtained from an IDP (typically KeyCloak)
-* OpenCloud Groupware with master authentication
-  * the OpenCloud UI client uses APIs from the OpenCloud Groupware backend (and authenticates using OIDC)
-  * the OpenCloud Groupware backend, in turn, performs JMAP operations with Stalwart, and authenticates using Stalwart's shared secret master authentication protocol
-* OpenCloud Groupware with generated token authentication
-  * the OpenCloud UI client uses APIs from the OpenCloud Groupware backend (and authenticates using OIDC)
-  * the OpenCloud Groupware backend, in turn, performs JMAP operations with Stalwart, and authenticates against Stalwart using bearer authentication with JWTs that it generates itself
-  * in the future, that JWT might also be the JWT that the OpenCloud UI used to authenticate against the OpenCloud Groupware in the first place
-
-### Stalwart with the LDAP Directory
-
-```mermaid
-flowchart LR
-    c(client)
-    s(Stalwart)
-    l(LDAP)
-
-    c -- IMAP/SMTP --> s
-    c -- JMAP --> s
-    s -- LDAP --> l
-```
-
-Clients authenticate directly against Stalwart, that is configured to use an LDAP authentication Directory.
-An LDAP server (e.g. OpenLDAP) is needed as part of the infrastructure.
-OpenCloud also has to make use of the same LDAP server.
-
-* ✅ MUAs with basic authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's LDAP Directory plugin supports plain text authentication by looking up the userPassword attribute in the LDAP server
-* ❌ MUAs with application password authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's LDAP Directory plugin does not support application password as it is hardwired to look up the password in the userPassword attribute in the LDAP server
-  * even if it did support looking up alternative passwords in LDAP, this would hardly be practical as the application passwords are currently created and stored in OpenCloud, which would need to be modified to store them in LDAP in the first place
-* ❌ MUAs with SASL bearer token authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's LDAP Directory plugin does not support verifying OIDC tokens
-* ✅ JMAP clients with basic authentication
-  * JMAP clients authenticate directly against Stalwart
-  * Stalwart's LDAP Directory plugin supports plain text authentication by looking up the userPassword attribute in the LDAP server
-* ❌ JMAP clients with bearer token authentication
-  * JMAP clients authenticate directly against Stalwart
-  * Stalwart's LDAP Directory plugin does not support verifying OIDC tokens
-* ✅ OpenCloud Groupware with master authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * Stalwart detects and supports clear text password master authentication regardless of the Directory that is being used, and verifies it against the shared secret password that is configured in the server
-* ❌ OpenCloud Groupware with generated token authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * Stalwart's LDAP Directory plugin does not support verifying OIDC tokens
-
-### Stalwart with the OIDC Directory
-
-```mermaid
-flowchart LR
-    c(client)
-    s(Stalwart)
-    o(IDP)
-
-    c -- IMAP/SMTP --> s
-    c -- JMAP --> s
-    s -- OIDC HTTP --> o
-```
-
-Clients authenticate directly against Stalwart, that is configured to use an OIDC authentication Directory.
-An OIDC IDP (server) is needed as part of the infrastructure, e.g. KeyCloak.
-Optionally, an LDAP server (e.g. OpenLDAP) might be used as well, and KeyCloak would look up users and their credentials in LDAP.
-
-OpenCloud also has to make use of the same LDAP server, or would need to be modified to be capable of only making use of an OIDC IDP (which would include limitations that are yet to be resolved, e.g. the option of using KeyCloak Admin APIs to retreieve groups, group members, ...)
-
-* ❌ MUAs with basic authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's OIDC Directory plugin does not support plain text authentication
-* ❌ MUAs with application password authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's OIDC Directory plugin does not support application passwords
-* ❓ MUAs with SASL bearer token authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's OIDC Directory plugin does not currently support external IDPs, but is expected to in future versions
-  * as of Stalwart 0.12, this would only work if Stalwart itself is used as the IDP when acquiring a token
-* ❌ JMAP clients with basic authentication
-  * JMAP clients authenticate directly against Stalwart
-  * Stalwart's OIDC Directory plugin does not support plain text authentication
-* ❓ JMAP clients with bearer token authentication
-  * JMAP clients authenticate directly against Stalwart
-  * Stalwart's OIDC Directory plugin does not currently support external IDPs, but is expected to in future versions
-  * as of Stalwart 0.12, this would only work if Stalwart itself is used as the IDP when acquiring a token
-* ✅ OpenCloud Groupware with master authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * Stalwart detects and supports clear text password master authentication regardless of the Directory that is being used, and verifies it against the shared secret password that is configured in the server
-* ❓ OpenCloud Groupware with generated token authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * Stalwart's OIDC Directory plugin does not currently support external IDPs, but is expected to in future versions
-  * as of Stalwart 0.12, this would only work if Stalwart itself is used as the IDP when acquiring a token, which is not the case with this approach as the tokens are generated by the Groupware backend itself
-
-### Stalwart with the Internal Directory
-
-```mermaid
-flowchart LR
-    c(client)
-    s(Stalwart)
-
-    c -- IMAP/SMTP --> s
-    c -- JMAP --> s
-```
-
-Clients authenticate directly against Stalwart, that is configured to use an Internal authentication Directory.
-Neither an OIDC IDP nor an LDAP server are needed as part of the infrastructure, as principal resources (users, groups) and their credentials exist in Stalwart's storage.
-
-OpenCloud would not be capable of accessing those resources, which means that provisioning of groups, users, user passwords must be duplicated and kept in sync between Stalwart and OpenCloud.
-
-* ✅ MUAs with basic authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's Internal Directory plugin supports plain text authentication
-* ✅ MUAs with application password authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's Internal Directory plugin supports application passwords
-  * users are able to create those themselves using the self-service web UI of Stalwart
-  * they are not shared with the OpenCloud application passwords though and would need to be provisioned into Stalwart when created in OpenCloud to provide a single UI
-* ❌ MUAs with SASL bearer token authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's Internal Directory plugin does not support OIDC token authentication
-* ✅ JMAP clients with basic authentication
-  * JMAP clients authenticate directly against Stalwart
-  * Stalwart's Internal Directory plugin supports plain text authentication
-* ❌ JMAP clients with bearer token authentication
-  * JMAP clients authenticate directly against Stalwart
-  * Stalwart's Internal Directory plugin does not support OIDC token authentication
-* ✅ OpenCloud Groupware with master authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * Stalwart detects and supports clear text password master authentication regardless of the Directory that is being used, and verifies it against the shared secret password that is configured in the server
-* ❌ OpenCloud Groupware with generated token authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * Stalwart's Internal Directory plugin does not support OIDC token authentication
-
-### Stalwart with the OpenCloud Authentication API
-
-```mermaid
-flowchart LR
-    c(client)
-    s(Stalwart)
-    o(OpenCloud)
-    l(LDAP)
-
-    c -- IMAP/SMTP --> s
-    c -- JMAP --> s
-    s -- REST --> o
-    o -- LDAP --> l
-```
-
-Clients authenticate directly against Stalwart, that is configured to use an "External" authentication Directory, that is yet to be developed. (warning)
-Its protocol is currently not defined, but not particularly relevant at this time, as long as it supports accepting basic and bearer authentication in order to authenticate both username and password credentials as well as OIDC tokens.
-
-That External Directory implementation forwards the basic or bearer credentials to an endpoint in the OpenCloud backend, that the responds with whether the authentication is successful or not, as well as with additional information that is needed for Stalwart (email address, display name, groups, roles, ...)
-
-* ✅ MUAs with basic authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's External Directory supports plain text authentication by relaying the authentication operation to the OpenCloud backend, which can then authenticate users by username and password using an LDAP server
-  * note that this option requires having an LDAP server in the environment, including having it accessible by OpenCloud
-  * if that is not the case, then a viable option is also to support OIDC tokens and application passwords
-  * to clarify: this scenario is only about supporting authentication using the "primary" username and password
-* ✅ MUAs with application password authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's External Directory supports application password authentication by relaying the authentication operation to the OpenCloud backend, which can then authenticate against its list of application passwords
-  * this is the ideal scenario for application passwords, since they are already supported by OpenCloud, and can be created and managed using the OpenCloud UI
-  * relaying the authentication operation to OpenCloud also prevents the need for duplicate provisioning of application passwords
-* ✅ MUAs with SASL bearer token authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's External Directory supports OIDC token authentication by relaying the authentication operation to the OpenCloud backend, which can then either perform local token inspection and authentication by verifying the token's signature, or use the OIDC IDP's token introspection endpoint
-* ✅ JMAP clients with basic authentication
-  * JMAP clients authenticate directly against Stalwart
-  * Stalwart's External Directory supports plain text authentication by relaying the authentication operation to the OpenCloud backend, which can then authenticate users by username and password using an LDAP server
-  * the same limitations/requirements as for the "MUAs with basic authentication" scenario apply here as well
-* ✅ JMAP clients with bearer token authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's External Directory supports OIDC token authentication by relaying the authentication operation to the OpenCloud backend, which can then either perform local token inspection and authentication by verifying the token's signature, or use the OIDC IDP's token introspection endpoint
-* ✅ OpenCloud Groupware with master authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * Stalwart detects and supports clear text password master authentication regardless of the Directory that is being used, and verifies it against the shared secret password that is configured in the server
-* ✅ OpenCloud Groupware with generated token authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * in the worst case, the External Directory plugin in Stalwart would also perform a forwarding of the authentication operation to OpenCloud, which would obviously be able to verify a token it has created
-  * an optimization might be possible here, if the External Directory implementation permits for the configuration of specific issuers which should then be verifying against a JWK set directly, whereas the fallback behaviour would be to query the OpenCloud Authentication API
-
-### Stalwart with Nauthilus and LDAP
-
-```mermaid
-flowchart LR
-    c(client)
-    s(Stalwart)
-    n(Nauthilus)
-    l(LDAP)
-
-    c -- IMAP/SMTP --> s
-    c -- JMAP --> s
-    s -- REST --> n
-    n -- LDAP --> l
-```
-
-In this scenario, we introduce the [Nauthilus authentication service](https://nauthilus.org/), which has its own API but also a KeyCloak integration plugin.
-It supports various backends and can also be scripted for more complex combinations.
-
-⚠️ It would require the implementation of a Stalwart Nauthilus Directory, **that is yet to be developed**.
-
-We do not make use of any OpenCloud Authentication API but, instead, attempt to have everything go through Nauthilus instead, backed by an LDAP server that then contains the users, groups, and user passwords.
-
-The upside of using Nauthilus is that it does brute force attack detection and can provide metrics across multiple protocols and clients in a centralized fashion.
-
-* ✅ MUAs with basic authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's Nauthilus Directory supports plain text authentication by relaying the authentication operation to Nauthilus, e.g. using its JSON API
-  * Nauthilus provides a response that contains user attributes from LDAP (display name, email addresses, ...)
-* ❓ MUAs with application password authentication
-  * Nauthilus has no support for application passwords in itself
-  * a Lua plugin could potentially be used in Nauthilus to detect whether the clear text password matches a regular expression for application passwords and, if that is the case, first attempt to verify it through an API call (that does not exist yet) to the OpenCloud backend, but that would definitely be more complex and less elegant than having a single API
-* ❓ MUAs with SASL bearer token authentication
-  * it is currently unclear whether Nauthilus supports OIDC token authentication
-* ✅ JMAP clients with basic authentication
-  * Stalwart's Nauthilus Directory supports plain text authentication by relaying the authentication operation to Nauthilus, e.g. using its JSON API
-  * Nauthilus provides a response that contains user attributes from LDAP (display name, email addresses, ...)
-* ❓ JMAP clients with bearer token authentication
-  * it is currently unclear whether Nauthilus supports OIDC token authentication
-* ✅ OpenCloud Groupware with master authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * Stalwart detects and supports clear text password master authentication regardless of the Directory that is being used, and verifies it against the shared secret password that is configured in the server
-* ❓ OpenCloud Groupware with generated token authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * it is currently unclear whether Nauthilus supports OIDC token authentication
-  * an optimization might be possible here, if the Nauthilus Directory implementation permits for the configuration of specific issuers which should then be verifying against a JWK set directly, whereas the fallback behaviour would be to query the Nauthilus API, but that does sound like a stretch to fit into the concept
-
-### Stalwart with Nauthilus and an OpenCloud Authentication API
-
-```mermaid
-flowchart LR
-    c(client)
-    j(client)
-    s(Stalwart)
-    n(Nauthilus)
-    o(OpenCloud)
-    l(LDAP)
-    k(Keycloak)
-
-    c -- IMAP/SMTP --> s
-    j -- JMAP --> s
-    s -- REST --> n
-    subgraph internal auth
-        n -- REST --> o
-        o -- LDAP --> l
-        o -- OIDC --> k
-    end
-```
-
-This option also makes use of the [Nauthilus authentication service](https://nauthilus.org/), but instead of it using LDAP to resolve users, we would either make use of its Lua scripting abilities to implement a backend that performs HTTP calls to an OpenCloud Authentication API, or implement an additional Nauthilus backend that uses the Nauthilus API to delegate to another instance, which would then be the OpenCloud Authentication API with support for the Nauthilus API.
-
-⚠️ As with the previous option, it would require the implementation of a Stalwart Nauthilus Directory, **that is yet to be developed**.
-
-Interestingly, if the OpenCloud Authentication API follows the Nauthilus API, this scenario can easily be degraded by dropping Nauthilus and, instead, having all services talk to the OpenCloud Authentication API directly.
-
-* ✅ MUAs with basic authentication
-  * MUAs authenticate directly against Stalwart
-  * Stalwart's Nauthilus Directory supports plain text authentication by relaying the authentication operation to Nauthilus, e.g. using its JSON API
-  * Nauthilus provides a response that contains user attributes from LDAP (display name, email addresses, ...)
-* ✅ MUAs with application password authentication
-  * Nauthilus would forward the authentication request to the OpenCloud Authentication API, which would support application passwords
-* ❓ MUAs with SASL bearer token authentication
-  * it is currently unclear whether Nauthilus supports OIDC token authentication and whether it would be able to forward such requests to the OpenCloud Authentication API
-* ✅ JMAP clients with basic authentication
-  * Stalwart's Nauthilus Directory supports plain text authentication by relaying the authentication operation to Nauthilus, e.g. using its JSON API
-  * Nauthilus then forwards that request to the OpenCloud Authentication API
-  * the OpenCloud Authentication API, and then Nauthilus, provides a response that contains user attributes from LDAP (display name, email addresses, ...) or claims from the JWT
-* ❓ JMAP clients with bearer token authentication
-  * it is currently unclear whether Nauthilus supports OIDC token authentication and whether it would be able to forward such requests to the OpenCloud Authentication API
-* ✅ OpenCloud Groupware with master authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * Stalwart detects and supports clear text password master authentication regardless of the Directory that is being used, and verifies it against the shared secret password that is configured in the server
-* ❓ OpenCloud Groupware with generated token authentication
-  * the OpenCloud Groupware backend authenticates directly against Stalwart
-  * it is currently unclear whether Nauthilus supports OIDC token authentication and whether it would be able to forward such requests to the OpenCloud Authentication API
-
-> [!IMPORTANT]
-> We need to clarify whether the Nauthilus API allows for a JWT to be submitted for the authentication request, and not only username and password – not to secure the request in itself, but to forward an OIDC token based authentication attempt as part of the payload.
-
-### Comparing Options
-
-| | MUA basic | MUA app password | MUA sasl | JMAP clients with basic auth | JMAP clients with JWT auth | Groupware Middleware with master auth | Groupware Middleware with JWT auth |
-| --- | --- | --- | --- | --- | --- | --- | --- |
-| Stalwart 0.12 with LDAP Directory | ✅ MUA → Stalwart | ❌ not supported with LDAP | ❌ not supported with LDAP | ✅ | ❌ | ✅ | ❌ |
-| Stalwart 0.12 with OIDC Directory | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ |
-| Stalwart 0.12 with Internal Directory | ✅ MUA → Stalwart, must be provisioned in Stalwart | ✅ MUA → Stalwart, must be provisioned in Stalwart | ❌ | ❌ | ❌ unless using Stalwart as IDP | ✅ | ❌ |
-| Stalwart + OpenCloud Authentication API | ✅ MUA → Stalwart → OpenCloud | ✅ MUA → Stalwart → OpenCloud | ✅ MUA → Stalwart → OpenCloud | ✅ MUA → Stalwart → OpenCloud | ✅ MUA → Stalwart → OpenCloud | ✅ | ✅ |
-| Stalwart + Nauthilus + LDAP | ✅ MUA → IMAP proxy → Nauthilus → LDAP | ❌ | ❌ | ✅ | ❌ | ✅ | ❌ |
-| Stalwart + Nauthilus + OpenCloud Authentication API | ✅ MUA → IMAP proxy → Nauthilus → OpenCloud | ✅ MUA → IMAP proxy → Nauthilus → OpenCloud | ✅ MUA → IMAP proxy → Nauthilus → OpenCloud | ✅ MUA → IMAP proxy → Nauthilus → OpenCloud | ✅ MUA → IMAP proxy → Nauthilus → OpenCloud | ✅ | ✅ |
-| Stalwart + Nauthilus-like OpenCloud Authentication API | ✅ MUA → Stalwart → OpenCloud | ✅ MUA → Stalwart → OpenCloud | ✅ MUA → Stalwart → OpenCloud | ✅ MUA → Stalwart → OpenCloud | ✅ MUA → Stalwart → OpenCloud | ✅ | ✅ |
@@ -1,64 +0,0 @@
---
-status: proposed
-date: 2025-06-24
-author: Pascal Bleser <p.bleser@opencloud.eu>
-decision-makers:
-consulted:
-informed:
-title: "Implementing Groupware as a separate Microservice vs integrated in the OpenCloud Stack"
-template: https://raw.githubusercontent.com/adr/madr/refs/tags/4.0.0/template/adr-template.md
---
-
-* Status: draft
-
-## Context
-
-Should the Groupware backend be an independent microservice or be part of the OpenCloud single binary framework?
-
-The OpenCloud backend is built on a framework that
-
-* implements token based authentication between services
-* allows for a "single binary" deployment mode that runs all services within that one binary
-* integrates services such as a NATS event bus
-
-This decision is about whether the Groupware backend service should be implemented within that framework or, instead, be implemented as a standalone backend service.
