Digital Sovereignty — The Four Pillars

• Infrastructure Sovereignty
  Operate servers and networks independently
• Data Sovereignty
  Control over data storage and access
• Software Sovereignty
  Open-source software without proprietary dependencies
• Operational Sovereignty
  Complete control over updates and maintenance

What is openDesk?

• Open-source alternative to M365 & Google Workspace
• By Government for Government (BMI / ZenDiS)
• BSI-certified (German sovereignty)
• Cloud-Native: Kubernetes-based workplace
• Modular Components:
  • Chat, Files, Wiki, Project management
  • Email, Diagrams, Web office, Video
• Self-Hosted or SaaS

Component Overview

Component	Software
Chat	Element / Synapse
Files	Nextcloud
Wiki	XWiki
Project	OpenProject
Email	OX App Suite
Diagrams	CryptPad
Web office	Collabora
Video	Jitsi

openDesk Project Statistics

Development	Community
Start: July 2023	Contributors: ~ 70
Runtime: ~ 3 years	Organizations: ~ 27
Commits: ~ 1,500
Releases: ~ 150

OpenCode.de | Supply Chain
BMI-funded platform | Signed container images
Sovereign cloud infrastructure | SBOM for all components

Infrastructure Overview

Virtualization with Proxmox

Helmfile & HRZ-Environment

# Deployment with Helmfile
helmfile apply -e hrz

• Helmfile Orchestration
  • Declarative configuration in helmfile_generic.yaml.gotmpl
  • Environment-specific overrides in environments/hrz/
  • Automatic dependency backup
• HRZ-Environment created
  • Copy of staging with adjustments
  • Uni Marburg-specific configuration
  • Test system for pilot operation

Local Chart Development

# Clone/pull charts locally
python3 dev/charts-local.py --match intercom
python3 dev/charts-local.py --revert

• Local Chart Development & Testing
• Clone/pull in charts-<branch>/
• Helmfile references to local paths
• Backup & Revert with --revert

User-Import: Provisioning

• UDM REST API — CSV/ODS import, LDAP groups
• Account Linking — SAML identity linking
• Demo Mode — Test accounts, profile pictures

User-Import: Deprovisioning

Two-Phase Deprovisioning Workflow:

• Phase 1: Disable User
  • IAM API → UCS Disable → Timestamp in Description
  • Keycloak: Remove SAML + dissolve groups
• Phase 2: Delete User
  • Grace Period (6 months) → Permanent deletion
  • Output: deprovisioned-*, deleted-*

openDesk Edu — Overview

• Extension of openDesk CE for universities
• New Components:
  • Learning Management Systems (ILIAS, Moodle)
  • Video Conferencing for Teaching (BigBlueButton)
  • Alternative File Sync (OpenCloud)
• All integrated with Keycloak SSO
• Deploy everything with helmfile apply

GitHub: github.com/opendesk-edu/opendesk-edu

Educational Components

Component	Status	Description
ILIAS	Stable	LMS with SAML SSO — Courses, SCORM, Tests
Moodle	Beta	LMS with Shibboleth — Plugins, Gradebook
BigBlueButton	Beta	Video conferencing for teaching — Recording, Whiteboard
OpenCloud	Beta	CS3-based file sync — Alternative to Nextcloud

ILIAS SSO — Architecture

Quick Start - Deploy in 3 Steps

# 1. Clone the repository
git clone https://github.com/opendesk-edu/opendesk-edu.git
cd opendesk-edu

# 2. Configure your environment
# Edit helmfile/environments/default/global.yaml.gotmpl
# Set your domain, mail domain, and image registry

# 3. Deploy
helmfile -e default apply

Full documentation: docs/getting-started.md

Network Configuration

• Ingress Controller: haproxy-ingress
• Reverse Proxy: Traefik — HTTP/HTTPS termination
• LoadBalancer: MetalLB
• All Ingresses migrated to haproxy

Grafana Dashboard

Update Process

# Load latest releases
git checkout -b myrelease upstream/tags/v1.12.2
git pull

# Review changes
helmfile diff -e hrz

# Apply updates
helmfile apply -e hrz

# Rollback if needed
helmfile rollback -e hrz

• Controlled updates via Helmfile
• Easy rollback capability

HRZ-Upgrade: Ingress Migration

• Migration: nginx → haproxy-ingress
  • v1.11.2 → v1.13.x (uniapps branch)
  • All Ingresses migrated to haproxy
• Ingress Classes:
  • ingressClassName: haproxy
  • nginx fully deprecated
• Configuration:
  • replicaCount: 2, LoadBalancer
  • tune.bufsize: 65536, tune.http.maxhdr: 256

HRZ-Upgrade: Dual Backup

• Goals: Redundant Backup Storage
• Strategy: S3-compatible with restic backend
  • Primary: s3.example.org:9000/backup-primary
  • Secondary: s3-backup.example.org:9000/backup-secondary
• Schedule: Daily at 00:42, Check weekly, Prune Sundays
• Retention: 14 Daily, Keep Last 5

Institutional Hurdles

• Legal Department
  • GDPR, AVV contracts, License compliance
• Staff Council
  • Service agreement, Co-determination for IT systems
• Administration
  • Microsoft preferences, Format compatibility
• Required Documents
  • DSFA, TCO calculation

Next Steps & Recommendations

1. Start pilot operation
2. Staggered rollout (10 → 100 → 1000 users)
3. Clear separation from production systems
4. Evaluation: Categorize use cases by sovereignty requirements
5. Budget for operations team (not just implementation)

Get Involved!

Help us build openDesk Edu for universities!

• Star the repo: github.com/opendesk-edu/opendesk-edu
• Test locally: Deploy with Helmfile and provide feedback
• Report issues: Issues for bugs or feature requests
• Contribute: PRs welcome — see CONTRIBUTING.md

Let's build sovereign university software together!

Technical Resources

• openDesk: docs.opendesk.eu ·
  Deployment-Guide ·
  User-Import
• openDesk Edu: github.com/opendesk-edu/opendesk-edu · Educational extension for universities
• DFN-AAI: dfn.de/dienste/dfnaai/
• K3s: docs.k3s.io
• Helmfile: helmfile.readthedocs.io
• Cluster-Automation: Kubespray ·
  k3s-ansible

Organizational Resources

• HBDI Recommendation (M365 Assessment):
  PDF
• Hessischer Digitalpakt Hochschulen:
  PDF
• EVB-IT Open Source (ZenDiS):
  zendis.de
• EVB-IT & BVB (digitale-verwaltung.de):
  digitale-verwaltung.de
• Digital Sovereignty at Universities:
  PDF
• CoCreate-Werkstattgespräch:
  PDF