🎉 Release 7.2.3 (#3258 )

* 🎉 Release 7.2.3 * 🎉 Release 7.2.3
bump-opencloud-7.2.3 (#3261 )
2026-09-08 11:53:07 -04:00 · 2026-08-06 15:22:44 +02:00 · 2026-08-06 15:11:55 +02:00 · 2026-08-06 12:42:14 +02:00 · 2026-07-14 10:24:53 +02:00 · 2026-07-14 09:44:49 +02:00
114 changed files with 1483 additions and 594 deletions
@@ -1,4 +1,4 @@
 # The test runner source for UI tests
-WEB_COMMITID=2cee98bb27fab223fc4ce2455f5483ce7767ff1a
-WEB_BRANCH=main
+WEB_COMMITID=2cf68437639154cff66f8d6920470ee25a80f6b3
+WEB_BRANCH=stable-7.1

@@ -75,11 +75,11 @@ OC_FED_DOMAIN = "%s:10200" % FED_OC_SERVER_NAME
 event = {
    "base": {
        "event": ["push", "manual"],
-        "branch": "main",
+        "branch": "stable-*",
    },
    "cron": {
        "event": "cron",
-        "branch": "main",
+        "branch": "stable-*",
    },
    "pull_request": {
        "event": "pull_request",
@@ -403,9 +403,10 @@ config = {
        "architectures": ["arm64", "amd64"],
        "production": {
            # NOTE: need to be updated if new production releases are determined
-            "tags": ["2.0", "4.0"],
+            "tags": ["2.0", "4.0", "7.2"],
            # NOTE: need to be set to true if patch releases are made from stable-X-branches
-            "skip_rolling": "false",
+            "skip_rolling": True,
+            "skip_daily": True,
            "repo": docker_repo_slug,
            "build_type": "production",
        },
@@ -1722,7 +1723,7 @@ def dockerReleases(ctx):
            docker_releases.append("rolling")

        # on non tag events, do daily build
-    else:
+    elif not config["dockerReleases"]["production"]["skip_daily"]:
        docker_releases.append("daily")

    for releaseConfigName in docker_releases:
@@ -2084,6 +2085,7 @@ def readyReleaseGo():
                "image": READY_RELEASE_GO,
                "settings": {
                    "git_email": "devops@opencloud.eu",
+                    "release_branch": "stable-7.2",
                    "forge_type": "github",
                    "forge_token": {
                        "from_secret": "github_token",
@@ -1,5 +1,63 @@
 # Changelog

+## [7.2.3](https://github.com/opencloud-eu/opencloud/releases/tag/v7.2.3) - 2026-08-06
+
+### ❤️ Thanks to all contributors! ❤️
+
+@aduffeck, @v-scharf
+
+### 🐛 Bug Fixes
+
+- Fix missing favorite flag on opensearch hits [[#3256](https://github.com/opencloud-eu/opencloud/pull/3256)]
+
+## [7.2.2](https://github.com/opencloud-eu/opencloud/releases/tag/v7.2.2) - 2026-07-14
+
+### ❤️ Thanks to all contributors! ❤️
+
+@kulmann, @v-scharf
+
+### 📦️ Dependencies
+
+- [full-ci] chore: bump web to v7.1.4 [[#3122](https://github.com/opencloud-eu/opencloud/pull/3122)]
+
+## [7.2.1](https://github.com/opencloud-eu/opencloud/releases/tag/v7.2.1) - 2026-07-06
+
+### ❤️ Thanks to all contributors! ❤️
+
+@JammingBen, @v-scharf
+
+### 🐛 Bug Fixes
+
+- Fix warming up the id cache for the user storage [[#3072](https://github.com/opencloud-eu/opencloud/pull/3072)]
+
+### 📦️ Dependencies
+
+- [full-ci] chore: bump web to v7.1.3 [[#3052](https://github.com/opencloud-eu/opencloud/pull/3052)]
+
+## [7.2.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.2.0) - 2026-06-24
+
+### ❤️ Thanks to all contributors! ❤️
+
+@Heiko-Pohl, @JammingBen, @ScharfViktor, @aduffeck, @butonic, @dragonchaser, @kulmann, @rhafer
+
+### 🐛 Bug Fixes
+
+- [stable-7.2] Backport fixes from main [[#2999](https://github.com/opencloud-eu/opencloud/pull/2999)]
+- fix(idp): aarch64 build [[#2906](https://github.com/opencloud-eu/opencloud/pull/2906)]
+- use ldap instead of ldaps internally [[#2880](https://github.com/opencloud-eu/opencloud/pull/2880)]
+
+### 📚 Documentation
+
+- Rename role_name from "guest" to "user-light"  [[#2912](https://github.com/opencloud-eu/opencloud/pull/2912)]
+
+### 📦️ Dependencies
+
+- [full-ci] chore: bump web to v7.1.2 [[#3012](https://github.com/opencloud-eu/opencloud/pull/3012)]
+- [full-ci] chore: bump web to v7.1.1 [[#2998](https://github.com/opencloud-eu/opencloud/pull/2998)]
+- bump reva to latest main [[#2922](https://github.com/opencloud-eu/opencloud/pull/2922)]
+- build(deps-dev): bump webpack-manifest-plugin from 5.0.0 to 6.0.1 in /services/idp [[#2884](https://github.com/opencloud-eu/opencloud/pull/2884)]
+- build(deps): bump axios from 1.16.0 to 1.16.1 in /services/idp [[#2883](https://github.com/opencloud-eu/opencloud/pull/2883)]
+
 ## [7.1.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.1.0) - 2026-06-02

 ### ❤️ Thanks to all contributors! ❤️
@@ -21,15 +21,14 @@ COPY ./ /opencloud/
 WORKDIR /opencloud/opencloud
 RUN make node-generate-prod

-FROM golang:1.24-alpine AS build
-RUN apk add bash make git curl gcc musl-dev libc-dev binutils-gold inotify-tools vips-dev
+FROM quay.io/opencloudeu/golang-ci:1.25 AS build

 COPY --from=generate /opencloud /opencloud

 WORKDIR /opencloud/opencloud
 RUN make go-generate build ENABLE_VIPS=true

-FROM alpine:3.23
+FROM alpine:3.24

 RUN apk add --no-cache attr ca-certificates curl mailcap tree vips && \
 	echo 'hosts: files dns' >| /etc/nsswitch.conf
@@ -64,7 +64,7 @@ require (
 	github.com/open-policy-agent/opa v1.15.2
 	github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89
 	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d
-	github.com/opencloud-eu/reva/v2 v2.46.3-0.20260609140739-8f745511cb37
+	github.com/opencloud-eu/reva/v2 v2.46.7
 	github.com/opensearch-project/opensearch-go/v4 v4.6.0
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/pkg/errors v0.9.1
@@ -948,8 +948,8 @@ github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89 h1:W1ms+l
 github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89/go.mod h1:vigJkNss1N2QEceCuNw/ullDehncuJNFB6mEnzfq9UI=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d h1:JcqGDiyrcaQwVyV861TUyQgO7uEmsjkhfm7aQd84dOw=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260310090739-853d972b282d/go.mod h1:pzatilMEHZFT3qV7C/X3MqOa3NlRQuYhlRhZTL+hN6Q=
-github.com/opencloud-eu/reva/v2 v2.46.3-0.20260609140739-8f745511cb37 h1:QpDLacGIjn1N9o1tU/26DVxnB4SbuaK4MCnw86tXCOI=
-github.com/opencloud-eu/reva/v2 v2.46.3-0.20260609140739-8f745511cb37/go.mod h1:RoFQt+u7edxwzHr1IZ2Y6VaDinMiRPQupAvMBy3WVmE=
+github.com/opencloud-eu/reva/v2 v2.46.7 h1:zhUIMWNqqpGFpkLVIn56d5EpBoRNR5fBptovLzBRqTU=
+github.com/opencloud-eu/reva/v2 v2.46.7/go.mod h1:RoFQt+u7edxwzHr1IZ2Y6VaDinMiRPQupAvMBy3WVmE=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4 h1:l2oB/RctH+t8r7QBj5p8thfEHCM/jF35aAY3WQ3hADI=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -1,4 +1,4 @@
-FROM golang:alpine3.23 AS build
+FROM quay.io/opencloudeu/golang-ci:1.25 AS build
 ARG TARGETOS
 ARG TARGETARCH
 ARG VERSION
@@ -6,8 +6,6 @@ ARG STRING
 ARG EDITION="dev"
 ARG SRCDIR

-RUN apk add bash make git curl gcc musl-dev libc-dev binutils-gold inotify-tools vips-dev
-
 WORKDIR /build
 RUN --mount=type=bind,target=/build,rw \
    --mount=type=cache,target=/go/pkg/mod \
@@ -15,7 +13,7 @@ RUN --mount=type=bind,target=/build,rw \
    GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH:-amd64}" ; \
    make -C ${SRCDIR:-.}/opencloud release-linux-docker-${TARGETARCH} ENABLE_VIPS=true DIST=/dist

-FROM alpine:3.23
+FROM alpine:3.24
 ARG VERSION
 ARG REVISION
 ARG TARGETOS
@@ -31,6 +31,7 @@ import (
 const (
 	parentIDAttrName = "user.oc.parentid"
 	idAttrName       = "user.oc.id"
+	nameAttrName     = "user.oc.name"
 	spaceIDAttrName  = "user.oc.space.id"
 	ownerIDAttrName  = "user.oc.owner.id"
 )
@@ -292,7 +293,7 @@ func checkSpaceID(spacePath string) {
 	}
 }

-func walkParentIDs(dir string, parentID string) int {
+func walkNodes(dir string, parentID string) int {
 	fixes := 0
 	entries, err := os.ReadDir(dir)
 	if err != nil {
@@ -307,6 +308,7 @@ func walkParentIDs(dir string, parentID string) int {
 			continue
 		}

+		// Check if the parent ID attribute matches the expected parent ID, if not, fix it.
 		actualParentID, err := xattr.Get(fullPath, parentIDAttrName)
 		if err != nil || string(actualParentID) != parentID {
 			err = xattr.Set(fullPath, parentIDAttrName, []byte(parentID))
@@ -314,7 +316,22 @@ func walkParentIDs(dir string, parentID string) int {
 				logFailure("Failed to fix parent ID for '%s': %v", fullPath, err)
 			} else {
 				spinner.Pause()
-				fmt.Printf("\n  + Fixed parent ID for '%s'\n", fullPath)
+				fmt.Printf("  + Fixed parent ID for '%s'", fullPath)
+				spinner.Unpause()
+				fixes++
+				restartRequired = true
+			}
+		}
+
+		// Check that the name attribute matches the actual name of the file/directory, if not, fix it.
+		nameAttr, err := xattr.Get(fullPath, nameAttrName)
+		if err != nil || string(nameAttr) != entry.Name() {
+			err = xattr.Set(fullPath, nameAttrName, []byte(entry.Name()))
+			if err != nil {
+				logFailure("Failed to fix name attribute for '%s': %v", fullPath, err)
+			} else {
+				spinner.Pause()
+				fmt.Printf("  + Fixed name attribute for '%s'", fullPath)
 				spinner.Unpause()
 				fixes++
 				restartRequired = true
@@ -327,14 +344,14 @@ func walkParentIDs(dir string, parentID string) int {
 				logFailure("Directory '%s' missing '%s', skipping its children", fullPath, idAttrName)
 				continue
 			}
-			walkParentIDs(fullPath, string(nodeID))
+			walkNodes(fullPath, string(nodeID))
 		}
 	}
 	return fixes
 }

 func checkNodeIDs(spacePath string) {
-	spinner.Message(" - checking parent IDs")
+	spinner.Message(" - checking nodes")

 	rootID, err := xattr.Get(spacePath, idAttrName)
 	if err != nil || len(rootID) == 0 {
@@ -342,11 +359,11 @@ func checkNodeIDs(spacePath string) {
 		return
 	}

-	fixes := walkParentIDs(spacePath, string(rootID))
+	fixes := walkNodes(spacePath, string(rootID))

 	if fixes > 0 {
 		spinner.Pause()
-		fmt.Printf("\n  ✓ Fixed %d incorrect parent IDs in %s\n", fixes, filepath.Base(spacePath))
+		fmt.Printf("\n  ✓ Fixed %d incorrect node attributes in %s\n", fixes, filepath.Base(spacePath))
 		spinner.Unpause()
 	}
 }
@@ -0,0 +1,20 @@
+package nats
+
+import (
+	"crypto/tls"
+
+	"github.com/nats-io/nats.go"
+)
+
+func Secure(enableTLS, insecure bool, rootCA string) nats.Option {
+	if enableTLS {
+		if rootCA != "" {
+			return nats.RootCAs(rootCA)
+		}
+		return nats.Secure(&tls.Config{
+			MinVersion:         tls.VersionTLS12,
+			InsecureSkipVerify: insecure,
+		})
+	}
+	return nil
+}
@@ -48,14 +48,17 @@ type HTTPServiceTLS struct {
 }

 type Cache struct {
-	Store              string        `yaml:"store" env:"OC_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes              []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES" desc:"A comma separated list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store." introductionVersion:"1.0.0"`
-	Database           string        `yaml:"database" env:"OC_CACHE_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table              string        `yaml:"table" env:"OC_CACHE_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL" desc:"Time to live for events in the store. The duration can be set as number followed by a unit identifier like s, m or h." introductionVersion:"1.0.0"`
-	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername       string        `yaml:"auth_username" env:"OC_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword       string        `yaml:"auth_password" env:"OC_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES" desc:"A comma separated list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"OC_CACHE_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table                string        `yaml:"table" env:"OC_CACHE_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL" desc:"Time to live for events in the store. The duration can be set as number followed by a unit identifier like s, m or h." introductionVersion:"1.0.0"`
+	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"auth_username" env:"OC_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"auth_password" env:"OC_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided OC_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }

 // Commons holds configuration that are common to all extensions. Each extension can then decide whether
@@ -34,7 +34,7 @@ var (
 	// LatestTag is the latest released version plus the dev meta version.
 	// Will be overwritten by the release pipeline
 	// Needs a manual change for every tagged release
-	LatestTag = "7.1.0+dev"
+	LatestTag = "7.2.3+dev"

 	// Date indicates the build date.
 	// This has been removed, it looks like you can only replace static strings with recent go versions
@@ -9,9 +9,7 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/events"
 	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"github.com/opencloud-eu/reva/v2/pkg/store"
 	"github.com/spf13/cobra"
-	microstore "go-micro.dev/v4/store"

 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
 	"github.com/opencloud-eu/opencloud/pkg/generators"
@@ -77,15 +75,6 @@ func Server(cfg *config.Config) *cobra.Command {
 				return err
 			}

-			evStore := store.Create(
-				store.Store(cfg.Store.Store),
-				store.TTL(cfg.Store.TTL),
-				microstore.Nodes(cfg.Store.Nodes...),
-				microstore.Database(cfg.Store.Database),
-				microstore.Table(cfg.Store.Table),
-				store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
-			)
-
 			tm, err := pool.StringToTLSMode(cfg.GRPCClientTLS.Mode)
 			if err != nil {
 				logger.Error().Err(err).Msg("Failed to parse tls mode")
@@ -120,7 +109,6 @@ func Server(cfg *config.Config) *cobra.Command {
 					http.Context(ctx), // NOTE: not passing this "option" leads to a panic in go-micro
 					http.TraceProvider(tracerProvider),
 					http.Stream(evStream),
-					http.Store(evStore),
 					http.GatewaySelector(gatewaySelector),
 					http.HistoryClient(hClient),
 					http.ValueClient(vClient),
@@ -50,13 +50,15 @@ type Events struct {

 // Store configures the store to use
 type Store struct {
-	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;ACTIVITYLOG_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;ACTIVITYLOG_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database     string        `yaml:"database" env:"ACTIVITYLOG_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table        string        `yaml:"table" env:"ACTIVITYLOG_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;ACTIVITYLOG_STORE_TTL" desc:"Time to live for events in the store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;ACTIVITYLOG_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;ACTIVITYLOG_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;ACTIVITYLOG_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;ACTIVITYLOG_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"ACTIVITYLOG_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;ACTIVITYLOG_STORE_TTL" desc:"Time to live for events in the store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;ACTIVITYLOG_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;ACTIVITYLOG_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;ACTIVITYLOG_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;ACTIVITYLOG_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;ACTIVITYLOG_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided ACTIVITYLOG_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }

 // ServiceAccount is the configuration for the used service account
@@ -37,7 +37,6 @@ func DefaultConfig() *config.Config {
 			Store:    "nats-js-kv",
 			Nodes:    []string{"127.0.0.1:9233"},
 			Database: "activitylog",
-			Table:    "",
 		},
 		RevaGateway:     shared.DefaultRevaConfig().Address,
 		DefaultLanguage: "en",
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -17,8 +18,13 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("http reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))

 	return debug.NewService(
 		debug.Logger(options.Logger),
@@ -81,7 +81,6 @@ func Server(opts ...Option) (http.Service, error) {
 		svc.Logger(options.Logger),
 		svc.Stream(options.Stream),
 		svc.Mux(mux),
-		svc.Store(options.Store),
 		svc.Config(options.Config),
 		svc.GatewaySelector(options.GatewaySelector),
 		svc.TraceProvider(options.TraceProvider),
@@ -11,7 +11,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
 	"github.com/opencloud-eu/reva/v2/pkg/events"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	microstore "go-micro.dev/v4/store"
 	"go.opentelemetry.io/otel/trace"
 )

@@ -25,7 +24,6 @@ type Options struct {
 	TraceProvider       trace.TracerProvider
 	Stream              events.Stream
 	RegisteredEvents    []events.Unmarshaller
-	Store               microstore.Store
 	GatewaySelector     pool.Selectable[gateway.GatewayAPIClient]
 	Mux                 *chi.Mux
 	HistoryClient       ehsvc.EventHistoryService
@@ -69,13 +67,6 @@ func RegisteredEvents(e []events.Unmarshaller) Option {
 	}
 }

-// Store configures the store to use
-func Store(store microstore.Store) Option {
-	return func(o *Options) {
-		o.Store = store
-	}
-}
-
 // GatewaySelector adds a grpc client selector for the gateway service
 func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient]) Option {
 	return func(o *Options) {
@@ -2,6 +2,7 @@ package service

 import (
 	"context"
+	"crypto/tls"
 	"encoding/base32"
 	"encoding/json"
 	"fmt"
@@ -166,6 +167,18 @@ func New(opts ...Option) (*ActivitylogService, error) {
 	natsOptions := nats.Options{
 		Servers: o.Config.Store.Nodes,
 	}
+	if o.Config.Store.EnableTLS {
+		if o.Config.Store.TLSRootCACertificate != "" {
+			// when root ca is configured use it. an insecure flag is ignored.
+			nats.RootCAs(o.Config.Store.TLSRootCACertificate)(&natsOptions)
+		} else {
+			// enable tls and use insecure flag
+			nats.Secure(&tls.Config{MinVersion: tls.VersionTLS12, InsecureSkipVerify: o.Config.Store.TLSInsecure})(&natsOptions)
+		}
+	}
+	if o.Config.Store.AuthUsername != "" && o.Config.Store.AuthPassword != "" {
+		nats.UserInfo(o.Config.Store.AuthUsername, o.Config.Store.AuthPassword)(&natsOptions)
+	}
 	conn, err := natsOptions.Connect()
 	if err != nil {
 		return nil, err
@@ -10,6 +10,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -18,9 +19,14 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)).
 		WithCheck("antivirus reachability", func(ctx context.Context) error {
 			cfg := options.Config
 			switch cfg.Scanner.Type {
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -13,9 +14,14 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))

 	return debug.NewService(
 		debug.Logger(options.Logger),
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -13,9 +14,14 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))

 	return debug.NewService(
 		debug.Logger(options.Logger),
@@ -83,7 +83,8 @@ EventLoop:
 			if !ok {
 				break EventLoop
 			}
-			cl.processEvent(event)
+
+			go cl.processEvent(event)

 			if cl.stopped.Load() {
 				break EventLoop
@@ -101,6 +101,9 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Database(cfg.Store.Database),
 				microstore.Table(cfg.Store.Table),
 				store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
+				store.TLSEnabled(cfg.Store.EnableTLS),
+				store.TLSInsecure(cfg.Store.TLSInsecure),
+				store.TLSRootCA(cfg.Store.TLSRootCACertificate),
 			)

 			gr := runner.NewGroup()
@@ -4,11 +4,14 @@ import "time"