-
-## Decision Drivers
-
-* single binary deployment strategy is potentially important (TODO how important is it really? stakeholders:?)
-
-## Considered Options
-
-* have the Groupware Middleware as an independent microservice
-* have the Groupware Middleware implemented within the existing OpenCloud framework
-
-## Decision Outcome
-
-TODO
-
-### Consequences
-
-TODO
-
-### Confirmation
-
-TODO
-
-## Pros and Cons of the Options
-
-### Independent Microservice
-
-* (potentially) good: be free from technical decisions made for the existing OpenCloud stack, to avoid carrying potential technical baggage
-* (potentially) good: make use of a framework that is more fitting for the tasks the Groupware backend needs to accomplish
-* bad: re-implement framework components that already exist, with the need to maintain those in two separate codebases, or the added complexity of a shared library repository
-* bad: not have the ability to include the Groupware backend in the single binary deployment
-* neutral: a separate code repository and delivery for the Groupware backend, which might or might not be of advantage
-* neutral: may be implemented on a completely different technology stack, including the programming language
-
-### Part of the framework
-
-* good: fit into the opinionated choices that were made for the OpenCloud framework so far
-* good: many aspects are already implemented in the current framework and can be made use of, potentially enhanced for the needs of the Groupware backend
-* good: the ability to include the Groupware backend in the single binary deployment
-* neutral: be in the same code repository and part of the same delivery as other services in OpenCloud
-* neutral: must be implemented in Go on top of the same technology stack
@@ -1,89 +0,0 @@
---
-title: "Discover OIDC Client configuration via WebFinger"
---
-
-* Status: accepted
-* Deciders: [@TheOneRing @kulmann @rhafer @dragotin]
-* Date: 2026-02-02
-
-Reference: https://github.com/opencloud-eu/opencloud/pull/2072, https://github.com/opencloud-eu/desktop/issues/217
-
-## Context and Problem Statement
-
-Up to now our client applications used hard-coded OIDC client configurations.
-So it is not possible to change the client id that a client should use or the
-list of scopes that a client needs to request. This makes it hard to integrate
-OpenCloud with various existing identity providers. For example:
-
- Authentik basically creates a different issuer URL for each client. As OpenCloud
-  can only work with a single issuer URL, all OpenCloud clients need to use the
-  same client id to work with Authentik.
- Some IDPs are not able to work with user-supplied client ids. They generate
-  client ids automatically and do not allow to specify them manually.
- To make features like automatic role assignment work, clients need to request
-  specific scopes, depending on which exact IDP is used.
-
-## Decision Drivers
-
-* Support broader set of IDPs
-* avoid any manual configuration adjustments on the client side
-
-## Decision
-
-Enhance the WebFinger service in OpenCloud to provide platform-specific OIDC
-discovery, enabling clients to query for the correct OIDC `client_id` and
-`scopes` based on their application type (e.g., web, desktop, android, ios).
-
-This is achieved by allowing an additional `platform` query parameter to be used
-when querying the WebFinger endpoint. The response will include the appropriate
-`client_id` and `scopes` in the `properties` section of the response.
-
-This is implemented in a backward-compatible way, so existing clients that do not
-specify the `platform` parameter will continue to receive just the issuer information.
-
-## Example
-
-### Client Request
-
-```
-GET /.well-known/webfinger?resource=https://cloud.opencloud.test&rel=http://openid.net/specs/connect/1.0/issuer&platform=desktop
-```
-
-### Server Response
-
-```json
-{
-  "subject": "https://cloud.opencloud.test",
-  "links": [{
-    "rel": "http://openid.net/specs/connect/1.0/issuer",
-    "href": "https://idp.example.com"
-  }],
-  "properties": {
-    "http://opencloud.eu/ns/oidc/client_id": "desktop-client-id",
-    "http://opencloud.eu/ns/oidc/scopes": ["openid", "profile", "email", "offline_access"]
-  }
-}
-```
-
-### Server configuration (suggestion)
-
-To configure the OpenCloud server a couple of new config settings need to be introduced. This would
-be two new settings per client, e.g.:
-
-
-```
-WEBFINGER_ANDROID_OIDC_CLIENT_ID
-WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES
-WEBFINGER_DESKTOP_OIDC_CLIENT_ID
-WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES
-WEBFINGER_IOS_OIDC_CLIENT_ID
-WEBFINGER_IOS_OIDC_CLIENT_SCOPES
-WEBFINGER_WEB_OIDC_CLIENT_ID
-WEBFINGER_WEB_OIDC_CLIENT_SCOPES
-```
-
-Additionally for backwards compatibility the existing `WEB_OIDC_CLIENT_ID` and
-`WEB_OIDC_CLIENT_SCOPE` settings should be used as fallback for the `web`
-platform. Also we should make it easy to configure the same settings for all
-platforms at once by using `OC_OIDC_CLIENT_ID` and `OC_OIDC_CLIENT_SCOPE` as
-fallback for all platforms if the platform-specific settings are not set.
@@ -1,294 +0,0 @@
---
-status: proposed
-date: 2025-06-24
-author: Pascal Bleser <p.bleser@opencloud.eu>
-decision-makers:
-consulted:
-informed:
-title: "Resource Linking"
-template: https://raw.githubusercontent.com/adr/madr/refs/tags/4.0.0/template/adr-template.md
---
-
-* Status: draft
-
-## Context
-
-Which semantic and technical approach to take in order to provide strong integration of the various products and capabilities of OpenCloud, OpenTalk, and potentially other products as well?
-
-## Decision Drivers
-
-* a strong integration that allows users to access resources and relationships without having to switch views, which translates into a "mental switch" as well
-* an innovative approach that differs from the traditional way groupware applications have been designed in the past
-* TODO more decision drivers from PM
-* a model that is open and generic enough to integrate many different types of resources and relationships
-* a model that allows for independent and incremental upgrades to the resources and relationships that can be contributed by each service
-
-## Considered Options
-
-* resource linking
-* application launchers
-* TODO? can we come up with more ideas?
-
-## Decision Outcome
-
-TODO
-
-### Consequences
-
-TODO
-
-### Confirmation
-
-TODO
-
-## Pros and Cons of the Options
-
-### Resource Linking
-
-This concept primarily resides on the idea of having resources, which have attributes, and relations between them, pretty much as [RDF (Resource Description Framework)](https://www.w3.org/RDF/) does, where the Groupware backend provides services to explore relations of a given resource.
-
-* good: decoupling of UI, backends as well as other participants, as backends can gradually evolve the relationships and resources they understand and can contribute to over time, as well as for the UI that may just silently ignore resources it does not support yet or does not want to present to the user
-* good: potential for an asynchronous architecture that would enable the UI to present some resources early without having to wait for those that require more processing time or are provided by services that happen to be under heavier load
-* good: it should provide ammunition for a modern and original UI that is centered around resources and relationships rather than the usual visual paradigms
-* bad: it might be a challenge to implement this approach in a performant way with rapid response times, as it could cause additional complexity and storage services (e.g. to denormalize reverse indexes, cache expensive resource graphs, etc...)
-
-#### URNs
-
-Each resource has a unique identifier, for which [URNs (Uniform Resource Names)](https://www.rfc-editor.org/rfc/rfc1737) seem the best representation.
-
-URNs are composed of
-
-* a namespace identifier
-* a namespace-specific string
-
-As a convention, we will use the following:
-
-<table>
-    <thead>
-        <tr>
-            <th><code>urn:</code></th>
-            <th>ns</th>
-            <th colspan="2">namespace specific string</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td><code>urn:</code></td>
-            <td><code>oc:</code></td>
-            <td><code>&lt;type&gt;:</code></td>
-            <td><code>&lt;unique identifier&gt;:</code></td>
-        </tr>
-    </tbody>
-</table>
-
-##### Examples
-
-<table>
-    <thead>
-        <tr>
-            <th><code>urn:</code></th>
-            <th>namespace</th>
-            <th>type</th>
-            <th>unique id</th>
-        </tr>
-    </thead>
-    <tbody>
-        <tr>
-            <td><code>urn:</code></td>
-            <td><code>oc:</code></td>
-            <td><code>user:</code></td>
-            <td><code>camina.drummer</code></td>
-        </tr>
-        <tr>
-            <td><code>urn:</code></td>
-            <td><code>oc:</code></td>
-            <td><code>contact:</code></td>
-            <td><code>klaes.ashford</code></td>
-        </tr>
-        <tr>
-            <td><code>urn:</code></td>
-            <td><code>oc:</code></td>
-            <td><code>event:</code></td>
-            <td><code>dd4ea520-e414-41e1-b545-b1c7d4ce57e7</code></td>
-        </tr>
-        <tr>
-            <td><code>urn:</code></td>
-            <td><code>oc:</code></td>
-            <td><code>mail:</code></td>
-            <td><code>&lt;1e8074e8-cd56-4358-9f9e-f17cb701b950@opa.org&gt;</code></td>
-        </tr>
-    </tbody>
-</table>
-
-#### Exploration API
-
-Whenever the user puts a resource into focus in the OpenCloud Groupware UI (i.e. by selecting/clicking that resource, e.g. the sender of an email), it may send a request to the Groupware service API to inquire about related resources.
-
-What those related resources are still stands to be determined, but examples could be along the lines of
-
-* unread emails from the same sender
-* emails exchanged with that sender in the last 7 days
-* files recently shared with that user
-* spaces or groups in common with that user
-* OpenTalk meetings planned within the next 3 days
-
-In order to decouple the Groupware service from which resources and relations are supported,
-
-* whenever such an exploration request is received, the Groupware service forwards it to all known services, in a "fan-out" model
-* each service can understand the focused resource, or not, but if it does it may return related resources that it is capable of providing using its data model (e.g. OpenTalk providing related meeting resources, OpenCloud Groupware providing related calendar events, contacts, mails, etc...)
-* ideally, that happens in an asynchronous fashion, using e.g. [SSE (Server Side Events)](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events) to push results to the OpenCloud UI to avoid having to wait for the slowest contributor, although that pushes the "reduce" part of this ["map-reduce" operation](https://en.wikipedia.org/wiki/MapReduce) to the client
-
-```mermaid
-graph LR
-    c(client)
-    subgraph backend
-        a(opencloud api)
-        g(groupware)
-        ot(opentalk)
-        u(users)
-        s(stalwart)
-        k(keycloak)
-    end
-    subgraph storage
-        ots@{ shape: cyl, label: "opentalk\nstorage"}
-        ss@{ shape: cyl, label: "stalwart\nstorage"}
-        l@{ shape: cyl, label: "ldap"}
-    end
-    c-->|/related/urn:oc:user:camina.drummer|a
-    a-->|/related/urn:oc:user:camina.drummer|g
-    g-->s
-    s-->ss
-    a-->|/related/urn:oc:user:camina.drummer|ot
-    ot-->ots
-    a-->|/related/urn:oc:user:camina.drummer|u
-    u-->k
-    k-->l
-
-    ot-.->|urn:oc:meeting:232403bc-b98f-4643-a917-80bdcfc7aaba|a
-    g-.->|urn:oc:event:e5193ad3-8f1c-4162-8593-69fe659bcc08|a
-```
-
-This allows a decoupling of all the participants, enabling each service to add, remove or alter relationships that it is able to contribute for a given resource type.
-
-Obviously, the UI needs to be able to understand resource types to know how to represent them, but if it silently ignores resource types that it does not know of, backends can evolve independently from the UI.
-
-#### JSON-LD
-
-[JSON-LD (JSON for Linking Data)](https://json-ld.org/) seems like a potent representation format for those relationships in a REST environment.
-
-It could look something like this:
-
-```json
-{
-    "@context": {
-        "@user": "https://schema.opencloud.eu/user.jsonld",
-        "link": "https://schema.opencloud.eu/linked.jsonld"
-    },
-    "@type": "urn:oc:type:user",
-    "@id": "urn:oc:user:cdrummer",
-    "name": "Camina Drummer",
-    "email": "camina@opa.org",
-    "roles": ["admin", "pirate"],
-    "link:rooms": [
-        {
-            "@context": {
-                "@room": "https://meta.opencloud.eu/room.jsonld",
-                "link": "https://schema.opencloud.eu/linked.jsonld"
-            },
-            "@id": "urn:oc:room:a3f19df6-6c7d-45fa-b16c-6e168e2a2a43",
-            "name": "OPA Leadership Standup 2355-02-27",
-            "start": "2355-02-27T10:58:15.918Z",
-            "end": "2355-02-27T13:52:59.010Z",
-            "started_by": {
-                "@context": "https://meta.opencloud.eu/user.jsonld",
-                "@type": "urn:oc:type:user",
-                "@id": "urn:oc:user:adawes",
-                "name": "Anderson Dawes",
-                "email": "anderson@opa.org"
-            },
-            "link:events": [
-                {
-                    "@context": "https://meta.opencloud.eu/event.jsonld",
-                    "@type": "urn:oc:type:event",
-                    "@id": "urn:oc:event:3e041c88-088c-4015-a32e-5560561f6e26",
-                    "start": "2355-02-27T11:09:15.918Z",
-                    "end": "2355-02-27T13:52:59.010Z",
-                    "status": "confirmed",
-                    "invited": [
-                        {
-                            "@context": "https://meta.opencloud.eu/user.jsonld",
-                            "@type": "urn:oc:type:user",
-                            "@id": "urn:oc:user:adawes",
-                            "name": "Anderson Dawes",
-                            "email": "anderson@opa.org"
-                        },
-                        {
-                            "@context": "https://meta.opencloud.eu/user.jsonld",
-                            "@type": "urn:oc:type:user",
-                            "@id": "urn:oc:user:kashford",
-                            "name": "Klaes Ashford",
-                            "email": "klaes@opa.org"
-                        }
-                    ]
-                }
-            ],
-            "members": [
-                {
-                    "@context": "https://meta.opencloud.eu/contact.jsonld",
-                    "@type": "urn:oc:type:contact",
-                    "@id": "urn:oc:contact:9ccb247d-a728-4d8f-9259-c28cf6cef567",
-                    "name": "Naomi Nagata",
-                    "email": "naomo@opa.org"
-                },
-                {
-                    "@context": "https://meta.opencloud.eu/user.jsonld",
-                    "@type": "urn:oc:type:user",
-                    "@id": "urn:oc:user:adawes",
-                    "name": "Anderson Dawes",
-                    "email": "anderson@opa.org"
-                },
-                {
-                    "@context": "https://meta.opencloud.eu/user.jsonld",
-                    "@type": "urn:oc:type:user",
-                    "@id": "urn:oc:user:kashford",
-                    "name": "Klaes Ashford",
-                    "email": "klaes@opa.org"
-                }
-            ],
-            "chat": {
-                "@context": "https://meta.opencloud.eu/file.jsonld",
-                "@type": "urn:oc:type:file",
-                "@id": "urn:oc:file:OPA:chatlogs/2355/02/27/a3f19df6-6c7d-45fa-b16c-6e168e2a2a43.md",
-                "href": "https://cloud.opencloud.eu/spaces/OPA/chatlogs/2355/02/27/a3f19df6-6c7d-45fa-b16c-6e168e2a2a43.md"
-            }
-        }
-    ],
-    "link:mails": [
-        {
-            "@context": "https://meta.opencloud.eu/mail.jsonld",
-            "@type": "urn:oc:type:mail",
-            "@id": "583b9b66-c0b3-41ba-bf6c-a02ec5f4a638@smtp-07.opa.org",
-            "subject": "About bosmang Fred Johnson",
-            "date": "2355-01-03T09:39:44.919Z"
-        },
-        ...
-    ],
-    "link:shares": [
-        {
-            "@context": "https://meta.opencloud.eu/share.jsonld",
-            "@type": "urn:oc:type:share",
-            "@id": "841ef259-584d-4ce6-827f-b53f900c988d",
-            "filename": "remember the cant.jpg"
-        }
-    ]
-}
-```
-
-### Application Launchers
-
-Have a UI that is comprised of multiple more-or-less separate applications, with an application launcher bar, with each application being an icon in itself in that launcher.
-
-Similar to what e.g. Google does, or Open-Xchange App Suite.
-
-* bad: does not make for an integrated application paradigm since users still have to context switch between those applications/views to perform tasks
-
@@ -1,212 +0,0 @@
---
-title: "Inviting Guest users as fully integrated user in OpenCloud"
---
-
-* Status: postponed
-* Deciders: []
-* Date: 2026-01-20
-
-Reference: https://github.com/opencloud-eu/opencloud/issues/2111
-
-## Important Disclaimer
-
-The approach discussed here has been postponed (as of March, 2026) in favor
-of a different solution that does not require full-blown user-accounts in
-OpenCloud. That approach is currently tracked here:
-https://github.com/opencloud-eu/opencloud/issues/2513
-
-## Context and Problem statement
-
-To allow collaboration with external Users (Users that don't yet have an
-account in the IDP, and might be external to the organization), it should
-be possible to invite "Guest Users" into an OpenCloud instance.
-
-## Requirements
-
- the audit trail of the external user accessing the resource needs to
-  be maintained, that means sharing via a password protected public link
-  is not sufficient as access to that one is tracked as if the creator
-  of the link accessed the resource
- external users need to be authenticated just like "normal" users, when
-  accessing the shared resource (including the possibility to use 2FA)
- the ability to invite external users is tied to a separate permission
-  (e.g. "can invite guest users")
- make it work with all (most) of the user-management configurations we support.
-  The built-in IDP (lico) does not need to be supported.
- avoid creating "Shadow IT" Infrastructure, e.g. we don't want to
-  create/maintain a separate IDP instance just for Guest User that would
-  allow bypassing corporate rules for Identity Management
- the process of inviting a guest must can be asynchrounous, i.e. the user
-  account of the guest user might not be created at the moment of
-  creating the share/sending the invitaion as the whole process crosses
-  multiple systems (OpenCloud, Identity Management System, Email) and might
-  even require manual steps.
- It should be possible to "convert" a guest user into a "normal" user without
-  the user loosing their shares.
- Guest user invitations should have an expiration date, after which they can
-  no longer be accepted.
-
-
-### Privileges of guest users
-
- guest users can not share or invite other users to a space or create public
-  links. (primary focus of the feature is to provide a simple way to grant
-  external, authorized access. anything else like resharing would undermine
-  regular user accounts).
- guestusers can use the desktop and mobile client to access their shares or spaces
-
-
- all "normal" users are able to share with guest users, just as if they where "normal" users.
-
-
-## Questions still to be answered
-
- what's the life cycle of a guest user?
-  - Who's responsible for deprovisioning?
-  - Do guest users expire after a certain time?
-  - Do we need to keep track of who invited whom and when? (not just in
-    the audit log?)
- What if the user already exists but used a different mail address in
-  his account (e.g. sub-addressing?).
-
-## Obstacles
-
-### UserIDs
-
- Every user in OpenCloud needs to have a userid assigned
- Sharing, as many other features, needs that userid for storing the
-  share (share service) and for assigning the grants on the shared
-  resources (storage provider)
- When an external IDP is used the generation of that userid is usually
-  not in control of OpenCloud (exception User-Autoprovisioning, or when
-  the Provisioning/Education API is used). In that case, the userid is
-  taken from a LDAP Attribute maintained in the external system
-
-### Lots of identity management options
-
- OpenCloud provides many different ways to consume user-accounts. Guest
-  users are supposed to be working with all/most of them:
-  - External IDP, with external LDAP service
-  - External IDP, with manual provisioning via the
-    Education/Provisioning APIs (to a local OpenCloud specific LDAP
