From eb75377dd35d3260c78b01a76d4f9335999ac7ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Elena=20Barrios=20Gal=C3=A1n?= <elena@tresipunt.com>
Date: Tue, 4 Apr 2023 07:29:40 +0000
Subject: [PATCH 01/18] Revert ":q!Merge branch 'main' into
 feature/nextcloud_menu_settings"

This reverts commit 4e64f57c554a39cdcaa825ed0aa24ec19bb11f48
---
 dd-ctl                              | 10 ----------
 stress-tests/dd-stress-test.tpl.jmx |  8 ++++----
 stress-tests/dd-tests-selenium.py   | 12 ++++--------
 3 files changed, 8 insertions(+), 22 deletions(-)

diff --git a/dd-ctl b/dd-ctl
index 46011bd..261e8dc 100755
--- a/dd-ctl
+++ b/dd-ctl
@@ -806,16 +806,6 @@ upgrade_plugins_moodle(){
 	#mkdir -p /tmp/moodle/local/tresipuntimportgc
 	#cp -R local_plugins/moodle/tresipuntimportgc/* /tmp/moodle/local/tresipuntimportgc/
 
-	curl --location https://github.com/danmarsden/moodle-mod_attendance/archive/refs/heads/MOODLE_311_STABLE.zip > mod_attendance.zip
-    unzip -q mod_attendance.zip -d /tmp/moodle/mod/
-    mv /tmp/moodle/mod/moodle-mod_attendance-MOODLE_311_STABLE /tmp/moodle/mod/attendance
-    rm mod_attendance.zip
-
-	curl --location https://github.com/projectestac/moodle-mod_geogebra/archive/refs/heads/MOODLE_39_STABLE.zip > mod_geogebra.zip
-    unzip -q mod_geogebra.zip -d /tmp/moodle/mod/
-    mv /tmp/moodle/mod/moodle-mod_geogebra-MOODLE_39_STABLE /tmp/moodle/mod/geogebra
-    rm mod_geogebra.zip
-
 	cp -R /tmp/moodle/* "$SRC_FOLDER/moodle/"
 	rm -rf /tmp/moodle
 	docker exec -i dd-apps-moodle php7 admin/cli/purge_caches.php
diff --git a/stress-tests/dd-stress-test.tpl.jmx b/stress-tests/dd-stress-test.tpl.jmx
index b05b8b8..060d0d8 100644
--- a/stress-tests/dd-stress-test.tpl.jmx
+++ b/stress-tests/dd-stress-test.tpl.jmx
@@ -139,7 +139,7 @@
       </ConfigTestElement>
       <hashTree/>
       <ThreadGroup guiclass="ThreadGroupGui" testclass="ThreadGroup" testname="SAML Login Method" enabled="true">
-        <stringProp name="ThreadGroup.on_sample_error">startnextloop</stringProp>
+        <stringProp name="ThreadGroup.on_sample_error">stopthread</stringProp>
         <elementProp name="ThreadGroup.main_controller" elementType="LoopController" guiclass="LoopControlPanel" testclass="LoopController" testname="Loop Controller" enabled="true">
           <boolProp name="LoopController.continue_forever">false</boolProp>
           <intProp name="LoopController.loops">-1</intProp>
@@ -192,8 +192,8 @@
           <stringProp name="TestPlan.comments">Send response from login to SP for processing</stringProp>
         </ModuleController>
         <hashTree/>
-        <ResultCollector guiclass="SummaryReport" testclass="ResultCollector" testname="Summary Report N users" enabled="true">
-          <boolProp name="ResultCollector.error_logging">true</boolProp>
+        <ResultCollector guiclass="SummaryReport" testclass="ResultCollector" testname="Summary Report 20 users" enabled="true">
+          <boolProp name="ResultCollector.error_logging">false</boolProp>
           <objProp>
             <name>saveConfig</name>
             <value class="SampleSaveConfiguration">
@@ -230,7 +230,7 @@
         </ResultCollector>
         <hashTree/>
         <ResultCollector guiclass="RespTimeGraphVisualizer" testclass="ResultCollector" testname="Response Time Graph" enabled="true">
-          <boolProp name="ResultCollector.error_logging">true</boolProp>
+          <boolProp name="ResultCollector.error_logging">false</boolProp>
           <objProp>
             <name>saveConfig</name>
             <value class="SampleSaveConfiguration">
diff --git a/stress-tests/dd-tests-selenium.py b/stress-tests/dd-tests-selenium.py
index 2c57501..2dc94af 100644
--- a/stress-tests/dd-tests-selenium.py
+++ b/stress-tests/dd-tests-selenium.py
@@ -20,9 +20,6 @@ from selenium.webdriver.chrome.options import Options as ChromeOptions
 from typing import Any, Dict, Iterable, List
 
 
-STEP_TIMEOUT_SECONDS = 40
-
-
 class DDSession:
     driver: webdriver.Chrome
 
@@ -31,7 +28,7 @@ class DDSession:
         instance: str,
         users_file: str,
         out_dir: pathlib.Path,
-        stepTimeoutSeconds: int = STEP_TIMEOUT_SECONDS,
+        stepTimeoutSeconds: int = 20,
     ):
         self.instance = instance
         self.users_file = [
@@ -180,7 +177,6 @@ class DDSession:
             lambda d: (
                 d.find_elements(By.ID, "kc-form-login")
                 + d.find_elements(By.ID, "menu-apps-icon")
-                + d.find_elements(By.ID, "menu-apps-btn")
             )
         )
 
@@ -217,7 +213,7 @@ class DDSession:
         self.screenshot("OnlyOffice", "Opening")
 
         # Wait for OnlyOffice to start loading
-        oofCSS = ".app-onlyoffice #app iframe"
+        oofCSS = "div.app-onlyoffice #app iframe"
         WebDriverWait(self.driver, timeout=self.stepTimeoutSeconds).until(
             lambda d: d.find_elements(By.CSS_SELECTOR, oofCSS)
         )
@@ -296,13 +292,13 @@ def main_test(
     users_file: io.TextIOWrapper,
     out_dir: pathlib.Path,
     duration: int,
-    stepTimeoutSeconds: int = STEP_TIMEOUT_SECONDS,
+    stepTimeoutSeconds: int = 20,
 ) -> DDSession:
     session = DDSession(
         instance=instance,
         users_file=users_file.read(),
         out_dir=out_dir,
-        stepTimeoutSeconds=stepTimeoutSeconds,
+        stepTimeoutSeconds=20,
     )
 
     first_run = True

From 79b4d246ea307da0c3294b474b4d3a9b77095834 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Elena=20Barrios=20Gal=C3=A1n?= <elena@tresipunt.com>
Date: Tue, 4 Apr 2023 07:40:57 +0000
Subject: [PATCH 02/18] Update dd-ctl- mod_attendance and geogebra

---
 dd-ctl | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/dd-ctl b/dd-ctl
index 261e8dc..46011bd 100755
--- a/dd-ctl
+++ b/dd-ctl
@@ -806,6 +806,16 @@ upgrade_plugins_moodle(){
 	#mkdir -p /tmp/moodle/local/tresipuntimportgc
 	#cp -R local_plugins/moodle/tresipuntimportgc/* /tmp/moodle/local/tresipuntimportgc/
 