 // Store configures the store to use
 type Store struct {
-	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;COLLABORATION_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;COLLABORATION_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database     string        `yaml:"database" env:"COLLABORATION_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table        string        `yaml:"table" env:"COLLABORATION_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;COLLABORATION_STORE_TTL" desc:"Time to live for events in the store. Defaults to '30m' (30 minutes). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;COLLABORATION_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;COLLABORATION_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;COLLABORATION_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;COLLABORATION_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"COLLABORATION_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table                string        `yaml:"table" env:"COLLABORATION_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;COLLABORATION_STORE_TTL" desc:"Time to live for events in the store. Defaults to '30m' (30 minutes). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;COLLABORATION_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;COLLABORATION_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;COLLABORATION_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;COLLABORATION_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;COLLABORATION_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided COLLABORATION_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }
@@ -71,6 +71,9 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Database(cfg.Store.Database),
 				microstore.Table(cfg.Store.Table),
 				store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
+				store.TLSEnabled(cfg.Store.EnableTLS),
+				store.TLSInsecure(cfg.Store.TLSInsecure),
+				store.TLSRootCA(cfg.Store.TLSRootCACertificate),
 			)

 			service := grpc.NewService(
@@ -36,13 +36,16 @@ type GRPCConfig struct {

 // Store configures the store to use
 type Store struct {
-	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;EVENTHISTORY_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;EVENTHISTORY_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database     string        `yaml:"database" env:"EVENTHISTORY_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table        string        `yaml:"table" env:"EVENTHISTORY_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;EVENTHISTORY_STORE_TTL" desc:"Time to live for events in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;EVENTHISTORY_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;EVENTHISTORY_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;EVENTHISTORY_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;EVENTHISTORY_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"EVENTHISTORY_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table                string        `yaml:"table" env:"EVENTHISTORY_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;EVENTHISTORY_STORE_TTL" desc:"Time to live for events in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;EVENTHISTORY_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;EVENTHISTORY_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;EVENTHISTORY_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;EVENTHISTORY_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;EVENTHISTORY_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided EVENTHISTORY_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }

 // Events combines the configuration options for the event bus.
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -17,8 +18,13 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))

 	return debug.NewService(
 		debug.Logger(options.Logger),
@@ -63,8 +63,6 @@ type Config struct {

 	Groupware Groupware `yaml:"groupware"`

-	OpenXchange OpenXchange `yaml:"open_xchange"`
-
 	Context context.Context `yaml:"-"`
 }

@@ -123,26 +121,29 @@ type DataGateway struct {
 }

 type OCS struct {
-	Prefix                      string        `yaml:"prefix" env:"FRONTEND_OCS_PREFIX" desc:"URL path prefix for the OCS service. Note that the string must not start with '/'." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	SharePrefix                 string        `yaml:"share_prefix" env:"FRONTEND_OCS_SHARE_PREFIX" desc:"Path prefix for shares as part of a CS3 resource. Note that the path must start with '/'." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	HomeNamespace               string        `yaml:"home_namespace" env:"FRONTEND_OCS_PERSONAL_NAMESPACE" desc:"Home namespace identifier." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	AdditionalInfoAttribute     string        `yaml:"additional_info_attribute" env:"FRONTEND_OCS_ADDITIONAL_INFO_ATTRIBUTE" desc:"Additional information attribute for the user like {{.Mail}}." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	StatCacheType               string        `yaml:"stat_cache_type" env:"OC_CACHE_STORE;FRONTEND_OCS_STAT_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_STORE, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheNodes              []string      `yaml:"stat_cache_nodes" env:"OC_CACHE_STORE_NODES;FRONTEND_OCS_STAT_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_STORE_NODES, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheDatabase           string        `yaml:"stat_cache_database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	StatCacheTable              string        `yaml:"stat_cache_table" env:"FRONTEND_OCS_STAT_CACHE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	StatCacheTTL                time.Duration `yaml:"stat_cache_ttl" env:"OC_CACHE_TTL;FRONTEND_OCS_STAT_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_TTL, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheDisablePersistence bool          `yaml:"stat_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;FRONTEND_OCS_STAT_CACHE_DISABLE_PERSISTENCE" desc:"Disable persistence of the cache. Only applies when using the 'nats-js-kv' store type. Defaults to false." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_DISABLE_PERSISTENCE, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheAuthUsername       string        `yaml:"stat_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;FRONTEND_OCS_STAT_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when using the 'nats-js-kv' store type." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_AUTH_USERNAME, the OCS API is deprecated" deprecationReplacement:""`
-	StatCacheAuthPassword       string        `yaml:"stat_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;FRONTEND_OCS_STAT_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when using the 'nats-js-kv' store type." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_AUTH_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
+	Prefix                        string        `yaml:"prefix" env:"FRONTEND_OCS_PREFIX" desc:"URL path prefix for the OCS service. Note that the string must not start with '/'." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	SharePrefix                   string        `yaml:"share_prefix" env:"FRONTEND_OCS_SHARE_PREFIX" desc:"Path prefix for shares as part of a CS3 resource. Note that the path must start with '/'." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	HomeNamespace                 string        `yaml:"home_namespace" env:"FRONTEND_OCS_PERSONAL_NAMESPACE" desc:"Home namespace identifier." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	AdditionalInfoAttribute       string        `yaml:"additional_info_attribute" env:"FRONTEND_OCS_ADDITIONAL_INFO_ATTRIBUTE" desc:"Additional information attribute for the user like {{.Mail}}." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	StatCacheType                 string        `yaml:"stat_cache_type" env:"OC_CACHE_STORE;FRONTEND_OCS_STAT_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_STORE, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheNodes                []string      `yaml:"stat_cache_nodes" env:"OC_CACHE_STORE_NODES;FRONTEND_OCS_STAT_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_STORE_NODES, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheDatabase             string        `yaml:"stat_cache_database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	StatCacheTable                string        `yaml:"stat_cache_table" env:"FRONTEND_OCS_STAT_CACHE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	StatCacheTTL                  time.Duration `yaml:"stat_cache_ttl" env:"OC_CACHE_TTL;FRONTEND_OCS_STAT_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_TTL, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheDisablePersistence   bool          `yaml:"stat_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;FRONTEND_OCS_STAT_CACHE_DISABLE_PERSISTENCE" desc:"Disable persistence of the cache. Only applies when using the 'nats-js-kv' store type. Defaults to false." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_DISABLE_PERSISTENCE, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheAuthUsername         string        `yaml:"stat_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;FRONTEND_OCS_STAT_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when using the 'nats-js-kv' store type." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_AUTH_USERNAME, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheAuthPassword         string        `yaml:"stat_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;FRONTEND_OCS_STAT_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when using the 'nats-js-kv' store type." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_STAT_CACHE_AUTH_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
+	StatCacheEnableTLS            bool          `yaml:"stat_cache_enable_tls" env:"OC_CACHE_ENABLE_TLS;FRONTEND_OCS_STAT_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	StatCacheTLSInsecure          bool          `yaml:"stat_cache_tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;FRONTEND_OCS_STAT_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	StatCacheTLSRootCACertificate string        `yaml:"stat_cache_tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;FRONTEND_OCS_STAT_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided FRONTEND_OCS_STAT_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`

 	CacheWarmupDriver                    string             `yaml:"cache_warmup_driver,omitempty"`  // not supported by the OpenCloud product, therefore not part of docs
 	CacheWarmupDrivers                   CacheWarmupDrivers `yaml:"cache_warmup_drivers,omitempty"` // not supported by the OpenCloud product, therefore not part of docs
-	EnableDenials                        bool               `yaml:"enable_denials" env:"FRONTEND_OCS_ENABLE_DENIALS" desc:"EXPERIMENTAL: enable the feature to deny access on folders." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
-	ListOCMShares                        bool               `yaml:"list_ocm_shares" env:"OC_ENABLE_OCM;FRONTEND_OCS_LIST_OCM_SHARES" desc:"Include OCM shares when listing shares. See the OCM service documentation for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_LIST_OCM_SHARES, the OCS API is deprecated" deprecationReplacement:""`
-	IncludeOCMSharees                    bool               `yaml:"include_ocm_sharees" env:"OC_ENABLE_OCM;FRONTEND_OCS_INCLUDE_OCM_SHAREES" desc:"Include OCM sharees when listing sharees." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_INCLUDE_OCM_SHAREES, the OCS API is deprecated" deprecationReplacement:""`
-	PublicShareMustHavePassword          bool               `yaml:"public_sharing_share_must_have_password" env:"OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD;FRONTEND_OCS_PUBLIC_SHARE_MUST_HAVE_PASSWORD" desc:"Set this to true if you want to enforce passwords on all public shares." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_PUBLIC_SHARE_MUST_HAVE_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
-	WriteablePublicShareMustHavePassword bool               `yaml:"public_sharing_writeableshare_must_have_password" env:"OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD;FRONTEND_OCS_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD" desc:"Set this to true if you want to enforce passwords for writable shares. Only effective if the setting for 'passwords on all public shares' is set to false." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"FRONTEND_OCS_PUBLIC_WRITABLE_SHARE_MUST_HAVE_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
+	EnableDenials                        bool               `yaml:"enable_denials" env:"FRONTEND_OCS_ENABLE_DENIALS" desc:"EXPERIMENTAL: enable the feature to deny access on folders." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"The OCS API is deprecated" deprecationReplacement:""`
+	ListOCMShares                        bool               `yaml:"list_ocm_shares" env:"OC_ENABLE_OCM;FRONTEND_OCS_LIST_OCM_SHARES" desc:"Include OCM shares when listing shares. See the OCM service documentation for more details." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_LIST_OCM_SHARES, the OCS API is deprecated" deprecationReplacement:""`
+	IncludeOCMSharees                    bool               `yaml:"include_ocm_sharees" env:"OC_ENABLE_OCM;FRONTEND_OCS_INCLUDE_OCM_SHAREES" desc:"Include OCM sharees when listing sharees." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_INCLUDE_OCM_SHAREES, the OCS API is deprecated" deprecationReplacement:""`
+	PublicShareMustHavePassword          bool               `yaml:"public_sharing_share_must_have_password" env:"OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD;FRONTEND_OCS_PUBLIC_SHARE_MUST_HAVE_PASSWORD" desc:"Set this to true if you want to enforce passwords on all public shares." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_PUBLIC_SHARE_MUST_HAVE_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
+	WriteablePublicShareMustHavePassword bool               `yaml:"public_sharing_writeableshare_must_have_password" env:"OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD;FRONTEND_OCS_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD" desc:"Set this to true if you want to enforce passwords for writable shares. Only effective if the setting for 'passwords on all public shares' is set to false." introductionVersion:"1.0.0" deprecationVersion:"1.0.0" removalVersion:"7.2.0" deprecationInfo:"FRONTEND_OCS_PUBLIC_WRITABLE_SHARE_MUST_HAVE_PASSWORD, the OCS API is deprecated" deprecationReplacement:""`
 	ShowUserEmailInResults               bool               `yaml:"show_email_in_results" env:"OC_SHOW_USER_EMAIL_IN_RESULTS" desc:"Include user email addresses in responses. If absent or set to false emails will be omitted from results. Please note that admin users can always see all email addresses." introductionVersion:"1.0.0"`
 }

@@ -225,8 +226,3 @@ type PasswordPolicy struct {
 type Groupware struct {
 	Enabled bool `yaml:"enabled" env:"FRONTEND_GROUPWARE_ENABLED" desc:"Enable groupware features. Defaults to false." introductionVersion:"3.7.0"`
 }
-
-type OpenXchange struct {
-	Enabled bool   `yaml:"enabled" env:"FRONTEND_OPENXCHANGE_ENABLED" desc:"Enable Open-Xchange integration. Defaults to false." introductionVersion:"%%NEXT_PRODUCTION_VERSION%%"`
-	ApiUrl  string `yaml:"api_url" env:"FRONTEND_OPENXCHANGE_API_URL" desc:"The URL of the Open-Xchange API. Required if Open-Xchange integration is enabled." introductionVersion:"%%NEXT_PRODUCTION_VERSION%%"`
-}
@@ -158,10 +158,6 @@ func DefaultConfig() *config.Config {
 		Groupware: config.Groupware{
 			Enabled: false,
 		},
-		OpenXchange: config.OpenXchange{
-			Enabled: false,
-			ApiUrl:  "",
-		},
 	}
 }

@@ -164,14 +164,17 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 					"share_prefix":         cfg.OCS.SharePrefix,
 					"home_namespace":       cfg.OCS.HomeNamespace,
 					"stat_cache_config": map[string]any{
-						"cache_store":               cfg.OCS.StatCacheType,
-						"cache_nodes":               cfg.OCS.StatCacheNodes,
-						"cache_database":            cfg.OCS.StatCacheDatabase,
-						"cache_table":               cfg.OCS.StatCacheTable,
-						"cache_ttl":                 cfg.OCS.StatCacheTTL,
-						"cache_disable_persistence": cfg.OCS.StatCacheDisablePersistence,
-						"cache_auth_username":       cfg.OCS.StatCacheAuthUsername,
-						"cache_auth_password":       cfg.OCS.StatCacheAuthPassword,
+						"cache_store":                   cfg.OCS.StatCacheType,
+						"cache_nodes":                   cfg.OCS.StatCacheNodes,
+						"cache_database":                cfg.OCS.StatCacheDatabase,
+						"cache_table":                   cfg.OCS.StatCacheTable,
+						"cache_ttl":                     cfg.OCS.StatCacheTTL,
+						"cache_disable_persistence":     cfg.OCS.StatCacheDisablePersistence,
+						"cache_auth_username":           cfg.OCS.StatCacheAuthUsername,
+						"cache_auth_password":           cfg.OCS.StatCacheAuthPassword,
+						"cache_tls_enabled":             cfg.OCS.StatCacheEnableTLS,
+						"cache_tls_insecure":            cfg.OCS.StatCacheTLSInsecure,
+						"cache_tls_root_ca_certificate": cfg.OCS.StatCacheTLSRootCACertificate,
 					},
 					"prefix":                    cfg.OCS.Prefix,
 					"additional_info_attribute": cfg.OCS.AdditionalInfoAttribute,
@@ -343,10 +346,6 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 							"groupware": map[string]any{
 								"enabled": cfg.Groupware.Enabled,
 							},
-							"open_xchange": map[string]any{
-								"enabled": cfg.OpenXchange.Enabled,
-								"api_url": cfg.OpenXchange.ApiUrl,
-							},
 						},
 						"version": map[string]any{
 							"product":        "OpenCloud",
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -17,8 +18,13 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))