-    service) - e.g. in multi-tenant setups
-  - External IDP, with User-Autoprovisioning (also to a local OpenCloud
-    specific LDAP service)
-  - everything in-between and outside of the above
- Each of these options have different ways for user-provisioning and in
-  the way userids are generated and managed
-
-### How do we keep track of invitations?
-
- Completely rely on external system?
- Track creation and acceptance of invitations somehow?
- Do invitation expire at some point?
-
-## Possible solutions
-
-### Re-vitalize the PoC implementation of the invitations service and finalize it (<https://github.com/opencloud-eu/opencloud/blob/main/services/invitations/README.md>)
-
- Implements parts of the MSGraph Invitation Specification
-  (<https://learn.microsoft.com/en-us/graph/api/resources/invitation?view=graph-rest-1.0>)
- Currently there's just a single backend that allows creating users,
-  using the Keycloak Admin API
- As part of the user creation keycloak triggers an email to be sent to
-  the invited user to get him to verify his email address and set a
-  password. This is not really and invitation email.
-
-#### Pros
-
-    - A partial implementation already exists
-    - no shadow IT
-
-#### Cons
-
-    - while the emails sent by keycloak can be themed. There is no way
-      to add custom content, like: "you've being invited by user X to
-      access resource Y"
-    - the keycloak admin API does not return the password reset link in
-      the response, so we can't use that to send a custom email
-    - the keycloak implementation is not a real "user invitation"
-      workflow, the user experience for the invited user is not ideal
-    - The workflow likely only works with a limited set of setups.
-      (Specifically: a keycloak that is able to write into a connected
-      LDAP database, that OpenCloud can consume)
-    - As the invitations are not really tracked, e.g. we don't really
-      "know" if an invitation was accepted
-    - Requires direct access to the Identity Management System
-
-### Invitation Service + support for pending shares in the share manager
-
- Create some form in invitation manager and provide tools/documentation
-  for customers to hook that up with their Identity Management System
- User's with the "right" privileges are able to create invitations,
-  invitations get a unique identifier. Other data maintained on the
-  invitation:
-  - Invited user's email address
-  - Invited user's userid (once the user account was provisioned)
-  - Inviting user's userid
-  - Creation timestamp
-  - Invitation State (Pending, Accepted, …)
-  - (more probably)
- our sharing API
-  ('graph/v1beta1/drives/{drive-id}/items/{item-id}/invite') is enhanced
-  to allow creating shares that target an invitation as the share
-  recipient. (That share would only be persisted in the 'shares' service
-  and would not yet crate any grants on the filesystem, or send out
-  sharing notifications). (Requires changes to the CS3 sharing APIs)
- A middleware (specific to the Identity Management System) is
-  "informed" (e.g. via web hooks or a message queue) when a new
-  invitation is created. That middleware is responsible for provisioning
-  the user account of the guest user. Whatever this process looks like
-  it completely up to the middleware (maybe it triggers some invitation
-  workflow or it could just even open a support ticket with the IDP
-  admin)
- once the user is provisioned the middleware calls back into our
-  invitations service,marks the invitation as "accepted" and provides
-  the "userid" of the guest user. The invitations service then triggers
-  the "pending" shares to be processes, which causes the filesystem
-  grants to be written and notifications to be send out to the guest
-  user.
- We'd provide a reference implementation of that middleware, that works
-  with keycloak
-
-#### Pros
-
-    - Agnostic to whatever Identity Management System is used
-    - We have an audittrail about who was invited by whom at what point
-      in time
-    - no shadow IT
-
-#### Cons
-
-    - somewhat complex
-    - likely requires changes to the CS3 APIs
-
-#### Implementation Obstacles
-
-    - Permissions on spaces are currently not tracked in the share
-      manager, the are purely managed via grants. So currently the share
-      manager service currently does not know anything about (invited)
-      users being assigned to spaces
-
-## Additional thoughts
-
-If OpenCloud were responsible for allocating the UserIDs of all users
-the solution sketch above would likely loose some of its complexity. We
-would "roll" the userid for the invited user already when creating the invite.
-That would allow to skip the step of creating a "pending" Share with an
-invitation assigned. As we have an ID already, we could just create a "normal"
-share and even populate the grants on the filesystem for that share (or space)
-
-We've been pondering on the idea of making OpenCloud manage all UserIDs
-for quite a while as it would have some additional benefits for the
-whole user management story.
-
- We wouldn't rely anymore on the external Identity Management system to
-  provide a unique id with certain properties. Ideally the only unique
-  thing we'd need from the external system is the `iss` and `sub`
-  claims of the IDP and those are required by the OIDC standards.
-
-It could be worth to spend some time on figuring out a migration path
-towards such a solution, before spending resources on a complex guest
-features implementation.
@@ -1,62 +0,0 @@
---
-status: proposed
-date: 2025-06-25
-author: Pascal Bleser <p.bleser@opencloud.eu>
-decision-makers:
-consulted:
-informed:
-title: "Groupware Software Stack"
-template: https://raw.githubusercontent.com/adr/madr/refs/tags/4.0.0/template/adr-template.md
---
-
-* Status: draft
-
-## Context
-
-Which software stack to choose for the implementation of the OpenCloud Groupware service?
-
-## Considered Options
-
-* [Go](https://go.dev/) with the OpenCloud framework, as it is used in OpenCloud
-* Rust, as it is a similarly modern language, with know-how in Opentalk
-* Java with an opinionated microservice framework (e.g. [Micronaut](https://micronaut.io/))
-
-## Decision Outcome
-
-The decision was taken to go with the existing Go technology stack used in OpenCloud, since it allows for
-
-* everyone in the Groupware backend team to contribute
-* having a single technology stack across all OpenCloud backend features
-* having the option of a single binary deployment
-
-### Consequences
-
-TODO
-
-### Confirmation
-
-TODO
-
-## Pros and Cons of the Options
-
-### Go
-
-* good: established in the OpenCloud team, with expertise, potentially broadening the team that can contribute to Groupware development
-* good: make use of the existing infrastructure and framework, including the single binary deployment option
-* bad: less mature and capable technology stack, potentially problematic with regards to lack of asynchronous I/O and streamed HTTP processing
-
-### Rust
-
-* good: shared knowledge with the team of developers at OpenTalk
-* bad: little to no experience in the current OpenCloud team
-
-### Java
-
-* bad: little to no experience in the current OpenCloud team, with exception of the Groupware members
-* good: extensive experience with Micronaut with one OpenCloud developer
-* good: opinionated and well documented
-* good: cloud native
-* good: mature technology stack
-* good: asynchronous I/O and virtual threads make for efficient resource usage
-* potentially bad: likely to not fit well into low resource environments (although native compilation using GraalVM is possible)
-* potentially bad: prevents the single binary deployment option from including Groupware
@@ -1,73 +0,0 @@
---
-status: proposed
-date: 2025-06-25
-author: Pascal Bleser <p.bleser@opencloud.eu>
-decision-makers:
-consulted:
-informed:
-title: "Stalwart as Groupware Backend"
-template: https://raw.githubusercontent.com/adr/madr/refs/tags/4.0.0/template/adr-template.md
---
-
-* Status: draft
-
-## Context
-
-Which Groupware backend should be used?
-
-## Considered Options
-
-* [Stalwart](https://stalw.art/), contains not only mail but also collaborative features in an integrated package
-* traditional IMAP/POP/SMTP stacks (e.g. [Dovecot](https://www.dovecot.org/) + [Postfix](https://www.postfix.org/))
-
-## Decision Outcome
-
-The decision was made to go with Stalwart, as it reduces the implementation effort on our end, allowing us for a much faster time-to-market with a significantly smaller team of developers.
-
-### Consequences
-
-We will most probably not need to develop much of a calendar or contact stack ourselves, as Stalwart is planning to implement those as part of the upcoming [JMAP](https://jmap.io/spec-core.html) specifications for [contacts](https://jmap.io/spec-contacts.html) and [calendars](https://jmap.io/spec-calendars.html).
-
-The Groupware API will largely consist of a translation of high-level operations for the UI into JMAP operations sent to Stalwart.
-
-#### Risks
-
-On the flip side, there are a number of risks associated with that decision.
-
-* Stalwart underdelivers on its promises
-  * calendaring provides insufficient features for our implementation (e.g. event series handling being too basic)
-  * not scaling for large deployments
-  * necessary adaptations (e.g. for authentication integration) are rejected upstream
-  * etc...
-
-### Confirmation
-
-TODO
-
-## Pros and Cons of the Options
-
-### Stalwart
-
-* good: integrated package that contains IMAP/POP, SMTP, anti-spam, AI, encryption at rest and many other features in one
-* good: modern stack
-* good: capable of fault tolerance in large deployments through its use of [FoundationDB](https://www.foundationdb.org/)
-* bad: relatively new project with few to no large scale productive deployments (yet)
-* bad: significant human [SPoF](https://en.wikipedia.org/wiki/Single_point_of_failure)/[bus factor](https://en.wikipedia.org/wiki/Bus_factor) issue as the development team currently consists of one
-* good: supports and drives the JMAP protocol ([JMAP Core](https://jmap.io/spec-core.html), [JMAP Mail](https://jmap.io/spec-mail.html), [JMAP Contacts](https://jmap.io/spec-contacts.html), [JMAP Calendars](https://jmap.io/spec-calendars.html), [JMAP Tasks](https://jmap.io/spec-tasks.html), ...),
-  * which provides more high-level operations that we don't need to implement ourselves,
-  * as well as a much cleaner specification that reduces efforts too,
-  * and additionally can be implemented with an efficient stateless HTTP I/O stack
-* bad: no viable broad JMAP implementation alternatives in case Stalwart does not deliver ([Apache James](https://james.apache.org/) only seems to support a basic subset of JMAP)
-* good: implements a lot of Groupware "business logic" on its own, reducing the implementation effort on our end,
-  * most notably by not having to deal with IMAP extensions and quirks,
-  * or the complexity of calendar events
-
-### IMAP/SMTP
-
-* good: there are a number of alternatives in case a specific implementation does not deliver
-* good: the best implementation candidates are well-established, used in large amounts of productive deployments, supported by teams of developers
-* bad: more complex stack composed of numerous components as opposed to an all-in-one implementation
-* bad: the effort and complexity of having to deal with IMAP,
-  * its complexity due to its extensions and its many quirks,
-  * as well as a significantly less efficient I/O stack that requires stateful session handling
-* bad: requires the complete implementation of contacts, calendars and tasks in our own stack, as none of those services are provided by IMAP/SMTP backends
@@ -1,512 +0,0 @@
---
-status: accepted
-date: 2025-07-22
-author: pbleser-oc
-consulted: AlexAndBear, butonic, dragotin, fschade, JammingBen, kulmann, martinherfurth, micbar, rhafer
-title: "API for the Groupware Web UI"
---
-<!-- markdownlint-disable-file MD024 MD033 -->
-
-## Context
-
-We need a comprehensive HTTP API for the OpenCloud Web UI to provide access to the following (upcoming) modules and Groupware functionalities:
-
-* Mail
-* Contacts
-* Calendar
-* Tasks
-* Chat
-* Configuration
-
-```mermaid
-graph LR
-  subgraph clients
-    ui(OpenCloud UI)
-    muas(Other<br>MUAs)
-  end
-  subgraph Backend
-    subgraph OpenCloud
-      direction TB
-      groupware("OpenCloud<br>Groupware")
-      drive("OpenCloud<br>Drive")
-    end
-    stalwart(Stalwart)
-  end
-  subgraph Storage
-    drive_storage[(drive<br>storage)]
-    stalwart_metadata[(metadata<br>storage)]
-    stalwart_storage[(object<br>storage)]
-  end
-  ui x@==>|?|groupware
-  x@{ animate: true }
-  ui-->|Graph|drive
-  muas-->|IMAP,SMTP,*DAV|stalwart
-  groupware-->drive
-  groupware-->|JMAP|stalwart
-  drive-->drive_storage
-  stalwart-->stalwart_metadata
-  stalwart-->stalwart_storage
-```
-
-Additionally, the API must also be able to provide information about related resources and their relationships, as outlined in [the Resource Linking ADR](./0003-groupware-resource-linking.md).
-
-For the OpenCloud Drive services, the communication between UI client and backend services is performed via the [LibreGraph API](https://github.com/opencloud-eu/libre-graph-api), which is based on [Microsoft Graph](https://developer.microsoft.com/en-us/graph). The goal of this ADR is **not** to question or change that decision, and the choice of an option is merely for the communication with the Groupware backend.
-
-Communication between the OpenCloud Groupware and Stalwart will make use of the [JMAP (JSON Meta Application Protocol) protocol](https://jmap.io/spec-mail.html).
-
-The API for the OpenCloud Web UI is **not** supposed to be an abstraction of that and thus may use JMAP data formats.
-
-Other [MUAs (Mail User Agents)](https://en.wikipedia.org/wiki/Email_client) converse directly with Stalwart using [IMAP](https://en.wikipedia.org/wiki/Internet_Message_Access_Protocol) or [POP3](https://en.wikipedia.org/wiki/Post_Office_Protocol), [SMTP](https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol), [CalDAV](https://en.wikipedia.org/wiki/CalDAV), [CardDAV](https://en.wikipedia.org/wiki/CardDAV), or JMAP itself.
-
-This ADR concerns the decision regarding which API approach/process/technology/specification to use, not the details of the data model and such, which will need to be fleshed out following the requirements and priorities of the OpenCloud UI Client development, regardless of the selected approach.
-
-## Decision Drivers
-
-### UI Driven
-
-The decision must be significantly driven by the OpenCloud UI Client developers, since they are the primary consumers of the API.
-
-They will also be the sole consumers for a foreseeable while until the OpenCloud Groupware UI reaches a stable feature-complete milestone, which is the earliest point in time for the APIs to be considered stable as well and potentially be consumed by third parties.
-
-Backend developers are stakeholders in that aspect as well though, as the choice of API approach has an impact on the complexity, costs and maintainability of the backend services as well.
-
-### Economic Awareness
-
-Reduction of complexity and implementation efforts, albeit not at all costs, and not only on the short run.
-
-It is obviously of advantage when an option requires less implementation, or less complexity in its implementation.
-
-### Efficiency
-
-Regarding efficiency, the goal is to design an API that is tailored to providing responsiveness ([pagination](https://apisyouwonthate.com/blog/api-design-basics-pagination/), [SSEs (Server-Side Events)](https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events), ...) and good network performance.
-
-The latter is achieved by minimizing the number of roundtrips between the client and the servers, which, in turn, is typically achieved through the use of higher level APIs as opposed to a granular API that provides more flexibility but also, by its very nature, requires the combination of multiple request-response roundtrips over the wire.
-
-### Third Party Consumption
-
-We are assuming that the APIs are public APIs (not just technically) and may be consumed by SDKs and third parties.
-
-Implications are that care must be put into providing an API that is stable, versioned, has a changelog, and potentially provided as a product with [LTS (Long-term Support)](https://en.wikipedia.org/wiki/Long-term_support) options.
-
-This also hints at the necessity of a capability exchange/discovery protocol between clients and the Groupware backend, as we will have different versions of clients and servers in the wild, and they need to be able to understand each other. Crucially, if locally running clients are developed, they can go a long time without being updated.
-
-## Considered Options
-
-* [LibreGraph](#libregraph)
-* [JMAP](#jmap)
-* [custom REST API](#custom-rest-api) (albeit potentially based on standards, at least partially)
-
-## Decision Outcome
-
-The decision was made to go with the custom REST implementation option, mainly due to
-
-* the use of LibreGraph providing little benefits
-  * if would provide us with a fleshed out API for groupware
-  * but we would not implement it fully
-  * and it is really an API for Outlook and Exchange, not a generic groupware standard
-  * furthermore, a significant blocker is that it does not provide for a way to support multiple accounts for a user
-  * the experience of implementing and using the LibreGraph API for the Drive components has made light of some challenges that we would not like to repeat
-* using JMAP directly
-  * is a very interesting option in terms of standards, as it is an RFC,
-  * but we currently see that approach as too risky as per the potential complexity of parsing payloads of JMAP commands and their backreferences, plugging those across commands that must be forwarded as-is to Stalwart and others that need to be handled by the Groupware middleware itself, but also the potential need to reverse engineer the high-level meaning of chained low-level JMAP commands in order to implement enrichment, caches, reverse indexes, etc...
-  * however, it might be a better path forward in the future, especially if JMAP becomes a viable option for replacing the current use of LibreGraph as well
-
-### Consequences
-
-* we will need to design an API on our own, from scratch, albeit maximally making use of JMAP data structures
-* that API will need to be maintained as a product, with documentation, versioning, LTS
-
-## Pros and Cons of the Options
-
-* [LibreGraph](#proscons-libregraph)
-* [JMAP](#proscons-jmap)
-* [Custom REST API](#proscons-custom)
-
-### <a id="proscons-libregraph"/>LibreGraph
-
-[LibreGraph](https://github.com/opencloud-eu/libre-graph-api) is an API specification that is heavily inspired by and based on [Microsoft Graph](https://developer.microsoft.com/en-us/graph), of which it is a partial implementation, but also with modifications where necessary.
-
-Example:
-
-```text
-GET /v1.0/me/messages?$select=sender,subject&$count=50&$orderby=received
-```
-
-#### Good
-
-* is already in use as the API for OpenCloud Drive operations, with a small stack to use it in the OpenCloud Web UI
-* provides an API and data model that has already been thought out and used in production (albeit with only few different implementations)
-
-#### Neutral
-
-* does not have to follow the Microsoft Graph API, can be customized to our own needs, but in which case it becomes doubtful that there is any benefit in mimicking the Graph API in the first place if we diverge from it
-* there is no compatibility benefit
-  * the only MUA that uses the Microsoft Graph API is Microsoft Outlook, and it is not a goal to support Microsoft Outlook as a MUA beyond standard IMAP/SMTP/CalDAV/CardDAV services (and that would be Microsoft Graph, not LibreGraph nor any customizations we would require)
-  * we will not implement all of the Microsoft Graph API
-  * we will not implement parts of the Microsoft Graph API as-is either, but will require to make modifications
-* if there is a requirement for considering that API as a public API for third party integrators, then the API also needs to be documented, maintained, versioned, and kept stable as much as possible (this is neutral because it is a requirement that exists with every option)
-
-#### Bad
-
-* not an easy API to implement
-  * although we have libraries that take care of some of the more complex parts, such as parsing [OData](https://www.odata.org/) expressions
-  * really only easy to use when backed by a relational database and an object relational mapping framework using [ASP.NET](https://dotnet.microsoft.com/en-us/apps/aspnet) or [JPA](https://en.wikipedia.org/wiki/Jakarta_Persistence)/[Hibernate](https://hibernate.org/)
-  * its data model and peculiar interpretation of REST are really not [idomatic](https://en.wikipedia.org/wiki/HATEOAS) at all, and are clearly the result of reverse engineering the capabilities of Microsoft SQL Server and Exchange into a "standard" from the back, and then Microsoft Outlook's features and capabilities from the front
