Merge pull request #320 from opencloud-eu/renovate/stable-4.0-opencloudeu-opencloud-4.x

chore(deps): update opencloudeu/opencloud docker tag to v4.0.8 (stable-4.0)
chore(deps): update opencloudeu/opencloud docker tag to v4.0.8
2026-08-07 20:38:42 +08:00 · 2026-06-25 18:15:00 +02:00 · 2026-06-25 16:06:43 +00:00 · 2026-06-01 17:11:44 +02:00 · 2026-05-30 21:48:54 +00:00 · 2026-05-18 15:46:19 +02:00
47 changed files with 158 additions and 1419 deletions
--- a/.env.example
+++ b/.env.example
@@ -22,12 +22,6 @@ INSECURE=true
 #COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml
 # Keycloak Shared User Directory
 #COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/ldap-keycloak.yml:traefik/ldap-keycloak.yml
-# External IDP
-#COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/external-idp.yml
-# Euro Office with traefik and letsencrypt
-#COMPOSE_FILE=docker-compose.yml:weboffice/euro-office.yml:traefik/opencloud.yml:traefik/euro-office.yml
-# Euro Office with external proxy (Nginx, Caddy, etc.)
-#COMPOSE_FILE=docker-compose.yml:weboffice/euro-office.yml:external-proxy/opencloud.yml:external-proxy/euro-office.yml

 ## Traefik Settings ##
 # Note: Traefik is always enabled and can't be disabled.
@@ -62,12 +56,14 @@ TRAEFIK_SERVICES_TLS_CONFIG="tls.certresolver=letsencrypt"
 #   certificates:
 #     - certFile: /certs/opencloud.test.crt
 #       keyFile: /certs/opencloud.test.key
-#       stores:
-#         - default
+#   stores:
+#     default:
+#       defaultCertificate:
+#         certFile: /certs/opencloud.test.crt
+#         keyFile: /certs/opencloud.test.key
 #
 # The certificates need to be copied into ./certs/, the absolute path inside the container is /certs/.
 # You can also use TRAEFIK_CERTS_DIR=/path/on/host to set the path to the certificates directory.
-#TRAEFIK_CERTS_DIR=./certs
 # Enable the access log for Traefik by setting the following variable to true.
 TRAEFIK_ACCESS_LOG=
 # Configure the log level for Traefik.
@@ -87,9 +83,9 @@ TRAEFIK_LOG_LEVEL=
 # For production releases: "opencloudeu/opencloud"
 # For rolling releases:    "opencloudeu/opencloud-rolling"
 # Defaults to production if not set otherwise
-OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling
+OC_DOCKER_IMAGE=opencloudeu/opencloud
 # The openCloud container version.
-# Defaults to the latest version-tag. Use git pull to update.
+# Defaults to "latest" and points to the latest stable tag.
 OC_DOCKER_TAG=
 # The default id used in opencloud containers is 1000 for user and group.
 # If you want to change the default, use the following variable and the format [UID]:[GID].
@@ -121,30 +117,24 @@ LOG_LEVEL=
 # Define the kind of logging.
 # The default log can be read by machines.
 # Set this to true to make the log human readable.
-#LOG_PRETTY=true
+# LOG_PRETTY=true
 #
 # Define the openCloud storage location. Set the paths for config and data to a local path.
 # Ensure that the configuration and data directories are owned by the user and group with ID 1000:1000.
 # This matches the default user inside the container and avoids permission issues when accessing files.
 # Note that especially the data directory can grow big.
 # Leaving it default stores data in docker internal volumes.
-OC_CONFIG_DIR=
-OC_DATA_DIR=
+# OC_CONFIG_DIR=/your/local/opencloud/config
+# OC_DATA_DIR=/your/local/opencloud/data
 # OpenCloud Web can load extensions from a local directory.
 # The default uses the bind mount to the config/opencloud/apps directory.
-# Example: curl -L https://github.com/opencloud-eu/web-extensions/releases/download/unzip-v1.0.2/unzip-1.0.2.zip -o config/opencloud/apps/unzip-1.0.2.zip && unzip config/opencloud/apps/unzip-1.0.2.zip -d config/opencloud/apps && rm config/opencloud/apps/unzip-1.0.2.zip 
+# Example: curl -L https://github.com/opencloud-eu/web-extensions/releases/download/unzip-v1.0.2/unzip-1.0.2.zip | tar -xz -C config/opencloud/apps
 # NOTE: you need to restart the openCloud container to load the new extensions.
-#OC_APPS_DIR=/your/local/opencloud/apps
-#
-# The default language used by services and the WebUI.
-# Uses ISO 639-1 language codes (e.g. "en", "de", "fr").
-# Defaults to English if not set.
-DEFAULT_LANGUAGE=
+# OC_APPS_DIR=/your/local/opencloud/apps

 # Define the ldap-server storage location. Set the paths for config and data to a local path.
-# Leaving it default stores data in docker internal volumes.
-LDAP_CERTS_DIR=
-LDAP_DATA_DIR=
+# LDAP_CERTS_DIR=
+# LDAP_DATA_DIR=

 # S3 Storage configuration - optional
 # OpenCloud supports S3 storage as primary storage.
@@ -219,9 +209,9 @@ TIKA_IMAGE=
 # Domain of Collabora, where you can find the frontend.
 # Defaults to "collabora.opencloud.test"
 COLLABORA_DOMAIN=
-# NOTE: The WOPI server runs inside the main OpenCloud process and is served by
-# the OpenCloud proxy on the main OpenCloud domain (OC_DOMAIN) under the /wopi and
-# /collaboration paths. It no longer needs its own domain.
+# Domain of the wopiserver which handles Collabora.
+# Defaults to "wopiserver.opencloud.test"
+WOPISERVER_DOMAIN=
 # Admin user for Collabora.
 # Defaults to "admin".
 # Collabora Admin Panel URL:
@@ -243,21 +233,6 @@ COLLABORA_SSL_VERIFICATION=false
 COLLABORA_HOME_MODE=


-### Euro Office Settings ###
-# Domain of Euro Office, where you can find the document server.
-# Defaults to "euro-office.opencloud.test"
-EURO_OFFICE_DOMAIN=
-# JWT Secret for Euro Office. IMPORTANT: Change this for production!
-# Defaults to "changeme"
-EURO_OFFICE_JWT_SECRET=
-# Euro Office Docker image.
-# Defaults to "ghcr.io/euro-office/documentserver"
-EURO_OFFICE_DOCKER_IMAGE=
-# Euro Office Docker tag.
-# Defaults to "latest"
-EURO_OFFICE_DOCKER_TAG=
-
-
 ### Virusscanner Settings ###
 # IMPORTANT: If you enable antivirus, you also MUST configure the START_ADDITIONAL_SERVICES
 # envvar in the OpenCloud Settings above by adding 'antivirus' to the list.
@@ -323,14 +298,6 @@ LDAP_BIND_PASSWORD=

 ## Autoprovisioning Mode ##
 # Use together with idm/external-idp.yml
-# Role assignment driver for the proxy. Defaults to "oidc".
-# Possible values: "oidc", "default"
-# When set to "oidc", roles are assigned based on OIDC claims.
-# When set to "default", all users get the 'user' role assigned.
-PROXY_ROLE_ASSIGNMENT_DRIVER=
-# Assign the default 'user' role to new users. Defaults to "false".
-# Set to "true" when using PROXY_ROLE_ASSIGNMENT_DRIVER=default
-GRAPH_ASSIGN_DEFAULT_USER_ROLE=
 # If you want to use a keycloak for local testing, you can use testing/external-keycloak.yml and testing/ldap-manager.yml
 # Domain of your Identity Provider.
 IDP_DOMAIN=
@@ -340,23 +307,6 @@ IDP_DOMAIN=
 IDP_ISSUER_URL=
 # Url of the account edit page from your Identity Provider.
 IDP_ACCOUNT_URL=
-# Global Client ID: You can override this by specifying a custom client ID, or leave it blank to use the OC defaults, as described in the documentation
-#OC_OIDC_CLIENT_ID=
-# Declares which property should be used for the oidc claim
-# Example: "roles"
-PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=
-# Defines the OIDC client scope
-# Example: "openid profile email roles"
-OC_OIDC_CLIENT_SCOPES=
-# Client specific environment vars
-#WEBFINGER_WEB_OIDC_CLIENT_ID=
-#WEBFINGER_WEB_OIDC_CLIENT_SCOPES=
-#WEBFINGER_IOS_OIDC_CLIENT_ID=
-#WEBFINGER_IOS_OIDC_CLIENT_SCOPES=
-#WEBFINGER_ANDROID_OIDC_CLIENT_ID=
-#WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES=
-#WEBFINGER_DESKTOP_OIDC_CLIENT_ID=
-#WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES=

 ## Shared User Directory Mode ##
 # Use together with idm/ldap-keycloak.yml and traefik/ldap-keycloak.yml
@@ -366,26 +316,11 @@ KEYCLOAK_DOMAIN=
 KEYCLOAK_ADMIN=
 # Admin user login password. Defaults to "admin".
 KEYCLOAK_ADMIN_PASSWORD=
-# Configure the log level for Keycloak.
-# Possible values are "TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL" and "OFF". Default is "INFO".
-KC_LOG_LEVEL=
 # Keycloak Database username. Defaults to "keycloak".
 KC_DB_USERNAME=
 # Keycloak Database password. Defaults to "keycloak".
 KC_DB_PASSWORD=

-## Demo Users ##
-# Enable demo users and groups in the shared LDAP directory.
-# To enable, create custom/ldap-keycloak-demo-users.yml with:
-#   services:
-#     ldap-server:
-#       volumes:
-#         - ./config/ldap/ldif/30_demo_users.ldif:/ldifs/30_demo_users.ldif
-#         - ./config/ldap/ldif/40_demo_groups.ldif:/ldifs/40_demo_groups.ldif
-#
-# Then add it to: COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/ldap-keycloak.yml:traefik/ldap-keycloak.yml:custom/ldap-keycloak-demo-users.yml
-# WARNING: Do not use in production.
-
 ### Radicale Setting ###
 # Radicale is a small open-source CalDAV (calendars, to-do lists) and CardDAV (contacts) server.
 # When enabled OpenCloud is configured as a reverse proxy for Radicale, providing all authenticated
--- a/README.md
+++ b/README.md
@@ -12,7 +12,6 @@ OpenCloud Compose offers a modular approach to deploying OpenCloud with several
 - **Standard deployment** with Traefik reverse proxy and Let's Encrypt certificates or certificates from files
 - **External proxy** support for environments with existing reverse proxies (like Nginx, Caddy, etc.)
 - **Collabora Online** integration for document editing
- **Euro Office** integration for document editing
 - **Keycloak and LDAP** integration for centralized identity management
 - **Full text search** with Apache Tika for content extraction and metadata analysis
 - **Monitoring** with metrics endpoints for observability and performance monitoring
@@ -108,12 +107,9 @@ This setup includes:

 ### With Collabora Online

-> [!NOTE]
-> Collabora Online and [Euro Office](#with-euro-office) are mutually exclusive web office backends — both use the same `collaboration` (WOPI) service, which runs inside the main OpenCloud process. Enable only one of them at a time.
-
 Include Collabora for document editing using either method:

-> **DNS Requirements**: This setup requires DNS entries for the main OpenCloud domain and the Collabora subdomain. The WOPI server is served by OpenCloud on the main domain, so it does not need its own subdomain. Configure DNS A/AAAA records for your domains (e.g., `cloud.example.com`, `collabora.example.com`) or use a wildcard DNS entry (`*.example.com`).
+> **DNS Requirements**: This setup requires DNS entries for the main OpenCloud domain, Collabora subdomain, and WOPI server subdomain. Configure DNS A/AAAA records for your domains (e.g., `cloud.example.com`, `collabora.example.com`, `wopiserver.example.com`) or use a wildcard DNS entry (`*.example.com`).