 	return debug.NewService(
 		debug.Logger(options.Logger),
@@ -84,11 +84,18 @@ type Cache struct {
 	ProviderCacheDisablePersistence   bool          `yaml:"provider_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GATEWAY_PROVIDER_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the provider cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
 	ProviderCacheAuthUsername         string        `yaml:"provider_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;GATEWAY_PROVIDER_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
 	ProviderCacheAuthPassword         string        `yaml:"provider_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;GATEWAY_PROVIDER_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	CreateHomeCacheStore              string        `yaml:"create_home_cache_store" env:"OC_CACHE_STORE;GATEWAY_CREATE_HOME_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	CreateHomeCacheNodes              []string      `yaml:"create_home_cache_nodes" env:"OC_CACHE_STORE_NODES;GATEWAY_CREATE_HOME_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	CreateHomeCacheDatabase           string        `yaml:"create_home_cache_database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	CreateHomeCacheTTL                time.Duration `yaml:"create_home_cache_ttl" env:"OC_CACHE_TTL;GATEWAY_CREATE_HOME_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	CreateHomeCacheDisablePersistence bool          `yaml:"create_home_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GATEWAY_CREATE_HOME_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the create home cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	CreateHomeCacheAuthUsername       string        `yaml:"create_home_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;GATEWAY_CREATE_HOME_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	CreateHomeCacheAuthPassword       string        `yaml:"create_home_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;GATEWAY_CREATE_HOME_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	ProviderCacheEnableTLS            bool          `yaml:"provider_cache_enable_tls" env:"OC_CACHE_ENABLE_TLS;GATEWAY_PROVIDER_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	ProviderCacheTLSInsecure          bool          `yaml:"provider_cache_tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;GATEWAY_PROVIDER_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	ProviderCacheTLSRootCACertificate string        `yaml:"provider_cache_tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;GATEWAY_PROVIDER_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GATEWAY_PROVIDER_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
+
+	CreateHomeCacheStore                string        `yaml:"create_home_cache_store" env:"OC_CACHE_STORE;GATEWAY_CREATE_HOME_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	CreateHomeCacheNodes                []string      `yaml:"create_home_cache_nodes" env:"OC_CACHE_STORE_NODES;GATEWAY_CREATE_HOME_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	CreateHomeCacheDatabase             string        `yaml:"create_home_cache_database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	CreateHomeCacheTTL                  time.Duration `yaml:"create_home_cache_ttl" env:"OC_CACHE_TTL;GATEWAY_CREATE_HOME_CACHE_TTL" desc:"Default time to live for user info in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	CreateHomeCacheDisablePersistence   bool          `yaml:"create_home_cache_disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GATEWAY_CREATE_HOME_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the create home cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	CreateHomeCacheAuthUsername         string        `yaml:"create_home_cache_auth_username" env:"OC_CACHE_AUTH_USERNAME;GATEWAY_CREATE_HOME_CACHE_AUTH_USERNAME" desc:"The username to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	CreateHomeCacheAuthPassword         string        `yaml:"create_home_cache_auth_password" env:"OC_CACHE_AUTH_PASSWORD;GATEWAY_CREATE_HOME_CACHE_AUTH_PASSWORD" desc:"The password to use for authentication. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	CreateHomeCacheEnableTLS            bool          `yaml:"create_home_cache_enable_tls" env:"OC_CACHE_ENABLE_TLS;GATEWAY_CREATE_HOME_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	CreateHomeCacheTLSInsecure          bool          `yaml:"create_home_cache_tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;GATEWAY_CREATE_HOME_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	CreateHomeCacheTLSRootCACertificate string        `yaml:"create_home_cache_tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;GATEWAY_CREATE_HOME_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GATEWAY_CREATE_HOME_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }
@@ -45,15 +45,15 @@ func GatewayConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]a
 					"groupprovidersvc": cfg.GroupsEndpoint,
 					"permissionssvc":   cfg.PermissionsEndpoint,
 					// sharing is located on the sharing service
-					"usershareprovidersvc":          cfg.SharingEndpoint,
-					"publicshareprovidersvc":        cfg.SharingEndpoint,
-					"ocmshareprovidersvc":           cfg.OCMEndpoint,
-					"ocminvitemanagersvc":           cfg.OCMEndpoint,
-					"ocmproviderauthorizersvc":      cfg.OCMEndpoint,
-					"ocmcoresvc":                    cfg.OCMEndpoint,
+					"usershareprovidersvc":              cfg.SharingEndpoint,
+					"publicshareprovidersvc":            cfg.SharingEndpoint,
+					"ocmshareprovidersvc":               cfg.OCMEndpoint,
+					"ocminvitemanagersvc":               cfg.OCMEndpoint,
+					"ocmproviderauthorizersvc":          cfg.OCMEndpoint,
+					"ocmcoresvc":                        cfg.OCMEndpoint,
 					"use_common_space_root_share_logic": true,
-				"commit_share_to_storage_grant":    cfg.CommitShareToStorageGrant,
-					"share_folder":                  cfg.ShareFolder, // ShareFolder is the location where to create shares in the recipient's storage provider.
+					"commit_share_to_storage_grant":     cfg.CommitShareToStorageGrant,
+					"share_folder":                      cfg.ShareFolder, // ShareFolder is the location where to create shares in the recipient's storage provider.
 					// other
 					"disable_home_creation_on_login": cfg.DisableHomeCreationOnLogin,
 					"datagateway":                    strings.TrimRight(cfg.FrontendPublicURL, "/") + "/data",
@@ -71,14 +71,17 @@ func GatewayConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]a
 						"cache_auth_password": cfg.Cache.ProviderCacheAuthPassword,
 					},
 					"create_personal_space_cache_config": map[string]any{
-						"cache_store":               cfg.Cache.CreateHomeCacheStore,
-						"cache_nodes":               cfg.Cache.CreateHomeCacheNodes,
-						"cache_database":            cfg.Cache.CreateHomeCacheDatabase,
-						"cache_table":               "create_personal_space",
-						"cache_ttl":                 cfg.Cache.CreateHomeCacheTTL,
-						"cache_disable_persistence": cfg.Cache.CreateHomeCacheDisablePersistence,
-						"cache_auth_username":       cfg.Cache.CreateHomeCacheAuthUsername,
-						"cache_auth_password":       cfg.Cache.CreateHomeCacheAuthPassword,
+						"cache_store":                   cfg.Cache.CreateHomeCacheStore,
+						"cache_nodes":                   cfg.Cache.CreateHomeCacheNodes,
+						"cache_database":                cfg.Cache.CreateHomeCacheDatabase,
+						"cache_table":                   "create_personal_space",
+						"cache_ttl":                     cfg.Cache.CreateHomeCacheTTL,
+						"cache_disable_persistence":     cfg.Cache.CreateHomeCacheDisablePersistence,
+						"cache_auth_username":           cfg.Cache.CreateHomeCacheAuthUsername,
+						"cache_auth_password":           cfg.Cache.CreateHomeCacheAuthPassword,
+						"cache_tls_enabled":             cfg.Cache.CreateHomeCacheEnableTLS,
+						"cache_tls_insecure":            cfg.Cache.CreateHomeCacheTLSInsecure,
+						"cache_tls_root_ca_certificate": cfg.Cache.CreateHomeCacheTLSRootCACertificate,
 					},
 				},
 				"authregistry": map[string]any{
@@ -18,6 +18,7 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("nats reachability", func(ctx context.Context) error {
 			if options.Config.Cache.ProviderCacheStore == "nats-js-kv" && len(options.Config.Cache.ProviderCacheNodes) > 0 {
+				// no secureOption because we cannot yet configure tls for the cache store
 				return checks.NewNatsCheck(options.Config.Cache.ProviderCacheNodes[0])(ctx)
 			}
 			return nil
@@ -4,9 +4,11 @@ import (
 	"context"
 	"fmt"
 	"os/signal"
+	"strings"

 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
 	"github.com/opencloud-eu/opencloud/pkg/log"
+	natspkg "github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/runner"
 	"github.com/opencloud-eu/opencloud/pkg/tracing"
 	"github.com/opencloud-eu/opencloud/pkg/version"
@@ -50,13 +52,9 @@ func Server(cfg *config.Config) *cobra.Command {
 			var kv jetstream.KeyValue
 			// Allow to run without a NATS store (e.g. for the standalone Education provisioning service)
 			if len(cfg.Store.Nodes) > 0 {
-				//Connect to NATS servers
-				natsOptions := nats.Options{
-					Servers:  cfg.Store.Nodes,
-					User:     cfg.Store.AuthUsername,
-					Password: cfg.Store.AuthPassword,
-				}
-				conn, err := natsOptions.Connect()
+				// Connect to NATS servers
+				secureOption := natspkg.Secure(cfg.Store.EnableTLS, cfg.Store.TLSInsecure, cfg.Store.TLSRootCACertificate)
+				conn, err := nats.Connect(strings.Join(cfg.Store.Nodes, ","), secureOption, nats.UserInfo(cfg.Store.AuthUsername, cfg.Store.AuthPassword))
 				if err != nil {
 					return err
 				}
@@ -4,12 +4,15 @@ import "time"

 // Cache defines the available configuration for a cache store
 type Cache struct {
-	Store              string        `yaml:"store" env:"OC_CACHE_STORE;GRAPH_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes              []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;GRAPH_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store are configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database           string        `yaml:"database" env:"GRAPH_CACHE_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table              string        `yaml:"table" env:"GRAPH_CACHE_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;GRAPH_CACHE_TTL" desc:"Time to live for cache records in the graph. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GRAPH_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;GRAPH_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;GRAPH_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_CACHE_STORE;GRAPH_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;GRAPH_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store are configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"GRAPH_CACHE_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table                string        `yaml:"table" env:"GRAPH_CACHE_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;GRAPH_CACHE_TTL" desc:"Time to live for cache records in the graph. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;GRAPH_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;GRAPH_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;GRAPH_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;GRAPH_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;GRAPH_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;GRAPH_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GRAPH_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }
@@ -172,8 +172,11 @@ type Metadata struct {

 // Store configures the store to use
 type Store struct {
-	Nodes        []string `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;GRAPH_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database     string   `yaml:"database" env:"GRAPH_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	AuthUsername string   `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;GRAPH_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword string   `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;GRAPH_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Nodes                []string `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;GRAPH_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string   `yaml:"database" env:"GRAPH_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	AuthUsername         string   `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;GRAPH_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string   `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;GRAPH_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool     `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;GRAPH_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
+	TLSInsecure          bool     `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;GRAPH_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string   `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;GRAPH_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided GRAPH_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }
@@ -6,6 +6,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -32,8 +33,13 @@ func Server(opts ...Option) (*http.Server, error) {

 	// only check nats if really needed
 	if options.Config.Events.Endpoint != "" {
+		secureOption := nats.Secure(
+			options.Config.Events.EnableTLS,
+			options.Config.Events.TLSInsecure,
+			options.Config.Events.TLSRootCACertificate,
+		)
 		readyHandlerConfiguration = readyHandlerConfiguration.
-			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))
 	}

 	return debug.NewService(
@@ -22,7 +22,6 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
-
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"github.com/opencloud-eu/reva/v2/pkg/publicshare"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
@@ -30,16 +29,14 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"

-	"github.com/opencloud-eu/opencloud/pkg/l10n"
-	l10n_pkg "github.com/opencloud-eu/opencloud/services/graph/pkg/l10n"
-	"github.com/opencloud-eu/opencloud/services/graph/pkg/odata"
-
 	"github.com/opencloud-eu/opencloud/pkg/conversions"
+	"github.com/opencloud-eu/opencloud/pkg/l10n"
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity/cache"
+	"github.com/opencloud-eu/opencloud/services/graph/pkg/odata"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/unifiedrole"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/validate"
 )
@@ -755,16 +752,8 @@ func (api DriveItemPermissionsApi) ListPermissions(w http.ResponseWriter, r *htt

 	loc := r.Header.Get(l10n.HeaderAcceptLanguage)
 	w.Header().Add("Content-Language", loc)
-	if loc != "" && loc != "en" {
-		err := l10n_pkg.TranslateEntity(loc, "en", permissions,
-			l10n.TranslateEach("LibreGraphPermissionsRolesAllowedValues",
-				l10n.TranslateField("Description"),
-				l10n.TranslateField("DisplayName"),
-			),
-		)
-		if err != nil {
-			api.logger.Error().Err(err).Msg("tranlation error")
-		}
+	for i := range permissions.LibreGraphPermissionsRolesAllowedValues {
+		permissions.LibreGraphPermissionsRolesAllowedValues[i] = unifiedrole.LocalizeRole(&permissions.LibreGraphPermissionsRolesAllowedValues[i], loc)
 	}

 	render.Status(r, http.StatusOK)
@@ -806,16 +795,8 @@ func (api DriveItemPermissionsApi) ListSpaceRootPermissions(w http.ResponseWrite

 	loc := r.Header.Get(l10n.HeaderAcceptLanguage)
 	w.Header().Add("Content-Language", loc)
-	if loc != "" && loc != "en" {
-		err := l10n_pkg.TranslateEntity(loc, "en", permissions,
-			l10n.TranslateEach("LibreGraphPermissionsRolesAllowedValues",
-				l10n.TranslateField("Description"),
-				l10n.TranslateField("DisplayName"),
-			),
-		)
-		if err != nil {
-			api.logger.Error().Err(err).Msg("tranlation error")
-		}
+	for i := range permissions.LibreGraphPermissionsRolesAllowedValues {
+		permissions.LibreGraphPermissionsRolesAllowedValues[i] = unifiedrole.LocalizeRole(&permissions.LibreGraphPermissionsRolesAllowedValues[i], loc)
 	}

 	render.Status(r, http.StatusOK)
@@ -1119,7 +1119,7 @@ func (g Graph) DeleteDrive(w http.ResponseWriter, r *http.Request) {
 		return
 	case cs3rpc.Code_CODE_PERMISSION_DENIED:
 		logger.Debug().Interface("id", rid).Msg("could not delete drive: permission denied")
-		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, "drive not found")
+		errorcode.AccessDenied.Render(w, r, http.StatusForbidden, "permission denied")
 		return
 	case cs3rpc.Code_CODE_NOT_FOUND:
 		logger.Debug().Interface("id", rid).Msg("could not delete drive: drive not found")
@@ -7,14 +7,17 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/render"

+	"github.com/opencloud-eu/opencloud/pkg/l10n"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/unifiedrole"
 )

 // GetRoleDefinitions a list of permission roles than can be used when sharing with users or groups
 func (g Graph) GetRoleDefinitions(w http.ResponseWriter, r *http.Request) {
+	loc := r.Header.Get(l10n.HeaderAcceptLanguage)
+	w.Header().Add("Content-Language", loc)
 	render.Status(r, http.StatusOK)
-	render.JSON(w, r, g.availableRoles)
+	render.JSON(w, r, unifiedrole.LocalizeRoles(g.availableRoles, loc))
 }

 // GetRoleDefinition a permission role than can be used when sharing with users or groups
@@ -32,6 +35,8 @@ func (g Graph) GetRoleDefinition(w http.ResponseWriter, r *http.Request) {
 		errorcode.ItemNotFound.Render(w, r, http.StatusNotFound, err.Error())
 		return
 	}
+	loc := r.Header.Get(l10n.HeaderAcceptLanguage)
+	w.Header().Add("Content-Language", loc)
 	render.Status(r, http.StatusOK)
-	render.JSON(w, r, role)
+	render.JSON(w, r, unifiedrole.LocalizeRole(role, loc))
 }
@@ -0,0 +1,170 @@
+package svc_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	cs3mocks "github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks"
+	"google.golang.org/grpc"
+
+	"github.com/opencloud-eu/opencloud/pkg/shared"
+	"github.com/opencloud-eu/opencloud/services/graph/mocks"
+	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
+	"github.com/opencloud-eu/opencloud/services/graph/pkg/config/defaults"
+	service "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
+	"github.com/opencloud-eu/opencloud/services/graph/pkg/unifiedrole"
+)
+
+var _ = Describe("RoleManagement", func() {
+	var (
+		svc             service.Service
+		gatewayClient   *cs3mocks.GatewayAPIClient
+		gatewaySelector pool.Selectable[gateway.GatewayAPIClient]
+		eventsPublisher mocks.Publisher
+		permSvc         mocks.Permissions
+		cfg             *config.Config
+		rr              *httptest.ResponseRecorder
+		ctx             context.Context
+	)
+
+	BeforeEach(func() {
+		rr = httptest.NewRecorder()
+		ctx = context.Background()
+
+		cfg = defaults.FullDefaultConfig()
+		cfg.Identity.LDAP.CACert = ""
+		cfg.TokenManager.JWTSecret = "loremipsum"
+		cfg.Commons = &shared.Commons{}
+		cfg.GRPCClientTLS = &shared.GRPCClientTLS{}
+
+		pool.RemoveSelector("GatewaySelector" + "eu.opencloud.api.gateway")
+		gatewayClient = &cs3mocks.GatewayAPIClient{}
+		gatewaySelector = pool.GetSelector[gateway.GatewayAPIClient](
+			"GatewaySelector",
+			"eu.opencloud.api.gateway",
+			func(cc grpc.ClientConnInterface) gateway.GatewayAPIClient {
+				return gatewayClient
+			},
+		)
+		eventsPublisher = mocks.Publisher{}
+		permSvc = mocks.Permissions{}
+
+		var err error
+		svc, err = service.NewService(
+			service.Config(cfg),
+			service.WithGatewaySelector(gatewaySelector),
+			service.EventsPublisher(&eventsPublisher),
+			service.PermissionService(&permSvc),
+		)
+		Expect(err).ToNot(HaveOccurred())
+	})
+
+	Describe("GetRoleDefinitions", func() {
+		It("returns all available roles in English when no Accept-Language is set", func() {
+			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions", nil)
+			r = r.WithContext(ctx)
+			svc.ServeHTTP(rr, r)
+
+			Expect(rr.Code).To(Equal(http.StatusOK))
+
+			var roles []libregraph.UnifiedRoleDefinition
+			Expect(json.Unmarshal(rr.Body.Bytes(), &roles)).To(Succeed())
+			Expect(roles).NotTo(BeEmpty())
+
+			viewer := findRoleByID(roles, unifiedrole.UnifiedRoleViewerID)
+			Expect(viewer).NotTo(BeNil())
+			Expect(viewer.GetDisplayName()).To(Equal("Can view"))
+		})
+
+		It("returns translated roles when Accept-Language is German", func() {
+			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions", nil)
+			r.Header.Set("Accept-Language", "de")
+			r = r.WithContext(ctx)
+			svc.ServeHTTP(rr, r)
+
+			Expect(rr.Code).To(Equal(http.StatusOK))
+			Expect(rr.Header().Get("Content-Language")).To(Equal("de"))
+
+			var roles []libregraph.UnifiedRoleDefinition
+			Expect(json.Unmarshal(rr.Body.Bytes(), &roles)).To(Succeed())
+
+			viewer := findRoleByID(roles, unifiedrole.UnifiedRoleViewerID)
+			Expect(viewer).NotTo(BeNil())
+			Expect(viewer.GetDisplayName()).To(Equal("Kann anzeigen"))
+			Expect(viewer.GetDescription()).To(Equal("Ansehen und herunterladen."))
+		})
+
+		It("does not mutate the global buildInRoles after a German request", func() {
+			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions", nil)
+			r.Header.Set("Accept-Language", "de")
+			r = r.WithContext(ctx)
+			svc.ServeHTTP(rr, r)
+			Expect(rr.Code).To(Equal(http.StatusOK))
+
+			// A second request without a locale must still return English
+			rr2 := httptest.NewRecorder()
+			r2 := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions", nil)
+			r2 = r2.WithContext(ctx)
+			svc.ServeHTTP(rr2, r2)
+			Expect(rr2.Code).To(Equal(http.StatusOK))
+
+			var roles []libregraph.UnifiedRoleDefinition
+			Expect(json.Unmarshal(rr2.Body.Bytes(), &roles)).To(Succeed())
+			viewer := findRoleByID(roles, unifiedrole.UnifiedRoleViewerID)
+			Expect(viewer).NotTo(BeNil())
+			Expect(viewer.GetDisplayName()).To(Equal("Can view"))
+		})
+	})
+
+	Describe("GetRoleDefinition", func() {
+		It("returns a single role in English when no Accept-Language is set", func() {
+			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions/"+unifiedrole.UnifiedRoleViewerID, nil)
+			r = r.WithContext(ctx)
+			svc.ServeHTTP(rr, r)
+
+			Expect(rr.Code).To(Equal(http.StatusOK))
+			var role libregraph.UnifiedRoleDefinition
+			Expect(json.Unmarshal(rr.Body.Bytes(), &role)).To(Succeed())
+			Expect(role.GetDisplayName()).To(Equal("Can view"))
+		})
+
+		It("returns a single role translated when Accept-Language is German", func() {
+			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions/"+unifiedrole.UnifiedRoleViewerID, nil)
+			r.Header.Set("Accept-Language", "de")
+			r = r.WithContext(ctx)
+			svc.ServeHTTP(rr, r)
+
+			Expect(rr.Code).To(Equal(http.StatusOK))
+			Expect(rr.Header().Get("Content-Language")).To(Equal("de"))
+			var role libregraph.UnifiedRoleDefinition
+			Expect(json.Unmarshal(rr.Body.Bytes(), &role)).To(Succeed())
+			Expect(role.GetDisplayName()).To(Equal("Kann anzeigen"))
+			Expect(role.GetDescription()).To(Equal("Ansehen und herunterladen."))
+		})
+
+		It("returns 404 for an unknown roleID", func() {
+			r := httptest.NewRequest(http.MethodGet, "/graph/v1beta1/roleManagement/permissions/roleDefinitions/unknown-role-id", nil)
+			r = r.WithContext(ctx)
+			svc.ServeHTTP(rr, r)
+
+			Expect(rr.Code).To(Equal(http.StatusNotFound))
+		})
+	})
+})
+
+// findRoleByID returns the first role with the given ID from the slice, or nil.
+func findRoleByID(roles []libregraph.UnifiedRoleDefinition, id string) *libregraph.UnifiedRoleDefinition {
+	for i := range roles {
+		if roles[i].GetId() == id {
+			return &roles[i]
+		}
+	}
+	return nil
+}
@@ -6,11 +6,11 @@ import (
 	"strings"

 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
+	"github.com/opencloud-eu/reva/v2/pkg/conversions"
 	"google.golang.org/protobuf/proto"