-* not tailored to our needs
-  * we will most probably have a lot of cases in which we have to twist the Graph API to express what the UI needs
-  * will require using complex filters, which then require complex parsing in the backend in order to translate them into JMAP
-  * as opposed to directly using an expressive and maximally matching API in the first place
-  * we are likely to encounter use-cases that are not covered by the Graph API (especially due to our resource linking approach)
-* does not support multiple accounts per user
-  * would require the addition of an account parameter, as a query parameter or as part of the path, which would make every URL in the API incompatible with Microsoft Graph
-* more implementation effort than JMAP
-* the JMAP RFCs already provides a data model, and we would end up converting between them all the time, with incompatibilities (Graph has attributes JMAP doesn't, and the other way around)
-* possibly (probably?) more implementation effort than a custom REST API, due to its complexity
-
-#### Decision Drivers
-
-* UI Driven
-  * some members the OpenCloud Web Team strongly prefers not to use LibreGraph due to its complexity and to the fact that we would have to reftrofit operations into an existing API that was designed by a third party
-  * one upside is that there is already a client stack for performing LibreGraph operations, which could be reused to some degree for the Groupware APIs as well; it does not amount to all that much code though
-* Economic Awareness
-  * more complexity and more effort as the other options due to the inherent complexity of the specification
-  * a data model is already specified in full, which might save us some time on that front
-    * although probably not really either since the actual data model we will work with on the backend is prescribed by JMAP, and we will only be looking to map attributes betsween JMAP and LibreGraph
-    * the data model is not necessarily thorougly documented either, which will leave room for interpretation, also due to incompatibilities between JMAP and Graph
-    * there will be attributes that are defined in JMAP and that we will receive from Stalwart that will not have a corresponding attribute in Graph (or be a list of values as opposed to a single value), and those will require to either lose some data by squashing it into the Graph data model, or extending the Graph data model which renders us incompatible with it
-* Efficiency
-  * since the API is not tailored to our needs, we are much more likely to end up performing multiple roundtrips for single high level operations
-* Third Party Consumption
-  * for some of the operations, we could point to the Microsoft Graph documentation, although that would not make for a great experience either, we would probably need to replicate it
-  * our deviations and extensions will have to be maintained just like the other options
-  * LibreGraph doesn't help with API stability either since
-    * we don't implement all of it, and need to document what we implement and what we don't,
-    * won't be compatible either due to modifications (additional parameters, unsupported parameters, different interpretations),
-    * and will just as equally need to evolve it as the other options, requiring the documentation of changes as well
-  * will be required to be maintained as a public API
-    * documentation
-    * LTS
-    * versioning
-
-### <a id="proscons-jmap"/>JMAP
-
-[JMAP (JSON Meta Application Protocol)](https://jmap.io/spec.html) is a set of specifications that are codified in RFCs:
-
-* [RFC 8620](https://tools.ietf.org/html/rfc8620): core JMAP protocol
-* [RFC 8261](https://tools.ietf.org/html/rfc8621): JMAP Mail
-* [RFC 8887](https://www.rfc-editor.org/rfc/rfc8887.html): JMAP subprotocol for WebSocket
-* [RFC 9404](https://www.rfc-editor.org/rfc/rfc9404.html): JMAP Blob Management Extension
-* [RFC 9425](https://www.rfc-editor.org/rfc/rfc9425.html): JMAP Quotas
-* [RFC 9553](https://www.rfc-editor.org/rfc/rfc9553.html): uses JSContact
-* [RFC 8984](https://www.rfc-editor.org/rfc/rfc8984.html): uses JSCalendar
-
-of which some are still in development at the time of writing:
-
-* [JMAP Contacts](https://jmap.io/spec-contacts.html)
-* [JMAP Calendars](https://jmap.io/spec-calendars.html)
-* [JMAP Sharing](https://jmap.io/spec-sharing.html)
-* [JMAP Tasks](https://jmap.io/spec-tasks.html)
-
-To exemplify the JMAP protocol, the following code block is a JMAP request that
-
-* fetches the 30 last received emails from a mailbox (folder)
-* the threads of those emails
-* email metadata of all of those threads, including a preview
-
-<details open>
-<summary>Click here to toggle the display of this example.</summary>
-
-```json
-[[ "Email/query", {
-  "accountId": "ue150411c",
-  "filter": {
-    "inMailbox": "fb666a55"
-  },
-  "sort": [{
-    "isAscending": false,
-    "property": "receivedAt"
-  }],
-  "collapseThreads": true,
-  "position": 0,
-  "limit": 30,
-  "calculateTotal": true
-}, "0" ],
-[ "Email/get", {
-  "accountId": "ue150411c",
-  "#ids": {
-    "resultOf": "0",
-    "name": "Email/query",
-    "path": "/ids"
-  },
-  "properties": [
-    "threadId"
-  ]
-}, "1" ],
-[ "Thread/get", {
-  "accountId": "ue150411c",
-  "#ids": {
-    "resultOf": "1",
-    "name": "Email/get",
-    "path": "/list/*/threadId"
-  }
-}, "2" ],
-[ "Email/get", {
-  "accountId": "ue150411c",
-  "#ids": {
-    "resultOf": "2",
-    "name": "Thread/get",
-    "path": "/list/*/emailIds"
-  },
-  "properties": [
-    "threadId",
-    "mailboxIds",
-    "keywords",
-    "hasAttachment",
-    "from",
-    "subject",
-    "receivedAt",
-    "size",
-    "preview"
-  ]
-}, "3" ]]
-```
-
-</details>
-
-#### Good
-
-* flexible protocol that can easily be implemented by clients
-* potentially does not require implementation efforts on the backend side
-* would obviously support the full potential of JMAP and Stalwart
-* we could potentially extend JMAP with our own data models and operations based on the [JMAP Core Protocol](https://jmap.io/spec-core.html), possibly even propose them as RFCs
-* we can start with JMAP request objects that contain only a few or even only one JMAP methods (indicated by the [maxCallsInRequest capability](https://datatracker.ietf.org/doc/html/rfc8620#section-2)), allowing more calls as we need
-  * clients could implement the funtionality they need using multiple requests in the beginning, then we implement missing functionality on the server
-  * this would allow us to speed up requests that we need while at the same time giving clients the ability to make any necessary individual calls
-  * probably only a partially useful approach since chaining JMAP requests is necessary for even the most mundane operations, to avoid the inefficiency of multiple roundtrips
-
-#### Neutral
-
-* the [existing JMAP specifications](https://jmap.io/spec.html) will not cover 100% of the Web UI API needs (e.g. configuration settings[^config], [resource linking](./0003-groupware-resource-linking.md), ...), but that does not prevent us from implementing additional custom APIs, either as non-JMAP REST APIs, or as extensions of JMAP
-* we would need to gauge whether JMAP communication
-  * should occur directly between the OpenCloud UI and Stalwart,
-  * or whether an OpenCloud Groupware service should be used as an intermediary and as an [anti-corruption layer](https://ddd-practitioners.com/home/glossary/bounded-context/bounded-context-relationship/anticorruption-layer/)
-* if there is a requirement for considering that API as a public API for third party integrators, then the API also needs to be documented, maintained, versioned, and kept stable as much as possible (this is neutral because it is a requirement that exists with every option)
-
-[^config]: although Stalwart will most likely have a [JMAP API for application configuration settings as well](https://matrix.to/#/!blIcSTIPwfKMtOEWcg:matrix.org/$CD9C6IZN28bbmN0Arb_Y-RapgsS4XqAqnDgf15yJahM?via=matrix.org&via=mozilla.org&via=chat.opencloud.eu)
-    > Message from [Mauro](https://github.com/mdecimus):
-    >
-    > Hi everyone, I'm curious what you think about standardizing a simple protocol/extension for users to easily manage certain account settings directly from their email clients. For instance, such a protocol could handle:
-    >
-    > * Passwords, app passwords, and MFA settings
-    > * Locale preferences
-    > * Timezone configuration
-    > * Basic email forwarding (without needing custom Sieve scripts)
-    > * Vacation/auto-responses
-    > * Blocking specific email addresses
-    > * Spam reporting (though not strictly a setting)
-    > * Calendar-related preferences
-    > * Encryption-at-rest settings
-    > * Mail auto-expunge policies
-    > * ... and potentially more.
-    >
-    > My initial thought is to implement this as a JMAP extension rather than inventing another protocol similar to ManageSieve, which feels somewhat like a "Frankenstein" IMAP extension.
-    >
-    > Many mailbox providers already offer some or all of these settings through their web interfaces, but a standardized JMAP-based extension could let users adjust these directly within their preferred email clients or via APIs.
-
-#### Bad
-
-* potentially bad: most probably too flexible for its own good, as it makes it difficult to reverse-engineer the high-level meaning of a set of JMAP requests in order to capture its semantics, e.g. to implement caching or reverse indexes for performance
-* since the OpenCloud Drive backends use the LibreGraph API, using a JMAP based API for Groupware bears the risk of having multiple APIs to do the same thing, which we need to be careful about, and avoid if possible
-
-> [!NOTE]  
-> This seems like a mild "bad" item, but the risk risk here is significant: if it turns out that we need to capture the semantics of API requests to perform additional operations (e.g. caching or indexing for performance reasons, or to decorate the data from Stalwart with information from other services), then we would have to re-implement the whole API as JMAP is too complex to parse to extract semantics from.
-
-#### Two Approaches
-
-There are two approaches as to how to implement our protocol based on JMAP:
-
-* either our clients must split JMAP operations and send some to Stalwart, and others to the Groupware backend (depending on which endpoint is in charge of which API)
-* or our clients send all the JMAP operations to the Groupware backend, which is then in charge to relay JMAP commands that are to be handled by Stalwart to Stalwart
-
-##### Directly to Stalwart
-
-If the OpenCloud UI Client communicates directly with Stalwart (using JMAP), then
-
-* good: we don't need to implement any sort of "bridge" in the OpenCloud Groupware service (although the implementation effort is likely to be low)
-* good: we avoid an additional hop in the network, gaining on performance and potentially on throughput
-* bad: it will have to perform additional API requests for data and features that are not provided by Stalwart with the OpenCloud Groupware service (e.g. [Resource Linking](./0003-groupware-resource-linking.md)) as well, which is likely to lead to an increase in the number of network roundtrips
-* bad: would be unable to extend the protocol with OpenCloud Groupware specific models and data
-* bad: would be unable to implement caching or similar performance improvements if necessary
-* bad: prevents us from implementing infrastructure features that are not present in Stalwart and might never be in the way we would need them, e.g. sharding across multi-site redundancy
-
-```mermaid
-graph LR
-  subgraph clients
-    ui(OpenCloud UI)
-    muas(Other<br>MUAs)
-  end
-  subgraph Backend
-    subgraph OpenCloud
-      direction TB
-      groupware("OpenCloud<br>Groupware")
-      drive("OpenCloud<br>Drive")
-    end
-    stalwart(Stalwart)
-  end
-  subgraph Storage
-    drive_storage[(drive<br>storage)]
-    stalwart_metadata[(metadata<br>storage)]
-    stalwart_storage[(object<br>storage)]
-  end
-  ui x@==>|JMAP|stalwart
-  x@{ animate: true }
-  ui y@==>|JMAP or REST|groupware
-  y@{ animate: true }
-  ui-->|Graph|drive
-  muas-->|IMAP,SMTP,*DAV|stalwart
-  groupware-->drive
-  groupware-->|JMAP|stalwart
-  drive-->drive_storage
-  stalwart-->stalwart_metadata
-  stalwart-->stalwart_storage
-```
-
-##### Groupware intermediary
-
-Alternatively, if the OpenCloud UI Client exclusively communicates with the OpenCloud Groupware service (using JMAP), then
-
-* good: the OpenCloud Groupware service acts as a anti-corruption layer, which would allow us to
-  * implement caching and similar performance improvement measures if necessary (e.g. reverse indexing of costly data)
-  * implement infrastructure features that are not present in Stalwart and might never be in the way we would need them, e.g. sharding across multi-site redundancy
-  * extend the JMAP protocol
-* good: it enables us to minimize network roundtrips between the OpenCloud UI Client and the OpenCloud Groupware backend as there is no need to perform additional requests elsewhere
-* bad: we have an additional intermediary hop that "just" relays operations to Stalwart most of the time
-  * due to Go HTTP stack limitations (lack of zero-copy asynchronous I/O),
-    * that might incur a cost of "needlessly" copying data in memory
-    * as well as performing blocking I/O (at the very least since JMAP requests first need to be read in full by te OpenCloud Groupware before they then can be sent to Stalwart more or less as-is, and the same applies to the responses)
-
-```mermaid
-graph LR
-  subgraph clients
-    ui(OpenCloud UI)
-    muas(Other<br>MUAs)
-  end
-  subgraph Backend
-    subgraph OpenCloud
-      direction TB
-      groupware("OpenCloud<br>Groupware")
-      drive("OpenCloud<br>Drive")
-    end
-    stalwart(Stalwart)
-  end
-  subgraph Storage
-    drive_storage[(drive<br>storage)]
-    stalwart_metadata[(metadata<br>storage)]
-    stalwart_storage[(object<br>storage)]
-  end
-  ui y@==>|JMAP|groupware
-  y@{ animate: true }
-  ui-->|Graph|drive
-  muas-->|IMAP,SMTP,*DAV|stalwart
-  groupware-->drive
-  groupware-->|JMAP|stalwart
-  drive-->drive_storage
-  stalwart-->stalwart_metadata
-  stalwart-->stalwart_storage
-```
-
-#### Decision Drivers
-
-* UI Driven
-  * the UI team did not express any particular preference for this option, but the JMAP protocol is simple to implement on any client
-* Economic Awareness
-  * there would be less of a need to develop an API, but that doesn't put much into the balance
-  * developing a generic inbound JMAP command processing engine that is capable of resolving backreferences with requests that can be sent out to different backends (Stalwart, Drive, Groupware, OpenTalk, ...) seems risky in terms of complexity, also since Go doesn't have much of a [well-supported Reactive framework](https://github.com/ReactiveX/RxGo)
-* Efficiency
-  * the ability of the JMAP protocol to chain multiple low-level commands provides for a very efficient way to compose higher-level operations without the need for multiple round-trips
-* Third Party Consumption
-  * for some of the operations, we could point to the JMAP documentation and RFCs, although that would not make for a great experience either, we would probably need to replicate it
-  * our protocol extensions will have to be maintained just like the other options
-  * will be required to be maintained as a public API
-    * documentation
-    * LTS
-    * versioning
-
-### <a id="proscons-custom"/>Custom REST API
-
-A custom REST API would implement the resources and semantics as they are needed by the UI, and would be strongly if not fully UI-driven.
-
-The data model should remain close or equal to JMAP's, to avoid data loss by converting back and forth.
-
-We might look into existing specifications for formatting JSON payloads, such as [JSON:API](https://jsonapi.org/) or partial ones such as such as [JSON-LD](https://json-ld.org/) for relationships between resources, but this is currently outside of the scope of this ADR.
-
-```mermaid
-graph LR
-  subgraph clients
-    ui(OpenCloud UI)
-    muas(Other<br>MUAs)
-  end
-  subgraph Backend
-    subgraph OpenCloud
-      direction TB
-      groupware("OpenCloud<br>Groupware")
-      drive("OpenCloud<br>Drive")
-    end
-    stalwart(Stalwart)
-  end
-  subgraph Storage
-    drive_storage[(drive<br>storage)]
-    stalwart_metadata[(metadata<br>storage)]
-    stalwart_storage[(object<br>storage)]
-  end
-  ui y@==>|REST|groupware
-  y@{ animate: true }
-  ui-->|Graph|drive
-  muas-->|IMAP,SMTP,*DAV|stalwart
-  groupware-->drive
-  groupware-->|JMAP|stalwart
-  drive-->drive_storage
-  stalwart-->stalwart_metadata
-  stalwart-->stalwart_storage
-```
-
-Example:
-
-```text
-GET /groupware/startup/1/?mails=50
-```
-
-#### Good
-
-* completely tailored to the needs of the OpenCloud UI
-* a higher-level API allows for easily understanding the semantic of each operation, which enables the potential for keeping track of data in order to implement reverse indexes and caching, if necessary to achieve functional or performance goals, as opposed to using a lower-level API such as JMAP which is maximally flexible and difficult to reverse-engineer the meaning of the operation and data
-* can also be tailored to the capabilities of JMAP without exposing all of its flexibility
-* provides the potential for expanding upon what JMAP provides
-* would support the full potential of JMAP and Stalwart since the API would be designed accordingly
-* allows learning how to use and cache individual JMAP method call responses, allowing to make a better decision in the future if JMAP should be used by clients
-
-#### Neutral
-
-* if there is a requirement for considering that API as a public API for third party integrators, then the API also needs to be documented, maintained, versioned, and kept stable as much as possible (this is neutral because it is a requirement that exists with every option)
-
-#### Bad
-
-* only partially follows any standards (REST, JSON, JMAP for data models)
-* requires designing the API from scratch, as opposed to using the Graph API which already prescribes one
-  * although it probably makes sense to re-use the data model of JMAP, which is prescribed in RFCs, also to avoid data loss and copying things around needlessly
-* since the OpenCloud Drive backends use the LibreGraph API, using a custom REST API for Groupware bears the risk of having multiple APIs to do the same thing, which we need to be careful about, and avoid if possible
-
-#### Decision Drivers
-
-* UI Driven
-  * favoured solution for the OpenCloud Web UI team
-* Economic Awareness
-  * designing a new custom API is not much effort since it is UI requirements driven
-  * maintaining a new custom API or JMAP extensions is not more effort either, since the exact same thing needs to be done with LibreGraph, as it will have numerous exceptions and will require documenting those, as well as which parts of the Microsoft Graph API are implemented and which aren't
-* Efficiency
-  * the most efficient approach since it is tailored to what is actually needed for the OpenCloud UI, which will allow us to reduce the roundtrips to a minimum
-* Third Party Consumption
-  * a custom API will be required to be maintained as a public API
-    * documentation
-    * LTS
-    * versioning
@@ -1,52 +0,0 @@
---
-status: proposed
-date: 2025-07-07
-author: Pascal Bleser <p.bleser@opencloud.eu>
-decision-makers:
-consulted:
-informed:
-title: "Groupware Configuration Settings"
-template: https://raw.githubusercontent.com/adr/madr/refs/tags/4.0.0/template/adr-template.md
---
-
-* Status: draft
-
-## Context
-
-User Preferences need to be configurable through the UI and persisted in a backend service in order to be reliably available and backed up.
-
-Such configuration options have default values that need to be set on multiple levels:
-
-* globally
-* by tenant
-* by sub-tenant
-* by group of users
-* by user
-
-Some options might even be client-specific, e.g. differ between the OpenCloud Web UI on desktop and the OpenCloud Web UI on mobile.
-
-Furthermore, some options might be enforced and may not be overridden on every level (e.g. only globally or by tenant, by not modifiable by users.)
-
-Ideally, the configuration settings have an architecture that permits pluggable sources.
-
-This level of necessary complexity has a few drawbacks, the primary one being that it can become difficult to find out why a user sees this or that behavior in their UI, and thus to trace down where a given configuration setting is made (globally, on tenant level, etc...). It is thus critical to include tooling that allows to debug them.
-
-## Considered Options
-
-TODO
-
-## Decision Outcome
-
-TODO
-
-### Consequences
-
-TODO
-
-### Confirmation
-
-TODO
-
-## Pros and Cons of the Options
-
-TODO
@@ -1,6 +1,6 @@
 module github.com/opencloud-eu/opencloud