 Using `-f` flags:
 ```bash
@@ -128,44 +124,9 @@ COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:tr
 > **For local development only**: Add to `/etc/hosts`:
 > ```
 > 127.0.0.1 collabora.opencloud.test
+> 127.0.0.1 wopiserver.opencloud.test
 > ```

-> [!IMPORTANT]
-> **Upgrading from a previous setup**: The `collaboration` (WOPI) service no longer runs as a separate container or on its own `wopiserver.*` domain — it now runs inside the main OpenCloud process and is served by the OpenCloud proxy on the main domain under the `/wopi` and `/collaboration` paths. When upgrading:
-> - Pull the latest compose files and recreate the stack (`docker compose up -d`). The old `collaboration` container is removed automatically.
-> - You can retire the `wopiserver.*` DNS entry (and its `/etc/hosts` line), its reverse-proxy/Traefik route, and the `WOPISERVER_DOMAIN` variable in `.env` — all are now unused.
-> - If you run behind an external proxy, make sure it forwards `/wopi` and `/collaboration` on the OpenCloud domain to OpenCloud (port 9200). Forwarding the whole OpenCloud domain, as already configured, covers this.
-
-### With Euro Office
-
-> [!NOTE]
-> Euro Office and [Collabora Online](#with-collabora-online) are mutually exclusive web office backends — both use the same `collaboration` (WOPI) service, which runs inside the main OpenCloud process. Enable only one of them at a time.
-
-Include Euro Office for document editing using either method:
-
-> **DNS Requirements**: This setup requires DNS entries for the main OpenCloud domain and the Euro Office subdomain. The WOPI server is served by OpenCloud on the main domain, so it does not need its own subdomain. Configure DNS A/AAAA records for your domains (e.g., `cloud.example.com`, `euro-office.example.com`) or use a wildcard DNS entry (`*.example.com`).
-
-Using `-f` flags:
-```bash
-docker compose -f docker-compose.yml -f weboffice/euro-office.yml -f traefik/opencloud.yml -f traefik/euro-office.yml up -d
-```
-
-Or by setting in `.env`:
-```
-COMPOSE_FILE=docker-compose.yml:weboffice/euro-office.yml:traefik/opencloud.yml:traefik/euro-office.yml
-```
-
-> **For local development only**: Add to `/etc/hosts`:
-> ```
-> 127.0.0.1 euro-office.opencloud.test
-> ```
-
-> [!IMPORTANT]
-> Set a strong `EURO_OFFICE_JWT_SECRET` in your `.env` file for production. The default value (`changeme`) is intended for local development only.
-
-> [!NOTE]
-> Upgrading from a previous setup? See [Upgrading from a previous setup](#with-collabora-online) under Collabora Online — the WOPI server changes (no more separate container or `wopiserver.*` domain) apply to Euro Office as well.
-
 ### With Full Text Search

 Enable full text search capabilities with Apache Tika using either method:
@@ -265,28 +226,7 @@ COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud
 This exposes the necessary ports:
 - OpenCloud: 9200
 - Collabora: 9980
-
-The WOPI server runs inside the OpenCloud process and is served on the OpenCloud port (9200) under the `/wopi` and `/collaboration` paths, so no separate port needs to be exposed for it.
-
-To use Euro Office instead of Collabora behind an external proxy, swap the web office compose files:
-
-```bash
-docker compose -f docker-compose.yml -f weboffice/euro-office.yml -f external-proxy/opencloud.yml -f external-proxy/euro-office.yml up -d
-```
-
-Or by setting in `.env`:
-```
-COMPOSE_FILE=docker-compose.yml:weboffice/euro-office.yml:external-proxy/opencloud.yml:external-proxy/euro-office.yml
-```
-
-This exposes the necessary ports:
- OpenCloud: 9200
- Euro Office: 9900
-
-As with Collabora, the WOPI server is served on the OpenCloud port (9200) under the `/wopi` and `/collaboration` paths and needs no separate port.
-
-> [!WARNING]
-> `external-proxy/euro-office.yml` binds the exposed ports to `127.0.0.1` only. If your external proxy runs on a different host, use `external-proxy/euro-office-exposed.yml`, which binds to all interfaces (`0.0.0.0`). Only expose these ports when you know what you are doing.
+- WOPI server: 9300

 **Please note:**
 If you're using **Nginx Proxy Manager (NPM)**, you **should NOT** activate **"Block Common Exploits"** for the Proxy Host.
@@ -319,12 +259,12 @@ OpenCloud Compose supports adding SSL certificates for public domains and develo
 ### Use Let's Encrypt with ACME Challenge

 1. **Enable Let's Encrypt**:
-   - Set `TRAEFIK_ACME_MAIL` to your email address for the ACME challenge
+   - Set `TRAEFIK_LETSENCRYPT_EMAIL` to your email address for the ACME challenge
   - Set `TRAEFIK_SERVICES_TLS_CONFIG="tls.certresolver=letsencrypt"` to use Let's Encrypt (default value)

   ```bash
   # In your .env file
-   TRAEFIK_ACME_MAIL=devops@your-domain.tld
+   TRAEFIK_LETSENCRYPT_EMAIL=devops@your-domain.tld
   TRAEFIK_SERVICES_TLS_CONFIG="tls.certresolver=letsencrypt"
   ```

@@ -345,6 +285,10 @@ OpenCloud Compose supports adding SSL certificates for public domains and develo
         keyFile: /certs/opencloud.test.key
         stores:
           - default
+       - certFile: /certs/wildcard.example.com.crt
+         keyFile: /certs/wildcard.example.com.key
+         stores:
+           - default
   ```

 3. **Configure environment variables**:
@@ -401,10 +345,7 @@ Key variables:
 | `OC_DATA_DIR`                 | Data directory path                                   | (Docker volume)              |
 | `INSECURE`                    | Skip certificate validation                           | true                         |
 | `COLLABORA_DOMAIN`            | Collabora domain                                      | collabora.opencloud.test     |
-| `EURO_OFFICE_DOMAIN`          | Euro Office document server domain                    | euro-office.opencloud.test   |
-| `EURO_OFFICE_JWT_SECRET`      | JWT secret for Euro Office (change for production!)   | changeme                     |
-| `EURO_OFFICE_DOCKER_IMAGE`    | Euro Office Docker image                              | ghcr.io/euro-office/documentserver |
-| `EURO_OFFICE_DOCKER_TAG`      | Euro Office Docker tag                                | latest                       |
+| `WOPISERVER_DOMAIN`           | WOPI server domain                                    | wopiserver.opencloud.test    |
 | `TIKA_IMAGE`                  | Apache Tika image tag                                 | apache/tika:slim             |
 | `KEYCLOAK_DOMAIN`             | Keycloak domain                                       | keycloak.opencloud.test      |
 | `KEYCLOAK_ADMIN`              | Keycloak admin username                               | kcadmin                      |
@@ -412,7 +353,7 @@ Key variables:
 | `LDAP_BIND_PASSWORD`          | LDAP password for the bind user                       | admin                        |
 | `KC_DB_USERNAME`              | Database user for keycloak                            | keycloak                     |
 | `KC_DB_PASSWORD`              | Database password for keycloak                        | keycloak                     |
-| `TRAEFIK_ACME_MAIL`           | Email Address for the Let's Encrypt ACME challenge    | example@example.org          |
+| `TRAEFIK_LETSENCRYPT_EMAIL`   | Email Address for the Let's Encrypt ACME challenge    | example@example.org          |
 | `TRAEFIK_SERVICES_TLS_CONFIG` | Tell traefik and the services which TLS config to use | tls.certresolver=letsencrypt |
 | `TRAEFIK_CERTS_DIR`           | Directory for custom certificates.                    | ./certs                      |