+	curl --location https://github.com/danmarsden/moodle-mod_attendance/archive/refs/heads/MOODLE_311_STABLE.zip > mod_attendance.zip
+    unzip -q mod_attendance.zip -d /tmp/moodle/mod/
+    mv /tmp/moodle/mod/moodle-mod_attendance-MOODLE_311_STABLE /tmp/moodle/mod/attendance
+    rm mod_attendance.zip
+
+	curl --location https://github.com/projectestac/moodle-mod_geogebra/archive/refs/heads/MOODLE_39_STABLE.zip > mod_geogebra.zip
+    unzip -q mod_geogebra.zip -d /tmp/moodle/mod/
+    mv /tmp/moodle/mod/moodle-mod_geogebra-MOODLE_39_STABLE /tmp/moodle/mod/geogebra
+    rm mod_geogebra.zip
+
 	cp -R /tmp/moodle/* "$SRC_FOLDER/moodle/"
 	rm -rf /tmp/moodle
 	docker exec -i dd-apps-moodle php7 admin/cli/purge_caches.php

From 2cb1541d2edd2eeef1a4f1e05c43ca4a059f5c2e Mon Sep 17 00:00:00 2001
From: elena <elena@tresipunt.com>
Date: Wed, 12 Apr 2023 09:35:43 +0000
Subject: [PATCH 03/18] Revert "displayed nextcloud user menu like moodle and
 wp applications - not for admins!"

This reverts commit 6db2b8c60f4aa2363085bcf4a3be889416002cfa.
---
 .../src/themes/dd/core/templates/layout.user.php    | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php b/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
index 4c02e07..70453f9 100644
--- a/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
+++ b/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
@@ -23,7 +23,6 @@
 	$api_url = "https://" . preg_replace('/^nextcloud\./', 'api.', $_SERVER['HTTP_HOST']);
 	$avatar_url = "https://" . preg_replace('/^nextcloud\./', 'sso.', $_SERVER['HTTP_HOST']) . "/auth/realms/master/avatar-provider";
 	$profile_url = "https://" . preg_replace('/^nextcloud\./', 'sso.', $_SERVER['HTTP_HOST']) . "/auth/realms/master/account";
-	$showsettings = in_array($_['user_uid'], ['admin', 'ddadmin']) ? true : false;
 
 	// Remove user menu Settings item for non-administrator users
 	if(!array_key_exists('core_apps', $_["settingsnavigation"])){
@@ -154,22 +153,14 @@
 							</a>
 						</li>	
 					<?php foreach ($_['settingsnavigation'] as $entry):?>
-						<?php if ($showsettings) { ?>
-							<li data-id="<?php p($entry['id']); ?>">
-								<a href="<?php print_unescaped($entry['href']); ?>"
-									<?php if ($entry["active"]): ?> class="active"<?php endif; ?>>
-									<img alt="" src="<?php print_unescaped($entry['icon'] . '?v=' . $_['versionHash']); ?>">
-									<?php p($entry['name']) ?>
-								</a>
-							</li>
-						<?php } else if ($entry['id'] == 'logout') { ?>
+						<?php if ($entry['id'] == 'logout') { ?>
 							<li data-id="<?php p($entry['id']); ?>">
 								<a href="<?php print_unescaped($entry['href']); ?>">
 									<div class="ddiconcontainer">
 										<i class="icon fa fa-sign-out fa-fw ddicon" aria-hidden="true"></i> </div>
 										<?php p($entry['name']) ?>
 								</a>
-							</li>
+						</li>
 						<?php } ?>																									
 				<?php endforeach; ?>					
 					</ul>

From 928097939240fb91cf9fbb980c818e2dc42d8269 Mon Sep 17 00:00:00 2001
From: elena <elena@tresipunt.com>
Date: Wed, 12 Apr 2023 09:35:58 +0000
Subject: [PATCH 04/18] Revert "displayed nextcloud user menu like moodle and
 wp applications"

This reverts commit 5d5ef2f8848bba7a7da715c5ca07c423fd32a130.
---
 .../themes/dd/core/templates/layout.user.php  | 53 ++++++-------------
 1 file changed, 17 insertions(+), 36 deletions(-)

diff --git a/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php b/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
index 70453f9..e98f890 100644
--- a/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
+++ b/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
@@ -22,7 +22,6 @@
 */
 	$api_url = "https://" . preg_replace('/^nextcloud\./', 'api.', $_SERVER['HTTP_HOST']);
 	$avatar_url = "https://" . preg_replace('/^nextcloud\./', 'sso.', $_SERVER['HTTP_HOST']) . "/auth/realms/master/avatar-provider";
-	$profile_url = "https://" . preg_replace('/^nextcloud\./', 'sso.', $_SERVER['HTTP_HOST']) . "/auth/realms/master/account";
 
 	// Remove user menu Settings item for non-administrator users
 	if(!array_key_exists('core_apps', $_["settingsnavigation"])){
@@ -68,25 +67,16 @@
 			.newFileMenu > ul:nth-child(1) > li:nth-child(3) {
 				order: 1;
 			}
-			#header .header-right>div>.menu:after {
-				display:none;
-			}
-			.ddicon {
+			#header .header-right > div > .menu.settings-menu > ul li.onlytext {
+				display: inline-flex;
+				align-items: center;
+				height: 44px;
+				color: var(--color-main-text);
+				padding: 10px 35px;
+				box-sizing: border-box;
+				white-space: nowrap;
 				position: relative;
-				left: 8px;
-				top: 9px;
-			}
-			.ddiconcontainer {
-				margin-right: 16px;
-				width: 36px;
-				height: 36px;
-				background-color: #f0f0f0;
-				position: relative;
-				border-radius: 5px;
-				left: -7px;
-			}
-			#expanddiv {
-				padding: .5rem .7rem;
+				width: 100%;
 			}
 		</style>
 	</head>
@@ -144,25 +134,16 @@
 					<nav class="settings-menu" id="expanddiv" style="display:none;"
 						aria-label="<?php p($l->t('Settings menu'));?>">
 					<ul>
-						<li>						
-							<a target="_blank" href="<?php p($profile_url)?>">
-								<div class="ddiconcontainer">
-									<i class="icon fa fa-user fa-fw ddicon"></i>
-								</div>
-								<?php p($_['user_displayname']); ?>
-							</a>
-						</li>	
+						<li class="onlytext"><?php p($_['user_displayname']); ?></li>
 					<?php foreach ($_['settingsnavigation'] as $entry):?>
-						<?php if ($entry['id'] == 'logout') { ?>
-							<li data-id="<?php p($entry['id']); ?>">
-								<a href="<?php print_unescaped($entry['href']); ?>">
-									<div class="ddiconcontainer">
-										<i class="icon fa fa-sign-out fa-fw ddicon" aria-hidden="true"></i> </div>
-										<?php p($entry['name']) ?>
-								</a>
+						<li data-id="<?php p($entry['id']); ?>">
+							<a href="<?php print_unescaped($entry['href']); ?>"
+								<?php if ($entry["active"]): ?> class="active"<?php endif; ?>>
+								<img alt="" src="<?php print_unescaped($entry['icon'] . '?v=' . $_['versionHash']); ?>">
+								<?php p($entry['name']) ?>
+							</a>
 						</li>
-						<?php } ?>																									
-				<?php endforeach; ?>					
+					<?php endforeach; ?>
 					</ul>
 					</nav>
 				</div>