-go 1.25.8
+go 1.25.0

 require (
 	dario.cat/mergo v1.0.2
@@ -9,24 +9,21 @@ require (
 	github.com/Masterminds/semver v1.5.0
 	github.com/MicahParks/keyfunc/v2 v2.1.0
 	github.com/Nerzal/gocloak/v13 v13.9.0
-	github.com/ProtonMail/go-crypto v1.1.6
 	github.com/bbalet/stopwords v1.0.0
 	github.com/beevik/etree v1.6.0
-	github.com/blevesearch/bleve/v2 v2.6.0
-	github.com/brianvoe/gofakeit/v7 v7.7.3
+	github.com/blevesearch/bleve/v2 v2.5.5
 	github.com/cenkalti/backoff v2.2.1+incompatible
-	github.com/coreos/go-oidc/v3 v3.19.0
-	github.com/cs3org/go-cs3apis v0.0.0-20260424072047-8d9ef7076ae9
-	github.com/davidbyttow/govips/v2 v2.18.0
+	github.com/coreos/go-oidc/v3 v3.17.0
+	github.com/cs3org/go-cs3apis v0.0.0-20250908152307-4ca807afe54e
+	github.com/davidbyttow/govips/v2 v2.16.0
 	github.com/dhowden/tag v0.0.0-20240417053706-3d75831295e8
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
-	github.com/emersion/go-imap/v2 v2.0.0-beta.5
-	github.com/gabriel-vasile/mimetype v1.4.13
+	github.com/gabriel-vasile/mimetype v1.4.11
 	github.com/ggwhite/go-masker v1.1.0
-	github.com/go-chi/chi/v5 v5.3.1
+	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/render v1.0.3
-	github.com/go-jose/go-jose/v3 v3.0.5
-	github.com/go-ldap/ldap/v3 v3.4.13
+	github.com/go-jose/go-jose/v3 v3.0.4
+	github.com/go-ldap/ldap/v3 v3.4.12
 	github.com/go-ldap/ldif v0.0.0-20200320164324-fd88d9b715b3
 	github.com/go-micro/plugins/v4/client/grpc v1.2.1
 	github.com/go-micro/plugins/v4/logger/zerolog v1.2.0
@@ -36,96 +33,85 @@ require (
 	github.com/go-micro/plugins/v4/store/nats-js-kv v0.0.0-20240726082623-6831adfdcdc4
 	github.com/go-micro/plugins/v4/wrapper/monitoring/prometheus v1.2.0
 	github.com/go-micro/plugins/v4/wrapper/trace/opentelemetry v1.2.0
-	github.com/go-playground/validator/v10 v10.30.3
-	github.com/go-resty/resty/v2 v2.17.2
-	github.com/go-viper/mapstructure/v2 v2.5.0
-	github.com/golang-jwt/jwt/v5 v5.3.1
+	github.com/go-playground/validator/v10 v10.28.0
+	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/golang/protobuf v1.5.4
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-tika v0.3.1
 	github.com/google/uuid v1.6.0
-	github.com/gookit/config/v2 v2.2.9
+	github.com/gookit/config/v2 v2.2.7
 	github.com/gorilla/mux v1.8.1
-	github.com/gorilla/websocket v1.5.3
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3
 	github.com/invopop/validation v0.8.0
 	github.com/jellydator/ttlcache/v2 v2.11.1
-	github.com/jellydator/ttlcache/v3 v3.4.1
-	github.com/jhillyerd/enmime/v2 v2.2.0
+	github.com/jellydator/ttlcache/v3 v3.4.0
 	github.com/jinzhu/now v1.1.5
 	github.com/justinas/alice v1.2.0
-	github.com/kovidgoyal/imaging v1.8.22
-	github.com/leonelquinteros/gotext v1.7.3-0.20260422134830-b012b4ccae69
+	github.com/kovidgoyal/imaging v1.8.17
+	github.com/leonelquinteros/gotext v1.7.2
 	github.com/libregraph/idm v0.5.0
-	github.com/libregraph/lico v0.67.0
-	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/miekg/dns v1.1.68
+	github.com/libregraph/lico v0.66.0
+	github.com/mitchellh/mapstructure v1.5.0
 	github.com/mna/pigeon v1.3.0
-	github.com/moby/moby/api v1.54.2
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
-	github.com/nats-io/nats-server/v2 v2.14.3
-	github.com/nats-io/nats.go v1.52.0
+	github.com/nats-io/nats-server/v2 v2.12.6
+	github.com/nats-io/nats.go v1.49.0
 	github.com/oklog/run v1.2.0
-	github.com/olekukonko/tablewriter v1.1.4
+	github.com/olekukonko/tablewriter v1.1.1
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/ginkgo/v2 v2.32.0
-	github.com/onsi/gomega v1.42.1
-	github.com/open-policy-agent/opa v1.18.2
+	github.com/onsi/ginkgo/v2 v2.27.2
+	github.com/onsi/gomega v1.38.2
+	github.com/open-policy-agent/opa v1.10.1
 	github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89
-	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d
-	github.com/opencloud-eu/reva/v2 v2.46.4-0.20260625152426-8cff2a7032ec
-	github.com/opensearch-project/opensearch-go/v4 v4.6.0
+	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20250724122329-41ba6b191e76
+	github.com/opencloud-eu/reva/v2 v2.40.4
+	github.com/opensearch-project/opensearch-go/v4 v4.5.0
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/xattr v0.4.12
 	github.com/prometheus/client_golang v1.23.2
 	github.com/r3labs/sse/v2 v2.10.0
-	github.com/riandyrn/otelchi v0.12.3
-	github.com/rogpeppe/go-internal v1.15.0
+	github.com/riandyrn/otelchi v0.12.2
+	github.com/rogpeppe/go-internal v1.14.1
 	github.com/rs/cors v1.11.1
-	github.com/rs/zerolog v1.35.1
-	github.com/sethvargo/go-password v0.3.1
-	github.com/sirupsen/logrus v1.9.4
+	github.com/rs/zerolog v1.34.0
+	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af
 	github.com/spf13/afero v1.15.0
-	github.com/spf13/cobra v1.10.2
-	github.com/spf13/pflag v1.0.10
-	github.com/spf13/viper v1.21.0
+	github.com/spf13/cobra v1.10.1
 	github.com/stretchr/testify v1.11.1
 	github.com/test-go/testify v1.1.4
-	github.com/testcontainers/testcontainers-go v0.43.0
-	github.com/testcontainers/testcontainers-go/modules/opensearch v0.43.0
+	github.com/testcontainers/testcontainers-go v0.39.0
+	github.com/testcontainers/testcontainers-go/modules/opensearch v0.39.0
 	github.com/theckman/yacspin v0.13.12
 	github.com/thejerf/suture/v4 v4.0.6
-	github.com/tidwall/gjson v1.19.0
-	github.com/tidwall/pretty v1.2.1
+	github.com/tidwall/gjson v1.18.0
 	github.com/tidwall/sjson v1.2.5
-	github.com/tus/tusd/v2 v2.10.0
+	github.com/tus/tusd/v2 v2.8.0
 	github.com/unrolled/secure v1.16.0
+	github.com/urfave/cli/v2 v2.27.7
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wk8/go-ordered-map v1.0.0
 	github.com/xhit/go-simple-mail/v2 v2.16.0
 	go-micro.dev/v4 v4.11.0
-	go.etcd.io/bbolt v1.5.0
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0
-	go.opentelemetry.io/contrib/zpages v0.69.0
-	go.opentelemetry.io/otel v1.44.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0
-	go.opentelemetry.io/otel/sdk v1.44.0
-	go.opentelemetry.io/otel/trace v1.44.0
-	golang.org/x/crypto v0.53.0
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
-	golang.org/x/image v0.43.0
-	golang.org/x/net v0.56.0
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.21.0
-	golang.org/x/term v0.44.0
-	golang.org/x/text v0.39.0
-	golang.org/x/tools v0.47.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa
-	google.golang.org/grpc v1.82.0
-	google.golang.org/protobuf v1.36.11
+	go.etcd.io/bbolt v1.4.3
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0
+	go.opentelemetry.io/contrib/zpages v0.63.0
+	go.opentelemetry.io/otel v1.38.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.38.0
+	go.opentelemetry.io/otel/sdk v1.38.0
+	go.opentelemetry.io/otel/trace v1.38.0
+	golang.org/x/crypto v0.49.0
+	golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac
+	golang.org/x/image v0.33.0
+	golang.org/x/net v0.51.0
+	golang.org/x/oauth2 v0.33.0
+	golang.org/x/sync v0.20.0
+	golang.org/x/term v0.41.0
+	golang.org/x/text v0.35.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8
+	google.golang.org/grpc v1.77.0
+	google.golang.org/protobuf v1.36.10
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
@@ -134,97 +120,95 @@ require (

 require (
 	contrib.go.opencensus.io/exporter/prometheus v0.4.2 // indirect
-	filippo.io/edwards25519 v1.2.0 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/Azure/go-ntlmssp v0.1.1 // indirect
-	github.com/BurntSushi/toml v1.6.0 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/RoaringBitmap/roaring/v2 v2.14.5 // indirect
+	github.com/ProtonMail/go-crypto v1.1.5 // indirect
+	github.com/RoaringBitmap/roaring/v2 v2.4.5 // indirect
 	github.com/agnivade/levenshtein v1.2.1 // indirect
 	github.com/ajg/form v1.5.1 // indirect
 	github.com/alexedwards/argon2id v1.0.0 // indirect
 	github.com/amoghe/go-crypt v0.0.0-20220222110647-20eada5f5964 // indirect
-	github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect
+	github.com/antithesishq/antithesis-sdk-go v0.6.0-default-no-op // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bitly/go-simplejson v0.5.0 // indirect
-	github.com/bits-and-blooms/bitset v1.24.2 // indirect
-	github.com/blevesearch/bleve_index_api v1.3.11 // indirect
-	github.com/blevesearch/geo v0.2.5 // indirect
-	github.com/blevesearch/go-faiss v1.1.0 // indirect
+	github.com/bits-and-blooms/bitset v1.22.0 // indirect
+	github.com/blevesearch/bleve_index_api v1.2.11 // indirect
+	github.com/blevesearch/geo v0.2.4 // indirect
+	github.com/blevesearch/go-faiss v1.0.26 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
-	github.com/blevesearch/mmap-go v1.2.0 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.4.7 // indirect
+	github.com/blevesearch/mmap-go v1.0.4 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.3.13 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
-	github.com/blevesearch/vellum v1.2.0 // indirect
-	github.com/blevesearch/zapx/v11 v11.4.3 // indirect
-	github.com/blevesearch/zapx/v12 v12.4.3 // indirect
-	github.com/blevesearch/zapx/v13 v13.4.3 // indirect
-	github.com/blevesearch/zapx/v14 v14.4.3 // indirect
-	github.com/blevesearch/zapx/v15 v15.4.3 // indirect
-	github.com/blevesearch/zapx/v16 v16.3.4 // indirect
-	github.com/blevesearch/zapx/v17 v17.1.2 // indirect
+	github.com/blevesearch/vellum v1.1.0 // indirect
+	github.com/blevesearch/zapx/v11 v11.4.2 // indirect
+	github.com/blevesearch/zapx/v12 v12.4.2 // indirect
+	github.com/blevesearch/zapx/v13 v13.4.2 // indirect
+	github.com/blevesearch/zapx/v14 v14.4.2 // indirect
+	github.com/blevesearch/zapx/v15 v15.4.2 // indirect
+	github.com/blevesearch/zapx/v16 v16.2.7 // indirect
 	github.com/bluele/gcache v0.0.2 // indirect
 	github.com/bombsimon/logrusr/v3 v3.1.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a // indirect
-	github.com/ceph/go-ceph v0.40.0 // indirect
+	github.com/ceph/go-ceph v0.36.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cevaris/ordered_map v0.0.0-20190319150403-3adeae072e73 // indirect
-	github.com/clipperhouse/displaywidth v0.10.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.6.0 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/clipperhouse/displaywidth v0.3.1 // indirect
+	github.com/clipperhouse/stringish v0.1.1 // indirect
+	github.com/clipperhouse/uax29/v2 v2.2.0 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v1.0.0-rc.2 // indirect
+	github.com/containerd/platforms v1.0.0-rc.1 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
-	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
+	github.com/coreos/go-systemd/v22 v22.6.0 // indirect
 	github.com/cornelk/hashmap v1.0.8 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/crewjam/httperr v0.2.0 // indirect
 	github.com/crewjam/saml v0.4.14 // indirect
-	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.3.6 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/deckarep/golang-set v1.8.0 // indirect
-	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
 	github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
 	github.com/dgraph-io/ristretto v0.2.0 // indirect
 	github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/dlclark/regexp2 v1.4.0 // indirect
+	github.com/docker/docker v28.3.3+incompatible // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ebitengine/purego v0.10.0 // indirect
+	github.com/ebitengine/purego v0.8.4 // indirect
 	github.com/egirna/icap v0.0.0-20181108071049-d5ee18bd70bc // indirect
-	github.com/emersion/go-message v0.18.1 // indirect
-	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/emvi/iso-639-1 v1.1.1 // indirect
 	github.com/evanphx/json-patch/v5 v5.5.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/gdexlab/go-render v1.0.1 // indirect
 	github.com/go-acme/lego/v4 v4.4.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.9.0 // indirect
-	github.com/go-git/go-git/v5 v5.19.1 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-git/go-git/v5 v5.13.2 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -236,56 +220,59 @@ require (
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-redis/redis/v8 v8.11.5 // indirect
-	github.com/go-sql-driver/mysql v1.10.0 // indirect
+	github.com/go-resty/resty/v2 v2.7.0 // indirect
+	github.com/go-sql-driver/mysql v1.9.3 // indirect
 	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
+	github.com/go-test/deep v1.1.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
 	github.com/gobwas/ws v1.2.1 // indirect
-	github.com/goccy/go-json v0.10.6 // indirect
-	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/gofrs/flock v0.13.0 // indirect
+	github.com/gofrs/uuid v4.4.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
-	github.com/golang/snappy v1.0.0 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/gomodule/redigo v1.9.3 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
-	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
-	github.com/google/renameio/v2 v2.0.2 // indirect
-	github.com/gookit/goutil v0.8.0 // indirect
-	github.com/gorilla/css v1.0.1 // indirect
+	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
+	github.com/google/renameio/v2 v2.0.1 // indirect
+	github.com/gookit/goutil v0.7.1 // indirect
 	github.com/gorilla/handlers v1.5.1 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
-	github.com/hashicorp/go-plugin v1.8.0 // indirect
+	github.com/hashicorp/go-plugin v1.7.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/iancoleman/strcase v0.3.0 // indirect
 	github.com/imdario/mergo v0.3.15 // indirect
-	github.com/inbucket/html2text v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/juliangruber/go-intersect v1.1.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/kovidgoyal/go-parallel v1.1.1 // indirect
 	github.com/kovidgoyal/go-shm v1.0.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
-	github.com/lestrrat-go/dsig v1.2.1 // indirect
+	github.com/lestrrat-go/dsig v1.0.0 // indirect
 	github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
-	github.com/lestrrat-go/httprc/v3 v3.0.5 // indirect
-	github.com/lestrrat-go/jwx/v3 v3.1.1 // indirect
+	github.com/lestrrat-go/httprc/v3 v3.0.1 // indirect
+	github.com/lestrrat-go/jwx/v3 v3.0.11 // indirect
+	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
 	github.com/libregraph/oidc-go v1.1.0 // indirect
 	github.com/longsleep/go-metrics v1.0.0 // indirect
@@ -296,116 +283,114 @@ require (
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.19 // indirect
-	github.com/mattn/go-sqlite3 v1.14.42 // indirect
+	github.com/mattn/go-sqlite3 v1.14.32 // indirect
 	github.com/maxymania/go-system v0.0.0-20170110133659-647cc364bf0b // indirect
 	github.com/mendsley/gojwk v0.0.0-20141217222730-4d5ec6e58103 // indirect
+	github.com/miekg/dns v1.1.57 // indirect
 	github.com/mileusna/useragent v1.3.5 // indirect
-	github.com/minio/crc64nvme v1.1.1 // indirect
-	github.com/minio/highwayhash v1.0.4 // indirect
+	github.com/minio/crc64nvme v1.1.0 // indirect
+	github.com/minio/highwayhash v1.0.4-0.20251030100505-070ab1a87a76 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
-	github.com/minio/minio-go/v7 v7.1.0 // indirect
+	github.com/minio/minio-go/v7 v7.0.97 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.2.0 // indirect
-	github.com/moby/moby/client v0.4.0 // indirect
-	github.com/moby/patternmatcher v0.6.1 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
-	github.com/moby/term v0.5.2 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nats-io/jwt/v2 v2.8.2 // indirect
-	github.com/nats-io/nkeys v0.4.16 // indirect
+	github.com/nats-io/jwt/v2 v2.8.1 // indirect
+	github.com/nats-io/nkeys v0.4.15 // indirect
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/nxadm/tail v1.4.8 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
-	github.com/olekukonko/errors v1.2.0 // indirect
-	github.com/olekukonko/ll v0.1.6 // indirect
+	github.com/olekukonko/errors v1.1.0 // indirect
+	github.com/olekukonko/ll v0.1.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c // indirect
-	github.com/pablodz/inotifywaitgo v0.0.12 // indirect
+	github.com/pablodz/inotifywaitgo v0.0.9 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
-	github.com/pjbgf/sha1cd v0.6.0 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/pquerna/cachecontrol v0.2.0 // indirect
-	github.com/prometheus/alertmanager v0.31.1 // indirect
+	github.com/prometheus/alertmanager v0.29.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/common v0.67.1 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
 	github.com/prometheus/statsd_exporter v0.22.8 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russellhaering/goxmldsig v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd // indirect
-	github.com/sagikazarmark/locafero v0.11.0 // indirect
-	github.com/samber/lo v1.53.0 // indirect
-	github.com/samber/slog-common v0.21.0 // indirect
-	github.com/samber/slog-zerolog/v2 v2.9.2 // indirect
-	github.com/segmentio/asm v1.2.1 // indirect
-	github.com/segmentio/kafka-go v0.4.50 // indirect
+	github.com/samber/lo v1.51.0 // indirect
+	github.com/samber/slog-common v0.19.0 // indirect
+	github.com/samber/slog-zerolog/v2 v2.9.0 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
+	github.com/segmentio/kafka-go v0.4.49 // indirect
 	github.com/segmentio/ksuid v1.0.4 // indirect
 	github.com/sercand/kuberesolver/v5 v5.1.1 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/sethvargo/go-diceware v0.5.0 // indirect
-	github.com/shamaton/msgpack/v2 v2.4.1 // indirect
-	github.com/shirou/gopsutil/v4 v4.26.5 // indirect
+	github.com/sethvargo/go-password v0.3.1 // indirect
+	github.com/shamaton/msgpack/v2 v2.4.0 // indirect
+	github.com/shirou/gopsutil/v4 v4.25.6 // indirect
 	github.com/shurcooL/httpfs v0.0.0-20230704072500-f1e31cf0ba5c // indirect
 	github.com/shurcooL/vfsgen v0.0.0-20230704071429-0000e147ea92 // indirect
-	github.com/skeema/knownhosts v1.3.1 // indirect
-	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/skeema/knownhosts v1.3.0 // indirect
 	github.com/spacewander/go-suffix-tree v0.0.0-20191010040751-0865e368c784 // indirect
-	github.com/spf13/cast v1.10.0 // indirect
-	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
-	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/studio-b12/gowebdav v0.9.0 // indirect
-	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/tchap/go-patricia/v2 v2.3.3 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
-	github.com/tinylib/msgp v1.6.1 // indirect
-	github.com/tklauser/go-sysconf v0.3.16 // indirect
-	github.com/tklauser/numcpus v0.11.0 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tinylib/msgp v1.3.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.14 // indirect
+	github.com/tklauser/numcpus v0.8.0 // indirect
 	github.com/toorop/go-dkim v0.0.0-20201103131630-e1cd1a0a5208 // indirect
 	github.com/trustelem/zxcvbn v1.0.1 // indirect
-	github.com/urfave/cli/v2 v2.27.7 // indirect
-	github.com/valyala/fastjson v1.6.10 // indirect
-	github.com/vektah/gqlparser/v2 v2.5.34 // indirect
+	github.com/valyala/fastjson v1.6.4 // indirect
+	github.com/vektah/gqlparser/v2 v2.5.30 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
+	github.com/wk8/go-ordered-map v1.0.0 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	github.com/zeebo/xxh3 v1.1.0 // indirect
-	go.etcd.io/etcd/api/v3 v3.6.11 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.6.11 // indirect
-	go.etcd.io/etcd/client/v3 v3.6.11 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.6 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.6.6 // indirect
+	go.etcd.io/etcd/client/v3 v3.6.6 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
-	go.opentelemetry.io/otel/metric v1.44.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	golang.org/x/tools v0.42.0 // indirect
+	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect
 	gopkg.in/cenkalti/backoff.v1 v1.1.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
@@ -414,7 +399,7 @@ require (