--- a/antivirus/clamav.yml
+++ b/antivirus/clamav.yml
@@ -12,9 +12,6 @@ services:
      ANTIVIRUS_SCANNER_TYPE: clamav
    volumes:
      - clamav-socket:/var/run/clamav
-    depends_on:
-      clamav:
-        condition: service_healthy
  clamav:
    image: clamav/clamav:${CLAMAV_DOCKER_TAG:-latest}
    environment:
@@ -29,10 +26,6 @@ services:
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always
-    healthcheck:
-      test: sh -c "[ -S /tmp/clamd.sock ]"
-      timeout: 1s
-      retries: 20
 volumes:
  clamav-db:
  clamav-socket:
--- a/config/euro-office/app-registry.yaml
+++ b/config/euro-office/app-registry.yaml
@@ -1,71 +0,0 @@
-app_registry:
-  mimetypes:
-    - mime_type: application/pdf
-      extension: pdf
-      name: PDF
-      description: PDF document
-      icon: ''
-      default_app: ''
-      allow_creation: false
-    - mime_type: application/vnd.oasis.opendocument.text
-      extension: odt
-      name: OpenDocument
-      description: OpenDocument text document
-      icon: ''
-      default_app: Collabora
-      allow_creation: true
-    - mime_type: application/vnd.oasis.opendocument.spreadsheet
-      extension: ods
-      name: OpenSpreadsheet
-      description: OpenDocument spreadsheet document
-      icon: ''
-      default_app: Collabora
-      allow_creation: true
-    - mime_type: application/vnd.oasis.opendocument.presentation
-      extension: odp
-      name: OpenPresentation
-      description: OpenDocument presentation document
-      icon: ''
-      default_app: Collabora
-    - mime_type: application/vnd.oasis.opendocument.graphics
-      extension: odg
-      name: OpenGraphics
-      description: OpenDocument graphics document
-      icon: ''
-      default_app: Collabora
-      allow_creation: true
-    - mime_type: application/vnd.openxmlformats-officedocument.wordprocessingml.document
-      extension: docx
-      name: Microsoft Word
-      description: Microsoft Word document
-      icon: ''
-      default_app: Euro-Office
-      allow_creation: true
-    - mime_type: application/vnd.openxmlformats-officedocument.wordprocessingml.form
-      extension: docxf
-      name: Form Document
-      description: Form Document
-      icon: ''
-      default_app: Euro-Office
-      allow_creation: true
-    - mime_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
-      extension: xlsx
-      name: Microsoft Excel
-      description: Microsoft Excel document
-      icon: ''
-      default_app: Euro-Office
-      allow_creation: true
-    - mime_type: application/vnd.openxmlformats-officedocument.presentationml.presentation
-      extension: pptx
-      name: Microsoft PowerPoint
-      description: Microsoft PowerPoint document
-      icon: ''
-      default_app: Euro-Office
-      allow_creation: true
-    - mime_type: application/vnd.jupyter
-      extension: ipynb
-      name: Jupyter Notebook
-      description: Jupyter Notebook
-      icon: ''
-      default_app: ''
-      allow_creation: true
--- a/config/keycloak/docker-entrypoint-override.sh
+++ b/config/keycloak/docker-entrypoint-override.sh
@@ -1,8 +1,5 @@
 #!/bin/bash
-# print env variables for trace/debug log levels
-log_level=$(printf '%s' "$KC_LOG_LEVEL" | tr '[:upper:]' '[:lower:]')
-case "$log_level" in trace|debug) printenv ;; *) ;; esac
-
+printenv
 # replace openCloud domain and LDAP password in keycloak realm import
 mkdir /opt/keycloak/data/import
 sed -e "s/cloud.opencloud.test/${OC_DOMAIN}/g" -e "s/ldap-admin-password/${LDAP_ADMIN_PASSWORD:-admin}/g" /opt/keycloak/data/import-dist/openCloud-realm.json > /opt/keycloak/data/import/openCloud-realm.json
--- a/config/keycloak/themes/opencloud/login/resources/css/theme.css
+++ b/config/keycloak/themes/opencloud/login/resources/css/theme.css
@@ -1,51 +1,38 @@
 :root {
-    --pf-v5-global--primary-color--100: #e2baff;
-    --pf-v5-global--primary-color--200: #e2baff;
-    --pf-v5-global--primary-color--dark-100: #e2baff;
-    --pf-v5-c-button--m-secondary--Color: #e2baff;
-    --pf-v5-global--Color--light-100: #20434f;
-    --pf-v5-global--FontFamily--text: "Inter", "RedHatText", helvetica, arial, sans-serif;
-    --pf-v5-global--FontFamily--heading: "Inter", "RedHatDisplay", helvetica, arial, sans-serif;
+    --pf-global--primary-color--100: #e2baff;
+    --pf-global--primary-color--200: #e2baff;
+    --pf-global--primary-color--dark-100: #e2baff;
+    --pf-global--Color--light-100: #20434f;
 }

@font-face {
-    font-family: Inter;
-    src: url('../fonts/Inter-Variable.woff2') format('woff2');
-    font-weight: 100 900;
+    font-family: OpenCloud;
+    src: url('../fonts/OpenCloud500-Regular.woff2') format('woff2');
+    font-weight: normal;
+    font-style: normal;
+}
+
+@font-face {
+    font-family: OpenCloud;
+    src: url('../fonts/OpenCloud750-Bold.woff2') format('woff2');
+    font-weight: bold;
    font-style: normal;
 }

 body {
-    background: url(../img/background.png) no-repeat center fixed !important;
+    font-family: "OpenCloud", "Open Sans", Helvetica, Arial, sans-serif;
+    background: url(../img/background.png) no-repeat center !important;
    background-size: cover !important;
 }

 .kc-logo-text {
-    display: block;
-    width: 300px;
-    height: 63px;
-    background: url('../img/logo.svg') no-repeat center;
+    background-image: url(../img/logo.svg) !important;
    background-size: contain;
+    width: 400px;
+    margin: 0 !important;
 }

-.kc-logo-text span {
-    display: none;
-}
-
-#kc-header-wrapper {
+#kc-header-wrapper{
    display: flex;
    justify-content: center;
-}
-
-.pf-v5-c-login__main-header {
-    border-top: 4px solid var(--pf-v5-global--primary-color--100);
-}
-
-@media (min-width: 1200px) {
-    .pf-v5-c-login__container {
-        grid-template-columns: 34rem;
-        grid-template-areas:
-        "header"
-        "main";
-    }
-}
+}
--- a/config/keycloak/themes/opencloud/login/resources/fonts/Inter-Variable.woff2
+++ b/config/keycloak/themes/opencloud/login/resources/fonts/Inter-Variable.woff2
--- a/config/keycloak/themes/opencloud/login/resources/fonts/OpenCloud500-Regular.woff2
+++ b/config/keycloak/themes/opencloud/login/resources/fonts/OpenCloud500-Regular.woff2
--- a/config/keycloak/themes/opencloud/login/resources/fonts/OpenCloud750-Bold.woff2
+++ b/config/keycloak/themes/opencloud/login/resources/fonts/OpenCloud750-Bold.woff2
--- a/config/keycloak/themes/opencloud/login/resources/js/script.js
+++ b/config/keycloak/themes/opencloud/login/resources/js/script.js
@@ -16,4 +16,4 @@ document.addEventListener("DOMContentLoaded", function () {
    }

    setLogoUrl('https://opencloud.eu')
-});
+});
--- a/config/keycloak/themes/opencloud/login/theme.properties
+++ b/config/keycloak/themes/opencloud/login/theme.properties
@@ -1,5 +1,5 @@
-parent=keycloak.v2
+parent=keycloak
 import=common/keycloak