-	"github.com/opencloud-eu/reva/v2/pkg/conversions"
-
 	"github.com/opencloud-eu/opencloud/pkg/l10n"
+	graphl10n "github.com/opencloud-eu/opencloud/services/graph/pkg/l10n"
 )

 const (
@@ -546,6 +546,46 @@ func weightRoles(roleSet []*libregraph.UnifiedRoleDefinition, constraints string
 	return roleSet
 }

+// cloneRole returns a shallow struct copy of r with independent allocations for
+// the Description and DisplayName pointer fields — the only fields mutated by
+// TranslateEntity. All other fields (Id, LibreGraphWeight, RolePermissions) are
+// either read-only or stripped before rendering, so sharing their values is safe.
+func cloneRole(r *libregraph.UnifiedRoleDefinition) libregraph.UnifiedRoleDefinition {
+	c := *r
+	if r.Description != nil {
+		s := *r.Description
+		c.Description = &s
+	}
+	if r.DisplayName != nil {
+		s := *r.DisplayName
+		c.DisplayName = &s
+	}
+	return c
+}
+
+// LocalizeRole returns a translated, independent copy of a single role definition.
+// The global buildInRoles singleton is never modified.
+func LocalizeRole(r *libregraph.UnifiedRoleDefinition, locale string) libregraph.UnifiedRoleDefinition {
+	c := cloneRole(r)
+	if locale != "" && locale != "en" {
+		_ = graphl10n.TranslateEntity(locale, "en", &c,
+			l10n.TranslateField("Description"),
+			l10n.TranslateField("DisplayName"),
+		)
+	}
+	return c
+}
+
+// LocalizeRoles returns a translated, independent copy of each role definition.
+// The global buildInRoles singleton is never modified.
+func LocalizeRoles(roles []*libregraph.UnifiedRoleDefinition, locale string) []libregraph.UnifiedRoleDefinition {
+	out := make([]libregraph.UnifiedRoleDefinition, len(roles))
+	for i, r := range roles {
+		out[i] = LocalizeRole(r, locale)
+	}
+	return out
+}
+
 // GetAllowedResourceActions returns the allowed resource actions for the provided role by condition
 func GetAllowedResourceActions(role *libregraph.UnifiedRoleDefinition, condition string) []string {
 	if role == nil {
@@ -2,6 +2,7 @@ package unifiedrole_test

 import (
 	"slices"
+	"sync"
 	"testing"

 	. "github.com/onsi/gomega"
@@ -267,3 +268,84 @@ func TestGetAllowedResourceActions(t *testing.T) {
 		})
 	}
 }
+
+func TestLocalizeRole_English(t *testing.T) {
+	g := NewWithT(t)
+	original := unifiedrole.RoleViewer
+
+	result := unifiedrole.LocalizeRole(original, "en")
+
+	// Strings are unchanged for English
+	g.Expect(result.GetDisplayName()).To(Equal(original.GetDisplayName()))
+	g.Expect(result.GetDescription()).To(Equal(original.GetDescription()))
+
+	// Result is an independent copy — mutating it must not touch the global
+	translated := "mutated"
+	result.DisplayName = &translated
+	g.Expect(original.GetDisplayName()).NotTo(Equal("mutated"))
+}
+
+func TestLocalizeRole_German(t *testing.T) {
+	g := NewWithT(t)
+	original := unifiedrole.RoleViewer
+
+	result := unifiedrole.LocalizeRole(original, "de")
+
+	g.Expect(result.GetDisplayName()).To(Equal("Kann anzeigen"))
+	g.Expect(result.GetDescription()).To(Equal("Ansehen und herunterladen."))
+
+	// Global singleton must be untouched
+	g.Expect(original.GetDisplayName()).NotTo(Equal("Kann anzeigen"))
+	g.Expect(original.GetDescription()).NotTo(Equal("Ansehen und herunterladen."))
+}
+
+func TestLocalizeRole_EmptyLocale(t *testing.T) {
+	g := NewWithT(t)
+	original := unifiedrole.RoleViewer
+
+	result := unifiedrole.LocalizeRole(original, "")
+
+	// Empty locale falls back to source strings
+	g.Expect(result.GetDisplayName()).To(Equal(original.GetDisplayName()))
+	g.Expect(result.GetDescription()).To(Equal(original.GetDescription()))
+}
+
+func TestLocalizeRoles_German(t *testing.T) {
+	g := NewWithT(t)
+	roles := unifiedrole.BuildInRoles
+
+	results := unifiedrole.LocalizeRoles(roles, "de")
+
+	g.Expect(results).To(HaveLen(len(roles)))
+
+	// Every result is a value (not a pointer)
+	for i, r := range results {
+		// Id is preserved
+		g.Expect(r.GetId()).To(Equal(roles[i].GetId()))
+		// Global singleton is not mutated
+		g.Expect(roles[i].GetDisplayName()).NotTo(Equal(r.GetDisplayName()),
+			"global displayName for role %s was mutated", r.GetId())
+	}
+}
+
+func TestLocalizeRole_ConcurrentCallsDoNotRace(t *testing.T) {
+	// Run with -race to detect data races on the global buildInRoles strings.
+	const goroutines = 20
+	var wg sync.WaitGroup
+	wg.Add(goroutines)
+	for i := 0; i < goroutines; i++ {
+		locale := "de"
+		if i%2 == 0 {
+			locale = "fr"
+		}
+		go func(loc string) {
+			defer wg.Done()
+			_ = unifiedrole.LocalizeRoles(unifiedrole.BuildInRoles, loc)
+		}(locale)
+	}
+	wg.Wait()
+
+	// After all concurrent translations the globals must still hold English strings
+	g := NewWithT(t)
+	g.Expect(unifiedrole.RoleViewer.GetDisplayName()).To(Equal("Can view"))
+}
@@ -6,6 +6,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -14,12 +15,17 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)

+	secureOption := nats.Secure(
+		options.Config.Nats.EnableTLS,
+		options.Config.Nats.TLSSkipVerifyClientCert,
+		options.Config.Nats.TLSCert,
+	)
 	// For nats readiness and liveness checks are identical
 	// the nats server will neither be healthy nor ready when it can not reach the nats server/cluster
 	checkHandler := handlers.NewCheckHandler(
 		handlers.NewCheckHandlerConfiguration().
 			WithLogger(options.Logger).
-			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Nats.Host+":"+strconv.Itoa(options.Config.Nats.Port))),
+			WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Nats.Host+":"+strconv.Itoa(options.Config.Nats.Port), secureOption)),
 	)

 	return debug.NewService(
@@ -130,6 +130,9 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Database(cfg.Store.Database),
 				microstore.Table(cfg.Store.Table),
 				store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
+				store.TLSEnabled(cfg.Store.EnableTLS),
+				store.TLSInsecure(cfg.Store.TLSInsecure),
+				store.TLSRootCA(cfg.Store.TLSRootCACertificate),
 			)

 			svc := service.NewEventsNotifier(evts, channel, logger, gatewaySelector, valueService,
@@ -70,11 +70,14 @@ type ServiceAccount struct {

 // Store configures the store to use
 type Store struct {
-	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;NOTIFICATIONS_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;NOTIFICATIONS_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database     string        `yaml:"database" env:"NOTIFICATIONS_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table        string        `yaml:"table" env:"NOTIFICATIONS_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;NOTIFICATIONS_STORE_TTL" desc:"Time to live for notifications in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;NOTIFICATIONS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;NOTIFICATIONS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;NOTIFICATIONS_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;NOTIFICATIONS_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"NOTIFICATIONS_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table                string        `yaml:"table" env:"NOTIFICATIONS_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;NOTIFICATIONS_STORE_TTL" desc:"Time to live for notifications in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;NOTIFICATIONS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;NOTIFICATIONS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;NOTIFICATIONS_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;NOTIFICATIONS_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;NOTIFICATIONS_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided NOTIFICATIONS_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }
@@ -6,6 +6,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -14,9 +15,14 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)

+	secureOption := nats.Secure(
+		options.Config.Notifications.Events.EnableTLS,
+		options.Config.Notifications.Events.TLSInsecure,
+		options.Config.Notifications.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Notifications.Events.Endpoint)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Notifications.Events.Endpoint, secureOption)).
 		WithCheck("smtp-check", checks.NewTCPCheck(options.Config.Notifications.SMTP.Host+":"+strconv.Itoa(options.Config.Notifications.SMTP.Port)))

 	return debug.NewService(
@@ -81,6 +81,7 @@ func OCMConfigFromStruct(cfg *config.Config, logger log.Logger) map[string]any {
 					"events": map[string]any{
 						"natsaddress":          cfg.Events.Endpoint,
 						"natsclusterid":        cfg.Events.Cluster,
+						"enabletls":            cfg.Events.EnableTLS,
 						"tlsinsecure":          cfg.Events.TLSInsecure,
 						"tlsrootcacertificate": cfg.Events.TLSRootCACertificate,
 						"authusername":         cfg.Events.AuthUsername,
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -17,8 +18,13 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))

 	return debug.NewService(
@@ -31,9 +31,12 @@ type Config struct {

 // SigningKeys is a store configuration.
 type SigningKeys struct {
-	Store        string        `yaml:"store" env:"OC_CACHE_STORE;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE" desc:"The type of the signing key store. Supported values are: 'redis-sentinel' and 'nats-js-kv'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes        []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES" desc:"A list of nodes to access the configured store. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	TTL          time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TTL" desc:"Default time to live for signing keys. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_CACHE_STORE;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE" desc:"The type of the signing key store. Supported values are: 'redis-sentinel' and 'nats-js-kv'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES" desc:"A list of nodes to access the configured store. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TTL" desc:"Default time to live for signing keys. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided OCS_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }
@@ -21,6 +21,7 @@ func Server(opts ...Option) (*http.Server, error) {
 	readyHandlerConfiguration := healthHandlerConfiguration.
 		WithCheck("nats reachability", func(ctx context.Context) error {
 			if len(options.Config.SigningKeys.Nodes) > 0 {
+				// no secureOption because we cannot configure it
 				return checks.NewNatsCheck(options.Config.SigningKeys.Nodes[0])(ctx)
 			}
 			return nil
@@ -44,6 +44,9 @@ func Server(opts ...Option) (http.Service, error) {
 		microstore.Database("proxy"),
 		microstore.Table("signing-keys"),
 		store.Authentication(options.Config.SigningKeys.AuthUsername, options.Config.SigningKeys.AuthPassword),
+		store.TLSEnabled(options.Config.SigningKeys.EnableTLS),
+		store.TLSInsecure(options.Config.SigningKeys.TLSInsecure),
+		store.TLSRootCA(options.Config.SigningKeys.TLSRootCACertificate),
 	)

 	handle := svc.NewService(
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -17,8 +18,13 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))

 	return debug.NewService(
 		debug.Logger(options.Logger),
@@ -56,6 +56,9 @@ func Server(cfg *config.Config) *cobra.Command {
 					microstore.Database(cfg.Store.Database),
 					microstore.Table(cfg.Store.Table),
 					store.Authentication(cfg.Store.AuthUsername, cfg.Store.AuthPassword),
+					store.TLSEnabled(cfg.Store.EnableTLS),
+					store.TLSInsecure(cfg.Store.TLSInsecure),
+					store.TLSRootCA(cfg.Store.TLSRootCACertificate),
 				)

 				svc, err := service.NewPostprocessingService(ctx, logger, st, traceProvider, cfg)
@@ -59,11 +59,14 @@ type Debug struct {

 // Store configures the store to use
 type Store struct {
-	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;POSTPROCESSING_STORE" desc:"The type of the store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;POSTPROCESSING_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database     string        `yaml:"database" env:"POSTPROCESSING_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table        string        `yaml:"table" env:"POSTPROCESSING_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;POSTPROCESSING_STORE_TTL" desc:"Time to live for events in the store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;POSTPROCESSING_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;POSTPROCESSING_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;POSTPROCESSING_STORE" desc:"The type of the store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;POSTPROCESSING_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"POSTPROCESSING_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table                string        `yaml:"table" env:"POSTPROCESSING_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;POSTPROCESSING_STORE_TTL" desc:"Time to live for events in the store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;POSTPROCESSING_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;POSTPROCESSING_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;POSTPROCESSING_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;POSTPROCESSING_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;POSTPROCESSING_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided POSTPROCESSING_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -13,9 +14,14 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)

+	secureOption := nats.Secure(
+		options.Config.Postprocessing.Events.EnableTLS,
+		options.Config.Postprocessing.Events.TLSInsecure,
+		options.Config.Postprocessing.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Postprocessing.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Postprocessing.Events.Endpoint, secureOption))

 	return debug.NewService(
 		debug.Logger(options.Logger),
@@ -194,7 +194,7 @@ role_assignment:
              claim_value: mySpaceAdminRole
            - role_name: user
              claim_value: myUserRole
-            - role_name: guest
+            - role_name: user-light
              claim_value: myGuestRole
 ```

@@ -223,7 +223,7 @@ The default `role_claim` (or `PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM`) is `roles`. The
  claim_value: opencloudSpaceAdmin
 - role_name: user
  claim_value: opencloudUser
- role_name: guest
+- role_name: user-light
  claim_value: opencloudcloudGuest
 ```

@@ -66,6 +66,9 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Table(cfg.OIDC.UserinfoCache.Table),
 				store.DisablePersistence(cfg.OIDC.UserinfoCache.DisablePersistence),
 				store.Authentication(cfg.OIDC.UserinfoCache.AuthUsername, cfg.OIDC.UserinfoCache.AuthPassword),
+				store.TLSEnabled(cfg.OIDC.UserinfoCache.EnableTLS),
+				store.TLSInsecure(cfg.OIDC.UserinfoCache.TLSInsecure),
+				store.TLSRootCA(cfg.OIDC.UserinfoCache.TLSRootCACertificate),
 			)

 			signingKeyStore := store.Create(
@@ -76,6 +79,9 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Table("signing-keys"),
 				store.DisablePersistence(cfg.PreSignedURL.SigningKeys.DisablePersistence),
 				store.Authentication(cfg.PreSignedURL.SigningKeys.AuthUsername, cfg.PreSignedURL.SigningKeys.AuthPassword),
+				store.TLSEnabled(cfg.PreSignedURL.SigningKeys.EnableTLS),
+				store.TLSInsecure(cfg.PreSignedURL.SigningKeys.TLSInsecure),
+				store.TLSRootCA(cfg.PreSignedURL.SigningKeys.TLSRootCACertificate),
 			)

 			logger := log.Configure(cfg.Service.Name, cfg.Commons, cfg.LogLevel)
@@ -132,14 +132,17 @@ type JWKS struct {

 // Cache is a TTL cache configuration.
 type Cache struct {
-	Store              string        `yaml:"store" env:"OC_CACHE_STORE;PROXY_OIDC_USERINFO_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes              []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;PROXY_OIDC_USERINFO_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database           string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table              string        `yaml:"table" env:"PROXY_OIDC_USERINFO_CACHE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;PROXY_OIDC_USERINFO_CACHE_TTL" desc:"Default time to live for user info in the user info cache. This value is only applied when the token expiration cannot be extracted from the access tokens (e.g. when non-JWT access tokes are used). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;PROXY_OIDC_USERINFO_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;PROXY_OIDC_USERINFO_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;PROXY_OIDC_USERINFO_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_CACHE_STORE;PROXY_OIDC_USERINFO_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;PROXY_OIDC_USERINFO_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table                string        `yaml:"table" env:"PROXY_OIDC_USERINFO_CACHE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;PROXY_OIDC_USERINFO_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;PROXY_OIDC_USERINFO_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;PROXY_OIDC_USERINFO_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;PROXY_OIDC_USERINFO_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;PROXY_OIDC_USERINFO_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;PROXY_OIDC_USERINFO_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;PROXY_OIDC_USERINFO_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided PROXY_OIDC_USERINFO_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }

 // RoleAssignment contains the configuration for how to assign roles to users during login
@@ -189,12 +192,15 @@ type PreSignedURL struct {

 // SigningKeys is a store configuration.
 type SigningKeys struct {
-	Store              string        `yaml:"store" env:"OC_CACHE_STORE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE" desc:"The type of the signing key store. Supported values are: 'redis-sentinel', 'nats-js-kv' and 'opencloudstoreservice' (deprecated). See the text description for details." introductionVersion:"1.0.0"`
-	Nodes              []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES" desc:"A list of nodes to access the configured store. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TTL" desc:"Default time to live for signing keys. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_DISABLE_PERSISTENCE" desc:"Disables persistence of the store. Only applies when store type 'nats-js-kv' is configured. Defaults to true." introductionVersion:"1.0.0"`
-	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_CACHE_STORE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE" desc:"The type of the signing key store. Supported values are: 'redis-sentinel', 'nats-js-kv' and 'opencloudstoreservice' (deprecated). See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_NODES" desc:"A list of nodes to access the configured store. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TTL" desc:"Default time to live for signing keys. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_DISABLE_PERSISTENCE" desc:"Disables persistence of the store. Only applies when store type 'nats-js-kv' is configured. Defaults to true." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided PROXY_PRESIGNEDURL_SIGNING_KEYS_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }

 // ClaimsSelectorConf is the config for the claims-selector
@@ -11,6 +11,7 @@ import (
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
+	"github.com/opencloud-eu/opencloud/services/proxy/pkg/router"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
@@ -48,9 +49,13 @@ func (m createHome) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	ctx, span := m.tracer.Start(req.Context(), fmt.Sprintf("%s %s", req.Method, req.URL.Path), trace.WithSpanKind(trace.SpanKindServer))
 	req = req.WithContext(ctx)
 	defer span.End()
-	if !m.shouldServe(req) {
+	next := func() {
 		span.End()
 		m.next.ServeHTTP(w, req)
+	}
+
+	if !m.shouldServe(req) {
+		next()
 		return
 	}

@@ -63,6 +68,10 @@ func (m createHome) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	createHomeReq := &provider.CreateHomeRequest{}
 	u, ok := revactx.ContextGetUser(ctx)
 	if ok {
+		if u.GetId().GetType() == userv1beta1.UserType_USER_TYPE_LIGHTWEIGHT || u.GetId().GetType() == userv1beta1.UserType_USER_TYPE_SERVICE {
+			next()
+			return
+		}
 		roleIDs, err := m.getUserRoles(u)
 		if err != nil {
 			m.logger.Error().Err(err).Str("userid", u.Id.OpaqueId).Msg("failed to get roles for user")
@@ -88,12 +97,12 @@ func (m createHome) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 			}
 		}
 	}
-	span.End()
-	m.next.ServeHTTP(w, req)
+	next()
 }

 func (m createHome) shouldServe(req *http.Request) bool {
-	return req.Header.Get(revactx.TokenHeader) != ""
+	ri := router.ContextRoutingInfo(req.Context())
+	return req.Header.Get(revactx.TokenHeader) != "" && !ri.IsRouteUnprotected()
 }

 func (m createHome) getUserRoles(user *userv1beta1.User) ([]string, error) {
@@ -8,6 +8,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 	"github.com/opencloud-eu/opencloud/services/proxy/pkg/config"
@@ -21,8 +22,13 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))

 	var configDumpFunc http.HandlerFunc = configDump(options.Config)
 	return debug.NewService(
@@ -0,0 +1,13 @@
+package convert_test
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestConvert(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "OpenSearch Convert Suite")
+}
@@ -55,11 +55,12 @@ func OpenSearchHitToMatch(hit opensearchgoAPI.SearchHit) (*searchMessage.Match,
 				SpaceId:   resourceParentID.GetSpaceId(),
 				OpaqueId:  resourceParentID.GetOpaqueId(),
 			},
-			Size:     resource.Size,
-			Type:     resource.Type,
-			MimeType: resource.MimeType,
-			Deleted:  resource.Deleted,
-			Tags:     resource.Tags,
+			Size:      resource.Size,
+			Type:      resource.Type,
+			MimeType:  resource.MimeType,
+			Deleted:   resource.Deleted,
+			Tags:      resource.Tags,
+			Favorites: resource.Favorites,
 			Highlights: func() string {
 				contentHighlights, ok := hit.Highlight["Content"]
 				if !ok {
@@ -2,37 +2,114 @@ package convert_test

 import (
 	"encoding/json"
-	"testing"
+	"time"