 replace github.com/studio-b12/gowebdav => github.com/kobergj/gowebdav v0.0.0-20250102091030-aa65266db202

-replace github.com/unrolled/secure => github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4
+replace github.com/unrolled/secure => github.com/DeepDiver1975/secure v0.0.0-20240611112133-abc838fb797c

 replace go-micro.dev/v4 => github.com/butonic/go-micro/v4 v4.11.1-0.20241115112658-b5d4de5ed9b3

@@ -423,3 +408,6 @@ replace go-micro.dev/v4 => github.com/butonic/go-micro/v4 v4.11.1-0.202411151126
 exclude github.com/mattn/go-sqlite3 v2.0.3+incompatible

 replace github.com/go-micro/plugins/v4/store/nats-js-kv => github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a
+
+// to get the logger injection (https://github.com/pablodz/inotifywaitgo/pull/11)
+replace github.com/pablodz/inotifywaitgo v0.0.9 => github.com/opencloud-eu/inotifywaitgo v0.0.0-20251111171128-a390bae3c5e9
@@ -17,10 +17,7 @@ include ../.make/docs.mk

 .PHONY: dev-docker
 dev-docker:
-	docker build -f docker/Dockerfile.multiarch -t opencloudeu/opencloud:dev ..
-
-dev-docker-with-workspace:
-	docker build -f docker/Dockerfile.multiarch -t opencloudeu/opencloud:dev --build-arg SRCDIR=opencloud ../..
+	docker build -f docker/Dockerfile.multiarch -t opencloudeu/opencloud:dev ../..

 .PHONY: dev-docker-multiarch
 dev-docker-multiarch:
@@ -31,7 +28,7 @@ dev-docker-multiarch:
 	docker buildx rm opencloudbuilder || true
 	docker buildx create --platform linux/arm64,linux/amd64 --name opencloudbuilder
 	docker buildx use opencloudbuilder
-	docker buildx build --platform linux/arm64,linux/amd64 --output type=docker --file docker/Dockerfile.multiarch --tag opencloudeu/opencloud:dev-multiarch ..
+	docker buildx build --platform linux/arm64,linux/amd64 --output type=docker --file docker/Dockerfile.multiarch --tag opencloudeu/opencloud:dev-multiarch ../..
 	docker buildx rm opencloudbuilder

 .PHONY: debug-docker
@@ -1 +0,0 @@
-/__debug_bin*
@@ -1,28 +1,27 @@
-FROM quay.io/opencloudeu/golang-ci:1.25 AS build
+FROM golang:alpine3.22 AS build
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION
 ARG STRING
-ARG EDITION="dev"
-ARG SRCDIR
+ARG EDITION
+
+RUN apk add bash make git curl gcc musl-dev libc-dev binutils-gold inotify-tools vips-dev

 WORKDIR /build
 RUN --mount=type=bind,target=/build,rw \
    --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache \
    GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH:-amd64}" ; \
-    make -C ${SRCDIR:-.}/opencloud release-linux-docker-${TARGETARCH} ENABLE_VIPS=true DIST=/dist
+    make -C opencloud/opencloud release-linux-docker-${TARGETARCH} ENABLE_VIPS=true DIST=/dist

-FROM alpine:3.24
+FROM alpine:3.22
 ARG VERSION
 ARG REVISION
 ARG TARGETOS
 ARG TARGETARCH

-RUN apk add --no-cache attr bash ca-certificates curl imagemagick \
-                       inotify-tools libc6-compat mailcap tree vips \
-		       vips-magick patch && \
-    echo 'hosts: files dns' >| /etc/nsswitch.conf
+RUN apk add --no-cache attr bash ca-certificates curl inotify-tools libc6-compat mailcap tree vips patch && \
+	echo 'hosts: files dns' >| /etc/nsswitch.conf

 LABEL maintainer="openCloud GmbH <devops@opencloud.eu>" \
  org.opencontainers.image.title="OpenCloud" \
@@ -75,7 +75,7 @@ func CheckProviderConsistency(storagepath string, lbs ListBlobstore, fail bool)
 }

 // GatherData gathers and evaluates data produced by the DataProvider
-func (c *Consistency) GatherData(events <-chan any) {
+func (c *Consistency) GatherData(events <-chan interface{}) {
 	for ev := range events {
 		switch d := ev.(type) {
 		case NodeData:
@@ -10,12 +10,12 @@ import (
 func TestGatherData(t *testing.T) {
 	testcases := []struct {
 		Name     string
-		Events   []any
+		Events   []interface{}
 		Expected *backup.Consistency
 	}{
 		{
 			Name: "no symlinks - no blobs",
-			Events: []any{
+			Events: []interface{}{
 				nodeData("nodepath", "blobpath", true),
 			},
 			Expected: consistency(func(c *backup.Consistency) {
@@ -25,7 +25,7 @@ func TestGatherData(t *testing.T) {
 		},
 		{
 			Name: "symlink not required - no blobs",
-			Events: []any{
+			Events: []interface{}{
 				nodeData("nodepath", "blobpath", false),
 			},
 			Expected: consistency(func(c *backup.Consistency) {
@@ -34,7 +34,7 @@ func TestGatherData(t *testing.T) {
 		},
 		{
 			Name: "no inconsistencies",
-			Events: []any{
+			Events: []interface{}{
 				nodeData("nodepath", "blobpath", true),
 				linkData("linkpath", "nodepath"),
 				blobData("blobpath"),
@@ -44,7 +44,7 @@ func TestGatherData(t *testing.T) {
 		},
 		{
 			Name: "orphaned blob",
-			Events: []any{
+			Events: []interface{}{
 				nodeData("nodepath", "blobpath", true),
 				linkData("linkpath", "nodepath"),
 				blobData("blobpath"),
@@ -56,7 +56,7 @@ func TestGatherData(t *testing.T) {
 		},
 		{
 			Name: "missing node",
-			Events: []any{
+			Events: []interface{}{
 				linkData("linkpath", "nodepath"),
 				blobData("blobpath"),
 			},
@@ -67,7 +67,7 @@ func TestGatherData(t *testing.T) {
 		},
 		{
 			Name: "corrupt metadata",
-			Events: []any{
+			Events: []interface{}{
 				nodeData("nodepath", "blobpath", true, backup.InconsistencyMetadataMissing),
 				linkData("linkpath", "nodepath"),
 				blobData("blobpath"),
@@ -78,7 +78,7 @@ func TestGatherData(t *testing.T) {
 		},
 		{
 			Name: "corrupt metadata, no blob",
-			Events: []any{
+			Events: []interface{}{
 				nodeData("nodepath", "blobpath", true, backup.InconsistencyMetadataMissing),
 				linkData("linkpath", "nodepath"),
 			},
@@ -90,7 +90,7 @@ func TestGatherData(t *testing.T) {
 	}

 	for _, tc := range testcases {
-		events := make(chan any)
+		events := make(chan interface{})

 		go func() {
 			for _, ev := range tc.Events {
@@ -21,7 +21,7 @@ type ListBlobstore interface {

 // DataProvider provides data for the consistency check
 type DataProvider struct {
-	Events chan any
+	Events chan interface{}

 	fsys      fs.FS
 	discpath  string
@@ -51,7 +51,7 @@ type BlobData struct {
 // NewProvider creates a new DataProvider object
 func NewProvider(fsys fs.FS, discpath string, lbs ListBlobstore) *DataProvider {
 	return &DataProvider{
-		Events: make(chan any),
+		Events: make(chan interface{}),

 		fsys:      fsys,
 		discpath:  discpath,
@@ -75,20 +75,25 @@ func (dp *DataProvider) ProduceData() error {
 	wg := sync.WaitGroup{}

 	// crawl spaces
-	wg.Go(func() {
+	wg.Add(1)
+	go func() {
 		for _, d := range dirs {
 			dp.evaluateNodeDir(d)
 		}
-	})
+		wg.Done()
+	}()

 	// crawl trash
-	wg.Go(func() {
+	wg.Add(1)
+	go func() {
 		dp.evaluateTrashDir()
-	})
+		wg.Done()
+	}()

 	// crawl blobstore
 	if !dp.skipBlobs {
-		wg.Go(func() {
+		wg.Add(1)
+		go func() {
 			bs, err := dp.lbs.List()
 			if err != nil {
 				fmt.Println("error listing blobs", err)
@@ -97,7 +102,8 @@ func (dp *DataProvider) ProduceData() error {
 			for _, bn := range bs {
 				dp.Events <- BlobData{BlobPath: dp.lbs.Path(bn)}
 			}
-		})
+			wg.Done()
+		}()
 	}

 	// wait for all crawlers to finish
@@ -4,8 +4,6 @@ import (
 	"errors"
 	"fmt"

-	"github.com/spf13/cobra"
-
 	"github.com/opencloud-eu/opencloud/opencloud/pkg/backup"
 	"github.com/opencloud-eu/opencloud/opencloud/pkg/register"
 	"github.com/opencloud-eu/opencloud/pkg/config"
@@ -13,34 +11,62 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/config/parser"
 	decomposedbs "github.com/opencloud-eu/reva/v2/pkg/storage/fs/decomposed/blobstore"
 	decomposeds3bs "github.com/opencloud-eu/reva/v2/pkg/storage/fs/decomposeds3/blobstore"
+	"github.com/urfave/cli/v2"
 )

 // BackupCommand is the entrypoint for the backup command
-func BackupCommand(cfg *config.Config) *cobra.Command {
-	bckCmd := &cobra.Command{
-		Use:   "backup",
-		Short: "OpenCloud backup functionality",
-		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+func BackupCommand(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "backup",
+		Usage: "OpenCloud backup functionality",
+		Subcommands: []*cli.Command{
+			ConsistencyCommand(cfg),
+		},
+		Before: func(c *cli.Context) error {
 			return configlog.ReturnError(parser.ParseConfig(cfg, true))
 		},
+		Action: func(_ *cli.Context) error {
+			fmt.Println("Read the docs")
+			return nil
+		},
 	}
-	bckCmd.AddCommand(ConsistencyCommand(cfg))
-	return bckCmd
 }

 // ConsistencyCommand is the entrypoint for the consistency Command
-func ConsistencyCommand(cfg *config.Config) *cobra.Command {
-	consCmd := &cobra.Command{
-		Use:   "consistency",
-		Short: "check backup consistency",
-		RunE: func(cmd *cobra.Command, args []string) error {
+func ConsistencyCommand(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "consistency",
+		Usage: "check backup consistency",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "basepath",
+				Aliases:  []string{"p"},
+				Usage:    "the basepath of the decomposedfs (e.g. /var/tmp/opencloud/storage/users)",
+				Required: true,
+			},
+			&cli.StringFlag{
+				Name:    "blobstore",
+				Aliases: []string{"b"},
+				Usage:   "the blobstore type. Can be (none, decomposed, decomposeds3). Default decomposed",
+				Value:   "decomposed",
+			},
+			&cli.BoolFlag{
+				Name:  "fail",
+				Usage: "exit with non-zero status if consistency check fails",
+			},
+		},
+		Action: func(c *cli.Context) error {
+			basePath := c.String("basepath")
+			if basePath == "" {
+				fmt.Println("basepath is required")
+				return cli.ShowCommandHelp(c, "consistency")
+			}
+
 			var (
 				bs  backup.ListBlobstore
 				err error
 			)
-			basePath, _ := cmd.Flags().GetString("basepath")
-			blobstoreFlag, _ := cmd.Flags().GetString("blobstore")
-			switch blobstoreFlag {
+			switch c.String("blobstore") {
 			case "decomposeds3":
 				bs, err = decomposeds3bs.New(
 					cfg.StorageUsers.Drivers.DecomposedS3.Endpoint,
@@ -61,8 +87,7 @@ func ConsistencyCommand(cfg *config.Config) *cobra.Command {
 				fmt.Println(err)
 				return err
 			}
-			fail, _ := cmd.Flags().GetBool("fail")
-			if err := backup.CheckProviderConsistency(basePath, bs, fail); err != nil {
+			if err := backup.CheckProviderConsistency(basePath, bs, c.Bool("fail")); err != nil {
 				fmt.Println(err)
 				return err
 			}
@@ -70,11 +95,6 @@ func ConsistencyCommand(cfg *config.Config) *cobra.Command {
 			return nil
 		},
 	}
-	consCmd.Flags().StringP("basepath", "p", "", "the basepath of the decomposedfs (e.g. /var/tmp/opencloud/storage/users)")
-	_ = consCmd.MarkFlagRequired("basepath")
-	consCmd.Flags().StringP("blobstore", "b", "decomposed", "the blobstore type. Can be (none, decomposed, decomposeds3). Default decomposed")
-	consCmd.Flags().Bool("fail", false, "exit with non-zero status if consistency check fails")
-	return consCmd
 }

 func init() {
@@ -2,7 +2,6 @@ package command

 import (
 	"bytes"
-	"context"
 	"crypto/tls"
 	"encoding/base64"
 	"errors"
@@ -11,10 +10,8 @@ import (
 	"net/http"
 	"os"
 	"os/exec"
-	"os/signal"
 	"strconv"
 	"strings"
-	"syscall"
 	"time"

 	"github.com/olekukonko/tablewriter"
@@ -24,118 +21,105 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/version"
 	"github.com/pkg/xattr"
 	"github.com/rogpeppe/go-internal/lockedfile"
-	"github.com/spf13/cobra"
+	"github.com/urfave/cli/v2"
 )

 // BenchmarkCommand is the entrypoint for the benchmark commands.
-func BenchmarkCommand(cfg *config.Config) *cobra.Command {
-	benchCmd := &cobra.Command{
-		Use:   "benchmark",
-		Short: "cli tools to test low and high level performance",
+func BenchmarkCommand(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:        "benchmark",
+		Usage:       "cli tools to test low and high level performance",
+		Category:    "benchmark",
+		Subcommands: []*cli.Command{BenchmarkClientCommand(cfg), BenchmarkSyscallsCommand(cfg)},
 	}
-	benchCmd.AddCommand(BenchmarkClientCommand(cfg), BenchmarkSyscallsCommand(cfg))
-	return benchCmd
 }