 styles=css/login.css css/theme.css
-scripts=js/script.js
+scripts=js/script.js
--- a/config/opencloud/apps.yaml
+++ b/config/opencloud/apps.yaml
@@ -1,3 +0,0 @@
-maps:
-  config:
-    folderViewEnabled: false
--- a/config/opencloud/apps/maps/assets/src-D755RU42.css
+++ b/config/opencloud/apps/maps/assets/src-D755RU42.css
--- a/config/opencloud/apps/maps/js/dist-r7AkbZvS.mjs
+++ b/config/opencloud/apps/maps/js/dist-r7AkbZvS.mjs
--- a/config/opencloud/apps/maps/js/hostInit-E45YfNWJ.mjs
+++ b/config/opencloud/apps/maps/js/hostInit-E45YfNWJ.mjs
@@ -1 +0,0 @@
-import{t as e}from"./preload-helper-DafEc2pQ.mjs";await(await e(()=>import(`./remoteEntry-lxWu31Tr.mjs`),[],import.meta.url)).init();
--- a/config/opencloud/apps/maps/js/localSharedImportMap-CALnqYrs.mjs
+++ b/config/opencloud/apps/maps/js/localSharedImportMap-CALnqYrs.mjs
@@ -1 +0,0 @@
-import"./dist-r7AkbZvS.mjs";var e={"@opencloud-eu/web-client":{name:`@opencloud-eu/web-client`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},"@opencloud-eu/web-client/graph":{name:`@opencloud-eu/web-client/graph`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/graph' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},"@opencloud-eu/web-client/graph/generated":{name:`@opencloud-eu/web-client/graph/generated`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/graph/generated' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},"@opencloud-eu/web-client/ocs":{name:`@opencloud-eu/web-client/ocs`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/ocs' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},"@opencloud-eu/web-client/sse":{name:`@opencloud-eu/web-client/sse`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/sse' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},"@opencloud-eu/web-client/webdav":{name:`@opencloud-eu/web-client/webdav`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/webdav' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},"@opencloud-eu/web-pkg":{name:`@opencloud-eu/web-pkg`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-pkg' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},luxon:{name:`luxon`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module 'luxon' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},pinia:{name:`pinia`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module 'pinia' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},vue:{name:`vue`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module 'vue' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}},"vue3-gettext":{name:`vue3-gettext`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module 'vue3-gettext' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}}},t=[];export{t as usedRemotes,e as usedShared};
--- a/config/opencloud/apps/maps/js/maps-BAf8IhJ5.mjs
+++ b/config/opencloud/apps/maps/js/maps-BAf8IhJ5.mjs
@@ -1 +0,0 @@
-import{t as e}from"./src-CIfRBuLG.mjs";export{e as default};
--- a/config/opencloud/apps/maps/js/maps-uKkx1qsf.js
+++ b/config/opencloud/apps/maps/js/maps-uKkx1qsf.js
--- a/config/opencloud/apps/maps/js/mapsloadShare_mf_0_opencloud_mf_2_eu_mf_1_web_mf_2_pkgloadShare.mjs-BA8CS_pX.mjs
+++ b/config/opencloud/apps/maps/js/mapsloadShare_mf_0_opencloud_mf_2_eu_mf_1_web_mf_2_pkgloadShare.mjs-BA8CS_pX.mjs
--- a/config/opencloud/apps/maps/js/mapsloadSharevue3_mf_2_gettextloadShare.mjs-C70VjRQL.mjs
+++ b/config/opencloud/apps/maps/js/mapsloadSharevue3_mf_2_gettextloadShare.mjs-C70VjRQL.mjs
@@ -1 +0,0 @@
-var e=`__mf_init____mf__virtual/maps__mf_v__runtimeInit__mf_v__.js__`,t=globalThis[e];if(!t){let n,r,i=new Promise((e,t)=>{n=e,r=t});t=globalThis[e]={initPromise:i,initResolve:n,initReject:r},typeof window>`u`&&n({loadRemote:function(){return Promise.resolve(void 0)},loadShare:function(){return Promise.resolve(void 0)}})}var n=await t.initPromise.then(e=>e.loadShare(`vue3-gettext`,{customShareInfo:{shareConfig:{singleton:!0,strictVersion:!1,requiredVersion:`*`}}})).then(e=>typeof e==`function`?e():e);n.__esModule,n.default;var{createGettext:r,defineGettextConfig:i,makePO:a,parseSrc:o,tokenize:s,useGettext:c}=n;export{c as t};
--- a/config/opencloud/apps/maps/js/mapsloadSharevueloadShare.mjs-CwuktG-9.mjs
+++ b/config/opencloud/apps/maps/js/mapsloadSharevueloadShare.mjs-CwuktG-9.mjs
@@ -1 +0,0 @@
-var e=`__mf_init____mf__virtual/maps__mf_v__runtimeInit__mf_v__.js__`,t=globalThis[e];if(!t){let n,r,i=new Promise((e,t)=>{n=e,r=t});t=globalThis[e]={initPromise:i,initResolve:n,initReject:r},typeof window>`u`&&n({loadRemote:function(){return Promise.resolve(void 0)},loadShare:function(){return Promise.resolve(void 0)}})}var n=await t.initPromise.then(e=>e.loadShare(`vue`,{customShareInfo:{shareConfig:{singleton:!0,strictVersion:!1,requiredVersion:`*`}}})).then(e=>typeof e==`function`?e():e);n.__esModule,n.default;var{compile:r,Transition:i,TransitionGroup:a,VueElement:ee,createApp:te,createSSRApp:ne,defineCustomElement:re,defineSSRCustomElement:ie,hydrate:ae,initDirectivesForSSR:oe,nodeOps:se,patchProp:ce,render:le,useCssModule:ue,useCssVars:de,useHost:fe,useShadowRoot:pe,vModelCheckbox:me,vModelDynamic:he,vModelRadio:ge,vModelSelect:_e,vModelText:o,vShow:s,withKeys:c,withModifiers:l,EffectScope:u,ReactiveEffect:d,TrackOpTypes:f,TriggerOpTypes:p,customRef:m,effect:h,effectScope:g,getCurrentScope:_,getCurrentWatcher:v,isProxy:y,isReactive:b,isReadonly:x,isRef:S,isShallow:C,markRaw:w,onScopeDispose:T,onWatcherCleanup:E,proxyRefs:D,reactive:O,readonly:k,ref:A,shallowReactive:j,shallowReadonly:M,shallowRef:N,stop:P,toRaw:F,toRef:I,toRefs:ve,toValue:ye,triggerRef:be,unref:L,camelize:xe,capitalize:Se,normalizeClass:R,normalizeProps:Ce,normalizeStyle:we,toDisplayString:z,toHandlerKey:Te,BaseTransition:Ee,BaseTransitionPropsValidators:De,Comment:Oe,DeprecationTypes:ke,ErrorCodes:Ae,ErrorTypeStrings:je,Fragment:Me,KeepAlive:Ne,Static:Pe,Suspense:Fe,Teleport:Ie,Text:Le,assertNumber:Re,callWithAsyncErrorHandling:ze,callWithErrorHandling:Be,cloneVNode:Ve,compatUtils:He,computed:B,createBlock:V,createCommentVNode:H,createElementBlock:U,createElementVNode:W,createHydrationRenderer:Ue,createPropsRestProxy:We,createRenderer:Ge,createSlots:Ke,createStaticVNode:qe,createTextVNode:Je,createVNode:Ye,defineAsyncComponent:Xe,defineComponent:G,defineEmits:Ze,defineExpose:K,defineModel:Qe,defineOptions:$e,defineProps:et,defineSlots:tt,devtools:nt,getCurrentInstance:rt,getTransitionRawChildren:it,guardReactiveProps:at,h:ot,handleError:st,hasInjectionContext:ct,hydrateOnIdle:lt,hydrateOnInteraction:ut,hydrateOnMediaQuery:dt,hydrateOnVisible:ft,initCustomFormatter:pt,inject:mt,isMemoSame:ht,isRuntimeOnly:gt,isVNode:_t,mergeDefaults:vt,mergeModels:yt,mergeProps:bt,nextTick:xt,onActivated:St,onBeforeMount:Ct,onBeforeUnmount:q,onBeforeUpdate:wt,onDeactivated:Tt,onErrorCaptured:Et,onMounted:J,onRenderTracked:Dt,onRenderTriggered:Ot,onServerPrefetch:kt,onUnmounted:Y,onUpdated:At,openBlock:X,popScopeId:jt,provide:Mt,pushScopeId:Nt,queuePostFlushCb:Pt,registerRuntimeCompiler:Ft,renderList:It,renderSlot:Lt,resolveComponent:Rt,resolveDirective:zt,resolveDynamicComponent:Bt,resolveFilter:Vt,resolveTransitionHooks:Ht,setBlockTracking:Ut,setDevtoolsHook:Wt,setTransitionHooks:Gt,ssrContextKey:Kt,ssrUtils:qt,toHandlers:Jt,transformVNodeArgs:Yt,useAttrs:Xt,useId:Zt,useModel:Qt,useSSRContext:$t,useSlots:en,useTemplateRef:Z,useTransitionState:tn,version:nn,warn:rn,watch:Q,watchEffect:an,watchPostEffect:on,watchSyncEffect:sn,withAsyncContext:cn,withCtx:$,withDefaults:ln,withDirectives:un,withMemo:dn,withScopeId:fn}=n;export{G as _,Z as a,A as c,z as d,B as f,W as g,U as h,X as i,L as l,H as m,J as n,Q as o,V as p,Y as r,$ as s,q as t,R as u};
--- a/config/opencloud/apps/maps/js/preload-helper-DafEc2pQ.mjs
+++ b/config/opencloud/apps/maps/js/preload-helper-DafEc2pQ.mjs
@@ -1 +0,0 @@
-var e=`modulepreload`,t=function(e,t){return new URL(e,t).href},n={},r=function(r,i,a){let o=Promise.resolve();if(i&&i.length>0){let r=document.getElementsByTagName(`link`),s=document.querySelector(`meta[property=csp-nonce]`),c=s?.nonce||s?.getAttribute(`nonce`);function l(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:`fulfilled`,value:e}),e=>({status:`rejected`,reason:e}))))}o=l(i.map(i=>{if(i=t(i,a),i in n)return;n[i]=!0;let o=i.endsWith(`.css`),s=o?`[rel="stylesheet"]`:``;if(a)for(let e=r.length-1;e>=0;e--){let t=r[e];if(t.href===i&&(!o||t.rel===`stylesheet`))return}else if(document.querySelector(`link[href="${i}"]${s}`))return;let l=document.createElement(`link`);if(l.rel=o?`stylesheet`:e,o||(l.as=`script`),l.crossOrigin=``,l.href=i,c&&l.setAttribute(`nonce`,c),document.head.appendChild(l),o)return new Promise((e,t)=>{l.addEventListener(`load`,e),l.addEventListener(`error`,()=>t(Error(`Unable to preload CSS for ${i}`)))})}))}function s(e){let t=new Event(`vite:preloadError`,{cancelable:!0});if(t.payload=e,window.dispatchEvent(t),!t.defaultPrevented)throw e}return o.then(e=>{for(let t of e||[])t.status===`rejected`&&s(t.reason);return r().catch(s)})};export{r as t};
--- a/config/opencloud/apps/maps/js/remoteEntry-lxWu31Tr.mjs
+++ b/config/opencloud/apps/maps/js/remoteEntry-lxWu31Tr.mjs
@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./localSharedImportMap-CALnqYrs.mjs","./dist-r7AkbZvS.mjs","./preload-helper-DafEc2pQ.mjs","./virtualExposes-CZMUMkHF.mjs"])))=>i.map(i=>d[i]);
-import{t as e}from"./dist-r7AkbZvS.mjs";import{t}from"./preload-helper-DafEc2pQ.mjs";typeof __VUE_HMR_RUNTIME__>`u`&&(globalThis.__VUE_HMR_RUNTIME__={createRecord(){},rerender(){},reload(){}});var n=`__mf_init____mf__virtual/maps__mf_v__runtimeInit__mf_v__.js__`,r=globalThis[n];if(!r){let e,t,i=new Promise((n,r)=>{e=n,t=r});r=globalThis[n]={initPromise:i,initResolve:e,initReject:t},typeof window>`u`&&e({loadRemote:function(){return Promise.resolve(void 0)},loadShare:function(){return Promise.resolve(void 0)}})}var i=r.initResolve,a={},o=`default`,s=`maps`,c,l;async function u(){return c??=t(()=>import(`./localSharedImportMap-CALnqYrs.mjs`),__vite__mapDeps([0,1,2]),import.meta.url),c}async function d(){return l??=t(()=>import(`./virtualExposes-CZMUMkHF.mjs`).then(e=>e.default??e),__vite__mapDeps([3,2]),import.meta.url),l}async function f(t={},n=[]){let{usedShared:r,usedRemotes:c}=await u(),l=e({name:s,remotes:c,shared:r,plugins:[],shareStrategy:`version-first`});var d=a[o];if(d||=a[o]={from:s},!(n.indexOf(d)>=0)){n.push(d),l.initShareScopeMap(`default`,t),i(l);try{await Promise.all(await l.initializeSharing(`default`,{strategy:`version-first`,from:`build`,initScope:n}))}catch(e){console.error(`[Module Federation]`,e)}return l}}async function p(e){let t=await d();if(!(e in t))throw Error(`[Module Federation] Module ${e} does not exist in container.`);return t[e]().then(e=>()=>e)}export{p as get,f as init};
--- a/config/opencloud/apps/maps/js/rolldown-runtime-BLwG3bfA.mjs
+++ b/config/opencloud/apps/maps/js/rolldown-runtime-BLwG3bfA.mjs
@@ -1 +0,0 @@
