chore(deps): update quay.io/keycloak/keycloak docker tag to v26.7.2

README.md

@@ -215,11 +215,6 @@ This setup includes:
 - Radicale as a CalDAV (calendars, to-do lists) and CardDAV (contacts) server
 - Users access to a Personal Calendar and Addressbook
 
-Clients connect to `https://<your-domain>/caldav/` (calendar) and
-`https://<your-domain>/carddav/` (contacts) — note the required trailing
-slash — using an App Token as password. See [radicale/README.md](radicale/README.md)
-for client setup (GNOME Online Accounts, Thunderbird) and troubleshooting.
-
 ### With Monitoring
 
 Enable monitoring capabilities with metrics endpoints using either method:

config/opencloud/csp.yaml

@@ -49,7 +49,6 @@ directives:
   style-src:
     - '''self'''
     - '''unsafe-inline'''
-    - 'blob:'
   worker-src:
     - "'self'"
     - 'blob:'

config/opencloud/proxy.yaml

@@ -1,10 +1,6 @@
-# This adds four additional routes to the proxy, forwarding requests
-# on '/caldav/', '/carddav/' and the respective '/.well-known'
+# This adds four additional routes to the proxy. Forwarding
+# request on '/carddav/', '/caldav/' and the respective '/.well-knwown'
 # endpoints to the radicale container and setting the required headers.
-#
-# Client URLs (trailing slash required, see radicale/README.md):
-#   CalDAV:  https://<your-domain>/caldav/
-#   CardDAV: https://<your-domain>/carddav/
 additional_policies:
   - name: default
     routes:
@@ -14,15 +10,10 @@ additional_policies:
         skip_x_access_token: true
         additional_headers:
           - X-Script-Name: /caldav
-      # The '.well-known' endpoints are 'unprotected' so that DAV clients
-      # can discover the CalDAV/CardDAV URLs (RFC 6764) before they
-      # authenticate. Radicale only ever answers these paths with a 301
-      # redirect to '/caldav/' or '/carddav/' and serves no data here
-      # (deeper paths return 404), so no authentication is required.
       - endpoint: /.well-known/caldav
         backend: http://radicale:5232
+        remote_user_header: X-Remote-User
         skip_x_access_token: true
-        unprotected: true
         additional_headers:
           - X-Script-Name: /caldav
       - endpoint: /carddav/
@@ -33,8 +24,8 @@ additional_policies:
           - X-Script-Name: /carddav
       - endpoint: /.well-known/carddav
         backend: http://radicale:5232
+        remote_user_header: X-Remote-User
         skip_x_access_token: true
-        unprotected: true
         additional_headers:
           - X-Script-Name: /carddav
 # To enable the radicale web UI add this rule.

idm/ldap-keycloak.yml

@@ -78,7 +78,7 @@ services:
     restart: always
 
   keycloak:
-    image: quay.io/keycloak/keycloak:26.7.3
+    image: quay.io/keycloak/keycloak:26.7.2
     networks:
       opencloud-net:
     command: [ "start", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm" ]