 // BenchmarkClientCommand is the entrypoint for the benchmark client command.
-func BenchmarkClientCommand(cfg *config.Config) *cobra.Command {
-	benchClientCmd := &cobra.Command{
-		Use:   "client",
-		Short: "Start a client that continuously makes web requests and prints stats. The options mimic curl, but we default to PROPFIND requests.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			jobs, err := cmd.Flags().GetInt("jobs")
-			if err != nil {
-				return err
-			}
-			insecure, _ := cmd.Flags().GetBool("insecure")
+func BenchmarkClientCommand(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name: "client",
+
+		Usage: "Start a client that continuously makes web requests and prints stats. The options mimic curl, but URL must be at the end.",
+		Flags: []cli.Flag{
+
+			// TODO with v3 'flag.Persistent: true' can be set to make the order of flags no longer relevant \o/
+			// flags mimicing curl
+			&cli.StringFlag{
+				Name:    "request",
+				Aliases: []string{"X"},
+				Value:   "PROPFIND",
+				Usage:   "Specifies a custom request method to use when communicating with the HTTP server.",
+			},
+			&cli.StringFlag{
+				Name:    "user",
+				Aliases: []string{"u"},
+				Value:   "admin:admin",
+				Usage:   "Specify the user name and password to use for server authentication.",
+			},
+			&cli.BoolFlag{
+				Name:    "insecure",
+				Aliases: []string{"k"},
+				Usage:   "Skip the TLS verification step and proceed without checking.",
+			},
+			&cli.StringFlag{
+				Name:    "data",
+				Aliases: []string{"d"},
+				Usage:   "Sends the specified data in a request to the HTTP server.",
+				// TODE support multiple data flags, support data-binary, data-raw
+			},
+			&cli.StringSliceFlag{
+				Name:    "header",
+				Aliases: []string{"H"},
+				Usage:   "Extra header to include in information sent.",
+			},
+			&cli.StringFlag{
+				Name: "rate",
+				Usage: `Specify the maximum transfer frequency you allow a client to use - in number of transfer starts per time unit (sometimes called request rate).
+	The request rate is provided as "N/U" where N is an integer number and U is a time unit. Supported units are 's' (second), 'm' (minute), 'h' (hour) and 'd' /(day, as in a 24 hour unit). The default time unit, if no "/U" is provided, is number of transfers per hour.`,
+			},
+			/*
+				&cli.StringFlag{
+					Name:    "oauth2-bearer",
+					Usage:   "Specify the Bearer Token for OAUTH 2.0 server authentication.",
+				},
+				&cli.StringFlag{
+					Name:    "user-agent",
+					Aliases: []string{"A"},
+					Value:   "admin:admin",
+					Usage:   "Specify the User-Agent string to send to the HTTP	server.",
+				},
+			*/
+			// other flags
+			&cli.StringFlag{
+				Name:  "bearer-token-command",
+				Usage: "Command to execute for a bearer token, e.g. 'oidc-token opencloud'. When set, disables basic auth.",
+			},
+			&cli.IntFlag{
+				Name:  "every",
+				Usage: "Aggregate stats every time this amount of seconds has passed.",
+			},
+			&cli.IntFlag{
+				Name:    "jobs",
+				Aliases: []string{"j"},
+				Value:   1,
+				Usage:   "Number of parallel clients to start.",
+			},
+		},
+		Category: "benchmark",
+		Action: func(c *cli.Context) error {
 			opt := clientOptions{
-				url:      args[0],
-				insecure: insecure,
-				jobs:     jobs,
+				request:  c.String("request"),
+				url:      c.Args().First(),
+				insecure: c.Bool("insecure"),
+				jobs:     c.Int("jobs"),
 				headers:  make(map[string]string),
+				data:     []byte(c.String("data")),
 			}
-
-			if d, _ := cmd.Flags().GetString("data-raw"); d != "" {
-				opt.request = "POST"
-				opt.headers["Content-Type"] = "application/x-www-form-urlencoded"
-				opt.data = []byte(d)
-			}
-
-			if d, _ := cmd.Flags().GetString("data"); d != "" {
-				opt.request = "POST"
-				opt.headers["Content-Type"] = "application/x-www-form-urlencoded"
-				if strings.HasPrefix(d, "@") {
-					filePath := strings.TrimPrefix(d, "@")
-					var data []byte
-					var err error
-
-					// read from file or stdin and trim trailing newlines
-					if filePath == "-" {
-						data, err = os.ReadFile("/dev/stdin")
-					} else {
-						data, err = os.ReadFile(filePath)
-					}
-					if err != nil {
-						log.Fatal(errors.New("could not read data from file '" + filePath + "': " + err.Error()))
-					}
-
-					// clean byte array similar to curl's --data parameter
-					// It removes leading/trailing whitespace and converts line breaks to spaces
-
-					// Trim leading and trailing whitespace
-					data = bytes.TrimSpace(data)
-
-					// Replace newlines and carriage returns with spaces
-					data = bytes.ReplaceAll(data, []byte("\r\n"), []byte(" "))
-					data = bytes.ReplaceAll(data, []byte("\n"), []byte(" "))
-					data = bytes.ReplaceAll(data, []byte("\r"), []byte(" "))
-
-					// Replace multiple spaces with single space
-					for bytes.Contains(data, []byte("  ")) {
-						data = bytes.ReplaceAll(data, []byte("  "), []byte(" "))
-					}
-
-					opt.data = data
-				} else {
-					opt.data = []byte(d)
-				}
-			}
-
-			if d, _ := cmd.Flags().GetString("data-binary"); d != "" {
-				opt.request = "POST"
-				opt.headers["Content-Type"] = "application/x-www-form-urlencoded"
-				if strings.HasPrefix(d, "@") {
-					filePath := strings.TrimPrefix(d, "@")
-					var data []byte
-					var err error
-					if filePath == "-" {
-						data, err = os.ReadFile("/dev/stdin")
-					} else {
-						data, err = os.ReadFile(filePath)
-					}
-					if err != nil {
-						log.Fatal(errors.New("could not read data from file '" + filePath + "': " + err.Error()))
-					}
-					opt.data = data
-				} else {
-					opt.data = []byte(d)
-				}
-			}
-
-			// override method if specified
-			if request, _ := cmd.Flags().GetString("request"); request != "" {
-				opt.request = request
-			}
-
 			if opt.url == "" {
 				log.Fatal(errors.New("no URL specified"))
 			}

-			headersSlice, err := cmd.Flags().GetStringSlice("header")
-			if err != nil {
-				return err
-			}
-			for _, h := range headersSlice {
+			for _, h := range c.StringSlice("headers") {
 				parts := strings.SplitN(h, ":", 2)
 				if len(parts) != 2 {
 					log.Fatal(errors.New("invalid header '" + h + "'"))
@@ -143,7 +127,7 @@ func BenchmarkClientCommand(cfg *config.Config) *cobra.Command {
 				opt.headers[parts[0]] = strings.TrimSpace(parts[1])
 			}

-			rate, _ := cmd.Flags().GetString("rate")
+			rate := c.String("rate")
 			if rate != "" {
 				parts := strings.SplitN(rate, "/", 2)
 				num, err := strconv.Atoi(parts[0])
@@ -166,12 +150,12 @@ func BenchmarkClientCommand(cfg *config.Config) *cobra.Command {
 				opt.rateDelay = unit / time.Duration(num)
 			}

-			user, _ := cmd.Flags().GetString("user")
+			user := c.String("user")
 			opt.auth = func() string {
 				return "Basic " + base64.StdEncoding.EncodeToString([]byte(user))
 			}

-			btc, _ := cmd.Flags().GetString("bearer-token-command")
+			btc := c.String("bearer-token-command")
 			if btc != "" {
 				parts := strings.SplitN(btc, " ", 2)
 				var cmd *exec.Cmd
@@ -189,47 +173,16 @@ func BenchmarkClientCommand(cfg *config.Config) *cobra.Command {
 				}
 			}

-			every, err := cmd.Flags().GetInt("every")
-			if err != nil {
-				return err
-			}
+			every := c.Int("every")
 			if every != 0 {
 				opt.ticker = time.NewTicker(time.Second * time.Duration(every))
 				defer opt.ticker.Stop()
 			}

-			// Set up signal handling for Ctrl+C
-			ctx, cancel := context.WithCancel(cmd.Context())
-			defer cancel()
-
-			sigChan := make(chan os.Signal, 1)
-			signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
-			go func() {
-				<-sigChan
-				fmt.Println("\nReceived interrupt signal, shutting down...")
-				cancel()
-			}()
-			return client(ctx, opt)
+			return client(opt)

 		},
 	}
-
-	// flags mimicing curl
-	benchClientCmd.Flags().StringP("request", "X", "PROPFIND", "Specifies a custom request method to use when communicating with the HTTP server.")
-	benchClientCmd.Flags().StringP("user", "u", "admin:admin", "Specify the user name and password to use for server authentication.")
-	benchClientCmd.Flags().BoolP("insecure", "k", false, "Skip the TLS verification step and proceed without checking.")
-	benchClientCmd.Flags().StringP("data", "d", "", "Sends the specified data in a POST request to the HTTP server, in the same way that a browser does when a user has filled in an HTML form and presses the submit button. If you start the data with the letter @, the rest should be a file name to read the data from, or - if you want to read the data from stdin. When -d, --data is told to read from a file like that, carriage returns and newlines are stripped out. If you do not want the @ character to have a special interpretation use --data-raw instead.")
-	benchClientCmd.Flags().StringP("data-raw", "", "", "Sends the specified data in a request to the HTTP server.")
-	benchClientCmd.Flags().StringP("data-binary", "", "", "This posts data exactly as specified with no extra processing whatsoever. If you start the data with the letter @, the rest should be a file name to read the data from, or - if you want to read the data from stdin.")
-	benchClientCmd.Flags().StringSliceP("headers", "H", []string{}, "Extra header to include in information sent.")
-	benchClientCmd.Flags().String("rate", "", "Specify the maximum transfer frequency you allow a client to use - in number of transfer starts per time unit (sometimes called request rate). The request rate is provided as \"N/U\" where N is an integer number and U is a time unit. Supported units are 's' (second), 'm' (minute), 'h' (hour) and 'd' /(day, as in a 24 hour unit). The default time unit, if no \"/U\" is provided, is number of transfers per hour.")
-
-	// other flags
-	benchClientCmd.Flags().IntP("jobs", "j", 1, "Number of parallel clients to start. Defaults to 1.")
-	benchClientCmd.Flags().Int("every", 0, "Aggregate stats every time this amount of seconds has passed.")
-	benchClientCmd.Flags().String("bearer-token-command", "", "Command to execute for a bearer token, e.g. 'oidc-token opencloud'. When set, disables basic auth.")
-
-	return benchClientCmd
 }

 type clientOptions struct {
@@ -244,7 +197,8 @@ type clientOptions struct {
 	jobs      int
 }

-func client(ctx context.Context, o clientOptions) error {
+func client(o clientOptions) error {
+
 	type stat struct {
 		job      int
 		duration time.Duration
@@ -263,13 +217,6 @@ func client(ctx context.Context, o clientOptions) error {

 			cookies := map[string]*http.Cookie{}
 			for {
-				// Check if context is cancelled
-				select {
-				case <-ctx.Done():
-					return
-				default:
-				}
-
 				req, err := http.NewRequest(o.request, o.url, bytes.NewReader(o.data))
 				if err != nil {
 					log.Printf("client %d: could not create request: %s\n", i, err)
@@ -287,35 +234,20 @@ func client(ctx context.Context, o clientOptions) error {
 				res, err := client.Do(req)
 				duration := -time.Until(start)
 				if err != nil {
-					// Check if error is due to context cancellation
-					if ctx.Err() != nil {
-						return
-					}
 					log.Printf("client %d: could not create request: %s\n", i, err)
 					time.Sleep(time.Second)
 				} else {
 					res.Body.Close()
-					select {
-					case stats <- stat{
+					stats <- stat{
 						job:      i,
 						duration: duration,
 						status:   res.StatusCode,
-					}:
-					case <-ctx.Done():
-						return
 					}
 					for _, c := range res.Cookies() {
 						cookies[c.Name] = c
 					}
 				}
-				// Sleep with context awareness
-				if o.rateDelay > duration {
-					select {
-					case <-time.After(o.rateDelay - duration):
-					case <-ctx.Done():
-						return
-					}
-				}
+				time.Sleep(o.rateDelay - duration)
 			}
 		}(i)
 	}
@@ -324,14 +256,9 @@ func client(ctx context.Context, o clientOptions) error {
 	if o.ticker == nil {
 		// no ticker, just write every request
 		for {
-			select {
-			case stat := <-stats:
-				numRequests++
-				fmt.Printf("req %d took %v and returned status %d\n", numRequests, stat.duration, stat.status)
-			case <-ctx.Done():
-				fmt.Println("\nShutting down...")
-				return nil
-			}
+			stat := <-stats
+			numRequests++
+			fmt.Printf("req %d took %v and returned status %d\n", numRequests, stat.duration, stat.status)
 		}
 	}

@@ -347,25 +274,31 @@ func client(ctx context.Context, o clientOptions) error {
 				numRequests = 0
 				duration = 0
 			}
-		case <-ctx.Done():
-			if numRequests > 0 {
-				fmt.Printf("\n%d req at %v/req\n", numRequests, duration/time.Duration(numRequests))
-			}
-			fmt.Println("Shutting down...")
-			return nil
 		}
 	}

 }

 // BenchmarkSyscallsCommand is the entrypoint for the benchmark syscalls command.
-func BenchmarkSyscallsCommand(cfg *config.Config) *cobra.Command {
-	benchSysCallCmd := &cobra.Command{
-		Use:   "syscalls",
-		Short: "test the performance of syscalls",
-		RunE: func(cmd *cobra.Command, args []string) error {
+func BenchmarkSyscallsCommand(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "syscalls",
+		Usage: "test the performance of syscalls",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:  "path",
+				Usage: "Path to test",
+			},
+			&cli.StringFlag{
+				Name:  "iterations",
+				Value: "100",
+				Usage: "Number of iterations to execute",
+			},
+		},
+		Category: "benchmark",
+		Action: func(c *cli.Context) error {

-			path, _ := cmd.Flags().GetString("path")
+			path := c.String("path")
 			if path == "" {
 				f, err := os.CreateTemp("", "opencloud-bench-temp-")
 				if err != nil {
@@ -376,16 +309,11 @@ func BenchmarkSyscallsCommand(cfg *config.Config) *cobra.Command {
 				defer os.Remove(path)
 			}

-			iterations, err := cmd.Flags().GetInt("iterations")
-			if err != nil {
-				return err
-			}
+			iterations := c.Int("iterations")
+
 			return benchmark(iterations, path)
 		},
 	}
-	benchSysCallCmd.Flags().String("path", "", "Path to test")
-	benchSysCallCmd.Flags().Int("iterations", 100, "Number of iterations to execute")
-	return benchSysCallCmd
 }

 func benchmark(iterations int, path string) error {
@@ -1,7 +0,0 @@
-package command
-
-const (
-	CommandGroupServer   = "Server"
-	CommandGroupServices = "Service"
-	CommandGroupStorage  = "Storage"
-)
@@ -9,6 +9,8 @@ import (
 	"sort"
 	"strings"

+	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	"github.com/opencloud-eu/opencloud/opencloud/pkg/register"
 	"github.com/opencloud-eu/opencloud/pkg/config"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
@@ -23,57 +25,69 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/tree"
 	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
 	"github.com/opencloud-eu/reva/v2/pkg/store"
-
-	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
-	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	"github.com/rs/zerolog"
-	"github.com/spf13/cobra"
+	"github.com/urfave/cli/v2"
 )

 // DecomposedfsCommand is the entrypoint for the groups command.
-func DecomposedfsCommand(cfg *config.Config) *cobra.Command {
-	decomposedCmd := &cobra.Command{
-		Use:     "decomposedfs",
-		Short:   `cli tools to inspect and manipulate a decomposedfs storage.`,
-		GroupID: CommandGroupStorage,
+func DecomposedfsCommand(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:     "decomposedfs",
+		Usage:    `cli tools to inspect and manipulate a decomposedfs storage.`,
+		Category: "maintenance",
+		Subcommands: []*cli.Command{
+			metadataCmd(cfg),
+			checkCmd(cfg),
+		},
 	}
-	decomposedCmd.AddCommand(metadataCmd(cfg), checkCmd(cfg))
-	return decomposedCmd
 }

 func init() {
 	register.AddCommand(DecomposedfsCommand)
 }

-func checkCmd(_ *config.Config) *cobra.Command {
-	cCmd := &cobra.Command{
-		Use:   "check-treesize",
-		Short: `cli tool to check the treesize metadata of a Space`,
-		RunE:  check,
+func checkCmd(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "check-treesize",
+		Usage: `cli tool to check the treesize metadata of a Space`,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "root",
+				Aliases:  []string{"r"},
+				Required: true,
+				Usage:    "Path to the root directory of the decomposedfs",
+			},
+			&cli.StringFlag{
+				Name:     "node",
+				Required: true,
+				Aliases:  []string{"n"},
+				Usage:    "Space ID of the Space to inspect",
+			},
+			&cli.BoolFlag{
+				Name:  "repair",
+				Usage: "Try to repair nodes with incorrect treesize metadata. IMPORTANT: Only use this while OpenCloud is not running.",
+			},
+			&cli.BoolFlag{
+				Name:  "force",
+				Usage: "Do not prompt for confirmation when running in repair mode.",
+			},
+		},
+		Action: check,
 	}
-	cCmd.Flags().StringP("root", "r", "", "Path to the root directory of the decomposedfs")
-	_ = cCmd.MarkFlagRequired("root")
-	cCmd.Flags().StringP("node", "n", "", "Space ID of the Space to inspect")
-	_ = cCmd.MarkFlagRequired("node")
-	cCmd.Flags().Bool("repair", false, "Try to repair nodes with incorrect treesize metadata. IMPORTANT: Only use this while OpenCloud is not running.")
-	cCmd.Flags().Bool("force", false, "Do not prompt for confirmation when running in repair mode.")
-
-	return cCmd
 }

-func check(cmd *cobra.Command, args []string) error {
-	rootFlag, _ := cmd.Flags().GetString("root")
-	repairFlag, _ := cmd.Flags().GetBool("repair")
-	forceFlag, _ := cmd.Flags().GetBool("force")
+func check(c *cli.Context) error {
+	rootFlag := c.String("root")
+	repairFlag := c.Bool("repair")

-	if repairFlag && !forceFlag {
+	if repairFlag && !c.Bool("force") {
 		answer := strings.ToLower(stringPrompt("IMPORTANT: Only use '--repair' when OpenCloud is not running. Do you want to continue? [yes | no = default]"))
 		if answer != "yes" && answer != "y" {
 			return nil
 		}
 	}

-	lu, backend := getBackend(cmd)
+	lu, backend := getBackend(c)
 	o := &options.Options{
 		MetadataBackend: backend.Name(),
 		MaxConcurrency:  100,
@@ -86,7 +100,7 @@ func check(cmd *cobra.Command, args []string) error {

 	tree := tree.New(lu, bs, o, permissions.Permissions{}, store.Create(), &zerolog.Logger{})

-	nId, _ := cmd.Flags().GetString("node")
+	nId := c.String("node")
 	n, err := lu.NodeFromSpaceID(context.Background(), nId)
 	if err != nil || !n.Exists {
 		fmt.Println("Can not find node '" + nId + "'")
@@ -102,10 +116,7 @@ func check(cmd *cobra.Command, args []string) error {
 		})

 	treeSize, err := walkTree(ctx, tree, lu, n, repairFlag)
-	if err != nil {
-		fmt.Printf("failed to walk tree of node %s: %s\n", n.ID, err)
-	}
-	treesizeFromMetadata, err := n.GetTreeSize(cmd.Context())
+	treesizeFromMetadata, err := n.GetTreeSize(c.Context)
 	if err != nil {
 		fmt.Printf("failed to read treesize of node: %s: %s\n", n.ID, err)
 	}
@@ -115,7 +126,7 @@ func check(cmd *cobra.Command, args []string) error {
 		if repairFlag {
 			fmt.Printf("Fixing tree size for node: %s. Calculated treesize: %d\n",
 				n.ID, treeSize)
-			n.SetTreeSize(cmd.Context(), treeSize)
+			n.SetTreeSize(c.Context, treeSize)
 		}
 	}
 	return nil
@@ -174,79 +185,105 @@ func walkTree(ctx context.Context, tree *tree.Tree, lu *lookup.Lookup, root *nod
 	return treesize, nil
 }