-var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),s=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},c=(n,r,a)=>(a=n==null?{}:e(i(n)),s(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n));export{c as n,o as t};
--- a/config/opencloud/apps/maps/js/src-CIfRBuLG.mjs
+++ b/config/opencloud/apps/maps/js/src-CIfRBuLG.mjs
--- a/config/opencloud/apps/maps/js/src-D0iZetHT.mjs
+++ b/config/opencloud/apps/maps/js/src-D0iZetHT.mjs
@@ -1 +0,0 @@
-import{t as e}from"./src-CIfRBuLG.mjs";export{e as default};
--- a/config/opencloud/apps/maps/js/virtualExposes-CZMUMkHF.mjs
+++ b/config/opencloud/apps/maps/js/virtualExposes-CZMUMkHF.mjs
@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["../assets/src-D755RU42.css"])))=>i.map(i=>d[i]);
-import{t as e}from"./preload-helper-DafEc2pQ.mjs";var t={},n=new Set;async function r(e){if(typeof document>`u`)return;let r=t[e]||[];await Promise.all(r.map(e=>{let t=new URL(e,import.meta.url).href;return n.has(t)||(n.add(t),document.querySelector(`link[rel="stylesheet"][data-mf-href="${t}"]`))?Promise.resolve():new Promise((e,n)=>{let r=document.createElement(`link`);r.rel=`stylesheet`,r.href=t,r.setAttribute(`data-mf-href`,t),r.onload=()=>e(),r.onerror=()=>n(Error(`[Module Federation] Failed to load CSS asset: ${t}`)),document.head.appendChild(r)})}))}var i={".":async()=>{await r(`.`);let t=await e(()=>import(`./maps-BAf8IhJ5.mjs`),__vite__mapDeps([0]),import.meta.url),n={};return Object.assign(n,t),Object.defineProperty(n,`__esModule`,{value:!0,enumerable:!1}),n}};export{i as default};
--- a/config/opencloud/apps/maps/manifest.json
+++ b/config/opencloud/apps/maps/manifest.json
@@ -1,3 +1,3 @@
 {
-  "entrypoint": "js/remoteEntry-lxWu31Tr.mjs"
-}
+  "entrypoint": "js/maps-uKkx1qsf.js"
+}
--- a/config/opencloud/csp.yaml
+++ b/config/opencloud/csp.yaml
@@ -9,7 +9,6 @@ directives:
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
    - 'https://${IDP_DOMAIN|keycloak.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
    - 'https://update.opencloud.eu/'
-    - 'https://tile.openstreetmap.org/'
  default-src:
    - '''none'''
  font-src:
@@ -22,10 +21,8 @@ directives:
    - 'https://embed.diagrams.net/'
    # In contrary to bash and docker the default is given after the | character
    - 'https://${COLLABORA_DOMAIN|collabora.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
-    - 'https://${EURO_OFFICE_DOMAIN|euro-office.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
    # This is needed for the external-sites web extension when embedding sites
    - 'https://docs.opencloud.eu'
-    - 'https://${IDP_DOMAIN|keycloak.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
  img-src:
    - '''self'''
    - 'data:'
@@ -34,7 +31,6 @@ directives:
    - 'https://tile.openstreetmap.org/'
    # In contrary to bash and docker the default is given after the | character
    - 'https://${COLLABORA_DOMAIN|collabora.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
-    - 'https://${EURO_OFFICE_DOMAIN|euro-office.opencloud.test}${TRAEFIK_PORT_HTTPS}/'
  manifest-src:
    - '''self'''
  media-src:
@@ -49,6 +45,3 @@ directives:
  style-src:
    - '''self'''
    - '''unsafe-inline'''
-  worker-src:
-    - "'self'"
-    - 'blob:'
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,8 +1,8 @@
 ---
 services:
  opencloud:
-    # renovate: depName=opencloudeu/opencloud-rolling
-    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-7.4.0}
+    # renovate: depName=opencloudeu/opencloud
+    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud}:${OC_DOCKER_TAG:-4.0.8}
    # changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog
    # release notes: https://docs.opencloud.eu/opencloud_release_notes.html
    user: ${OC_CONTAINER_UID_GID:-1000:1000}
@@ -47,18 +47,15 @@ services:
      OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
      # control the password enforcement and policy for public shares
      OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD:-true}"
-      OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD:-false}"
+      OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD:-true}"
      OC_PASSWORD_POLICY_DISABLED: "${OC_PASSWORD_POLICY_DISABLED:-false}"
      OC_PASSWORD_POLICY_MIN_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_CHARACTERS:-8}"
      OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS:-1}"
      OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS:-1}"
      OC_PASSWORD_POLICY_MIN_DIGITS: "${OC_PASSWORD_POLICY_MIN_DIGITS:-1}"
      OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS:-1}"
-      # default language for services/WebUI; defaults to English, language code (ISO 639-1, e.g. de, en, fr)
-      OC_DEFAULT_LANGUAGE: ${DEFAULT_LANGUAGE}
    volumes:
      - ./config/opencloud/csp.yaml:/etc/opencloud/csp.yaml
-      - ./config/opencloud/apps.yaml:/etc/opencloud/apps.yaml
      - ./config/opencloud/banned-password-list.txt:/etc/opencloud/banned-password-list.txt
      # configure the .env file to use own paths instead of docker internal volumes
      - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud
--- a/external-proxy/collabora-exposed.yml
+++ b/external-proxy/collabora-exposed.yml
@@ -1,6 +1,10 @@
 ---
 # only expose the ports when you know what you are doing!
 services:
+  collaboration:
+    ports:
+      # expose the wopi server on all interfaces
+      - "0.0.0.0:9300:9300"
  collabora:
    ports:
      # expose the collabora server on all interfaces
--- a/external-proxy/collabora.yml
+++ b/external-proxy/collabora.yml
@@ -1,5 +1,9 @@
 ---
 services:
+  collaboration:
+    ports:
+      # expose the wopi server on localhost
+      - "127.0.0.1:9300:9300"
  collabora:
    ports:
      # expose the collabora server on localhost
--- a/external-proxy/euro-office-exposed.yml
+++ b/external-proxy/euro-office-exposed.yml
@@ -1,7 +0,0 @@
---
-# only expose the ports when you know what you are doing!
-services:
-  euro-office:
-    ports:
-      # expose the euro-office document server on all interfaces
-      - "0.0.0.0:9900:80"
--- a/external-proxy/euro-office.yml
+++ b/external-proxy/euro-office.yml
@@ -1,6 +0,0 @@
---
-services:
-  euro-office:
-    ports:
-      # expose the euro-office document server on localhost
-      - "127.0.0.1:9900:80"
--- a/external-proxy/opencloud.yml
+++ b/external-proxy/opencloud.yml
@@ -1,9 +1,9 @@
 ---
 services:
  opencloud:
-    environment:
-      # bind to all interfaces
-      PROXY_HTTP_ADDR: "0.0.0.0:9200"
-    ports:
-      # expose the opencloud server on localhost
-      - "127.0.0.1:9200:9200"
+      environment:
+        # bind to all interfaces
+        PROXY_HTTP_ADDR: "0.0.0.0:9200"
+      ports:
+        # expose the opencloud server on localhost
+        - "127.0.0.1:9200:9200"
--- a/idm/external-idp.yml
+++ b/idm/external-idp.yml
@@ -14,18 +14,8 @@ services:
      GRAPH_LDAP_REFINT_ENABLED: "true" # osixia has refint enabled.
      FRONTEND_READONLY_USER_ATTRIBUTES: "user.onPremisesSamAccountName,user.displayName,user.mail,user.passwordProfile,user.accountEnabled,user.appRoleAssignments"
      PROXY_OIDC_REWRITE_WELLKNOWN: "true"
-      OC_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID}
-      OC_OIDC_CLIENT_SCOPES: ${OC_OIDC_CLIENT_SCOPES}
-      PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM: ${PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM:-roles}
-      WEBFINGER_WEB_OIDC_CLIENT_ID: ${WEBFINGER_WEB_OIDC_CLIENT_ID:-web}
-      WEBFINGER_WEB_OIDC_CLIENT_SCOPES: ${WEBFINGER_WEB_OIDC_CLIENT_SCOPES:-openid profile email}
-      WEBFINGER_ANDROID_OIDC_CLIENT_ID: ${WEBFINGER_ANDROID_OIDC_CLIENT_ID:-OpenCloudAndroid}
-      WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES: ${WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES:-openid profile email offline_access}
-      WEBFINGER_IOS_OIDC_CLIENT_ID: ${WEBFINGER_IOS_OIDC_CLIENT_ID:-OpenCloudIOS}
-      WEBFINGER_IOS_OIDC_CLIENT_SCOPES: ${WEBFINGER_IOS_OIDC_CLIENT_SCOPES:-openid profile email offline_access}
-      WEBFINGER_DESKTOP_OIDC_CLIENT_ID: ${WEBFINGER_DESKTOP_OIDC_CLIENT_ID:-OpenCloudDesktop}
-      WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES: ${WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES:-openid profile email offline_access}
-      PROXY_ROLE_ASSIGNMENT_DRIVER: ${PROXY_ROLE_ASSIGNMENT_DRIVER:-oidc}
+      WEB_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID:-web}
+      PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"
      OC_OIDC_ISSUER: ${IDP_ISSUER_URL:-https://keycloak.opencloud.test/realms/openCloud}
      # This specifies to start all services except idm and idp. These are replaced by external services.
      OC_EXCLUDE_RUN_SERVICES: idm,idp
@@ -47,7 +37,7 @@ services:
      OC_LDAP_DISABLE_USER_MECHANISM: "attribute"
      OC_ADMIN_USER_ID: ""
      SETTINGS_SETUP_DEFAULT_ASSIGNMENTS: "false"
-      GRAPH_ASSIGN_DEFAULT_USER_ROLE: ${GRAPH_ASSIGN_DEFAULT_USER_ROLE:-false}
+      GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
      GRAPH_USERNAME_MATCH: "none"
      # We need to set the IDP_DOMAIN to allow the CSP rules to be set correctly
      IDP_DOMAIN: ${IDP_DOMAIN:-keycloak.opencloud.test}
@@ -55,7 +45,6 @@ services:
      WEB_OPTION_ACCOUNT_EDIT_LINK_HREF: ${IDP_ACCOUNT_URL}
  ldap-server:
    image: bitnamilegacy/openldap:2.6
-    # Bitnami images require GID 0 to write to internal socket and PID directories
    networks:
      opencloud-net:
    entrypoint: [ "/bin/sh", "/opt/bitnami/scripts/openldap/docker-entrypoint-override.sh", "/opt/bitnami/scripts/openldap/run.sh" ]
--- a/idm/ldap-keycloak.yml
+++ b/idm/ldap-keycloak.yml
@@ -23,19 +23,19 @@ services:
      # Keycloak IDP specific configuration
      PROXY_AUTOPROVISION_ACCOUNTS: "false"
      PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"
-      OC_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}/realms/openCloud
+      OC_OIDC_ISSUER: https://${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}/realms/openCloud
      PROXY_OIDC_REWRITE_WELLKNOWN: "true"
      WEB_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID:-web}
      PROXY_USER_OIDC_CLAIM: "uuid"
      PROXY_USER_CS3_CLAIM: "userid"
-      WEB_OPTION_ACCOUNT_EDIT_LINK_HREF: "https://${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}/realms/openCloud/account"
+      WEB_OPTION_ACCOUNT_EDIT_LINK_HREF: "https://${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}/realms/openCloud/account"
      # admin and demo accounts must be created in Keycloak
      OC_ADMIN_USER_ID: ""
      SETTINGS_SETUP_DEFAULT_ASSIGNMENTS: "false"
      GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
      GRAPH_USERNAME_MATCH: "none"
      # This is needed to set the correct CSP rules for OpenCloud
-      IDP_DOMAIN: ${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
+      IDP_DOMAIN: ${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}