From ff78c2f48988a7f949c7bc24e8d6ebb47c891cc9 Mon Sep 17 00:00:00 2001
From: elena <elena@tresipunt.com>
Date: Wed, 12 Apr 2023 09:36:04 +0000
Subject: [PATCH 05/18] Revert "new feature: display user name on user menu
 header"

This reverts commit 006add66c45d8fce7802fecdb90a8f1aaece555c.
---
 .../src/themes/dd/core/templates/layout.user.php     | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php b/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
index e98f890..4ab08df 100644
--- a/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
+++ b/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
@@ -67,17 +67,6 @@
 			.newFileMenu > ul:nth-child(1) > li:nth-child(3) {
 				order: 1;
 			}
-			#header .header-right > div > .menu.settings-menu > ul li.onlytext {
-				display: inline-flex;
-				align-items: center;
-				height: 44px;
-				color: var(--color-main-text);
-				padding: 10px 35px;
-				box-sizing: border-box;
-				white-space: nowrap;
-				position: relative;
-				width: 100%;
-			}
 		</style>
 	</head>
 	<body id="<?php p($_['bodyid']);?>">
@@ -134,7 +123,6 @@
 					<nav class="settings-menu" id="expanddiv" style="display:none;"
 						aria-label="<?php p($l->t('Settings menu'));?>">
 					<ul>
-						<li class="onlytext"><?php p($_['user_displayname']); ?></li>
 					<?php foreach ($_['settingsnavigation'] as $entry):?>
 						<li data-id="<?php p($entry['id']); ?>">
 							<a href="<?php print_unescaped($entry['href']); ?>"

From 1087c5c5131afea6ce902e19cfe210bddbe17adb Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Wed, 11 Jan 2023 18:19:09 +0100
Subject: [PATCH 06/18] [NC] Rework image to self-configure as opposed to using
 dd-ctl

By managing volumes in a better fashion and using code that is closer
to being idempotent, while being declarative, we achieve an image that
is closer to the original one, but gets the plugins that we want and
the configuration that we want for integration with DD.

Closes #9. This image now allows for BBB_HOST and BBB_API_SECRET as
variables in dd.conf, which also configure the corresponding plugin on
Nextcloud.

This is a necessary update-step towards NC25, and temporarily disables
the forms plugin.
---
 dd-apps/docker/nextcloud/Dockerfile       |  39 +++-
 dd-apps/docker/nextcloud/dd-patch         |   1 +
 dd-apps/docker/nextcloud/nc-setup.sh      | 268 ++++++++++++++++++++++
 dd-apps/docker/nextcloud/nextcloud.yml    |  19 +-
 dd-apps/docker/nextcloud/supervisord.conf |  14 ++
 dd-ctl                                    | 214 -----------------
 dd.conf.sample                            |  11 +
 7 files changed, 344 insertions(+), 222 deletions(-)
 create mode 100755 dd-apps/docker/nextcloud/nc-setup.sh

diff --git a/dd-apps/docker/nextcloud/Dockerfile b/dd-apps/docker/nextcloud/Dockerfile
index acdd39b..dfdea19 100644
--- a/dd-apps/docker/nextcloud/Dockerfile
+++ b/dd-apps/docker/nextcloud/Dockerfile
@@ -1,5 +1,6 @@
 #
 #   Copyright © 2021,2022 IsardVDI S.L.
+#   Copyright © 2023 Evilham <contact@evilham.com>
 #
 #   This file is part of DD
 #
@@ -28,7 +29,17 @@ RUN set -ex; \
         procps \
         samba-client \
         supervisor \
-#       libreoffice \
+    ;
+
+# These are documented DD dependencies for nc-setup.sh
+# jq: to patch mimetypemapping
+# npm + composer: due to oddities installing forms plugin
+RUN set -ex; \
+    \
+    apk add --no-cache \
+        jq \
+        npm \
+        composer \
     ;
 
 RUN set -ex; \
@@ -59,6 +70,26 @@ RUN set -ex; \
     apk add --virtual .nextcloud-phpext-rundeps $runDeps; \
     apk del .build-deps
 
+# Temporary replacement for a real queue
+RUN echo '*/1 * * * * /nc-queue.sh' >> /etc/crontabs/www-data
+COPY nc-queue.sh /
+COPY nc-mail-update.sh /
+# DD plugins and other setup
+COPY nc-setup.sh /
+# SAML setup script
+COPY saml.sh /
+# Submission template
+COPY template.docx /
+
+## Save current forms plugin hash
+#RUN sh -c 'curl -sL https://api.github.com/repos/3iPunt/nextcloud_forms/commits/STABLE_25 | jq  -r .sha > /forms.hash'
+## And current forms code
+#RUN sh -c 'curl -sL "https://github.com/3iPunt/nextcloud_forms/archive/$(cat /forms.hash).zip" > /forms.zip'
+# Mail app patches. To remove in NC 25
+COPY nc_mail/ /nc_mail/
+
+# Setup cron as documented in:
+# https://github.com/nextcloud/docker/blob/master/.examples/dockerfiles/cron/fpm-alpine/Dockerfile
 RUN mkdir -p \
     /var/log/supervisord \
     /var/run/supervisord \
@@ -66,12 +97,6 @@ RUN mkdir -p \
 
 COPY supervisord.conf /
 
-# Temporary replacement for a real queue
-RUN echo '*/1 * * * * /nc-queue.sh' >> /etc/crontabs/www-data
-COPY nc-queue.sh /
-COPY nc-mail-update.sh /
-COPY saml.sh /
-
 ENV NEXTCLOUD_UPDATE=1
 
 CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]
diff --git a/dd-apps/docker/nextcloud/dd-patch b/dd-apps/docker/nextcloud/dd-patch
index 5da1ffe..72f2848 100644
--- a/dd-apps/docker/nextcloud/dd-patch
+++ b/dd-apps/docker/nextcloud/dd-patch
@@ -5,3 +5,4 @@ supervisord.conf	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.git
 nc_mail/appinfo/info.xml	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/v1.15.2/appinfo/info.xml
 nc_mail/lib/Command/UpdateAccount.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/1e777a1783254bd4b7f69f39a6c5123323f8b701/lib/Command/UpdateAccount.php
 nc_mail/lib/Db/MailAccountMapper.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/1e777a1783254bd4b7f69f39a6c5123323f8b701/lib/Db/MailAccountMapper.php
+src/themes/dd/core/templates/layout.user.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/server/v21.0.9/core/templates/layout.user.php
diff --git a/dd-apps/docker/nextcloud/nc-setup.sh b/dd-apps/docker/nextcloud/nc-setup.sh
new file mode 100755
index 0000000..fa5c00c
--- /dev/null
+++ b/dd-apps/docker/nextcloud/nc-setup.sh
@@ -0,0 +1,268 @@
+#!/bin/sh -eu
+
+#
+# This runs as www-data
+#
+
+occupgrade() {
+	# Maintenance mode must be off
+	./occ maintenance:mode --off
+	# Sometimes this has to happen twice
+	./occ upgrade
+	./occ upgrade
+}
+
+plugin_status() {
+	plugin="$1"
+	plugins_state="$(./occ app:list --output=json_pretty)"
+	version="$(echo "${plugins_state}" | jq -r ".enabled.${plugin}")"
+	if [ "${version}" != "null" ]; then
+		printf "%s\t%s" "enabled" "${version}"
+	else
+		version="$(echo "${plugins_state}" | jq -r ".disabled.${plugin}")"
+		if [ "${version}" != "null" ]; then
+			printf "%s\t%s" "disabled" "${version}"
+		else
+			printf "%s\t%s" "n/a" "n/a"
+		fi
+	fi
+}
+
+
+cat <<EOF
+**************************************
+Performing DD-specific Nextcloud setup
+**************************************
+
+EOF
+
+# Install static settings
+echo "--> Setting up static DD config"
+STATIC_CFG=/var/www/html/config/zzz_dd.config.php
+cat > "${STATIC_CFG}" <<EOF
+<?php
+/** DD-customised static settings
+  */
+\$CONFIG = array(
+  'default_language' => 'ca',
+  'skeletondirectory' => '',
+  'theme' => 'dd',
+  'allow_local_remote_servers' => true,
+);
+EOF
+
+occupgrade
+
+# These cannot be edited from outside of the DD project
+# Operators should instead rely on the environment variables to ease deployment
+# EXTRA_PLUGINS_ENABLE and EXTRA_PLUGINS_DISABLE
+CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,ownpad,onlyoffice"
+CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles,forms"
+
+if [ "${DISABLE_CLAMAV:-true}" = "false" ]; then
+	CORE_PLUGINS_ENABLE="${CORE_PLUGINS_ENABLE},files_antivirus"
+	USING_CLAMAV="YES"
+else
+	CORE_PLUGINS_DISABLE="${CORE_PLUGINS_DISABLE},files_antivirus"
+fi
+
+# Take care of installing core plugins and extra requested plugins
+PLUGINS="${CORE_PLUGINS_ENABLE},${CORE_PLUGINS_DISABLE},${EXTRA_PLUGINS_ENABLE:-},${EXTRA_PLUGINS_DISABLE:-}"
+
+# Install all plugins
+# shellcheck disable=SC2086  # We do want multiple arguments
+for plugin in $(echo "${PLUGINS}" | tr ',' '\n'); do
+	if plugin_status "${plugin}" | grep -q "n/a"; then
+		echo "--> Installing ${plugin}"
+		./occ --no-warnings app:install "${plugin}"
+	fi
+done
+
+# Enable core plugins
+# shellcheck disable=SC2086  # We do want multiple arguments
+for plugin in $(echo "${CORE_PLUGINS_ENABLE}" | tr ',' '\n'); do
+	if plugin_status "${plugin}" | grep -qE "^disabled"; then
+		echo "--> Enabling core ${plugin}"
+		./occ --no-warnings app:enable "${plugin}"
+	fi
+done
+
+# Disable core plugins
+# shellcheck disable=SC2086  # We do want multiple arguments
+for plugin in $(echo "${CORE_PLUGINS_DISABLE}" | tr ',' '\n'); do
+	if plugin_status "${plugin}" | grep -qE "^enabled"; then
+		echo "--> Disabling core ${plugin}"
+		./occ --no-warnings app:disable "${plugin}"
+	fi
+done
+
+
+# Enable extra plugins
+# shellcheck disable=SC2086  # We do want multiple arguments
+for plugin in $(echo "${EXTRA_PLUGINS_ENABLE:-}" | tr ',' '\n'); do
+	if plugin_status "${plugin}" | grep -qE "^disabled"; then
+		echo "--> Enabling extra ${plugin}"
+		./occ --no-warnings app:enable "${plugin}"
+	fi
+done
+
+# Disable extra plugins
+# shellcheck disable=SC2086  # We do want multiple arguments
+for plugin in $(echo "${EXTRA_PLUGINS_DISABLE:-}" | tr ',' '\n'); do
+	if plugin_status "${plugin}" | grep -qE "^enabled"; then
+		echo "--> Disabling extra ${plugin}"
+		./occ --no-warnings app:disable "${plugin}"
+	fi
+done
+
+occupgrade
+
+# Temporary patch while upstream lands our changes
+# See: https://github.com/nextcloud/mail/pull/6908
+for f in appinfo/info.xml lib/Command/UpdateAccount.php lib/Db/MailAccountMapper.php; do
+	install -m 0644 -o www-data -g www-data "/nc_mail/$f" "/var/www/html/custom_apps/mail/$f"
+done
+
+occupgrade
+
+## Forms
+# TODO: This is broken in NC 24 due to:
+#   https://github.com/nextcloud/forms/pull/1149/files
+## TODO: request explanations and reduce upstream diff
+## This is what is being used: https://github.com/juanan3ip/form
+#FORMS_EXPECTED_HASH="$(cat /forms.hash)"
+#FORMS_DIR="/var/www/html/custom_apps/forms"
+#FORMS_HASH=""
+#if [ -f "${FORMS_DIR}.hash" ]; then
+#	FORMS_HASH="$(cat "${FORMS_DIR}.hash")"
+#fi
+#if [ "${FORMS_EXPECTED_HASH}" != "${FORMS_HASH}" ]; then
+#	# Remove old plugin
+#	rm -rf "${FORMS_DIR}"
+#	# Install new one
+#	unzip -o /forms.zip -d /tmp
+#	mv "/tmp/form-${FORMS_EXPECTED_HASH}" "${FORMS_DIR}"
+#	# Perform config / install
+#	npm --prefix "${FORMS_DIR}" install
+#	composer --ignore-platform-req=ext-dom -d"${FORMS_DIR}" install --no-dev -o
+#	# Place hash marker
+#	cp /forms.hash "${FORMS_DIR}.hash"
+#fi
+#if plugin_status "${plugin}" | grep -qE "^disabled"; then
+#	./occ app:enable forms
+#fi
+#
+#occupgrade
+
+#
+# Apply app-specific configurations
+#
+echo "--> Configuring BBB"
+# Host
+./occ config:app:set -n bbb api.url --value="${BBB_HOST:-}"
+# API Secret
+./occ config:app:set -n -q bbb api.secret --value="${BBB_API_SECRET:-}"
+# Disable Big Blue Button media check by default
+./occ config:app:set -n bbb join.mediaCheck --value="false"
+# Disable Big Blue Button listen only mode by default
+# And enable option to join muted to Big Blue Button room by default
+## TODO: Upstream these as toggeable settings
+# shellcheck disable=SC2016  # We want these literal strings
+sed -i.orig \
+	-e 's/^\(\s*$room->setListenOnly(\)true\();\)$/\1false\2/' \
+	-e 's/^\(\s*$room->setJoinMuted(\)false\();\)$/\1true\2/' \
+	/var/www/html/custom_apps/bbb/lib/Service/RoomService.php
+# Remove meeting join nextcloud bbb app dialog exclamation marks