-func metadataCmd(cfg *config.Config) *cobra.Command {
-	metaCmd := &cobra.Command{
-		Use:   "metadata",
-		Short: `cli tools to inspect and manipulate node metadata`,
+func metadataCmd(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "metadata",
+		Usage: `cli tools to inspect and manipulate node metadata`,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "root",
+				Aliases:  []string{"r"},
+				Required: true,
+				Usage:    "Path to the decomposedfs",
+			},
+			&cli.StringFlag{
+				Name:     "node",
+				Required: true,
+				Aliases:  []string{"n"},
+				Usage:    "Path to or ID of the node to inspect",
+			},
+		},
+		Subcommands: []*cli.Command{dumpCmd(cfg), getCmd(cfg), setCmd(cfg)},
 	}
-	metaCmd.AddCommand(dumpCmd(cfg), getCmd(cfg), setCmd(cfg))
-	metaCmd.Flags().StringP("root", "r", "", "Path to the root directory of the decomposedfs")
-	_ = metaCmd.MarkFlagRequired("root")
-	metaCmd.Flags().StringP("node", "n", "", "Path to or ID of the node to inspect")
-	_ = metaCmd.MarkFlagRequired("node")
-	return metaCmd
 }

-func dumpCmd(_ *config.Config) *cobra.Command {
-	return &cobra.Command{
-		Use:   "dump",
-		Short: `print the metadata of the given node. String attributes will be enclosed in quotes. Binary attributes will be returned encoded as base64 with their value being prefixed with '0s'.`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			lu, backend := getBackend(cmd)
-			path, err := getNode(cmd, lu)
+func dumpCmd(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "dump",
+		Usage: `print the metadata of the given node. String attributes will be enclosed in quotes. Binary attributes will be returned encoded as base64 with their value being prefixed with '0s'.`,
+		Action: func(c *cli.Context) error {
+			lu, backend := getBackend(c)
+			path, err := getNode(c, lu)
 			if err != nil {
 				return err
 			}

-			attribs, err := backend.All(cmd.Context(), path)
+			attribs, err := backend.All(c.Context, path)
 			if err != nil {
 				fmt.Println("Error reading attributes")
 				return err
 			}
-			attributeFlag, _ := cmd.Flags().GetString("attribute")
-			printAttribs(attribs, attributeFlag)
+			printAttribs(attribs, c.String("attribute"))
 			return nil
 		},
 	}
 }

-func getCmd(_ *config.Config) *cobra.Command {
-	gCmd := &cobra.Command{
-		Use:   "get",
-		Short: `print a specific attribute of the given node. String attributes will be enclosed in quotes. Binary attributes will be returned encoded as base64 with their value being prefixed with '0s'.`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			lu, backend := getBackend(cmd)
-			path, err := getNode(cmd, lu)
+func getCmd(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "get",
+		Usage: `print a specific attribute of the given node. String attributes will be enclosed in quotes. Binary attributes will be returned encoded as base64 with their value being prefixed with '0s'.`,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "attribute",
+				Aliases: []string{"a"},
+				Usage:   "attribute to inspect",
+			},
+		},
+		Action: func(c *cli.Context) error {
+			lu, backend := getBackend(c)
+			path, err := getNode(c, lu)
 			if err != nil {
 				return err
 			}

-			attribs, err := backend.All(cmd.Context(), path)
+			attribs, err := backend.All(c.Context, path)
 			if err != nil {
 				fmt.Println("Error reading attributes")
 				return err
 			}
-			attributeFlag, _ := cmd.Flags().GetString("attribute")
-			printAttribs(attribs, attributeFlag)
+			printAttribs(attribs, c.String("attribute"))
 			return nil
 		},
 	}
-	gCmd.Flags().StringP("attribute", "a", "", "attribute to inspect, can be a glob pattern (e.g. 'user.*' will match all attributes starting with 'user.').")
-	return gCmd
 }

-func setCmd(_ *config.Config) *cobra.Command {
-	sCmd := &cobra.Command{
-		Use:   "set",
-		Short: `manipulate metadata of the given node. Binary attributes can be given hex encoded (prefix by '0x') or base64 encoded (prefix by '0s').`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			lu, backend := getBackend(cmd)
-			n, err := getNode(cmd, lu)
+func setCmd(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:  "set",
+		Usage: `manipulate metadata of the given node. Binary attributes can be given hex encoded (prefix by '0x') or base64 encoded (prefix by '0s').`,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "attribute",
+				Required: true,
+				Aliases:  []string{"a"},
+				Usage:    "attribute to inspect",
+			},
+			&cli.StringFlag{
+				Name:     "value",
+				Required: true,
+				Aliases:  []string{"v"},
+				Usage:    "value to set",
+			},
+		},
+		Action: func(c *cli.Context) error {
+			lu, backend := getBackend(c)
+			n, err := getNode(c, lu)
 			if err != nil {
 				return err
 			}

-			v, _ := cmd.Flags().GetString("value")
+			v := c.String("value")
 			if strings.HasPrefix(v, "0s") {
 				b64, err := base64.StdEncoding.DecodeString(v[2:])
 				if err == nil {
@@ -263,8 +300,7 @@ func setCmd(_ *config.Config) *cobra.Command {
 				}
 			}

-			attributeFlag, _ := cmd.Flags().GetString("attribute")
-			err = backend.Set(cmd.Context(), n, attributeFlag, []byte(v))
+			err = backend.Set(c.Context, n, c.String("attribute"), []byte(v))
 			if err != nil {
 				fmt.Println("Error setting attribute")
 				return err
@@ -272,16 +308,9 @@ func setCmd(_ *config.Config) *cobra.Command {
 			return nil
 		},
 	}
-	sCmd.Flags().StringP("attribute", "a", "", "attribute to inspect, can be a glob pattern (e.g. 'user.*' will match all attributes starting with 'user.').")
-	_ = sCmd.MarkFlagRequired("attribute")
-
-	sCmd.Flags().StringP("value", "v", "", "value to set")
-	_ = sCmd.MarkFlagRequired("value")
-
-	return sCmd
 }

-func backend(backend string) metadata.Backend {
+func backend(root, backend string) metadata.Backend {
 	switch backend {
 	case "xattrs":
 		return metadata.NewXattrsBackend(cache.Config{})
@@ -291,11 +320,11 @@ func backend(backend string) metadata.Backend {
 	return metadata.NullBackend{}
 }

-func getBackend(cmd *cobra.Command) (*lookup.Lookup, metadata.Backend) {
-	rootFlag, _ := cmd.Flags().GetString("root")
+func getBackend(c *cli.Context) (*lookup.Lookup, metadata.Backend) {
+	rootFlag := c.String("root")

 	bod := lookup.DetectBackendOnDisk(rootFlag)
-	backend := backend(bod)
+	backend := backend(rootFlag, bod)
 	lu := lookup.New(backend, &options.Options{
 		Root:            rootFlag,
 		MetadataBackend: bod,
@@ -303,8 +332,8 @@ func getBackend(cmd *cobra.Command) (*lookup.Lookup, metadata.Backend) {
 	return lu, backend
 }

-func getNode(cmd *cobra.Command, lu *lookup.Lookup) (*node.Node, error) {
-	nodeFlag, _ := cmd.Flags().GetString("node")
+func getNode(c *cli.Context, lu *lookup.Lookup) (*node.Node, error) {
+	nodeFlag := c.String("node")

 	id, err := storagespace.ParseID(nodeFlag)
 	if err != nil {
@@ -0,0 +1,9 @@
+package helper
+
+import (
+	"fmt"
+)
+
+func SubcommandDescription(serviceName string) string {
+	return fmt.Sprintf("%s service commands", serviceName)
+}
Author	SHA1	Message	Date
OpenCloud Devops	c8769532d4	🎉 Release 4.0.4 (#2338 ) * 🎉 Release 4.0.4 * 🎉 Release 4.0.4 * 🎉 Release 4.0.4 * 🎉 Release 4.0.4 * 🎉 Release 4.0.4	2026-03-30 15:50:34 +02:00
Viktor Scharf	9995160624	[stable-4.0] bump version 4.0.4 (#2546 )	2026-03-30 15:07:08 +02:00
Viktor Scharf	b55462b185	[stable-4.0] chore: bump reva to v2.40.4 (#2545 )	2026-03-30 12:23:10 +02:00
Ralf Haferkamp	9c4ac18e47	chore: bump github.com/nats-io/nats-server/v2 Fixes various CVEs (see https://github.com/nats-io/nats-server/releases/tag/v2.12.6 for details)	2026-03-30 12:22:23 +02:00
Ralf Haferkamp	8cf768bf80	chore: bump github.com/russellhaering/goxmldsig CVE-2026-33487	2026-03-30 12:22:23 +02:00
Viktor Scharf	336acffb16	add final step for branch protection (#2501 ) (#2532 ) * add final step for branch protection * add step for ready release	2026-03-30 10:35:53 +02:00
Andre Duffeck	09d95eb415	Merge pull request #2527 from aduffeck/backport-bleve-batch-fix Backport bleve batch fix	2026-03-26 08:52:39 +01:00
Viktor Scharf	8f7ad7f328	change php image	2026-03-26 07:42:11 +01:00
André Duffeck	228adbe177	Reduce default batch size to prevent memory issues with large documents	2026-03-25 18:32:57 +01:00
André Duffeck	de1120210e	Commit batches when the limit is reached while iterating over children	2026-03-25 18:32:54 +01:00
Florian Schade	ffea35ebf5	Merge pull request #2407 from dragonchaser/backport-backchannel-logout Backport backchannel logout	2026-03-02 13:19:36 +01:00
Florian Schade	f8bed839ce	fix: send the backchannel logout event only if a session exists	2026-03-02 10:25:55 +01:00
Christian Richter	8a667ff1c7	readd missing import Signed-off-by: Christian Richter <c.richter@opencloud.eu>	2026-02-26 09:50:20 +01:00
Ralf Haferkamp	2a2d925ee4	fix(idp): Remove kpop dependency The built package (https://download.kopano.io/community/kapp:/kpop-2.7.2.tgz) seems to be no longer available and upstream lico already switched away from it quite a while ago. Fixes: #2364	2026-02-26 09:27:53 +01:00
Christian Richter	9cf02e5c7e	fix: simplify subject.session key parsing Signed-off-by: Christian Richter <c.richter@opencloud.eu>	2026-02-26 09:11:25 +01:00
Florian Schade	44fc25dbf6	refactor: make the logout mode private	2026-02-26 09:08:24 +01:00
Florian Schade	8d99cf3f8b	fix: use base64 record keys to prevent separator clashes with subjects or sessionIds that contain a dot	2026-02-26 09:08:17 +01:00
Florian Schade	a5f5009f9d	chore: change naming	2026-02-26 09:08:11 +01:00
Florian Schade	6af2c44f7f	test: add more backchannellogout tests	2026-02-26 09:08:04 +01:00
Florian Schade	f7a86d681a	chore: cleanup backchannel logout pr for review	2026-02-26 09:07:57 +01:00
Florian Schade	a9660e3e8c	enhancement: document idp side-effects	2026-02-26 09:07:50 +01:00
Florian Schade	66d220ff44	enhancement: finalize backchannel logout	2026-02-26 09:07:29 +01:00
Christian Richter Jörn Dreyer Michael Barz	2e36859816	refactor deletion Co-authored-by: Jörn Dreyer <j.dreyer@opencloud.eu> Co-authored-by: Michael Barz <m.barz@opencloud.eu> Signed-off-by: Christian Richter <c.richter@opencloud.eu>	2026-02-26 08:53:21 +01:00
Christian Richter	06708d94a9	create mapping in cache for subject => sessionid Signed-off-by: Christian Richter <c.richter@opencloud.eu>	2026-02-26 08:53:12 +01:00
Christian Richter	5aefcb9544	add mapping to backchannel logout for subject => sessionid Signed-off-by: Christian Richter <c.richter@opencloud.eu>	2026-02-26 08:53:05 +01:00
Christian RichterandMichael Barz	ca559bc3fb	add additional validation to logout token Signed-off-by: Christian Richter <c.richter@opencloud.eu> Co-authored-by: Michael Barz <m.barz@opencloud.eu>	2026-02-26 08:52:59 +01:00
Sawjan Gurung	535a5d67e9	Merge pull request #2330 from opencloud-eu/port/ci-skip-prs [full-ci][tests-only] ci: port ci skip prs	2026-02-13 09:57:56 +05:45
Sawjan Gurung	98b6c53270	ci: fix unwanted workflow skip in the cron pipelines (#2117 ) * ci: run workflow if not found in the list Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * ci: suffix event in cache key to separate cron and push pipelines Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * ci: prefix test workflow with test Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * ci: create empty cache dir for unit tests Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> --------- Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>	2026-02-12 17:49:21 +05:45
Sawjan Gurung	fe84d0dec4	[POC] ci: skip previously passed workflows on pipeline restart (#2099 ) * ci: add pipeline info check scripts Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * ci: prefix test pipelines with test Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * ci: implement skip-on-pass for test workflows Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * ci: add cache purge workflow Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> --------- Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>	2026-02-12 17:49:07 +05:45
Sawjan Gurung	17606da390	ci: generate api, cli and e2e pipelines in a similar way (#2095 ) * ci: refactor ci config Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * ci: refactor storage and configs Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * ci: fix format Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> --------- Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>	2026-02-12 17:46:59 +05:45
OpenCloud Devops	239ce6a794	🎉 Release 4.0.3 (#2281 )	2026-02-05 17:11:52 +01:00
Andre Duffeck	4f36445048	Merge pull request #2275 from aduffeck/bump-reva-2.40.3 Bump reva 2.40.3	2026-02-05 16:14:26 +01:00
André Duffeck	312eacd46a	Bump latest tag	2026-02-05 15:35:05 +01:00
André Duffeck	3c906e1dae	Bump reva	2026-02-05 15:34:11 +01:00
OpenCloud Devops	fc5ee78dc8	🎉 Release 4.0.2 (#2037 ) * 🎉 Release 4.0.2 * 🎉 Release 4.0.2 * 🎉 Release 4.0.2 * 🎉 Release 4.0.2 * 🎉 Release 4.0.2	2026-02-05 14:52:46 +01:00
Andre Duffeck	913c51d8d5	Merge pull request #2274 from aduffeck/bump-reva-v2.40.2 Bump reva	2026-02-05 12:53:12 +01:00
André Duffeck	052ee8910d	Bump reva	2026-02-05 11:45:04 +01:00
Viktor ScharfandSawjan Gurung	ed285049dc	[tests-only] port tests to stable #2087 #2039 (#2185 ) * [tests-only] test: fix API tests (#2087) * test: use placeholder value Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * test: fix antivirus test expectations Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> --------- Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * skip collaborativePosix tests in CI (#2039) --------- Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> Co-authored-by: Sawjan Gurung <saw.jan.grg3e@gmail.com>	2026-01-21 07:25:05 +01:00
Sawjan Gurung	867da079a8	[full-ci][tests-only] test: fix some test flakiness (#2003 ) * test: check content after upload Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> test: check content with retry Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * test: check empty body before json decoding Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * test: wait post-processing for webdav requests if applicable Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> * test: check token before doing request Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> test: check body before json decoding Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> test: add wait step Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com> --------- Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>	2025-12-16 14:43:39 +05:45
Sawjan Gurung	389638878a	Merge pull request #2007 from opencloud-eu/ci/fix-translation-pipeline ci: fix translation pipeline	2025-12-16 14:43:39 +05:45
Saw-jan	949f14a278	test: add test to check mismatch offset during TUS upload Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>	2025-12-16 14:43:39 +05:45
Saw-jan	27450c97bb	test: proper resource existence check Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>	2025-12-16 14:43:39 +05:45
OpenCloud Devops	ac072bee8f	🎉 Release 4.0.1 (#1984 ) * 🎉 Release 4.0.1 * 🎉 Release 4.0.1 * 🎉 Release 4.0.1 * 🎉 Release 4.0.1 * 🎉 Release 4.0.1 * 🎉 Release 4.0.1	2025-12-15 14:52:02 +01:00
Viktor Scharf	fa4cd8e279	bump-version-4.0.1 (#2028 ) apiAntivirus/antivirus.feature:228 was green in the previous run	2025-12-15 14:39:51 +01:00
Prashant Gurung	7bdbd9c474	skip test related pipelines for ready-release-go PRs (#2011 ) (#2018 ) Signed-off-by: prashant-gurung899 <prasantgrg777@gmail.com>	2025-12-12 17:29:13 +05:45
Florian Schade	1d43bbea17	Merge pull request #2010 from fschade/backport/stable-4.0/pr-2001 [stable-4.0] fix: build time edition channels #2001	2025-12-12 09:25:15 +01:00
Florian Schade	d19968bec7	enhancement: introduce build time edition channels be careful, the env:OC_EDITION, env:FRONTEND_EDITION, and conf:edition got removed as part of this commit, no deprecation because the flag is build time only! (cherry picked from commit `40d8aacea4`)	2025-12-11 11:52:57 +01:00
Benedikt Kulmann	4962328f0c	fix: enforce trailing slash for server url (#2002 ) (cherry picked from commit `614d916978`)	2025-12-11 10:52:20 +01:00
Viktor ScharfandJannik Stehle	80cf0ba72c	ci: use secret for the chat notifications url (#2006 ) Co-authored-by: Jannik Stehle <j.stehle@opencloud.eu>	2025-12-11 10:02:56 +01:00
Michael BarzandStavros Kois	26f5cd7493	fix: enhance resource creation with detailed process information (#1978 ) (#2000 ) (cherry picked from commit `64119b3f8a`) Co-authored-by: Stavros Kois <s.kois@outlook.com>	2025-12-11 09:08:19 +01:00
Michael Barz	52cd4abc15	Add release_branch setting to release-helper	2025-12-05 22:27:13 +01:00
Viktor Scharf	4d5851cdff	enable release-go plagin in stable-4.0 branch (#1982 )	2025-12-05 15:38:58 +01:00
Viktor Scharf	5390322e38	[stable-4.0] replace golang image (#1955 ) (#1972 ) * replace golang image (#1955) (cherry picked from commit `6ce0cc6b1f`) * fix test * Update CliContext.php	2025-12-05 10:39:02 +01:00
				`@@ -1 +0,0 @@`
				`{"@type":"RocksDb","path":"/var/lib/stalwart/","blobSize":16834,"bufferSize":134217728,"poolWorkers":null}`