  ldap-server:
    image: bitnamilegacy/openldap:2.6
@@ -64,7 +64,7 @@ services:
    restart: always

  postgres:
-    image: postgres:17.10-alpine
+    image: postgres:17.7-alpine
    networks:
      opencloud-net:
    volumes:
@@ -78,7 +78,7 @@ services:
    restart: always

  keycloak:
-    image: quay.io/keycloak/keycloak:26.7.0
+    image: quay.io/keycloak/keycloak:26.3.3
    networks:
      opencloud-net:
    command: [ "start", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm" ]
@@ -89,14 +89,13 @@ services:
      - "./config/keycloak/themes/opencloud:/opt/keycloak/themes/opencloud"
    environment:
      LDAP_ADMIN_PASSWORD: ${LDAP_BIND_PASSWORD:-admin}
-      OC_DOMAIN: ${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
+      OC_DOMAIN: ${OC_DOMAIN:-cloud.opencloud.test}
      KC_HOSTNAME: ${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}
      KC_DB: postgres
      KC_DB_URL: "jdbc:postgresql://postgres:5432/keycloak"
      KC_DB_USERNAME: ${KC_DB_USERNAME:-keycloak}
      KC_DB_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
      KC_FEATURES: impersonation
-      KC_LOG_LEVEL: ${KC_LOG_LEVEL:-INFO}
      KC_PROXY_HEADERS: xforwarded
      KC_HTTP_ENABLED: true
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-kcadmin}
--- a/renovate.json
+++ b/renovate.json
@@ -1,43 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "platformAutomerge": true,
-  "enabledManagers": ["docker-compose", "custom.regex"],
-  "baseBranchPatterns": ["main", "stable-4.0", "stable-7.2"],
-  "packageRules": [
-    {
-      "matchManagers": ["docker-compose", "custom.regex"],
-      "labels": ["Type:Dependencies", "Bot:Renovate"]
-    },
-    {
-      "matchManagers": ["docker-compose"],
-      "matchUpdateTypes": ["patch"],
-      "automerge": true
-    },
-    {
-      "matchBaseBranches": ["stable-4.0", "stable-7.2"],
-      "matchUpdateTypes": ["major", "minor"],
-      "enabled": false
-    },
-    {
-      "matchPackageNames": ["postgres"],
-      "matchManagers": ["docker-compose"],
-      "allowedVersions": "/^17\\.\\d+-alpine$/"
-    }
-  ],
-  "docker-compose": {
-    "managerFilePatterns": ["/.+\\.ya?ml$/"]
-  },
-  "customManagers": [
-    {
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/^docker-compose\\.yml$/",
-        "/^weboffice\\/collabora\\.yml$/"
-      ],
-      "matchStrings": [
-        "# renovate: depName=(?<depName>[^\\s]+)\\n\\s+image: \\$\\{[^}]+\\}:\\$\\{[^}]+-(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\\}"
-      ],
-      "datasourceTemplate": "docker"
-    }
-  ]
-}
--- a/search/opensearch.yml
+++ b/search/opensearch.yml
@@ -1,59 +0,0 @@
---
-services:
-  opencloud:
-    environment:
-      # Point the search service at OpenSearch instead of the embedded bleve index.
-      SEARCH_ENGINE_TYPE: open-search
-      SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ADDRESSES: http://opensearch:9200
-      SEARCH_ENGINE_OPEN_SEARCH_CLIENT_INSECURE: "true"
-      SEARCH_ENGINE_OPEN_SEARCH_RESOURCE_INDEX_NAME: ${OPENSEARCH_RESOURCE_INDEX:-opencloud-resources}
-    depends_on:
-      opensearch:
-        condition: service_healthy
-
-  opensearch:
-    image: ${OPENSEARCH_DOCKER_IMAGE:-opensearchproject/opensearch}:${OPENSEARCH_DOCKER_TAG:-2.19.5}
-    environment:
-      discovery.type: single-node
-      bootstrap.memory_lock: "true"
-      OPENSEARCH_JAVA_OPTS: ${OPENSEARCH_JAVA_OPTS:--Xms512m -Xmx512m}
-      # Security plugin is disabled: OpenSearch is only reachable on the
-      # internal opencloud-net bridge and no port is published to the host.
-      # Do NOT enable a published port or expose this via the reverse proxy
-      # without first enabling and configuring the security plugin.
-      DISABLE_SECURITY_PLUGIN: "true"
-      DISABLE_INSTALL_DEMO_CONFIG: "true"
-      # Disable the disk-based shard allocation watermarks. By default OpenSearch
-      # marks indices read-only when the host disk is <5% free, which silently
-      # turns bulk upserts into no-ops. Fine to disable on a single-node dev box.
-      cluster.routing.allocation.disk.threshold_enabled: "false"
-    ulimits:
-      memlock:
-        soft: -1
-        hard: -1
-      nofile:
-        soft: 65536
-        hard: 65536
-    networks:
-      opencloud-net:
-    volumes:
-      - ${OPENSEARCH_DATA_DIR:-opensearch-data}:/usr/share/opensearch/data
-    healthcheck:
-      # Single-node clusters can't go green (replicas have nowhere to land), so
-      # yellow is the healthy state. Still gates opencloud until opensearch accepts
-      # requests.
-      test:
-        [
-          "CMD-SHELL",
-          "curl -sf 'http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=5s' > /dev/null || exit 1"
-        ]
-      interval: 5s
-      timeout: 10s
-      retries: 24
-      start_period: 60s
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: always
-
-volumes:
-  opensearch-data:
--- a/search/tika.yml
+++ b/search/tika.yml
@@ -1,7 +1,7 @@
 ---
 services:
  tika:
-    image: ${TIKA_IMAGE:-apache/tika:latest}
+    image: ${TIKA_IMAGE:-apache/tika:3.2.3.0}
    # Using the base variant for smaller image size and faster startup
    # The base variant includes core functionality for text extraction
    # Full variant is only needed for specialized OCR/image processing
@@ -11,18 +11,6 @@ services:
    restart: always
    logging:
      driver: ${LOG_DRIVER:-local}
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "bash",
-          "-c",
-          "exec 3<>/dev/tcp/127.0.0.1/9998 && printf 'GET /tika HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && grep '200 OK' <&3",
-        ]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-      start_period: 5s

  opencloud:
    environment:
@@ -30,6 +18,3 @@ services:
      SEARCH_EXTRACTOR_TYPE: tika
      SEARCH_EXTRACTOR_TIKA_TIKA_URL: http://tika:9998
      FRONTEND_FULL_TEXT_SEARCH_ENABLED: "true"
-    depends_on:
-      tika:
-        condition: service_healthy
--- a/testing/external-keycloak.yml
+++ b/testing/external-keycloak.yml
@@ -1,7 +1,7 @@
 ---
 services:
  postgres:
-    image: postgres:17.10-alpine
+    image: postgres:17.7-alpine
    networks:
      opencloud-net:
    volumes:
@@ -15,7 +15,7 @@ services:
    restart: always