+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
 	opensearchgoAPI "github.com/opensearch-project/opensearch-go/v4/opensearchapi"
-	"github.com/stretchr/testify/assert"

 	"github.com/opencloud-eu/opencloud/pkg/conversions"
 	searchMessage "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/search/v0"
 	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/convert"
-	"github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+	opensearchtest "github.com/opencloud-eu/opencloud/services/search/pkg/opensearch/internal/test"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/search"
 )

-func TestOpenSearchHitToMatch(t *testing.T) {
-	resource := opensearchtest.Testdata.Resources.File
-	resource.MimeType = "audio/anything"
-
-	hit := opensearchgoAPI.SearchHit{
-		Score:  1.1,
-		Source: json.RawMessage(opensearchtest.JSONMustMarshal(t, resource)),
-	}
-	match, err := convert.OpenSearchHitToMatch(hit)
-	assert.NoError(t, err)
-	assert.Equal(t, hit.Score, match.Score)
-	assert.Equal(t, resource.Name, match.Entity.Name)
-	t.Parallel()
-	t.Run("converts the audio field to the expected type", func(t *testing.T) {
-		// searchMessage.Audio contains int64, int32 ... values that are converted to strings by the JSON marshaler,
-		// so we need to convert the resource.Audio to align the expectations for the JSON comparison.
-		audio, err := conversions.To[*searchMessage.Audio](resource.Audio)
-		assert.NoError(t, err)
-
-		assert.Equal(t, resource.Audio.Bitrate, match.Entity.Audio.Bitrate)
-		assert.JSONEq(t, opensearchtest.JSONMustMarshal(t, audio), opensearchtest.JSONMustMarshal(t, match.Entity.Audio))
-	})
+// jsonMarshal marshals data to a JSON string, failing the running spec on error.
+func jsonMarshal(data any) string {
+	GinkgoHelper()
+	b, err := json.Marshal(data)
+	Expect(err).ToNot(HaveOccurred())
+	return string(b)
 }
+
+var _ = Describe("OpenSearchHitToMatch", func() {
+	var (
+		resource search.Resource
+		hit      opensearchgoAPI.SearchHit
+		mtime    time.Time
+		match    *searchMessage.Match
+		err      error
+	)
+
+	BeforeEach(func() {
+		resource = opensearchtest.Testdata.Resources.File
+		resource.MimeType = "audio/mpeg"
+		mtime = time.Date(2025, 7, 24, 15, 15, 1, 0, time.UTC)
+		resource.Mtime = mtime.Format(time.RFC3339)
+		resource.Favorites = []string{"cbf24bce-3e6e-4d9e-a2a2-cbf24bce3e6e"}
+
+		hit = opensearchgoAPI.SearchHit{
+			Score:  1.1,
+			Source: json.RawMessage(jsonMarshal(resource)),
+			Highlight: map[string][]string{
+				"Content": {"first match", "second match"},
+			},
+		}
+
+		match, err = convert.OpenSearchHitToMatch(hit)
+		Expect(err).ToNot(HaveOccurred())
+	})
+
+	It("maps the score", func() {
+		Expect(match.Score).To(Equal(hit.Score))
+	})
+
+	It("maps all resource fields to the entity", func() {
+		entity := match.Entity
+		Expect(entity).ToNot(BeNil())
+
+		// reference (derived from RootID) and path
+		Expect(entity.Ref.ResourceId.StorageId).To(Equal("1"))
+		Expect(entity.Ref.ResourceId.SpaceId).To(Equal("1"))
+		Expect(entity.Ref.ResourceId.OpaqueId).To(Equal("1"))
+		Expect(entity.Ref.Path).To(Equal(resource.Path))
+
+		// resource id
+		Expect(entity.Id.StorageId).To(Equal("1"))
+		Expect(entity.Id.SpaceId).To(Equal("1"))
+		Expect(entity.Id.OpaqueId).To(Equal("3"))
+
+		// parent id
+		Expect(entity.ParentId.StorageId).To(Equal("1"))
+		Expect(entity.ParentId.SpaceId).To(Equal("1"))
+		Expect(entity.ParentId.OpaqueId).To(Equal("2"))
+
+		// scalar fields
+		Expect(entity.Name).To(Equal(resource.Name))
+		Expect(entity.Size).To(Equal(resource.Size))
+		Expect(entity.Type).To(Equal(resource.Type))
+		Expect(entity.MimeType).To(Equal(resource.MimeType))
+		Expect(entity.Deleted).To(Equal(resource.Deleted))
+		Expect(entity.Tags).To(Equal(resource.Tags))
+		Expect(entity.Favorites).To(Equal(resource.Favorites))
+
+		// highlights are joined together
+		Expect(entity.Highlights).To(Equal("first match; second match"))
+
+		// last modified time is parsed from the Mtime
+		Expect(entity.LastModifiedTime).ToNot(BeNil())
+		Expect(entity.LastModifiedTime.Seconds).To(Equal(mtime.Unix()))
+	})
+
+	It("converts the media metadata to the expected types", func() {
+		// searchMessage.Audio contains int64, int32 ... values that are converted to strings by the JSON marshaler,
+		// so we need to convert the resource fields to align the expectations for the JSON comparison.
+		expectedAudio, err := conversions.To[*searchMessage.Audio](resource.Audio)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(match.Entity.Audio.Bitrate).To(Equal(resource.Audio.Bitrate))
+		Expect(jsonMarshal(match.Entity.Audio)).To(MatchJSON(jsonMarshal(expectedAudio)))
+
+		expectedImage, err := conversions.To[*searchMessage.Image](resource.Image)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(jsonMarshal(match.Entity.Image)).To(MatchJSON(jsonMarshal(expectedImage)))
+
+		expectedLocation, err := conversions.To[*searchMessage.GeoCoordinates](resource.Location)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(jsonMarshal(match.Entity.Location)).To(MatchJSON(jsonMarshal(expectedLocation)))
+
+		expectedPhoto, err := conversions.To[*searchMessage.Photo](resource.Photo)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(jsonMarshal(match.Entity.Photo)).To(MatchJSON(jsonMarshal(expectedPhoto)))
+	})
+})
@@ -535,7 +535,7 @@ func (s *Service) IndexSpace(spaceID *provider.StorageSpaceId, forceRescan bool)
 // TrashItem marks the item as deleted.
 func (s *Service) TrashItem(rID *provider.ResourceId) {
 	if err := s.engine.Delete(storagespace.FormatResourceID(rID)); err != nil {
-		s.logger.Error().Err(err).Interface("Id", rID).Msg("failed to remove item from index")
+		s.logger.Info().Err(err).Interface("Id", rID).Msg("failed to remove item from index")
 	}
 }

@@ -7,6 +7,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -19,8 +20,13 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption)).
 		WithCheck("tika-check", func(ctx context.Context) error {
 			if options.Config.Extractor.Type == "tika" {
 				u, err := url.Parse(options.Config.Extractor.Tika.TikaURL)
@@ -55,13 +55,16 @@ type Metadata struct {

 // Cache configures the cache of the Metadata store
 type Cache struct {
-	Store              string        `yaml:"store" env:"OC_CACHE_STORE;SETTINGS_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes              []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;SETTINGS_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database           string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	FileTable          string        `yaml:"files_table" env:"SETTINGS_FILE_CACHE_TABLE" desc:"The database table the store should use for the file cache." introductionVersion:"1.0.0"`
-	DirectoryTable     string        `yaml:"directories_table" env:"SETTINGS_DIRECTORY_CACHE_TABLE" desc:"The database table the store should use for the directory cache." introductionVersion:"1.0.0"`
-	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;SETTINGS_CACHE_TTL" desc:"Default time to live for entries in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;SETTINGS_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;SETTINGS_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;SETTINGS_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_CACHE_STORE;SETTINGS_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"addresses" env:"OC_CACHE_STORE_NODES;SETTINGS_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	FileTable            string        `yaml:"files_table" env:"SETTINGS_FILE_CACHE_TABLE" desc:"The database table the store should use for the file cache." introductionVersion:"1.0.0"`
+	DirectoryTable       string        `yaml:"directories_table" env:"SETTINGS_DIRECTORY_CACHE_TABLE" desc:"The database table the store should use for the directory cache." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;SETTINGS_CACHE_TTL" desc:"Default time to live for entries in the cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;SETTINGS_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;SETTINGS_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;SETTINGS_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;SETTINGS_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;SETTINGS_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;SETTINGS_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SETTINGS_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }
@@ -140,6 +140,9 @@ func (c *CachedMDC) Init(ctx context.Context, id string) error {
 		microstore.Table(c.cfg.Metadata.Cache.DirectoryTable),
 		store.DisablePersistence(c.cfg.Metadata.Cache.DisablePersistence),
 		store.Authentication(c.cfg.Metadata.Cache.AuthUsername, c.cfg.Metadata.Cache.AuthPassword),
+		store.TLSEnabled(c.cfg.Metadata.Cache.EnableTLS),
+		store.TLSInsecure(c.cfg.Metadata.Cache.TLSInsecure),
+		store.TLSRootCA(c.cfg.Metadata.Cache.TLSRootCACertificate),
 	)
 	c.filesCache = store.Create(
 		store.Store(c.cfg.Metadata.Cache.Store),
@@ -149,6 +152,9 @@ func (c *CachedMDC) Init(ctx context.Context, id string) error {
 		microstore.Table(c.cfg.Metadata.Cache.FileTable),
 		store.DisablePersistence(c.cfg.Metadata.Cache.DisablePersistence),
 		store.Authentication(c.cfg.Metadata.Cache.AuthUsername, c.cfg.Metadata.Cache.AuthPassword),
+		store.TLSEnabled(c.cfg.Metadata.Cache.EnableTLS),
+		store.TLSInsecure(c.cfg.Metadata.Cache.TLSInsecure),
+		store.TLSRootCA(c.cfg.Metadata.Cache.TLSRootCACertificate),
 	)
 	return c.next.Init(ctx, id)
 }
@@ -155,6 +155,7 @@ type Events struct {
 	EnableTLS         bool   `yaml:"enable_tls" env:"OC_EVENTS_ENABLE_TLS;SHARING_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the OpenCloud service which receives and delivers events between the services." introductionVersion:"1.0.0"`
 	AuthUsername      string `yaml:"auth_username" env:"OC_EVENTS_AUTH_USERNAME;SHARING_EVENTS_AUTH_USERNAME" desc:"Username for the events broker." introductionVersion:"1.0.0"`
 	AuthPassword      string `yaml:"auth_password" env:"OC_EVENTS_AUTH_PASSWORD;SHARING_EVENTS_AUTH_PASSWORD" desc:"Password for the events broker." introductionVersion:"1.0.0"`
+	// TODO use TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"OC_EVENTS_TLS_ROOT_CA_CERTIFICATE;SHARING_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided SHARING_EVENTS_TLS_INSECURE will be seen as false." introductionVersion:"1.0.0"`
 }

 // PasswordPolicy configures reva password policy
@@ -83,6 +83,7 @@ func SharingConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string]
 							"events": map[string]any{
 								"natsaddress":          cfg.Events.Addr,
 								"natsclusterid":        cfg.Events.ClusterID,
+								"enabletls":            cfg.Events.EnableTLS,
 								"tlsinsecure":          cfg.Events.TLSInsecure,
 								"tlsrootcacertificate": cfg.Events.TLSRootCaCertPath,
 								"authusername":         cfg.Events.AuthUsername,
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -13,9 +14,14 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCaCertPath,
+	)
 	readyHandlerConfiguration := handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption)).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr))

 	return debug.NewService(
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -17,8 +18,13 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))

 	return debug.NewService(
 		debug.Logger(options.Logger),
@@ -49,17 +49,19 @@ func (s SSE) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 // ListenForEvents listens for events
 func (s SSE) ListenForEvents() {
 	for e := range s.evChannel {
-		switch ev := e.Event.(type) {
-		default:
-			s.l.Error().Interface("event", ev).Msg("unhandled event")
-		case events.SendSSE:
-			for _, uid := range ev.UserIDs {
-				s.sse.Publish(uid, &sse.Event{
-					Event: []byte(ev.Type),
-					Data:  ev.Message,
-				})
+		go func() {
+			switch ev := e.Event.(type) {
+			default:
+				s.l.Error().Interface("event", ev).Msg("unhandled event")
+			case events.SendSSE:
+				for _, uid := range ev.UserIDs {
+					s.sse.Publish(uid, &sse.Event{
+						Event: []byte(ev.Type),
+						Data:  ev.Message,
+					})
+				}
 			}
-		}
+		}()
 	}
 }

@@ -77,11 +77,14 @@ type DecomposedDriver struct {

 // Cache holds cache config
 type Cache struct {
-	Store              string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_SYSTEM_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes              []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_SYSTEM_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database           string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_SYSTEM_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_SYSTEM_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername       string        `yaml:"auth_username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_SYSTEM_CACHE_AUTH_USERNAME" desc:"Username for the configured store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword       string        `yaml:"auth_password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_SYSTEM_CACHE_AUTH_PASSWORD" desc:"Password for the configured store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_SYSTEM_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_SYSTEM_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_SYSTEM_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_SYSTEM_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"auth_username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_SYSTEM_CACHE_AUTH_USERNAME" desc:"Username for the configured store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"auth_password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_SYSTEM_CACHE_AUTH_PASSWORD" desc:"Password for the configured store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;STORAGE_SYSTEM_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;STORAGE_SYSTEM_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;STORAGE_SYSTEM_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_SYSTEM_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }
@@ -165,13 +165,16 @@ func metadataDrivers(localEndpoint string, cfg *config.Config) map[string]any {
 			"cache_database": "system",
 		},
 		"filemetadatacache": map[string]any{
-			"cache_store":               cfg.FileMetadataCache.Store,
-			"cache_nodes":               cfg.FileMetadataCache.Nodes,
-			"cache_database":            cfg.FileMetadataCache.Database,
-			"cache_ttl":                 cfg.FileMetadataCache.TTL,
-			"cache_disable_persistence": cfg.FileMetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FileMetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FileMetadataCache.AuthPassword,
+			"cache_store":                   cfg.FileMetadataCache.Store,
+			"cache_nodes":                   cfg.FileMetadataCache.Nodes,
+			"cache_database":                cfg.FileMetadataCache.Database,
+			"cache_ttl":                     cfg.FileMetadataCache.TTL,
+			"cache_disable_persistence":     cfg.FileMetadataCache.DisablePersistence,
+			"cache_auth_username":           cfg.FileMetadataCache.AuthUsername,
+			"cache_auth_password":           cfg.FileMetadataCache.AuthPassword,
+			"cache_tls_enabled":             cfg.FileMetadataCache.EnableTLS,
+			"cache_tls_insecure":            cfg.FileMetadataCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.FileMetadataCache.TLSRootCACertificate,
 		},
 	}

@@ -223,27 +223,35 @@ type Events struct {
 	NumConsumers      int    `yaml:"num_consumers" env:"STORAGE_USERS_EVENTS_NUM_CONSUMERS" desc:"The amount of concurrent event consumers to start. Event consumers are used for post-processing files. Multiple consumers increase parallelisation, but will also increase CPU and memory demands. The setting has no effect when the OC_ASYNC_UPLOADS is set to false. The default and minimum value is 1." introductionVersion:"1.0.0"`
 	AuthUsername      string `yaml:"username" env:"OC_EVENTS_AUTH_USERNAME;STORAGE_USERS_EVENTS_AUTH_USERNAME" desc:"The username to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services." introductionVersion:"1.0.0"`
 	AuthPassword      string `yaml:"password" env:"OC_EVENTS_AUTH_PASSWORD;STORAGE_USERS_EVENTS_AUTH_PASSWORD" desc:"The password to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services." introductionVersion:"1.0.0"`
+	// TODO use TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"OC_EVENTS_TLS_ROOT_CA_CERTIFICATE;STORAGE_USERS_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_USERS_EVENTS_TLS_INSECURE will be seen as false." introductionVersion:"1.0.0"`
 }

 // FilemetadataCache holds cache config
 type FilemetadataCache struct {
-	Store              string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_USERS_FILEMETADATA_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes              []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_USERS_FILEMETADATA_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database           string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	TTL                time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_USERS_FILEMETADATA_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	DisablePersistence bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_FILEMETADATA_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername       string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword       string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_USERS_FILEMETADATA_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_USERS_FILEMETADATA_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE;STORAGE_USERS_FILEMETADATA_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_USERS_FILEMETADATA_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens has no expiration. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_FILEMETADATA_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_USERS_FILEMETADATA_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;STORAGE_USERS_FILEMETADATA_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;STORAGE_USERS_FILEMETADATA_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;STORAGE_USERS_FILEMETADATA_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_USERS_FILEMETADATA_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }

 // IDCache holds cache config
 type IDCache struct {
-	Store              string   `yaml:"store" env:"OC_CACHE_STORE;STORAGE_USERS_ID_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes              []string `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_USERS_ID_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database           string   `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	DisablePersistence bool     `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_ID_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
-	AuthUsername       string   `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_USERS_ID_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword       string   `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_USERS_ID_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_CACHE_STORE;STORAGE_USERS_ID_CACHE_STORE" desc:"The type of the cache store. Supported values are: 'memory', 'redis-sentinel', 'nats-js-kv', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_CACHE_STORE_NODES;STORAGE_USERS_ID_CACHE_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"OC_CACHE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_CACHE_TTL;STORAGE_USERS_ID_CACHE_TTL" desc:"Default time to live for user info in the user info cache. Only applied when access tokens have no expiration. Defaults to 300s which is derived from the underlaying package though not explicitly set as default. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	DisablePersistence   bool          `yaml:"disable_persistence" env:"OC_CACHE_DISABLE_PERSISTENCE;STORAGE_USERS_ID_CACHE_DISABLE_PERSISTENCE" desc:"Disables persistence of the cache. Only applies when store type 'nats-js-kv' is configured. Defaults to false." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_CACHE_AUTH_USERNAME;STORAGE_USERS_ID_CACHE_AUTH_USERNAME" desc:"The username to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_CACHE_AUTH_PASSWORD;STORAGE_USERS_ID_CACHE_AUTH_PASSWORD" desc:"The password to authenticate with the cache store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_CACHE_ENABLE_TLS;STORAGE_USERS_ID_CACHE_ENABLE_TLS" desc:"Enable TLS for the connection to file metadata cache." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_CACHE_TLS_INSECURE;STORAGE_USERS_ID_CACHE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_CACHE_TLS_ROOT_CA_CERTIFICATE;STORAGE_USERS_ID_CACHE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided STORAGE_USERS_ID_CACHE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }

 // EOSDriver is the storage driver configuration when using 'eos' storage driver
@@ -109,21 +109,28 @@ func Posix(cfg *config.Config, enableFSScan, enableFSWatch bool) map[string]any
 		"lock_cycle_duration_factor": cfg.Drivers.Posix.LockCycleDurationFactor,
 		"max_concurrency":            cfg.Drivers.Posix.MaxConcurrency,
 		"idcache": map[string]any{
-			"cache_store":               cfg.IDCache.Store,
-			"cache_nodes":               cfg.IDCache.Nodes,
-			"cache_database":            cfg.IDCache.Database,
-			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
-			"cache_auth_username":       cfg.IDCache.AuthUsername,
-			"cache_auth_password":       cfg.IDCache.AuthPassword,
+			"cache_store":                   cfg.IDCache.Store,
+			"cache_nodes":                   cfg.IDCache.Nodes,
+			"cache_database":                cfg.IDCache.Database,
+			"cache_ttl":                     cfg.IDCache.TTL,
+			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
+			"cache_auth_username":           cfg.IDCache.AuthUsername,
+			"cache_auth_password":           cfg.IDCache.AuthPassword,
+			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
+			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
 		},
 		"filemetadatacache": map[string]any{
-			"cache_store":               cfg.FilemetadataCache.Store,
-			"cache_nodes":               cfg.FilemetadataCache.Nodes,
-			"cache_database":            cfg.FilemetadataCache.Database,
-			"cache_ttl":                 cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
+			"cache_store":                   cfg.FilemetadataCache.Store,
+			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
+			"cache_database":                cfg.FilemetadataCache.Database,
+			"cache_ttl":                     cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
+			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
+			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
 		},
 		"events": map[string]any{
 			"numconsumers": cfg.Events.NumConsumers,
@@ -205,21 +212,28 @@ func Decomposed(cfg *config.Config) map[string]any {
 		"disable_versioning":          cfg.Drivers.Decomposed.DisableVersioning,
 		"multi_tenant_enabled":        cfg.Commons.MultiTenantEnabled,
 		"filemetadatacache": map[string]any{
-			"cache_store":               cfg.FilemetadataCache.Store,
-			"cache_nodes":               cfg.FilemetadataCache.Nodes,
-			"cache_database":            cfg.FilemetadataCache.Database,
-			"cache_ttl":                 cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
+			"cache_store":                   cfg.FilemetadataCache.Store,
+			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
+			"cache_database":                cfg.FilemetadataCache.Database,
+			"cache_ttl":                     cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
+			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
+			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
 		},
 		"idcache": map[string]any{
-			"cache_store":               cfg.IDCache.Store,
-			"cache_nodes":               cfg.IDCache.Nodes,
-			"cache_database":            cfg.IDCache.Database,
-			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
-			"cache_auth_username":       cfg.IDCache.AuthUsername,
-			"cache_auth_password":       cfg.IDCache.AuthPassword,
+			"cache_store":                   cfg.IDCache.Store,
+			"cache_nodes":                   cfg.IDCache.Nodes,
+			"cache_database":                cfg.IDCache.Database,
+			"cache_ttl":                     cfg.IDCache.TTL,
+			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
+			"cache_auth_username":           cfg.IDCache.AuthUsername,
+			"cache_auth_password":           cfg.IDCache.AuthPassword,
+			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
+			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
 		},
 		"events": map[string]any{
 			"numconsumers": cfg.Events.NumConsumers,
@@ -259,21 +273,28 @@ func DecomposedNoEvents(cfg *config.Config) map[string]any {
 		"disable_versioning":          cfg.Drivers.Decomposed.DisableVersioning,
 		"multi_tenant_enabled":        cfg.Commons.MultiTenantEnabled,
 		"filemetadatacache": map[string]any{
-			"cache_store":               cfg.FilemetadataCache.Store,
-			"cache_nodes":               cfg.FilemetadataCache.Nodes,
-			"cache_database":            cfg.FilemetadataCache.Database,
-			"cache_ttl":                 cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
+			"cache_store":                   cfg.FilemetadataCache.Store,
+			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
+			"cache_database":                cfg.FilemetadataCache.Database,
+			"cache_ttl":                     cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
+			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
+			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
 		},
 		"idcache": map[string]any{
-			"cache_store":               cfg.IDCache.Store,
-			"cache_nodes":               cfg.IDCache.Nodes,
-			"cache_database":            cfg.IDCache.Database,
-			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
-			"cache_auth_username":       cfg.IDCache.AuthUsername,
-			"cache_auth_password":       cfg.IDCache.AuthPassword,
+			"cache_store":                   cfg.IDCache.Store,
+			"cache_nodes":                   cfg.IDCache.Nodes,
+			"cache_database":                cfg.IDCache.Database,
+			"cache_ttl":                     cfg.IDCache.TTL,
+			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
+			"cache_auth_username":           cfg.IDCache.AuthUsername,
+			"cache_auth_password":           cfg.IDCache.AuthPassword,
+			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
+			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
 		},
 	}
 }
@@ -315,21 +336,28 @@ func DecomposedS3(cfg *config.Config) map[string]any {
 		"multi_tenant_enabled":        cfg.Commons.MultiTenantEnabled,
 		"asyncfileuploads":            cfg.Drivers.DecomposedS3.AsyncUploads,
 		"filemetadatacache": map[string]any{
-			"cache_store":               cfg.FilemetadataCache.Store,
-			"cache_nodes":               cfg.FilemetadataCache.Nodes,
-			"cache_database":            cfg.FilemetadataCache.Database,
-			"cache_ttl":                 cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
+			"cache_store":                   cfg.FilemetadataCache.Store,
+			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
+			"cache_database":                cfg.FilemetadataCache.Database,
+			"cache_ttl":                     cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
+			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
+			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
 		},
 		"idcache": map[string]any{
-			"cache_store":               cfg.IDCache.Store,
-			"cache_nodes":               cfg.IDCache.Nodes,
-			"cache_database":            cfg.IDCache.Database,
-			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
-			"cache_auth_username":       cfg.IDCache.AuthUsername,
-			"cache_auth_password":       cfg.IDCache.AuthPassword,
+			"cache_store":                   cfg.IDCache.Store,
+			"cache_nodes":                   cfg.IDCache.Nodes,
+			"cache_database":                cfg.IDCache.Database,
+			"cache_ttl":                     cfg.IDCache.TTL,
+			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
+			"cache_auth_username":           cfg.IDCache.AuthUsername,
+			"cache_auth_password":           cfg.IDCache.AuthPassword,
+			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
+			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
 		},
 		"events": map[string]any{
 			"numconsumers": cfg.Events.NumConsumers,
@@ -373,21 +401,28 @@ func DecomposedS3NoEvents(cfg *config.Config) map[string]any {
 		"multi_tenant_enabled":        cfg.Commons.MultiTenantEnabled,
 		"lock_cycle_duration_factor":  cfg.Drivers.DecomposedS3.LockCycleDurationFactor,
 		"filemetadatacache": map[string]any{
-			"cache_store":               cfg.FilemetadataCache.Store,
-			"cache_nodes":               cfg.FilemetadataCache.Nodes,
-			"cache_database":            cfg.FilemetadataCache.Database,
-			"cache_ttl":                 cfg.FilemetadataCache.TTL,
-			"cache_disable_persistence": cfg.FilemetadataCache.DisablePersistence,
-			"cache_auth_username":       cfg.FilemetadataCache.AuthUsername,
-			"cache_auth_password":       cfg.FilemetadataCache.AuthPassword,
+			"cache_store":                   cfg.FilemetadataCache.Store,
+			"cache_nodes":                   cfg.FilemetadataCache.Nodes,
+			"cache_database":                cfg.FilemetadataCache.Database,
+			"cache_ttl":                     cfg.FilemetadataCache.TTL,
+			"cache_disable_persistence":     cfg.FilemetadataCache.DisablePersistence,
+			"cache_auth_username":           cfg.FilemetadataCache.AuthUsername,
+			"cache_auth_password":           cfg.FilemetadataCache.AuthPassword,
+			"cache_tls_enabled":             cfg.FilemetadataCache.EnableTLS,
+			"cache_tls_insecure":            cfg.FilemetadataCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.FilemetadataCache.TLSRootCACertificate,
 		},
 		"idcache": map[string]any{
-			"cache_store":               cfg.IDCache.Store,
-			"cache_nodes":               cfg.IDCache.Nodes,
-			"cache_database":            cfg.IDCache.Database,
-			"cache_disable_persistence": cfg.IDCache.DisablePersistence,
-			"cache_auth_username":       cfg.IDCache.AuthUsername,
-			"cache_auth_password":       cfg.IDCache.AuthPassword,
+			"cache_store":                   cfg.IDCache.Store,
+			"cache_nodes":                   cfg.IDCache.Nodes,
+			"cache_database":                cfg.IDCache.Database,
+			"cache_ttl":                     cfg.IDCache.TTL,
+			"cache_disable_persistence":     cfg.IDCache.DisablePersistence,
+			"cache_auth_username":           cfg.IDCache.AuthUsername,
+			"cache_auth_password":           cfg.IDCache.AuthPassword,
+			"cache_tls_enabled":             cfg.IDCache.EnableTLS,
+			"cache_tls_insecure":            cfg.IDCache.TLSInsecure,
+			"cache_tls_root_ca_certificate": cfg.IDCache.TLSRootCACertificate,
 		},
 	}
 }
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -13,9 +14,14 @@ import (
 func Server(opts ...Option) (*http.Server, error) {
 	options := newOptions(opts...)

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCaCertPath,
+	)
 	readyHandler := handlers.NewCheckHandler(handlers.NewCheckHandlerConfiguration().
 		WithLogger(options.Logger).
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr)).
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Addr, secureOption)).
 		WithCheck("grpc reachability", checks.NewGRPCCheck(options.Config.GRPC.Addr)),
 	)

@@ -2,15 +2,6 @@

 package thumbnail

-import "github.com/davidbyttow/govips/v2/vips"
-
-func init() {
-	// temporary remove TIFF and JP2K from go-vips' list of supported
-	// imagetypes
-	delete(vips.ImageTypes, vips.ImageTypeTIFF)
-	delete(vips.ImageTypes, vips.ImageTypeJP2K)
-}
-
 var (
 	// SupportedMimeTypes contains an all mimetypes which are supported by the thumbnailer.
 	SupportedMimeTypes = map[string]struct{}{
@@ -20,6 +11,7 @@ var (
 		"image/gif":                         {},
 		"image/bmp":                         {},
 		"image/x-ms-bmp":                    {},
+		"image/tiff":                        {},
 		"text/plain":                        {},
 		"audio/flac":                        {},
 		"audio/mpeg":                        {},
@@ -92,6 +92,9 @@ func Server(cfg *config.Config) *cobra.Command {
 				microstore.Database(cfg.Persistence.Database),
 				microstore.Table(cfg.Persistence.Table),
 				store.Authentication(cfg.Persistence.AuthUsername, cfg.Persistence.AuthPassword),
+				store.TLSEnabled(cfg.Persistence.EnableTLS),
+				store.TLSInsecure(cfg.Persistence.TLSInsecure),
+				store.TLSRootCA(cfg.Persistence.TLSRootCACertificate),
 			)

 			tm, err := pool.StringToTLSMode(cfg.GRPCClientTLS.Mode)
@@ -39,13 +39,16 @@ type Config struct {

 // Persistence configures the store to use
 type Persistence struct {
-	Store        string        `yaml:"store" env:"OC_PERSISTENT_STORE;USERLOG_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
-	Nodes        []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;USERLOG_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	Database     string        `yaml:"database" env:"USERLOG_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
-	Table        string        `yaml:"table" env:"USERLOG_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
-	TTL          time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;USERLOG_STORE_TTL" desc:"Time to live for events in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
-	AuthUsername string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;USERLOG_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
-	AuthPassword string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;USERLOG_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	Store                string        `yaml:"store" env:"OC_PERSISTENT_STORE;USERLOG_STORE" desc:"The type of the store. Supported values are: 'memory', 'nats-js-kv', 'redis-sentinel', 'noop'. See the text description for details." introductionVersion:"1.0.0"`
+	Nodes                []string      `yaml:"nodes" env:"OC_PERSISTENT_STORE_NODES;USERLOG_STORE_NODES" desc:"A list of nodes to access the configured store. This has no effect when 'memory' store is configured. Note that the behaviour how nodes are used is dependent on the library of the configured store. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	Database             string        `yaml:"database" env:"USERLOG_STORE_DATABASE" desc:"The database name the configured store should use." introductionVersion:"1.0.0"`
+	Table                string        `yaml:"table" env:"USERLOG_STORE_TABLE" desc:"The database table the store should use." introductionVersion:"1.0.0"`
+	TTL                  time.Duration `yaml:"ttl" env:"OC_PERSISTENT_STORE_TTL;USERLOG_STORE_TTL" desc:"Time to live for events in the store. Defaults to '336h' (2 weeks). See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
+	AuthUsername         string        `yaml:"username" env:"OC_PERSISTENT_STORE_AUTH_USERNAME;USERLOG_STORE_AUTH_USERNAME" desc:"The username to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	AuthPassword         string        `yaml:"password" env:"OC_PERSISTENT_STORE_AUTH_PASSWORD;USERLOG_STORE_AUTH_PASSWORD" desc:"The password to authenticate with the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"1.0.0"`
+	EnableTLS            bool          `yaml:"enable_tls" env:"OC_PERSISTENT_STORE_ENABLE_TLS;USERLOG_STORE_ENABLE_TLS" desc:"Enable TLS for the connection to the store. Only applies when store type 'nats-js-kv' is configured." introductionVersion:"7.2.0"`
+	TLSInsecure          bool          `yaml:"tls_insecure" env:"OC_INSECURE;OC_PERSISTENT_STORE_TLS_INSECURE;USERLOG_STORE_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"7.2.0"`
+	TLSRootCACertificate string        `yaml:"tls_root_ca_certificate" env:"OC_PERSISTENT_STORE_TLS_ROOT_CA_CERTIFICATE;USERLOG_STORE_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided USERLOG_STORE_TLS_INSECURE will be seen as false." introductionVersion:"7.2.0"`
 }

 // Events combines the configuration options for the event bus.
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/checks"
 	"github.com/opencloud-eu/opencloud/pkg/handlers"
+	"github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/service/debug"
 	"github.com/opencloud-eu/opencloud/pkg/version"
 )
@@ -17,8 +18,13 @@ func Server(opts ...Option) (*http.Server, error) {
 		WithLogger(options.Logger).
 		WithCheck("web reachability", checks.NewHTTPCheck(options.Config.HTTP.Addr))

+	secureOption := nats.Secure(
+		options.Config.Events.EnableTLS,
+		options.Config.Events.TLSInsecure,
+		options.Config.Events.TLSRootCACertificate,
+	)
 	readyHandlerConfiguration := healthHandlerConfiguration.
-		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint))
+		WithCheck("nats reachability", checks.NewNatsCheck(options.Config.Events.Endpoint, secureOption))

 	return debug.NewService(
 		debug.Logger(options.Logger),
@@ -101,7 +101,7 @@ func (ul *UserlogService) MemorizeEvents(ch <-chan events.Event) {
 	for i := 0; i < ul.cfg.MaxConcurrency; i++ {
 		go func(ch <-chan events.Event) {
 			for event := range ch {
-				ul.processEvent(event)
+				go ul.processEvent(event)
 			}
 		}(ch)
 	}
@@ -1,7 +1,7 @@
 SHELL := bash
 NAME := web
-WEB_ASSETS_VERSION = v7.1.0
-WEB_ASSETS_BRANCH = main
+WEB_ASSETS_VERSION = v7.1.4
+WEB_ASSETS_BRANCH = stable-7.1

 ifneq (, $(shell command -v go 2> /dev/null)) # suppress `command not found warnings` for non go targets in CI
 include ../../.bingo/Variables.mk
@@ -5,8 +5,8 @@ type Options struct {
 	AccountEditLink        *AccountEditLink    `json:"accountEditLink,omitempty" yaml:"accountEditLink"`
 	DisableFeedbackLink    bool                `json:"disableFeedbackLink,omitempty" yaml:"disableFeedbackLink" env:"WEB_OPTION_DISABLE_FEEDBACK_LINK" desc:"Set this option to 'true' to disable the feedback link in the top bar. Keeping it enabled by setting the value to 'false' or with the absence of the option, allows OpenCloud to get feedback from your user base through a dedicated survey website." introductionVersion:"1.0.0"`
 	FeedbackLink           *FeedbackLink       `json:"feedbackLink,omitempty" yaml:"feedbackLink"`
-	RunningOnEOS           bool                `json:"runningOnEos,omitempty" yaml:"runningOnEos" env:"WEB_OPTION_RUNNING_ON_EOS" desc:"Set this option to 'true' if running on an EOS storage backend (https://eos-web.web.cern.ch/eos-web/) to enable its specific features. Defaults to 'false'." introductionVersion:"1.0.0" deprecationVersion:"6.2.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"WEB_OPTION_RUNNING_ON_EOS is deprecated and will be removed in a future release."`
-	CernFeatures           bool                `json:"cernFeatures,omitempty" yaml:"cernFeatures" deprecationVersion:"6.2.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%"`
+	RunningOnEOS           bool                `json:"runningOnEos,omitempty" yaml:"runningOnEos" env:"WEB_OPTION_RUNNING_ON_EOS" desc:"Set this option to 'true' if running on an EOS storage backend (https://eos-web.web.cern.ch/eos-web/) to enable its specific features. Defaults to 'false'." introductionVersion:"1.0.0" deprecationVersion:"6.2.0" removalVersion:"7.2.0" deprecationInfo:"WEB_OPTION_RUNNING_ON_EOS is deprecated and will be removed in a future release."`
+	CernFeatures           bool                `json:"cernFeatures,omitempty" yaml:"cernFeatures" deprecationVersion:"6.2.0" removalVersion:"7.2.0"`
 	OpenFilesInNewTab      bool                `json:"openFilesInNewTab,omitempty" yaml:"openFilesInNewTab" env:"WEB_OPTION_OPEN_FILES_IN_NEW_TAB" desc:"Set this option to 'true' to open files in a new browser tab instead of navigating in the same tab. Defaults to 'false'." introductionVersion:"5.3.0"`
 	Upload                 *Upload             `json:"upload,omitempty" yaml:"upload"`
 	Editor                 *Editor             `json:"editor,omitempty" yaml:"editor"`
@@ -287,9 +287,7 @@ class GraphContext implements Context {
 	public function adminDeletesUserUsingTheGraphApi(string $user, ?string $byUser = null): ?ResponseInterface {
 		$credentials = $this->getAdminOrUserCredentials($byUser);
 		$userId = $this->featureContext->getAttributeOfCreatedUser($user, 'id');
-		if ($userId === null) {
-			throw new \RuntimeException("Cannot delete user '$user': no userId found");
-		}
+		$userId = $userId ?: $user;
 		return GraphHelper::deleteUserByUserId(
 			$this->featureContext->getBaseUrl(),
 			$this->featureContext->getStepLineRef(),
@@ -469,6 +469,80 @@ trait Provisioning {
 		$this->ldapCreatedUsers[] = $setting["userid"];
 	}