+sed -i.orig \
+	-e 's/\(^\s*"Please enter your name!" : [^¡]*\)¡\?\([^!]*\)!\(.*\)$/\1\2\3/' \
+	-e 's/\(^\s*"Let.s go!" : [^¡]*\)¡\?\([^!]*\)!\(.*\)$/\1\2\3/' \
+	/var/www/html/custom_apps/bbb/l10n/*.json
+
+# Patches / fixes for Ownpad
+## Fix mimetypemapping for ownpad
+MIMETYPEMAPPINGJSON="/var/www/html/config/mimetypemapping.json"
+if ! grep -q "application/x-ownpad" "${MIMETYPEMAPPINGJSON}"; then
+	jq '. + {"pad": ["application/x-ownpad"], "calc": ["application/x-ownpad"]}' \
+		/var/www/html/resources/config/mimetypemapping.dist.json > "${MIMETYPEMAPPINGJSON}"
+	# We have to tell NC about this change as documented here:
+	# https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html#maintenance-commands
+	./occ maintenance:mimetype:update-db
+fi
+## Open pads on new tab/window
+OWNPADJS="/var/www/html/custom_apps/ownpad/js/ownpad.js"
+if ! grep -q viewerDD "${OWNPADJS}"; then
+	## TODO: Upstream this as a toggeable setting
+	sed -i.orig 's/^\(\s*\)var viewer = \(OC.generateUrl.*\)/\1var viewerDD = \2; window.open(viewerDD); return;/' "${OWNPADJS}"
+fi
+
+# Settings
+echo "--> Applying custom settings"
+./occ --no-warnings config:app:set -n ownpad ownpad_etherpad_enable --value="yes"
+./occ --no-warnings config:app:set -n ownpad ownpad_etherpad_host --value="https://pad.$DOMAIN"
+
+./occ --no-warnings config:app:set -n onlyoffice DocumentServerUrl --value="https://oof.$DOMAIN"
+./occ --no-warnings config:app:set -n onlyoffice jwt_secret --value="secret"
+./occ --no-warnings config:app:set -n onlyoffice jwt_header --value="Authorization"
+./occ --no-warnings config:app:set -n onlyoffice sameTab --value="false"
+
+# Moodle nextcloud task needs forcesave onlyoffice option
+./occ --no-warnings config:app:set -n onlyoffice customizationForcesave --value="true"
+
+# Add allow list IPs
+./occ --no-warnings config:app:set -n bruteForce whitelist_1 --value='172.16.0.0/12'
+
+# OnlyOffice
+./occ --no-warnings config:app:set -n onlyoffice preview --value="true"
+./occ --no-warnings config:app:set -n onlyoffice defFormats --value='{"csv":"false","doc":"true","docm":"false","docx":"true","docxf":"true","oform":"true","dotx":"false","epub":"false","html":"false","odp":"true","ods":"true","odt":"true","otp":"true","ots":"true","ott":"true","pdf":"false","potm":"false","potx":"false","ppsm":"false","ppsx":"true","ppt":"true","pptm":"false","pptx":"true","rtf":"false","txt":"false","xls":"true","xlsm":"false","xlsx":"true","xltm":"false","xltx":"true"}'
+./occ --no-warnings config:app:set -n onlyoffice editFormats --value='{"csv":"true","odp":"false","ods":"false","odt":"false","rtf":"false","txt":"true"}'
+
+if [ -n "${USING_CLAMAV:-}" ]; then
+	echo "--> Configuring ClamAV"
+	./occ --no-warnings config:app:set -n files_antivirus av_mode --value="daemon"
+	./occ --no-warnings config:app:set -n files_antivirus av_host --value="dd-apps-clamav"
+	./occ --no-warnings config:app:set -n files_antivirus av_port --value="3310"
+	./occ --no-warnings config:app:set -n files_antivirus av_infected_action --value="only_log"
+	./occ --no-warnings config:app:set -n files_antivirus av_stream_max_length --value="26214400"
+	./occ --no-warnings config:app:set -n files_antivirus av_max_file_size --value="-1"
+fi
+
+# Allow nextcloud into other apps iframes
+echo "--> Fixing CSP"
+# TODO: this should be done in a different fashion
+# Content-Security-Policy: frame-ancestors 'self' *.$DOMAIN;
+# Content-Set-Policy: connect-src 'self -' *.$DOMAIN;
+# Content-Set-Policy: img-src 'self' *. -$DOMAIN;
+# Content-Set-Policy: style-src 'self'  -*.$DOMAIN;
+# Content-Set-Policy: font-src 'self' * -.$DOMAIN;
+sed -i \
+	-E "s%'\\\\'self\\\\'',.*$%'\\\\'self\\\\'', '*.${DOMAIN}',%" \
+	/var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php
+
+# Add default file for moodle activities
+TEMPLATEDOCX="/var/www/html/data/admin/files/template.docx"
+if [ ! -f "${TEMPLATEDOCX}" ]; then
+	echo "--> Copying activity template for Moodle"
+	cp /template.docx "${TEMPLATEDOCX}"
+	# We have to tell NC about this change
+	./occ  files:scan admin
+fi
+
+# Configure logo
+echo "--> Configuring logo"
+# TODO: This should be a tad more dynamic
+cachebuster="0"
+if ./occ config:app:get theming cachebuster; then
+	cachebuster="$(./occ config:app:get theming cachebuster)"
+fi
+./occ theming:config logo /custom/img/logo.png
+./occ theming:config background /custom/img/background.png
+./occ config:app:set theming cachebuster --value="$((cachebuster + 1 ))"
+
+occupgrade
+
+cat <<EOF
+*************************************
+Done with DD-specific Nextcloud setup
+*************************************
+
+EOF
diff --git a/dd-apps/docker/nextcloud/nextcloud.yml b/dd-apps/docker/nextcloud/nextcloud.yml
index b4cc1d2..b4b3d9a 100644
--- a/dd-apps/docker/nextcloud/nextcloud.yml
+++ b/dd-apps/docker/nextcloud/nextcloud.yml
@@ -28,14 +28,25 @@ services:
         # Update dd.conf.sample when bumping this version in main
         - IMG=${NEXTCLOUD_IMG_OVERRIDE-nextcloud:24.0.10-fpm-alpine}
     container_name: dd-apps-nextcloud-app
+    image: registry.dd-work.space/dd/apps-nextcloud:${DD_BUILD:-latest}
     restart: unless-stopped
     depends_on:
       - dd-apps-postgresql
     volumes:
       - /etc/localtime:/etc/localtime:ro
+      # According to the documentation: https://hub.docker.com/_/nextcloud
+      # We need the full dir for upgrades, only version.php should matter though?
       - ${SRC_FOLDER}/nextcloud:/var/www/html
-      - ${DATA_FOLDER}/nextcloud:/var/www/html/data
+      # Making these dirs explicit so we can segregate them easier in the future
+      #- ${SRC_FOLDER}/nextcloud/custom_apps:/var/www/html/custom_apps
+      #- ${SRC_FOLDER}/nextcloud/config:/var/www/html/config
+      - ${DATA_FOLDER}/nextcloud:/var/www/html/data:rw
+      - ${BUILD_APPS_ROOT_PATH}/docker/nextcloud/src/themes/dd:/var/www/html/themes/dd:ro
+      # We need this to configure the custom logos and background
+      - ${CUSTOM_PATH}/custom/img:/custom/img:ro
+      # SAML certificates
       - ${DATA_FOLDER}/saml/nextcloud:/saml:ro
+      # NC mail client update queue
       - ${DATA_FOLDER}/nc-mail-queue:/nc-mail-queue:rw
     environment:
       # DD-specific settings
@@ -62,6 +73,12 @@ services:
       - PHP_MEMORY_LIMIT=${NEXTCLOUD_MEMORY_LIMIT-512M}
       # Proxy-specific settings
       - OVERWRITEPROTOCOL=https
+      # BBB settings
+      - BBB_HOST=${BBB_HOST:-}
+      - BBB_API_SECRET=${BBB_API_SECRET:-}
+      # Operator preferences
+      - EXTRA_PLUGINS_ENABLE=${NEXTCLOUD_PLUGINS_ENABLE:-}
+      - EXTRA_PLUGINS_DISABLE=${NEXTCLOUD_PLUGINS_DISABLE:-}
     networks:
       - dd_net
 