  keycloak:
-    image: quay.io/keycloak/keycloak:26.7.0
+    image: quay.io/keycloak/keycloak:26.3.3
    networks:
      opencloud-net:
    command: [ "start", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm" ]
@@ -32,7 +32,6 @@ services:
      KC_DB_USERNAME: ${KC_DB_USERNAME:-keycloak}
      KC_DB_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
      KC_FEATURES: impersonation
-      KC_LOG_LEVEL: ${KC_LOG_LEVEL:-INFO}
      KC_PROXY_HEADERS: xforwarded
      KC_HTTP_ENABLED: true
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-kcadmin}
--- a/traefik/collabora.yml
+++ b/traefik/collabora.yml
@@ -5,6 +5,15 @@ services:
      opencloud-net:
        aliases:
          - ${COLLABORA_DOMAIN:-collabora.opencloud.test}
+          - ${WOPISERVER_DOMAIN:-wopiserver.opencloud.test}
+  collaboration:
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.collaboration.entrypoints=https"
+      - "traefik.http.routers.collaboration.rule=Host(`${WOPISERVER_DOMAIN:-wopiserver.opencloud.test}`)"
+      - "traefik.http.routers.collaboration.${TRAEFIK_SERVICES_TLS_CONFIG}"
+      - "traefik.http.routers.collaboration.service=collaboration"
+      - "traefik.http.services.collaboration.loadbalancer.server.port=9300"
  collabora:
    labels:
      - "traefik.enable=true"
@@ -12,5 +21,4 @@ services:
      - "traefik.http.routers.collabora.rule=Host(`${COLLABORA_DOMAIN:-collabora.opencloud.test}`)"
      - "traefik.http.routers.collabora.${TRAEFIK_SERVICES_TLS_CONFIG}"
      - "traefik.http.routers.collabora.service=collabora"
-      - "traefik.http.routers.collabora.middlewares=hsts-header"
      - "traefik.http.services.collabora.loadbalancer.server.port=9980"
--- a/traefik/euro-office.yml
+++ b/traefik/euro-office.yml
@@ -1,18 +0,0 @@
---
-services:
-  traefik:
-    networks:
-      opencloud-net:
-        aliases:
-          - ${EURO_OFFICE_DOMAIN:-euro-office.opencloud.test}
-  euro-office:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.euro-office.entrypoints=https"
-      - "traefik.http.routers.euro-office.rule=Host(`${EURO_OFFICE_DOMAIN:-euro-office.opencloud.test}`)"
-      - "traefik.http.routers.euro-office.${TRAEFIK_SERVICES_TLS_CONFIG}"
-      - "traefik.http.routers.euro-office.service=euro-office"
-      - "traefik.http.services.euro-office.loadbalancer.server.port=80"
-      # websockets can't be opened when this is omitted
-      - "traefik.http.middlewares.euro-office.headers.customrequestheaders.X-Forwarded-Proto=https"
-      - "traefik.http.routers.euro-office.middlewares=euro-office"
--- a/traefik/ldap-keycloak.yml
+++ b/traefik/ldap-keycloak.yml
@@ -12,5 +12,4 @@ services:
      - "traefik.http.routers.keycloak.rule=Host(`${KEYCLOAK_DOMAIN:-keycloak.opencloud.test}`)"
      - "traefik.http.routers.keycloak.${TRAEFIK_SERVICES_TLS_CONFIG}"
      - "traefik.http.routers.keycloak.service=keycloak"
-      - "traefik.http.routers.keycloak.middlewares=hsts-header"
      - "traefik.http.services.keycloak.loadbalancer.server.port=8080"
--- a/traefik/opencloud.yml
+++ b/traefik/opencloud.yml
@@ -3,20 +3,13 @@ services:
  opencloud:
    labels:
      - "traefik.enable=true"
-      # define middleware here, to make sure its loaded with the first defined container (opencloud)
-      # if defined in the traefik container with a disabled dashboard it won't be loaded fast enough
-      - "traefik.http.middlewares.hsts-header.headers.stsSeconds=31536000"
-      - "traefik.http.middlewares.hsts-header.headers.stsIncludeSubdomains=true"
-      - "traefik.http.middlewares.hsts-header.headers.stsPreload=true"
-      - "traefik.http.middlewares.hsts-header.headers.forceSTSHeader=true"
      - "traefik.http.routers.opencloud.entrypoints=https"
      - "traefik.http.routers.opencloud.rule=Host(`${OC_DOMAIN:-cloud.opencloud.test}`)"
      - "traefik.http.routers.opencloud.service=opencloud"
-      - "traefik.http.routers.opencloud.middlewares=hsts-header"
      - "traefik.http.services.opencloud.loadbalancer.server.port=9200"
      - "traefik.http.routers.opencloud.${TRAEFIK_SERVICES_TLS_CONFIG}"
  traefik:
-    image: traefik:v3.7.9
+    image: traefik:v3.6.14
    # release notes: https://github.com/traefik/traefik/releases
    user: ${TRAEFIK_CONTAINER_UID_GID:-0:0}
    networks:
--- a/weboffice/collabora.yml
+++ b/weboffice/collabora.yml
@@ -6,98 +6,80 @@ services:
      # this is needed for setting the correct CSP header
      COLLABORA_DOMAIN: ${COLLABORA_DOMAIN:-collabora.opencloud.test}
      TRAEFIK_PORT_HTTPS: ${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-      # run the collaboration (WOPI) service inside the main opencloud process,
-      # appended to any user defined services in START_ADDITIONAL_SERVICES
-      OC_ADD_RUN_SERVICES: ${START_ADDITIONAL_SERVICES:-}${START_ADDITIONAL_SERVICES:+,}collaboration
+      # expose nats and the reva gateway for the collaboration service
+      NATS_NATS_HOST: 0.0.0.0
+      GATEWAY_GRPC_ADDR: 0.0.0.0:9142
      # make collabora the secure view app
      FRONTEND_APP_HANDLER_SECURE_VIEW_APP_ADDR: eu.opencloud.api.collaboration
      GRAPH_AVAILABLE_ROLES: "b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5,a8d5fe5e-96e3-418d-825b-534dbdf22b99,fb6c3e19-e378-47e5-b277-9732f9de6e21,58c63c02-1d89-4572-916a-870abc5a1b7d,2d00ce52-1fc2-4dbc-8b95-a73b73395f5a,1c996275-f1c9-4e71-abdf-a42f6495e960,312c0871-5ef7-4b3a-85b6-0e4074c64049,aa97fe03-7980-45ac-9e50-b325749fd7e6"
-      # collaboration service configuration; the WOPI endpoint is served by the
-      # opencloud proxy on the opencloud domain (/wopi and /collaboration routes),
-      # so no separate wopiserver domain, route or port is needed
-      COLLABORATION_WOPI_SRC: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
+
+  collaboration:
+    # renovate: depName=opencloudeu/opencloud
+    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud}:${OC_DOCKER_TAG:-4.0.8}
+    user: ${OC_CONTAINER_UID_GID:-1000:1000}
+    networks:
+      opencloud-net:
+    depends_on:
+      opencloud:
+        condition: service_started
+      collabora:
+        condition: service_healthy
+    entrypoint:
+      - /bin/sh
+    command: [ "-c", "opencloud collaboration server" ]
+    environment:
+      COLLABORATION_GRPC_ADDR: 0.0.0.0:9301
+      COLLABORATION_HTTP_ADDR: 0.0.0.0:9300
+      MICRO_REGISTRY: "nats-js-kv"
+      MICRO_REGISTRY_ADDRESS: "opencloud:9233"
+      COLLABORATION_WOPI_SRC: https://${WOPISERVER_DOMAIN:-wopiserver.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
      COLLABORATION_APP_NAME: "CollaboraOnline"
      COLLABORATION_APP_PRODUCT: "Collabora"
      COLLABORATION_APP_ADDR: https://${COLLABORA_DOMAIN:-collabora.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
      COLLABORATION_APP_ICON: https://${COLLABORA_DOMAIN:-collabora.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}/favicon.ico
      COLLABORATION_APP_INSECURE: "${INSECURE:-true}"
      COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "${INSECURE:-true}"
-
-  # One-shot service that generates the WOPI proof key on first start and
-  # keeps it in a named volume, like the proofKeyGeneration feature of the
-  # collabora-online helm chart.
-  # To rotate the key, remove the volume and start again:
-  #   docker compose down collabora && docker volume rm <project>_collabora-proof-key
-  collabora-proof-key:
-    image: alpine/openssl:3.5.7
-    entrypoint: ["/bin/sh"]
-    command:
-      - -ec
-      - |
-        if [ ! -s /proof/proof_key ]; then
-          openssl genrsa -traditional -out /proof/proof_key.tmp 4096
-          chown 1001:1001 /proof/proof_key.tmp
-          chmod 400 /proof/proof_key.tmp
-          mv /proof/proof_key.tmp /proof/proof_key
-          echo "WOPI proof key generated"
-        else
-          echo "WOPI proof key already exists"
-        fi
+      COLLABORATION_LOG_LEVEL: ${LOG_LEVEL:-info}
+      OC_URL: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
    volumes:
-      - collabora-proof-key:/proof
+      # configure the .env file to use own paths instead of docker internal volumes
+      - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud
    logging:
      driver: ${LOG_DRIVER:-local}
-    restart: "no"
+    restart: always