+	/**
+	 * Creates a user through the Graph API and replaces a stale existing user if needed.
+	 *
+	 * @param string $userName
+	 * @param string $password
+	 * @param string|null $email
+	 * @param string|null $displayName
+	 * @param string|null $byUser
+	 *
+	 * @return string
+	 * @throws Exception|GuzzleException
+	 */
+	private function createGraphUserWithReplacement(
+		string $userName,
+		string $password,
+		?string $email,
+		?string $displayName,
+		?string $byUser = null
+	): string {
+		$userName = $this->getActualUsername($userName);
+		$userName = \trim($userName);
+		if ($displayName === null) {
+			$displayName = $this->getDisplayNameForUser($userName);
+			if ($displayName === null) {
+				$displayName = $this->getDisplayNameForUser('regularuser');
+			}
+		}
+		if ($email === null) {
+			$email = $this->getEmailAddressForUser($userName);
+			if ($email === null) {
+				$email = \str_replace(["@", " "], "", $userName) . '@opencloud.eu';
+			}
+		}
+		$reqUser = $byUser ? $this->getActualUsername($byUser) : $this->getAdminUsername();
+		$response = GraphHelper::createUser(
+			$this->getBaseUrl(),
+			$this->getStepLineRef(),
+			$reqUser,
+			$this->getPasswordForUser($reqUser),
+			$userName,
+			$password,
+			$email,
+			$displayName,
+		);
+
+		if ($response->getStatusCode() === 409) {
+			$responseBody = $this->getJsonDecodedResponse($response);
+			if (($responseBody['error']['code'] ?? null) === 'nameAlreadyExists') {
+				$deleteResponse = $this->deleteUser($userName);
+				$this->theHTTPStatusCodeShouldBe(204, "", $deleteResponse);
+
+				$response = GraphHelper::createUser(
+					$this->getBaseUrl(),
+					$this->getStepLineRef(),
+					$reqUser,
+					$this->getPasswordForUser($reqUser),
+					$userName,
+					$password,
+					$email,
+					$displayName,
+				);
+			}
+		}
+
+		Assert::assertEquals(
+			201,
+			$response->getStatusCode(),
+			__METHOD__ . " cannot create user '$userName'.\nResponse:" .
+			json_encode($this->getJsonDecodedResponse($response))
+		);
+
+		return (string)$this->getJsonDecodedResponse($response)['id'];
+	}
+
 	/**
 	 * @param string $group group name
 	 *
@@ -581,37 +655,7 @@ trait Provisioning {
 					);
 				}
 			} else {
-				// Use the same logic as userHasBeenCreated for email generation
-				if ($email === null) {
-					$email = $this->getEmailAddressForUser($userName);
-					if ($email === null) {
-						// escape @ & space if present in userId
-						$email = \str_replace(["@", " "], "", $userName) . '@opencloud.eu';
-					}
-				}
-
-				$userName = $this->getActualUsername($userName);
-				$userName = \trim($userName);
-
-				$response = GraphHelper::createUser(
-					$this->getBaseUrl(),
-					$this->getStepLineRef(),
-					$this->getAdminUsername(),
-					$this->getAdminPassword(),
-					$userName,
-					$password,
-					$email,
-					$displayName,
-				);
-
-				Assert::assertEquals(
-					201,
-					$response->getStatusCode(),
-					__METHOD__ . " cannot create user '$userName'.\nResponse:" .
-					json_encode($this->getJsonDecodedResponse($response))
-				);
-
-				$userId = $this->getJsonDecodedResponse($response)['id'];
+				$userId = $this->createGraphUserWithReplacement($userName, $password, $email, $displayName);
 			}

 			$this->addUserToCreatedUsersList($userName, $password, $displayName, $email, $userId ?? null);
@@ -1069,24 +1113,7 @@ trait Provisioning {
 				);
 			}
 		} else {
-			$reqUser = $byUser ? $this->getActualUsername($byUser) : $this->getAdminUsername();
-			$response = GraphHelper::createUser(
-				$this->getBaseUrl(),
-				$this->getStepLineRef(),
-				$reqUser,
-				$this->getPasswordForUser($reqUser),
-				$user,
-				$password,
-				$email,
-				$displayName,
-			);
-			Assert::assertEquals(
-				201,
-				$response->getStatusCode(),
-				__METHOD__ . " cannot create user '$user'.\nResponse:" .
-				json_encode($this->getJsonDecodedResponse($response))
-			);
-			$userId = $this->getJsonDecodedResponse($response)['id'];
+			$userId = $this->createGraphUserWithReplacement($user, $password, $email, $displayName, $byUser);
 		}

 		$this->addUserToCreatedUsersList($user, $password, $displayName, $email, $userId);
@@ -1709,7 +1736,6 @@ trait Provisioning {
 				$this->ocsApiVersion
 			);
 		} else {
-			// users can be deleted using the username in the GraphApi too
 			$response = $this->graphContext->adminDeletesUserUsingTheGraphApi($user);
 		}
 		return $response;
@@ -63,28 +63,28 @@ Feature: Disabling and deleting space
  Scenario Outline: user cannot delete their own space without first disabling it
    Given the administrator has assigned the role "<user-role>" to user "Alice" using the Graph API
    When user "Alice" deletes a space "Project Moon"
-    Then the HTTP status code should be "400"
+    Then the HTTP status code should be "<code>"
    And the user "Alice" should have a space called "Project Moon"
    Examples:
-      | user-role   |
-      | Admin       |
-      | Space Admin |
-      | User        |
-      | User Light  |
+      | user-role   | code |
+      | Admin       | 400  |
+      | Space Admin | 400  |
+      | User        | 403  |
+      | User Light  | 403  |


-  Scenario Outline: user can delete their own disabled space via the Graph API
+  Scenario Outline: user cannot delete their own disabled space via the Graph API
    Given the administrator has assigned the role "<user-role>" to user "Alice" using the Graph API
    And user "Alice" has disabled a space "Project Moon"
    When user "Alice" deletes a space "Project Moon"
-    Then the HTTP status code should be "204"
-    And the user "Alice" should not have a space called "Project Moon"
+    Then the HTTP status code should be "<code>"
+    And the user "Alice" <shouldOrNot> have a space called "Project Moon"
    Examples:
-      | user-role   |
-      | Admin       |
-      | Space Admin |
-      | User        |
-      | User Light  |
+      | user-role   | code | shouldOrNot |
+      | Admin       | 204  | should not  |
+      | Space Admin | 204  | should not  |
+      | User        | 403  | should      |
+      | User Light  | 403  | should      |


  Scenario Outline: an admin and space manager can disable other space via the Graph API
@@ -134,7 +134,7 @@ Feature: Disabling and deleting space

  Scenario Outline: viewer and space editor cannot disable space
    When user "<user>" tries to disable a space "Project Moon" owned by user "Alice"
-    Then the HTTP status code should be "404"
+    Then the HTTP status code should be "403"
    And the user "<user>" should have a space called "Project Moon"
    Examples:
      | user  |
@@ -152,11 +152,14 @@ Feature: Space management

  Scenario Outline: space admin user tries to disable the personal space
    When user "<user>" disables a space "Alice Hansen" owned by user "Alice"
-    Then the HTTP status code should be "404"
+    Then the HTTP status code should be "<code>"
    Examples:
-      | user  |
-      | Brian |
-      | Carol |
+      | user  | code |
+      # Brian is Space Admin and can currently list all Personal Spaces, so he
+      # gets a 403 instead of a 404 here. This might change in the future see:
+      # https://github.com/opencloud-eu/opencloud/issues/2979
+      | Brian | 403  |
+      | Carol | 404  |


  Scenario: space admin user deletes the project space
@@ -405,10 +405,13 @@ func SpaceUpdated(r *provider.UpdateStorageSpaceResponse, req *provider.UpdateSt

 // SpaceEnabled converts the response to an event
 func SpaceEnabled(r *provider.UpdateStorageSpaceResponse, req *provider.UpdateStorageSpaceRequest, executant *user.User) events.SpaceEnabled {
+	var grants map[string]provider.ResourcePermissions
+	_ = utils.ReadJSONFromOpaque(r.GetOpaque(), "grants", &grants)
 	return events.SpaceEnabled{
 		Executant: executant.GetId(),
 		ID:        r.StorageSpace.Id,
 		Owner:     extractOwner(r.StorageSpace.Owner),
+		Members:   grants,
 		Timestamp: utils.TSNow(),
 	}
 }
@@ -460,9 +463,12 @@ func SpaceUnshared(r *collaboration.RemoveShareResponse, req *collaboration.Remo

 // SpaceDisabled converts the response to an event
 func SpaceDisabled(r *provider.DeleteStorageSpaceResponse, req *provider.DeleteStorageSpaceRequest, executant *user.User) events.SpaceDisabled {
+	var grants map[string]provider.ResourcePermissions
+	_ = utils.ReadJSONFromOpaque(r.GetOpaque(), "grants", &grants)
 	return events.SpaceDisabled{
 		Executant: executant.GetId(),
 		ID:        req.Id,
+		Members:   grants,
 		Timestamp: time.Now(),
 	}
 }
@@ -169,11 +169,12 @@ func NewUnary(m map[string]interface{}) (grpc.UnaryServerInterceptor, int, error
 		case *provider.UpdateStorageSpaceResponse:
 			if isSuccess(v) {
 				r := req.(*provider.UpdateStorageSpaceRequest)
-				if r.StorageSpace.Name != "" {
-					ev = SpaceRenamed(v, r, executant)
-				} else if utils.ExistsInOpaque(r.Opaque, "restore") {
+				switch {
+				case utils.ExistsInOpaque(r.Opaque, "restore"):
 					ev = SpaceEnabled(v, r, executant)
-				} else {
+				case r.StorageSpace.Name != "":
+					ev = SpaceRenamed(v, r, executant)
+				default:
 					ev = SpaceUpdated(v, r, executant)
 				}
 			}
@@ -608,6 +608,12 @@ func (s *Service) UpdateStorageSpace(ctx context.Context, req *provider.UpdateSt
 		return nil, err
 	}
 	s.addMissingStorageProviderID(res.GetStorageSpace().GetRoot(), res.GetStorageSpace().GetId())
+	if res.Opaque == nil {
+		res.Opaque = &typesv1beta1.Opaque{
+			Map: map[string]*typesv1beta1.OpaqueEntry{},
+		}
+	}
+	res.Opaque.Map["grants"] = res.StorageSpace.GetOpaque().GetMap()["grants"]
 	return res, nil
 }

@@ -625,7 +631,10 @@ func (s *Service) DeleteStorageSpace(ctx context.Context, req *provider.DeleteSt
 		case errtypes.IsNotFound:
 			st = status.NewNotFound(ctx, "space not found")
 		case errtypes.PermissionDenied:
-			st = status.NewPermissionDenied(ctx, err, "permission denied")
+			// The requesting user, while being a member of the space, is currently
+			// not allowed to list that space. E.g. because it is disabled. Return
+			// a "NotFound" status here.
+			st = status.NewNotFound(ctx, "space not found")
 		case errtypes.BadRequest:
 			st = status.NewInvalid(ctx, err.Error())
 		default:
@@ -119,11 +119,18 @@ func (s *svc) handleTusPost(ctx context.Context, w http.ResponseWriter, r *http.
 		isSecretFileDrop = true
 	}

-	// r.Header.Get(net.HeaderOCChecksum)
-	// TODO must be SHA1, ADLER32 or MD5 ... in capital letters????
-	// curl -X PUT https://demo.example.org/remote.php/webdav/testcs.bin -u demo:demo -d '123' -v -H 'OC-Checksum: SHA1:40bd001563085fc35165329ea1ff5c5ecbdbbeef'
-
-	// TODO check Expect: 100-continue
+	checksum := ""
+	if cs, ok := meta["checksum"]; ok {
+		cparts := strings.SplitN(cs, " ", 2)
+		if len(cparts) != 2 {
+			log.Debug().Str("upload-checksum", cs).Msg("invalid Upload-Checksum format, expected '[algorithm] [checksum]'")
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		} else {
+			// we do not check the algorithm here, because it might depend on the storage
+			checksum = strings.ToLower(cparts[0]) + " " + cparts[1]
+		}
+	}

 	client, err := s.gatewaySelector.Next()
 	if err != nil {
@@ -216,6 +223,12 @@ func (s *svc) handleTusPost(ctx context.Context, w http.ResponseWriter, r *http.
 		},
 	}

+	if checksum != "" {
+		opaqueMap[net.HeaderUploadChecksum] = &typespb.OpaqueEntry{
+			Decoder: "plain",
+			Value:   []byte(checksum),
+		}
+	}
 	mtime := meta["mtime"]
 	if mtime != "" {
 		opaqueMap[net.HeaderOCMtime] = &typespb.OpaqueEntry{
@@ -67,6 +67,7 @@ func (SpaceRenamed) Unmarshal(v []byte) (interface{}, error) {
 type SpaceDisabled struct {
 	Executant *user.UserId
 	ID        *provider.StorageSpaceId
+	Members   map[string]provider.ResourcePermissions
 	Timestamp time.Time
 }

@@ -82,6 +83,7 @@ type SpaceEnabled struct {
 	Executant *user.UserId
 	ID        *provider.StorageSpaceId
 	Owner     *user.UserId
+	Members   map[string]provider.ResourcePermissions
 	Timestamp *types.Timestamp
 }

@@ -7,10 +7,21 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/storage/fs/posix/blobstore"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/fs/posix/lookup"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/fs/posix/options"
+	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/tree/propagator"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/utils/templates"
 	"github.com/rs/zerolog"
 )

+const (
+	// The needles include the separator at the beginning to avoid matching internal dir names in substrings
+	// The end segment boundary is checked in isInternalDir
+	trashNeedle    = needle(string(filepath.Separator) + lookup.TrashDir)
+	metadataNeedle = needle(string(filepath.Separator) + lookup.MetadataDir)
+	tmpNeedle      = needle(string(filepath.Separator) + blobstore.TMPDir)
+)
+
+type needle string
+
 // Ignorer handles checking if paths should be ignored in posix operations
 type Ignorer struct {
 	options            *options.Options
@@ -31,39 +42,29 @@ func NewIgnorer(options *options.Options, log *zerolog.Logger) *Ignorer {

 // IsIgnored checking if paths should be ignored in posix operations
 func (i *Ignorer) IsIgnored(path string) bool {
-	return IsLockFile(path) || IsTrash(path) || i.IsUpload(path) || i.IsInternal(path) || i.IsRootPath(path) || i.IsSpaceRoot(path)
+	return i.IsChanges(path) ||
+		i.IsIndex(path) ||
+		IsLockFile(path) ||
+		i.IsTrash(path) ||
+		i.IsMetadata(path) ||
+		i.IsTemporary(path) ||
+		i.IsUpload(path) ||
+		i.IsRootPath(path) ||
+		i.IsSpaceRoot(path)
+}
+
+func (i *Ignorer) IsChanges(path string) bool {
+	return strings.HasPrefix(path, filepath.Join(i.options.Root, propagator.ChangesDir))
+}
+
+func (i *Ignorer) IsIndex(path string) bool {
+	return strings.HasPrefix(path, filepath.Join(i.options.Root, lookup.IndexesDir))
 }

 func (i *Ignorer) IsUpload(path string) bool {
 	return strings.HasPrefix(path, i.options.UploadDirectory)
 }

-func (i *Ignorer) IsIndex(path string) bool {
-	return strings.HasPrefix(path, filepath.Join(i.options.Root, "indexes"))
-}
-
-func (i *Ignorer) IsChanges(path string) bool {
-	return strings.HasPrefix(path, filepath.Join(i.options.Root, "changes"))
-}
-
-func (i *Ignorer) IsTemporary(path string) bool {
-	if filepath.IsAbs(path) {
-		tmpDirPattern := filepath.Join(i.options.Root, "*", "*", blobstore.TMPDir)
-		isTempDir, err := filepath.Match(tmpDirPattern, path)
-		if err != nil {
-			i.log.Error().Err(err).Str("pattern", tmpDirPattern).Str("path", path).Msg("error matching temporary path")
-			return false
-		}
-		isTempParentDir, err := filepath.Match(tmpDirPattern, filepath.Dir(path))
-		if err != nil {
-			i.log.Error().Err(err).Str("pattern", tmpDirPattern).Str("path", filepath.Dir(path)).Msg("error matching temporary path")
-			return false
-		}
-		return isTempDir || isTempParentDir
-	}
-	return path == blobstore.TMPDir || filepath.Dir(path) == blobstore.TMPDir
-}
-
 func (i *Ignorer) IsRootPath(path string) bool {
 	return path == i.options.Root ||
 		path == i.personalSpacesRoot ||
@@ -75,14 +76,39 @@ func (i *Ignorer) IsSpaceRoot(path string) bool {
 	return parent == i.personalSpacesRoot || parent == i.projectSpacesRoot
 }

-func (i *Ignorer) IsInternal(path string) bool {
-	return i.IsIndex(path) || strings.Contains(path, lookup.MetadataDir) || i.IsTemporary(path) || i.IsChanges(path)
-}
-
 func IsLockFile(path string) bool {
 	return strings.HasSuffix(path, ".flock") || strings.HasSuffix(path, ".mlock")
 }

-func IsTrash(path string) bool {
-	return strings.HasSuffix(path, ".trashinfo") || strings.HasSuffix(path, ".trashitem") || strings.Contains(path, ".Trash")
+func (i *Ignorer) IsMetadata(path string) bool {
+	return i.isInternalDir(path, metadataNeedle)
+}
+
+func (i *Ignorer) IsTemporary(path string) bool {
+	return i.isInternalDir(path, tmpNeedle)
+}
+
+func (i *Ignorer) IsTrash(path string) bool {
+	return i.isInternalDir(path, trashNeedle)
+}
+
+// isInternalDir checks if the path contains the match dir and that the match lives
+// in the space root, e.g. "/storage/users/user1/.metadata/file" -> match is ".metadata",
+// parent dir is "/storage/users/user1" which is a space root, so this would return true
+func (i *Ignorer) isInternalDir(path string, match needle) bool {
+	idx := strings.Index(path, string(match))
+	if idx <= 0 {
+		return false
+	}
+
+	// must end at a segment boundary (end of path or separator)
+	if length := idx + len(match); length != len(path) && path[length] != filepath.Separator {
+		return false
+	}
+
+	// get the path of the parent dir, e.g. "/a/match" ->  index of "match" is 3
+	// so parentPath is path[:2] -> "/a"
+	parentPath := path[:idx-1]
+
+	return len(parentPath) > 0 && i.IsSpaceRoot(parentPath)
 }
@@ -34,6 +34,7 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/fs/posix/idcache"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/fs/posix/options"
+	dfslookup "github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/lookup"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata/prefixes"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/node"
@@ -48,7 +49,11 @@ import (

 var tracer trace.Tracer

-const MetadataDir = ".oc-nodes"
+const (
+	IndexesDir  = dfslookup.IndexesDir
+	MetadataDir = ".oc-nodes"
+	TrashDir    = ".Trash"
+)

 var _spaceTypePersonal = "personal"
 var _spaceTypeProject = "project"
@@ -145,7 +145,7 @@ func (tb *Trashbin) Setup(fs storage.FS) error {
 }

 func trashRootForNode(n *node.Node) string {
-	return filepath.Join(n.SpaceRoot.InternalPath(), ".Trash")
+	return filepath.Join(n.SpaceRoot.InternalPath(), lookup.TrashDir)
 }

 func (tb *Trashbin) MoveToTrash(ctx context.Context, n *node.Node, path string) error {
@@ -192,7 +192,7 @@ func (tb *Trashbin) ListRecycle(ctx context.Context, spaceID string, key, relati
 	_, span := tracer.Start(ctx, "ListRecycle")
 	defer span.End()