diff --git a/dd-apps/docker/nextcloud/supervisord.conf b/dd-apps/docker/nextcloud/supervisord.conf
index 4f76259..9677e64 100644
--- a/dd-apps/docker/nextcloud/supervisord.conf
+++ b/dd-apps/docker/nextcloud/supervisord.conf
@@ -20,3 +20,17 @@ stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 command=/cron.sh
+
+; Add our customisation scripts
+; Note these run *after* Nextcloud's upgrade logic and in parallel to php-fpm startup
+[program:nc-setup]
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+startsecs=0
+priority=100
+user=www-data
+environment=USER="www-data",HOME="/home/www-data"
+directory=/var/www/html
+command=/nc-setup.sh
diff --git a/dd-ctl b/dd-ctl
index 46011bd..b707268 100755
--- a/dd-ctl
+++ b/dd-ctl
@@ -325,180 +325,6 @@ down(){
 	docker-compose down
 }
 
-setup_nextcloud(){
-	echo " --> Applying custom settings in nextcloud"
-	# docker exec -u www-data dd-apps-nextcloud-app sh -c 'export OC_PASS=$DDADMIN_PASSWORD && php occ user:add --password-from-env --display-name="DD Admin" --group="admin" $DDADMIN_USER'
-
-	# docker exec -u www-data dd-apps-nextcloud-app sh -c 'export OC_PASS=admin && php occ user:delete admin'
-	# docker exec -u www-data dd-apps-nextcloud-app sh -c 'export OC_PASS=LostAdminGroup && php occ user:add --password-from-env --display-name="Admin" --group="admin" admin'
-
-	# docker exec -u www-data dd-apps-nextcloud-app php occ --no-warnings config:app:set unaprova token --value "SuperS3cret"
-
-	#cp -R $BUILD_APPS_ROOT_PATH/dd-apps/docker/nextcloud/themes/* $DATA_FOLDER/nextcloud/themes/
-	docker exec -u www-data dd-apps-nextcloud-app php occ --no-warnings config:system:set default_language --value="ca"
-	docker exec -u www-data dd-apps-nextcloud-app php occ --no-warnings config:system:set skeletondirectory --value=''
-
-	# Disable certain NextCloud apps
-	for app in firstrunwizard recommendations dashboard circles; do
-		docker exec -i -u www-data dd-apps-nextcloud-app sh -s <<-EOF
-		php occ --no-warnings app:disable "${app}" || true
-		EOF
-	done
-
-	# Install and enable NextCloud apps
-	for app in bruteforcesettings polls calendar spreed bbb mail ownpad onlyoffice; do
-		docker exec -i -u www-data dd-apps-nextcloud-app sh -s <<-EOF
-		php occ --no-warnings app:install "${app}"
-		php occ --no-warnings app:enable "${app}"
-		EOF
-	done
-
-	# Install ClamAV conditionally
-	if [ "${DISABLE_CLAMAV:-true}" = "false" ]; then
-		docker exec -i -u www-data dd-apps-nextcloud-app sh -s <<-EOF
-		php occ --no-warnings app:install files_antivirus
-		php occ --no-warnings app:enable files_antivirus
-		EOF
-	else
-		# Enforce disabled
-		docker exec -i -u www-data dd-apps-nextcloud-app sh -s <<-EOF
-		php occ --no-warnings app:install files_antivirus
-		php occ --no-warnings app:disable files_antivirus
-		EOF
-	fi
-
-	#docker exec -u www-data dd-apps-nextcloud-app php occ app:install user_saml
-	docker exec -u www-data dd-apps-nextcloud-app php occ app:enable user_saml
-
-	# Installing apps may require an occ upgrade
-	nextcloud_upgrade
-
-	# Temporary patch while upstream lands our changes
-	# See: https://github.com/nextcloud/mail/pull/6908
-	for f in appinfo/info.xml lib/Command/UpdateAccount.php lib/Db/MailAccountMapper.php; do
-		install -m 0644 -o 82 -g 82 "dd-apps/docker/nextcloud/nc_mail/$f" "${SRC_FOLDER}/nextcloud/custom_apps/mail/$f"
-	done
-
-	# Disable Big Blue Button media check by default
-	docker exec -u www-data dd-apps-nextcloud-app php occ config:app:set bbb join.mediaCheck --value="false"
-	# Disable Big Blue Button listen only mode by default
-	docker exec dd-apps-nextcloud-app sed -i.orig 's/^\(\s*$room->setListenOnly(\)true\();\)$/\1false\2/' /var/www/html/custom_apps/bbb/lib/Service/RoomService.php
-	# Enable option to join muted to Big Blue Button room by default
-	docker exec dd-apps-nextcloud-app sed -i 's/^\(\s*$room->setJoinMuted(\)false\();\)$/\1true\2/' /var/www/html/custom_apps/bbb/lib/Service/RoomService.php
-	# Remove meeting join nextcloud bbb app dialog exclamation marks
-	docker exec dd-apps-nextcloud-app sh -c "sed -i.orig 's/\(^\s*\"Please enter your name!\" : [^¡]*\)¡\?\([^!]*\)!\(.*\)$/\1\2\3/' /var/www/html/custom_apps/bbb/l10n/*.json"
-	docker exec dd-apps-nextcloud-app sh -c "sed -i 's/\(^\s*\"Let\x27s go!\" : [^¡]*\)¡\?\([^!]*\)!\(.*\)$/\1\2\3/' /var/www/html/custom_apps/bbb/l10n/*.json"
-
-	docker exec -u www-data dd-apps-nextcloud-app php occ --no-warnings config:system:set theme  --value=dd
-	docker exec -u www-data dd-apps-nextcloud-app php occ --no-warnings config:system:set allow_local_remote_servers  --value=true
-	docker exec -u www-data dd-apps-nextcloud-app php occ --no-warnings maintenance:theme:update
-
-	docker exec dd-apps-nextcloud-app apk add jq
-	docker exec dd-apps-nextcloud-app sh -c 'jq ". + {\"pad\": [\"application/x-ownpad\"], \"calc\": [\"application/x-ownpad\"]}" /var/www/html/resources/config/mimetypemapping.dist.json > /var/www/html/config/mimetypemapping.json'
-	# Open pads in a new tab/window
-	docker exec dd-apps-nextcloud-app sed -i.orig 's/^\(\s*\)\(var viewer = OC.generateUrl.*\)/\1\2\n\1window.open(viewer);\n\1return;/' /var/www/html/custom_apps/ownpad/js/ownpad.js
-
-	# SMTP
-	SMTP_LOCAL_PART="$(echo "${SMTP_USER}" | cut -d '@' -f 1)"
-	SMTP_DOMAIN="$(echo "${SMTP_USER}" | cut -d '@' -f 2)"
-	docker exec -i -u www-data dd-apps-nextcloud-app sh -s <<-EOF
-	php occ --no-warnings config:system:set -n mail_smtpmode --value="smtp"
-	php occ --no-warnings config:system:set -n mail_smtpsecure --value="${SMTP_PROTOCOL}"
-	php occ --no-warnings config:system:set -n mail_sendmailmode --value="smtp"
-	php occ --no-warnings config:system:set -n mail_from_address --value="${SMTP_LOCAL_PART}"
-	php occ --no-warnings config:system:set -n mail_domain --value="${SMTP_DOMAIN}"
-	php occ --no-warnings config:system:set -n mail_smtpauth --value=1