radicale/README.md

@@ -1,77 +0,0 @@
-# Radicale — CalDAV / CardDAV
-
-This module adds [Radicale](https://radicale.org/) as a CalDAV (calendars,
-to-do lists) and CardDAV (contacts) server behind the OpenCloud proxy. Every
-user gets a personal calendar and address book on first access.
-
-## Enabling
-
-Add `radicale/radicale.yml` to your `COMPOSE_FILE`:
-
-```
-COMPOSE_FILE=docker-compose.yml:radicale/radicale.yml:traefik/opencloud.yml
-```
-
-The routes are defined in [`config/opencloud/proxy.yaml`](../config/opencloud/proxy.yaml),
-which `radicale.yml` mounts into the opencloud container.
-
-## Connecting clients
-
-### URLs
-
-| Service | URL |
-|---|---|
-| CalDAV (calendar) | `https://<your-domain>/caldav/` |
-| CardDAV (contacts) | `https://<your-domain>/carddav/` |
-
-**The trailing slash is required.** `https://<your-domain>/caldav` (without
-the slash) is not routed to Radicale and returns the OpenCloud web UI instead.
-
-Clients that implement DAV service discovery (RFC 6764) can also be pointed
-at the bare domain `https://<your-domain>/` — the `/.well-known/caldav` and
-`/.well-known/carddav` endpoints redirect them to the URLs above. Clients
-that don't (or that get confused by the web UI at the base URL) need the full
-URL including the suffix.
-
-### Authentication: use an App Token
-
-DAV clients authenticate with **username + App Token** — not your account
-password. With the default configuration (`PROXY_ENABLE_BASIC_AUTH=false`)
-the account password is rejected with `401 Unauthorized`; App Tokens work out
-of the box.
-
-Create a token either
-
-- in the web UI under **Settings → App Tokens**, or
-- on the CLI:
-
-  ```bash
-  docker compose exec opencloud opencloud auth-app create --user-name=<user> --expiration=72h
-  ```
-
-### GNOME Online Accounts
-
-GNOME expects a directly answering DAV endpoint per account, so calendars and
-contacts are added as two separate accounts:
-
-1. **Settings → Online Accounts → Add Account → Calendar (CalDAV)**
-   — URL `https://<your-domain>/caldav/`, your username, an App Token as
-   password.
-2. **Settings → Online Accounts → Add Account → Contacts (CardDAV)**
-   — URL `https://<your-domain>/carddav/`, same credentials.
-
-### Thunderbird
-
-- Calendar: *New Calendar → On the Network*, URL `https://<your-domain>/caldav/`
-- Address book: *New Address Book → Add CardDAV Address Book*, URL
-  `https://<your-domain>/carddav/`
-
-Use an App Token as the password in both dialogs.
-
-## Troubleshooting
-
-| Symptom | Cause |
-|---|---|
-| `401 Unauthorized` | Account password used instead of an App Token (or the token expired). |
-| `405 Method Not Allowed` / HTML response | Trailing slash missing — the request landed on the web UI, not Radicale. |
-| Client says "not a (Cal)DAV server" at the base URL | The client doesn't do RFC 6764 discovery. Use the full `/caldav/` / `/carddav/` URL. |

testing/external-keycloak.yml

@@ -15,7 +15,7 @@ services:
     restart: always
 
   keycloak:
-    image: quay.io/keycloak/keycloak:26.7.3
+    image: quay.io/keycloak/keycloak:26.7.2
     networks:
       opencloud-net:
     command: [ "start", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm" ]

traefik/opencloud.yml

@@ -16,7 +16,7 @@ services:
       - "traefik.http.services.opencloud.loadbalancer.server.port=9200"
       - "traefik.http.routers.opencloud.${TRAEFIK_SERVICES_TLS_CONFIG}"
   traefik:
-    image: traefik:v3.7.12
+    image: traefik:v3.7.10
     # release notes: https://github.com/traefik/traefik/releases
     user: ${TRAEFIK_CONTAINER_UID_GID:-0:0}
     networks:

weboffice/collabora.yml

@@ -29,7 +29,7 @@ services:
   # To rotate the key, remove the volume and start again:
   #   docker compose down collabora && docker volume rm <project>_collabora-proof-key
   collabora-proof-key:
-    image: alpine/openssl:3.5.8
+    image: alpine/openssl:3.5.7
     entrypoint: ["/bin/sh"]
     command:
       - -ec

weboffice/euro-office.yml

@@ -32,7 +32,6 @@ services:
       WOPI_ENABLED: "true"
       # self-signed certificates
       USE_UNAUTHORIZED_STORAGE: "${INSECURE:-false}"
-      JWT_SECRET: "${EURO_OFFICE_JWT_SECRET}"
     volumes:
       # Mount local TrueType fonts so the container can use system fonts
       # (e.g. Microsoft fonts like Arial, Calibri, Cambria by installing the `ttf-mscorefonts-installer` package).