-	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), ".Trash")
+	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), lookup.TrashDir)
 	base := filepath.Join(trashRoot, "files")

 	var originalPath string
@@ -304,7 +304,7 @@ func (tb *Trashbin) RestoreRecycleItem(ctx context.Context, spaceID string, key,
 	_, span := tracer.Start(ctx, "RestoreRecycleItem")
 	defer span.End()

-	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), ".Trash")
+	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), lookup.TrashDir)
 	trashPath := filepath.Clean(filepath.Join(trashRoot, "files", key+".trashitem", relativePath))

 	restorePath := ""
@@ -377,7 +377,7 @@ func (tb *Trashbin) PurgeRecycleItem(ctx context.Context, spaceID, key, relative
 	_, span := tracer.Start(ctx, "PurgeRecycleItem")
 	defer span.End()

-	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), ".Trash")
+	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), lookup.TrashDir)
 	trashPath := filepath.Clean(filepath.Join(trashRoot, "files", key+".trashitem", relativePath))

 	type item struct {
@@ -522,7 +522,7 @@ func (tb *Trashbin) EmptyRecycle(ctx context.Context, spaceID string) error {
 	_, span := tracer.Start(ctx, "EmptyRecycle")
 	defer span.End()

-	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), ".Trash")
+	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), lookup.TrashDir)
 	filesRoot := filepath.Join(trashRoot, "files")

 	entries, err := os.ReadDir(filesRoot)
@@ -582,7 +582,7 @@ func (tb *Trashbin) EmptyRecycle(ctx context.Context, spaceID string) error {
 func (tb *Trashbin) IsEmpty(ctx context.Context, spaceID string) bool {
 	_, span := tracer.Start(ctx, "HasTrashedItems")
 	defer span.End()
-	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), ".Trash", "info")
+	trashRoot := filepath.Join(tb.lu.InternalPath(spaceID, spaceID), lookup.TrashDir, "info")
 	trash, err := os.Open(filepath.Clean(trashRoot))
 	if err != nil {
 		// there is no trash for this space, so no trashed items
@@ -41,7 +41,6 @@ import (

 	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
 	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/storage/fs/posix/ignore"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/fs/posix/watcher"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/metadata/prefixes"
@@ -898,17 +897,19 @@ func (t *Tree) WarmupIDCache(root string, assimilate, onlyDirty bool) error {
 		}

 		// skip irrelevant files
-		if t.Ignorer.IsInternal(path) ||
-			ignore.IsLockFile(path) ||
-			ignore.IsTrash(path) ||
-			t.Ignorer.IsUpload(path) {
-			if info.IsDir() {
+		if t.Ignorer.IsIgnored(path) {
+			switch {
+			case t.Ignorer.IsSpaceRoot(path):
+				// ignore the space root itself, but do not skip the whole tree
+				return nil
+			case t.Ignorer.IsRootPath(path):
+				// ignor the root path itself, but do not skip the whole tree
+				return nil
+			case info.IsDir():
 				return filepath.SkipDir
+			default:
+				return nil
 			}
-			return nil
-		}
-		if t.Ignorer.IsRootPath(path) {
-			return nil // ignore the root paths
 		}

 		if !info.IsDir() && !info.Mode().IsRegular() {
@@ -32,6 +32,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	"github.com/pkg/xattr"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
 	"github.com/rs/zerolog"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/trace"
@@ -54,6 +56,7 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/permissions"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/tree/propagator"
 	"github.com/opencloud-eu/reva/v2/pkg/storage/pkg/decomposedfs/usermapper"
+	"github.com/opencloud-eu/reva/v2/pkg/storage/utils/templates"
 	"github.com/opencloud-eu/reva/v2/pkg/utils"
 )

@@ -177,14 +180,67 @@ func New(lu node.PathLookup, bs node.Blobstore, um usermapper.Mapper, trashbin *
 		go t.workScanQueue()
 	}
 	if o.ScanFS {
+		// warmup the cache for all space roots right away so clients and migrations don't get confused when starting with a cold cache
+		err := t.warmupSpaceRootCache(o)
+		if err != nil {
+			return nil, errors.Wrap(err, "error warming up space root cache")
+		}
+
+		// scan the whole tree asynchronously to pick up new nodes
 		go func() {
-			_ = t.WarmupIDCache(o.Root, true, false)
+			start := time.Now()
+			err := t.WarmupIDCache(o.Root, true, false)
+			if err != nil {
+				t.log.Error().Err(err).Msg("error during initial fs scan")
+			}
+			duration := time.Since(start)
+
+			scanDurationGauge := promauto.NewGauge(prometheus.GaugeOpts{
+				Name: "reva_fs_scan_duration_seconds",
+				Help: "Duration of the initial filesystem scan in seconds",
+			})
+			scanDurationGauge.Set(duration.Seconds())
+			t.log.Info().Dur("duration", duration).Msg("initial fs scan finished")
 		}()
 	}

 	return t, nil
 }

+func (t *Tree) warmupSpaceRootCache(options *options.Options) error {
+	personalRoot := filepath.Clean(filepath.Join(options.Root, templates.Base(options.PersonalSpacePathTemplate)))
+	projectRoot := filepath.Clean(filepath.Join(options.Root, templates.Base(options.GeneralSpacePathTemplate)))
+
+	var paths []string
+	personalEntries, err := os.ReadDir(personalRoot)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return errors.Wrap(err, "could not read personal space root directory")
+	}
+	for _, entry := range personalEntries {
+		paths = append(paths, filepath.Join(personalRoot, entry.Name()))
+	}
+	projectEntries, err := os.ReadDir(projectRoot)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return errors.Wrap(err, "could not read project space root directory")
+	}
+	for _, entry := range projectEntries {
+		paths = append(paths, filepath.Join(projectRoot, entry.Name()))
+	}
+
+	for _, path := range paths {
+		spaceID, _, _, _, err := t.lookup.MetadataBackend().IdentifyPath(context.TODO(), path)
+		if err != nil {
+			t.log.Error().Err(err).Str("path", path).Msg("could not identify space root path")
+			continue
+		}
+		err = t.idCache.Set(context.TODO(), spaceID, spaceID, path)
+		if err != nil {
+			return errors.Wrap(err, "could not cache space root path")
+		}
+	}
+	return nil
+}
+
 func (t *Tree) checkStorage() error {
 	// check if the root path is a directory
 	err := os.MkdirAll(t.options.Root, 0700)
@@ -270,6 +326,10 @@ func (t *Tree) GetMD(_ context.Context, n *node.Node) (os.FileInfo, error) {

 // TouchFile creates a new empty file
 func (t *Tree) TouchFile(ctx context.Context, n *node.Node, markprocessing bool, mtime string) error {
+	if t.Ignorer.IsIgnored(filepath.Join(n.ParentPath(), n.Name)) {
+		return errtypes.PermissionDenied(n.ID)
+	}
+
 	if n.Exists {
 		if markprocessing {
 			return n.SetXattr(ctx, prefixes.StatusPrefix, []byte(node.ProcessingStatus))
@@ -510,7 +570,7 @@ func (t *Tree) ListFolder(ctx context.Context, n *node.Node) ([]*node.Node, erro
 	g.Go(func() error {
 		defer close(work)
 		for _, name := range names {
-			if t.Ignorer.IsInternal(name) || ignore.IsLockFile(name) || ignore.IsTrash(name) {
+			if t.Ignorer.IsIgnored(filepath.Join(dir, name)) {
 				continue
 			}

@@ -702,6 +762,10 @@ func (t *Tree) ResolveSpaceIDIndexEntry(spaceID string) (string, error) {

 // InitNewNode initializes a new node
 func (t *Tree) InitNewNode(ctx context.Context, n *node.Node, fsize uint64) (metadata.UnlockFunc, error) {
+	if t.Ignorer.IsIgnored(filepath.Join(n.ParentPath(), n.Name)) {
+		return nil, errtypes.PermissionDenied(n.ID)
+	}
+
 	_, span := tracer.Start(ctx, "InitNewNode")
 	defer span.End()
 	// create folder structure (if needed)
@@ -748,6 +812,10 @@ func (t *Tree) InitNewNode(ctx context.Context, n *node.Node, fsize uint64) (met

 // TODO check if node exists?
 func (t *Tree) createDirNode(ctx context.Context, n *node.Node) (err error) {
+	if t.Ignorer.IsIgnored(filepath.Join(n.ParentPath(), n.Name)) {
+		return errtypes.PermissionDenied(n.ID)
+	}
+
 	ctx, span := tracer.Start(ctx, "createDirNode")
 	defer span.End()

@@ -794,6 +862,7 @@ func (t *Tree) createDirNode(ctx context.Context, n *node.Node) (err error) {
 	attributes := n.NodeMetadata(ctx)
 	attributes[prefixes.MTimeAttr] = []byte(mtime.UTC().Format(time.RFC3339Nano))
 	attributes[prefixes.IDAttr] = []byte(n.ID)
+	attributes[prefixes.SpaceIDAttr] = []byte(n.SpaceID)
 	attributes[prefixes.TreesizeAttr] = []byte("0") // initialize as empty, TODO why bother? if it is not set we could treat it as 0?

 	if t.options.TreeTimeAccounting || t.options.TreeSizeAccounting {
Author	SHA1	Message	Date
OpenCloud Devops	a17a70c8b7	🎉 Release 7.2.3 (#3258 ) * 🎉 Release 7.2.3 * 🎉 Release 7.2.3	2026-08-06 15:22:44 +02:00
Viktor Scharf	df3a790a2f	bump-opencloud-7.2.3 (#3261 )	2026-08-06 15:11:55 +02:00
Andre Duffeck	eb73d2af0e	Fix missing favorite flag on opensearch hits (#3256 )	2026-08-06 12:42:14 +02:00
OpenCloud Devops	31f01c6d3d	🎉 Release 7.2.2 (#3124 ) * 🎉 Release 7.2.2 * 🎉 Release 7.2.2	2026-07-14 10:24:53 +02:00
Viktor Scharf	6597dad1f9	chore: bump opencloud v7.2.2 (#3125 )	2026-07-14 09:44:49 +02:00
Benedikt Kulmann	8b01d08ce3	chore: bump web to v7.1.4 (#3122 )	2026-07-13 14:27:38 +02:00
OpenCloud Devops	c73ed01908	🎉 Release 7.2.1 (#3017 ) * 🎉 Release 7.2.1 * 🎉 Release 7.2.1 * 🎉 Release 7.2.1	2026-07-06 16:56:15 +02:00
Viktor Scharf	8c4f9d96c0	Fix warming up the id cache for the user storage (#3072 )	2026-07-06 16:32:23 +02:00
Jannik Stehle	a83a3b7680	Merge pull request #3052 from opencloud-eu/bump-web-7.1.3 [full-ci] chore: bump web to v7.1.3	2026-07-02 09:23:54 +02:00
Jannik Stehle	cee5657651	chore: bump web to v7.1.3	2026-07-01 09:50:17 +02:00
Michael Barz	0a500d25bf	Merge pull request #3016 from opencloud-eu/do-not-push-to-rolling skip rolling release for production tags	2026-06-25 10:01:54 +02:00
v.scharf	be121d8a94	skip rolling release for production tags	2026-06-25 09:39:41 +02:00
OpenCloud Devopsandv.scharf	c067b65f3f	🎉 Release 7.2.0 (#2934 ) * 🎉 Release 7.2.0 * 🎉 Release 7.2.0 * 🎉 Release 7.2.0 * 🎉 Release 7.2.0 * 🎉 Release 7.2.0 * trigger ci * 🎉 Release 7.2.0 * 🎉 Release 7.2.0 * 🎉 Release 7.2.0 * 🎉 Release 7.2.0 --------- Co-authored-by: v.scharf <v.scharf@opencloud.eu>	2026-06-25 08:19:55 +02:00
Ralf Haferkamp	c7ed57263c	Merge pull request #3012 from opencloud-eu/bump-web-7.1.2 [full-ci] chore: bump web to v7.1.2	2026-06-24 17:26:13 +02:00
Benedikt Kulmann	1b9cd062c7	chore: bump web to v7.1.2	2026-06-24 15:44:32 +02:00
Ralf Haferkamp	ae53d5847e	Merge pull request #3005 from rhafer/stable/7.2/reva-2.46.6 chore: bump reva to 2.46.6	2026-06-24 09:08:42 +02:00
Ralf Haferkamp	14b34903a7	chore: bump reva to 2.46.6	2026-06-23 16:30:01 +02:00
Michael Barz	a44539d5f6	chore: enable rolling channel	2026-06-23 09:14:02 +02:00
Michael Barz	69a1350921	Merge pull request #3000 from opencloud-eu/replace-placeholder-for-release 🎉 release. replace placeholders	2026-06-22 19:44:23 +02:00
v.scharf	d7375e9904	🎉 release. replace placeholders	2026-06-22 16:31:30 +02:00
Andre Duffeck	b4ed8c4aeb	Merge pull request #2999 from rhafer/stable/7.2/backports [stable-7.2] Backport fixes from main	2026-06-22 15:56:49 +02:00
Benedikt Kulmann	8fd9a82acf	Merge pull request #2998 from opencloud-eu/bump-web-7.1.1 [full-ci] chore: bump web to v7.1.1	2026-06-22 15:12:30 +02:00
André Duffeck	cd99a6fd44	Extend the posixfs consistency command to fix name attr mismatches (cherry picked from commit `cadd02ce29`) Backports: https://github.com/opencloud-eu/opencloud/pull/2980	2026-06-22 14:42:08 +02:00
André Duffeck	c24b6f1c33	Do not try to create personal spaces for lightweight or service users This fixes error logs like RR error when calling Createhome error="gateway: grpc failed with code CODE_INVALID_ARGUMENT" line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/create_home.go:87 service=proxy e.g. during internal requests to the data provider. (cherry picked from commit `1ea634e6e3`) Backports: https://github.com/opencloud-eu/opencloud/pull/2978	2026-06-22 14:41:10 +02:00
André Duffeck	569e630fe0	Handle events asynchronously That should help to keep up with the stream of messages and prevent services from being flagged as slow consumers. (cherry picked from commit `06365d9739`) Backports: #2974	2026-06-22 14:40:11 +02:00
Ralf Haferkamp	7143dc9cba	Revert "fix: disallow thumbnails for tiff and jpeg2000 images" The alpine base images now has a fixed libvips. So we can enable previews for these formats again. This reverts commit `c40629dd85`. (cherry picked from commit `fab1986fb6`) Backports: https://github.com/opencloud-eu/opencloud/pull/2973	2026-06-22 14:39:20 +02:00
Christian Richter	3f83cbc524	change error level for trashing items interaction with search Signed-off-by: Christian Richter <c.richter@opencloud.eu> (cherry picked from commit `faf3ff1959`) Backports: https://github.com/opencloud-eu/opencloud/pull/2951	2026-06-22 14:36:22 +02:00
André Duffeck	6ce5943e07	Do not choke on users that weren't cleaned up yet (cherry picked from commit `92e6c8f3ff`) Backports: https://github.com/opencloud-eu/opencloud/pull/2944	2026-06-22 14:35:05 +02:00
Ralf Haferkamp	7eb08af8ae	fix(graph): translate sharing roles consitently GetRoleDefinition/s does now handle l10n correctly. Previsouly it just returned the non-localized string. What made things worse was that ListPermissions() mutated global list of available roles and replaced some strings with translated values depending on the `accept-language` header. Which resulted in GetRoleDefinition returning results in mixed localization depending on who/what called ListPermissions before. Fixes: #2800 (cherry picked from commit `d163c8ed29`) Backports: https://github.com/opencloud-eu/opencloud/pull/2935	2026-06-22 14:34:16 +02:00
Jörn Friedrich Dreyer	7306abaaf9	add tls support for all nats connections Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de> (cherry picked from commit `77fd4fca69`) Backports: https://github.com/opencloud-eu/opencloud/pull/2063	2026-06-22 14:33:10 +02:00
Benedikt Kulmann	dd345bf48f	chore: bump web to v7.1.1	2026-06-22 12:54:41 +02:00
Ralf Haferkamp	f2e02e1f88	Merge pull request #2967 from rhafer/stable/7.2/reva-2.46.4 [stable-7.2] chore: bump reva to 2.46.5	2026-06-22 12:13:56 +02:00
Ralf Haferkamp	92a2980875	fix: Status codes for Space Disable/Delete Allow a "permission denied error" from reva to bubble up to the client. Reva was fixed to return "permission denied" only when the space to be delete can actually be listed by the user. Other wise it will return "not found". See reva commit 1bf72cb76394671f373e87f15f23f978cf41ab08. So when a user with the 'can manage' role tries to purge an already disabled space it will now get "Forbidden" status instead of a "Not found". Also fixes the expected status codes in the tests. (cherry picked from commit `99d80f30a9`)	2026-06-22 11:19:14 +02:00
Ralf Haferkamp	b25367a845	chore: bump reva to 2.46.5	2026-06-22 11:17:21 +02:00
Ralf Haferkamp	4d82968bd0	Merge pull request #2964 from rhafer/stable/7.2/alpine-bump [stable-7.2] Bump alpine base image	2026-06-18 11:31:45 +02:00
Ralf Haferkamp	90cc015a9c	Bump alpine base image Also adjusts the build image to use the opencloudeu/golang image. So we're in sync with how the binaries are built in CI. It already contains all the required dependencies. (cherry picked from commit `dbc8a21085`)	2026-06-17 15:46:16 +02:00
Michael Barz	6dcb7a1ff2	fix: stable trigger	2026-06-11 13:38:44 +02:00
Michael Barz	63664db2f6	Use rc version in pkg/version/version.go	2026-06-11 13:36:13 +02:00
Michael Barz	f8e26d3198	chore: bump version	2026-06-11 13:36:00 +02:00
v.scharf	a6ca2c538e	set stable in more places	2026-06-11 13:35:46 +02:00
Michael Barz	56e03f12ce	chore: prepare stable-7.2	2026-06-11 13:35:22 +02:00
Andre Duffeck	8ad66f5c35	Merge pull request #2922 from rhafer/reva-bump bump reva to latest main	2026-06-10 12:50:22 +02:00
Ralf Haferkamp	a532da40dc	bump reva to latest main	2026-06-10 11:44:11 +02:00
Heiko-Pohl	5d23251b96	Merge pull request #2912 from opencloud-eu/rename-guest-to-user-light Rename role_name from "guest" to "user-light"	2026-06-10 11:13:28 +02:00
Heiko Pohl	9502e00dc3	switch role_name from guest to user-light in proxy README.md	2026-06-09 11:41:52 +02:00