-	php occ --no-warnings config:system:set -n mail_smtpauthtype --value="LOGIN"
-	php occ --no-warnings config:system:set -n mail_smtphost --value="${SMTP_HOST}"
-	php occ --no-warnings config:system:set -n mail_smtpport --value="${SMTP_PORT}"
-	php occ --no-warnings config:system:set -n mail_smtpname --value="${SMTP_USER}"
-	echo 'Setting Nextcloud password'
-	php occ --no-warnings config:system:set -n -q mail_smtppassword --value="${SMTP_PASSWORD}"
-	EOF
-
-	# Settings
-	docker exec -i -u www-data dd-apps-nextcloud-app sh -s <<-EOF
-	php occ --no-warnings config:app:set -n ownpad ownpad_etherpad_enable --value="yes"
-	php occ --no-warnings config:app:set -n ownpad ownpad_etherpad_host --value="https://pad.$DOMAIN"
-
-	php occ --no-warnings config:app:set -n onlyoffice DocumentServerUrl --value="https://oof.$DOMAIN"
-	php occ --no-warnings config:app:set -n onlyoffice jwt_secret --value="secret"
-	php occ --no-warnings config:app:set -n onlyoffice jwt_header --value="Authorization"
-	php occ --no-warnings config:app:set -n onlyoffice sameTab --value="false"
-
-	# Moodle nextcloud task needs forcesave onlyoffice option
-	php occ --no-warnings config:app:set -n onlyoffice customizationForcesave --value="true"
-
-	# Add allow list IPs
-	php occ --no-warnings config:app:set -n bruteForce whitelist_1 --value='172.16.0.0/12'
-
-	# OnlyOffice
-	php occ --no-warnings config:app:set -n onlyoffice preview --value="true"
-	php occ --no-warnings config:app:set -n onlyoffice defFormats --value="{\"csv\":\"false\",\"doc\":\"true\",\"docm\":\"false\",\"docx\":\"true\",\"docxf\":\"true\",\"oform\":\"true\",\"dotx\":\"false\",\"epub\":\"false\",\"html\":\"false\",\"odp\":\"true\",\"ods\":\"true\",\"odt\":\"true\",\"otp\":\"true\",\"ots\":\"true\",\"ott\":\"true\",\"pdf\":\"false\",\"potm\":\"false\",\"potx\":\"false\",\"ppsm\":\"false\",\"ppsx\":\"true\",\"ppt\":\"true\",\"pptm\":\"false\",\"pptx\":\"true\",\"rtf\":\"false\",\"txt\":\"false\",\"xls\":\"true\",\"xlsm\":\"false\",\"xlsx\":\"true\",\"xltm\":\"false\",\"xltx\":\"true\"}",
-	php occ --no-warnings config:app:set -n onlyoffice editFormats --value="{\"csv\":\"true\",\"odp\":\"false\",\"ods\":\"false\",\"odt\":\"false\",\"rtf\":\"false\",\"txt\":\"true\"}"
-
-	EOF
-
-	# Configure ClamAV conditionally
-	if [ "${DISABLE_CLAMAV:-true}" = "false" ]; then
-		docker exec -i -u www-data dd-apps-nextcloud-app sh -s <<-EOF
-		php occ --no-warnings config:app:set -n files_antivirus av_mode --value="daemon"
-		php occ --no-warnings config:app:set -n files_antivirus av_host --value="dd-apps-clamav"
-		php occ --no-warnings config:app:set -n files_antivirus av_port --value="3310"
-		php occ --no-warnings config:app:set -n files_antivirus av_infected_action --value="only_log"
-		php occ --no-warnings config:app:set -n files_antivirus av_stream_max_length --value="26214400"
-		php occ --no-warnings config:app:set -n files_antivirus av_max_file_size --value="-1"
-		EOF
-	fi
-
-	# Allow nextcloud into other apps iframes
-	# Content-Security-Policy: frame-ancestors 'self' *.$DOMAIN;
-	docker exec dd-apps-nextcloud-app sed -i -e "/protected \\\$allowedFrameAncestors = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php
-
-	# Content-Sety-Policy: connect-src 'self -' *.$DOMAIN;
-	docker exec dd-apps-nextcloud-app sed -i -e "/protected \\\$allowedConnectDomains = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php
-
-	# Content-Sety-Policy: img-src 'self' *. -$DOMAIN;
-	docker exec dd-apps-nextcloud-app sed -i -e "/protected \\\$allowedImageDomains = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php
-
-	# Content-Sety-Policy: style-src 'self'  -*.$DOMAIN;
-	docker exec dd-apps-nextcloud-app sed -i -e "/protected \\\$allowedStyleDomains = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php
-
-	# Content-Sety-Policy: font-src 'self' * -.$DOMAIN;
-	docker exec dd-apps-nextcloud-app sed -i -e "/protected \\\$allowedFontDomains = \[/{n;s/\('\\\\\'self\\\\\'\)\('\)/\1 *.$DOMAIN\2/}" /var/www/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php
-
-	# Fix nextcloud files_external "segudos" typo
-	# https://github.com/nextcloud/server/pull/28990
-	docker exec dd-apps-nextcloud-app sh -c 'sed -i.orig -e "s/segudos/segundos/" /var/www/html/apps/files_external/l10n/es_*.js'
-
-	# Import fix from Nextcloud 22 of pdf viewer
-	# https://github.com/nextcloud/files_pdfviewer/issues/381#issuecomment-845806364
-	docker exec dd-apps-nextcloud-app sed -i 's/encodeURIComponent(i\[a\])/i[a]/' /var/www/html/apps/files_pdfviewer/js/files_pdfviewer-main.js
-
-	# Add default file for moodle activities
-	if [ ! -f "$DATA_FOLDER/nextcloud/admin/files/template.docx" ]; then
-		cp dd-apps/docker/nextcloud/template.docx "$DATA_FOLDER/nextcloud/admin/files/"
-	fi
-
-	# Custom forms
-	## This may be forcing the need for occ upgrade in the past
-	## Keep it towards the end
-	docker exec dd-apps-nextcloud-app apk add git npm composer
-	docker exec -u www-data dd-apps-nextcloud-app rm -rf /var/www/html/custom_apps/forms
-	docker exec -u www-data dd-apps-nextcloud-app git clone https://github.com/juanan3ip/form -b dev /var/www/html/custom_apps/forms
-	docker exec -u www-data dd-apps-nextcloud-app npm --prefix /var/www/html/custom_apps/forms install
-	docker exec -u www-data dd-apps-nextcloud-app composer -d/var/www/html/custom_apps/forms install --no-dev -o
-	docker exec -u www-data dd-apps-nextcloud-app php occ app:enable forms
-
-	nextcloud_upgrade
-	configure_nextcloud_logo
-	nextcloud_scan
-}
-
-nextcloud_upgrade(){
-	docker exec -i -u www-data dd-apps-nextcloud-app ./occ upgrade
-}
-
 nextcloud_scan(){
 	# The folders shown as 'not writeable' are empty user folders. Not a problem.
 	docker exec -u www-data dd-apps-nextcloud-app php occ files:scan --all
@@ -669,16 +495,6 @@ extras_pgtuner(){
 	echo " --> Generated pgtuner.yml"
 }
 