  collabora:
-    image: collabora/code:26.04.2.4.1
+    image: collabora/code:25.04.10.3.1
    # release notes: https://www.collaboraonline.com/release-notes/
    networks:
      opencloud-net:
-    depends_on:
-      collabora-proof-key:
-        condition: service_completed_successfully
    environment:
-      # WOPI host allowlist; the WOPI endpoint is served by the opencloud proxy on the opencloud domain
-      aliasgroup1: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-      extra_params: >
-        --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true}
-        --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true}
-        --o:ssl.termination=true
-        --o:welcome.enable=false
-        --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-        --o:net.lok_allow.host[14]=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
+      aliasgroup1: https://${WOPISERVER_DOMAIN:-wopiserver.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
+      DONT_GEN_SSL_CERT: "YES"
+      extra_params: |
+        --o:ssl.enable=${COLLABORA_SSL_ENABLE:-true} \
+        --o:ssl.ssl_verification=${COLLABORA_SSL_VERIFICATION:-true} \
+        --o:ssl.termination=true \
+        --o:welcome.enable=false \
+        --o:net.frame_ancestors=${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} \
+        --o:net.lok_allow.host[14]=${OC_DOMAIN-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-} \
        --o:home_mode.enable=${COLLABORA_HOME_MODE:-false}
      username: ${COLLABORA_ADMIN_USER:-admin}
      password: ${COLLABORA_ADMIN_PASSWORD:-admin}
    cap_add:
-      - SYS_ADMIN
-    security_opt:
-      - seccomp=unconfined
-      - apparmor:unconfined
+      - MKNOD
    volumes:
      # Mount local TrueType fonts so the container can use system fonts
      # (e.g. Microsoft fonts like Arial, Calibri, Cambria by installing the `ttf-mscorefonts-installer` package).
      - /usr/share/fonts/truetype:/usr/share/fonts/truetype/more:ro
      - /usr/share/fonts/truetype:/opt/cool/systemplate/usr/share/fonts/truetype/more:ro
-      # WOPI proof key generated by the collabora-proof-key service.
-      - type: volume
-        source: collabora-proof-key
-        target: /etc/coolwsd/proof_key
-        read_only: true
-        volume:
-          subpath: proof_key
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always
+    entrypoint: [ '/bin/bash', '-c' ]
+    command: [ 'coolconfig generate-proof-key && /start-collabora-online.sh' ]
    healthcheck:
-      # --use-env-vars makes the probe read extra_params, so it probes with
-      # the same http/https scheme the server actually runs with; without it
-      # the probe falls back to coolwsd.xml where ssl.enable defaults to true
-      test: ["CMD", "/usr/bin/coolwsd", "--probe", "--use-env-vars"]
+      test: [ "CMD", "curl", "-f", "http://localhost:9980/hosting/discovery" ]
      interval: 15s
      timeout: 10s
      retries: 5
-
-volumes:
-  collabora-proof-key:
--- a/weboffice/euro-office.yml
+++ b/weboffice/euro-office.yml
@@ -1,53 +0,0 @@
---
-services:
-
-  opencloud:
-    environment:
-      # this is needed for setting the correct CSP header
-      EURO_OFFICE_DOMAIN: ${EURO_OFFICE_DOMAIN:-euro-office.opencloud.test}
-      TRAEFIK_PORT_HTTPS: ${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-      # run the collaboration (WOPI) service inside the main opencloud process,
-      # appended to any user defined services in START_ADDITIONAL_SERVICES
-      OC_ADD_RUN_SERVICES: ${START_ADDITIONAL_SERVICES:-}${START_ADDITIONAL_SERVICES:+,}collaboration
-      # collaboration service configuration; the WOPI endpoint is served by the
-      # opencloud proxy on the opencloud domain (/wopi and /collaboration routes),
-      # so no separate wopiserver domain, route or port is needed
-      COLLABORATION_WOPI_SRC: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-      COLLABORATION_APP_NAME: "Euro-Office"
-      COLLABORATION_APP_PRODUCT: "OnlyOffice"
-      COLLABORATION_APP_ADDR: https://${EURO_OFFICE_DOMAIN:-euro-office.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
-      COLLABORATION_APP_ICON: https://${EURO_OFFICE_DOMAIN:-euro-office.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}/web-apps/apps/documenteditor/main/resources/img/favicon.ico
-      COLLABORATION_APP_INSECURE: "${INSECURE:-true}"
-      COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "${INSECURE:-true}"
-      COLLABORATION_APP_PROOF_DISABLE: "true"
-    volumes:
-      - ./config/euro-office/app-registry.yaml:/etc/opencloud/app-registry.yaml
-
-  euro-office:
-    image: ${EURO_OFFICE_DOCKER_IMAGE:-ghcr.io/euro-office/documentserver}:${EURO_OFFICE_DOCKER_TAG:-latest}
-    # changelog https://github.com/EURO-office/DocumentServer/releases
-    networks:
-      opencloud-net:
-    environment:
-      WOPI_ENABLED: "true"
-      # self-signed certificates
-      USE_UNAUTHORIZED_STORAGE: "${INSECURE:-false}"
-    volumes:
-      # Mount local TrueType fonts so the container can use system fonts
-      # (e.g. Microsoft fonts like Arial, Calibri, Cambria by installing the `ttf-mscorefonts-installer` package).
-      - /usr/share/fonts/truetype:/usr/share/fonts/truetype/more:ro
-    logging:
-      driver: ${LOG_DRIVER:-local}
-    restart: always
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "bash",
-          "-c",
-          "exec 3<>/dev/tcp/127.0.0.1/80 && printf 'GET /hosting/discovery HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && cat <&3 | head -1 | grep -q '200 OK'"
-        ]
-      interval: 30s
-      timeout: 10s
-      retries: 5
-      start_period: 120s
Author	SHA1	Message	Date
Michael Barz	6771b4d827	Merge pull request #320 from opencloud-eu/renovate/stable-4.0-opencloudeu-opencloud-4.x chore(deps): update opencloudeu/opencloud docker tag to v4.0.8 (stable-4.0)	2026-06-25 18:15:00 +02:00
renovate[bot]	fc98113122	chore(deps): update opencloudeu/opencloud docker tag to v4.0.8	2026-06-25 16:06:43 +00:00
Michael Barz	614fba7f50	Merge pull request #297 from opencloud-eu/renovate/stable-4.0-collabora-code-25.x chore(deps): update collabora/code docker tag to v25.04.10.3.1 (stable-4.0)	2026-06-01 17:11:44 +02:00
renovate[bot]	6e92873a16	chore(deps): update collabora/code docker tag to v25.04.10.3.1	2026-05-30 21:48:54 +00:00
Michael Barz	68a9e0acaf	Merge pull request #289 from opencloud-eu/renovate/stable-4.0-opencloudeu-opencloud-4.x chore(deps): update opencloudeu/opencloud docker tag to v4.0.7 (stable-4.0)	2026-05-18 15:46:19 +02:00
renovate[bot]	c2f49cbf7e	chore(deps): update opencloudeu/opencloud docker tag to v4.0.7	2026-05-18 13:39:28 +00:00
Michael Barz	46ebeebbde	Merge pull request #277 from opencloud-eu/renovate/stable-4.0-traefik-3.x chore(deps): update traefik docker tag to v3.6.14 (stable-4.0)	2026-04-23 10:09:06 +02:00
renovate[bot]	a6e9f4bcb5	chore(deps): update traefik docker tag to v3.6.14	2026-04-22 20:46:28 +00:00
Michael Barz	c1610e79c0	Merge pull request #269 from opencloud-eu/renovate/stable-4.0-opencloudeu-opencloud-4.x chore(deps): update opencloudeu/opencloud docker tag to v4.0.5 (stable-4.0)	2026-04-09 09:35:37 +02:00
renovate[bot]	d71557e4ca	chore(deps): update opencloudeu/opencloud docker tag to v4.0.5	2026-04-08 19:02:42 +00:00
Michael Barz	ec62b71fa8	Merge pull request #266 from opencloud-eu/renovate/stable-4.0-traefik-3.x chore(deps): update traefik docker tag to v3.6.13 (stable-4.0)	2026-04-08 15:45:21 +02:00
renovate[bot]	dcc11c04fe	chore(deps): update traefik docker tag to v3.6.13	2026-04-07 22:08:23 +00:00
Michael Barz	7e924c9ad2	Merge pull request #256 from opencloud-eu/renovate/stable-4.0-traefik-3.x chore(deps): update traefik docker tag to v3.6.12 (stable-4.0)	2026-04-07 11:17:18 +02:00
renovate[bot]	28da55369f	chore(deps): update traefik docker tag to v3.6.12	2026-04-02 08:28:53 +00:00
Thomas Schweiger	281af77ad9	Merge pull request #258 from opencloud-eu/renovate/stable-4.0-opencloudeu-opencloud-4.x chore(deps): update opencloudeu/opencloud docker tag to v4.0.4 (stable-4.0)	2026-04-02 10:27:47 +02:00
renovate[bot]	cf7d6954f9	chore(deps): update opencloudeu/opencloud docker tag to v4.0.4	2026-03-30 16:46:56 +00:00
Michael Barz	810a778e73	Merge pull request #253 from opencloud-eu/renovate/stable-4.0-collabora-code-25.x chore(deps): update collabora/code docker tag to v25.04.9.4.1 (stable-4.0)	2026-03-25 09:29:59 +01:00
renovate[bot]	df3e2bba9c	chore(deps): update collabora/code docker tag to v25.04.9.4.1	2026-03-25 08:29:27 +00:00
Michael Barz	87a0c9775d	Merge pull request #251 from opencloud-eu/renovate/stable-4.0-traefik-3.x chore(deps): update traefik docker tag to v3.6.11 (stable-4.0)	2026-03-25 09:28:33 +01:00
renovate[bot]	530bfa28bf	chore(deps): update traefik docker tag to v3.6.11	2026-03-19 21:51:08 +00:00
Michael Barz	559f5d3423	Merge pull request #248 from opencloud-eu/renovate/stable-4.0-collabora-code-25.x chore(deps): update collabora/code docker tag to v25.04.9.3.1 (stable-4.0)	2026-03-17 08:49:08 +01:00
renovate[bot]	9f93def3df	chore(deps): update collabora/code docker tag to v25.04.9.3.1	2026-03-16 17:30:17 +00:00
Michael Barz	5a0ddc3af6	Merge pull request #241 from opencloud-eu/renovate/stable-4.0-traefik-3.x chore(deps): update traefik docker tag to v3.6.10 (stable-4.0)	2026-03-07 08:01:20 +01:00
renovate[bot]	5fcba85d97	chore(deps): update traefik docker tag to v3.6.10	2026-03-06 21:45:38 +00:00
Michael Barz	28ff7644c1	Merge pull request #234 from opencloud-eu/pin-version feat: pin version, add renovate	2026-03-03 22:09:54 +01:00
Michael Barz	534b7c1817	Merge pull request #233 from opencloud-eu/renovate/stable-4.0-traefik-3.x chore(deps): update traefik docker tag to v3.6.9 (stable-4.0)	2026-03-03 21:52:07 +01:00
renovate[bot]	2f09abc647	chore(deps): update traefik docker tag to v3.6.9	2026-03-03 20:20:33 +00:00
Michael Barz	dabaff5653	feat: pin version, add renovate	2026-03-03 21:20:12 +01:00
Michael Barz	9603f62b4c	Merge pull request #232 from opencloud-eu/renovate/stable-4.0-collabora-code-25.x chore(deps): update collabora/code docker tag to v25.04.9.2.1 (stable-4.0)	2026-03-03 18:32:53 +01:00
renovate[bot]	ea2964c362	chore(deps): update collabora/code docker tag to v25.04.9.2.1	2026-03-03 17:02:54 +00:00
Thomas Schweiger	b575713523	Merge pull request #172 from opencloud-eu/pin-image-versions-for-stable-4 enhance: pin Docker image versions to specific tags	2025-12-04 11:34:43 +01:00
Thomas Schweiger	2cee7c8b05	enhance: pin Docker image versions to specific tags	2025-12-03 12:05:46 +01:00
				`@@ -1 +0,0 @@`
				import{t as e}from"./preload-helper-DafEc2pQ.mjs";await(await e(()=>import(`./remoteEntry-lxWu31Tr.mjs`),[],import.meta.url)).init();
				`@@ -1 +0,0 @@`
				import"./dist-r7AkbZvS.mjs";var e={"@opencloud-eu/web-client":{name:`@opencloud-eu/web-client`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},"@opencloud-eu/web-client/graph":{name:`@opencloud-eu/web-client/graph`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/graph' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},"@opencloud-eu/web-client/graph/generated":{name:`@opencloud-eu/web-client/graph/generated`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/graph/generated' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},"@opencloud-eu/web-client/ocs":{name:`@opencloud-eu/web-client/ocs`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/ocs' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},"@opencloud-eu/web-client/sse":{name:`@opencloud-eu/web-client/sse`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/sse' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},"@opencloud-eu/web-client/webdav":{name:`@opencloud-eu/web-client/webdav`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-client/webdav' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},"@opencloud-eu/web-pkg":{name:`@opencloud-eu/web-pkg`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module '@opencloud-eu/web-pkg' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},luxon:{name:`luxon`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module 'luxon' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},pinia:{name:`pinia`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module 'pinia' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},vue:{name:`vue`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module 'vue' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:``,import:!1}},"vue3-gettext":{name:`vue3-gettext`,version:void 0,scope:[`default`],loaded:!1,from:`maps`,async get(){throw Error(`[Module Federation] Shared module 'vue3-gettext' must be provided by host`)},shareConfig:{singleton:!0,requiredVersion:`*`,import:!1}}},t=[];export{t as usedRemotes,e as usedShared};
				`@@ -1 +0,0 @@`
				`import{t as e}from"./src-CIfRBuLG.mjs";export{e as default};`
				`@@ -1 +0,0 @@`
				var e=`__mf_init____mf__virtual/maps__mf_v__runtimeInit__mf_v__.js__`,t=globalThis[e];if(!t){let n,r,i=new Promise((e,t)=>{n=e,r=t});t=globalThis[e]={initPromise:i,initResolve:n,initReject:r},typeof window>`u`&&n({loadRemote:function(){return Promise.resolve(void 0)},loadShare:function(){return Promise.resolve(void 0)}})}var n=await t.initPromise.then(e=>e.loadShare(`vue3-gettext`,{customShareInfo:{shareConfig:{singleton:!0,strictVersion:!1,requiredVersion:`*`}}})).then(e=>typeof e==`function`?e():e);n.__esModule,n.default;var{createGettext:r,defineGettextConfig:i,makePO:a,parseSrc:o,tokenize:s,useGettext:c}=n;export{c as t};
				`@@ -1 +0,0 @@`
				var e=`modulepreload`,t=function(e,t){return new URL(e,t).href},n={},r=function(r,i,a){let o=Promise.resolve();if(i&&i.length>0){let r=document.getElementsByTagName(`link`),s=document.querySelector(`meta[property=csp-nonce]`),c=s?.nonce\|\|s?.getAttribute(`nonce`);function l(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:`fulfilled`,value:e}),e=>({status:`rejected`,reason:e}))))}o=l(i.map(i=>{if(i=t(i,a),i in n)return;n[i]=!0;let o=i.endsWith(`.css`),s=o?`[rel="stylesheet"]`:``;if(a)for(let e=r.length-1;e>=0;e--){let t=r[e];if(t.href===i&&(!o\|\|t.rel===`stylesheet`))return}else if(document.querySelector(`link[href="${i}"]${s}`))return;let l=document.createElement(`link`);if(l.rel=o?`stylesheet`:e,o\|\|(l.as=`script`),l.crossOrigin=``,l.href=i,c&&l.setAttribute(`nonce`,c),document.head.appendChild(l),o)return new Promise((e,t)=>{l.addEventListener(`load`,e),l.addEventListener(`error`,()=>t(Error(`Unable to preload CSS for ${i}`)))})}))}function s(e){let t=new Event(`vite:preloadError`,{cancelable:!0});if(t.payload=e,window.dispatchEvent(t),!t.defaultPrevented)throw e}return o.then(e=>{for(let t of e\|\|[])t.status===`rejected`&&s(t.reason);return r().catch(s)})};export{r as t};
				`@@ -1 +0,0 @@`
				var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports),s=(e,i,o,s)=>{if(i&&typeof i==`object`\|\|typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))\|\|s.enumerable});return e},c=(n,r,a)=>(a=n==null?{}:e(i(n)),s(r\|\|!n\|\|!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n));export{c as n,o as t};