-extras_nextcloud_remove_banned_ips(){
-	docker-compose exec dd-apps-postgresql psql -v ON_ERROR_STOP=1 \
-						-U admin nextcloud -c "DELETE FROM oc_bruteforce_attempts;"
-}
-
-extras_nextcloud_set_admin_group(){
-	docker exec -u www-data dd-apps-nextcloud-app sh -c 'export OC_PASS=admin && php occ user:delete admin'
-	docker exec -u www-data dd-apps-nextcloud-app sh -c 'export OC_PASS=N3xtcl0ud && php occ user:add --password-from-env --display-name="Admin" --group="admin" admin'
-}
-
 extras_dump_keycloak_client(){
 	docker exec -i dd-sso-keycloak sh -s <<-EOF
 	/opt/jboss/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080/auth --realm master --user admin --password keycloakkeycloak \
@@ -821,11 +637,6 @@ upgrade_plugins_moodle(){
 	docker exec -i dd-apps-moodle php7 admin/cli/purge_caches.php
 }
 
-upgrade_plugins_nextcloud(){
-	cp -R dd-apps/docker/nextcloud/src/* "$SRC_FOLDER/nextcloud/"
-	nextcloud_upgrade
-}
-
 upgrade_plugins_wp(){
 	cp -R dd-apps/docker/wordpress/src/* "$SRC_FOLDER/wordpress/"
 
@@ -857,29 +668,8 @@ upgrade_plugins_wp(){
 }
 
 update_logos_and_menu(){
-	# docker exec -i dd-sso-keycloak sh -c "/opt/jboss/keycloak/bin/jboss-cli.sh --connect --command='/subsystem=keycloak-server/theme=defaults/:write-attribute(name=cacheThemes,value=false)'"
-	# docker exec -i dd-sso-keycloak sh -c "/opt/jboss/keycloak/bin/jboss-cli.sh --connect --command='/subsystem=keycloak-server/theme=defaults/:write-attribute(name=cacheTemplates,value=false)'"
-	# docker exec -i dd-sso-keycloak sh -c "/opt/jboss/keycloak/bin/jboss-cli.sh --connect --command='/subsystem=keycloak-server/theme=defaults/:write-attribute(name=staticMaxAge,value=-1)'"
-	# docker exec -i dd-sso-keycloak sh -c "/opt/jboss/keycloak/bin/jboss-cli.sh --connect --command='reload'"
 	docker exec -i --user root dd-sso-keycloak sh -c 'rm -rf /opt/jboss/keycloak/standalone/tmp/kc-gzip-cache/*'
 	docker-compose build dd-sso-api && docker-compose up -d dd-sso-api
-	configure_nextcloud_logo
-}
-
-configure_nextcloud_logo(){
-	local instance_id
-	instance_id=$(docker exec -u www-data dd-apps-nextcloud-app php occ config:system:get instanceid)
-	local cachebuster
-	cachebuster=$(docker exec -u www-data dd-apps-nextcloud-app php occ config:app:get theming cachebuster)
-	docker exec -u www-data dd-apps-nextcloud-app mkdir -p "/var/www/html/data/appdata_$instance_id/theming/images"
-	nc_logo="${DATA_FOLDER}/nextcloud/appdata_$instance_id/theming/images/logo"
-	nc_background="${DATA_FOLDER}/nextcloud/appdata_$instance_id/theming/images/background"
-	cp custom/img/logo.png "${nc_logo}"
-	cp custom/img/background.png "${nc_background}"
-	chown 82:82 "${nc_logo}" "${nc_background}"
-	docker exec -u www-data dd-apps-nextcloud-app php occ config:app:set theming logoMime --value="image/png"
-	docker exec -u www-data dd-apps-nextcloud-app php occ config:app:set theming backgroundMime --value="image/png"
-	docker exec -u www-data dd-apps-nextcloud-app php occ config:app:set theming cachebuster --value="$((cachebuster + 1 ))"
 }
 
 genpwd() {
@@ -978,10 +768,8 @@ case "$OPERATION" in
 
 		wait_for_moodle
 		upgrade_plugins_moodle
-		upgrade_plugins_nextcloud
 		upgrade_plugins_wp
 
-		setup_nextcloud
 		setup_moodle
 		setup_wordpress
 
@@ -1008,7 +796,6 @@ case "$OPERATION" in
 	customize)
 		up
 		wait_for_moodle
-		setup_nextcloud
 		setup_wordpress
 		setup_moodle
 	;;
@@ -1066,7 +853,6 @@ case "$OPERATION" in
 		up
 		wait_for_moodle
 		upgrade_plugins_moodle
-		upgrade_plugins_nextcloud
 		upgrade_plugins_wp
 	;;
 	yml)
diff --git a/dd.conf.sample b/dd.conf.sample
index 553e9d3..c2f71ba 100644
--- a/dd.conf.sample
+++ b/dd.conf.sample
@@ -70,6 +70,11 @@ DDADMIN_USER=ddadmin
 DDADMIN_PASSWORD=Th3M@st3r
 DDADMIN_EMAIL=theemail@mymailserver.com
 
+# BBB settings
+# This gets automatically configured on Nextcloud
+#BBB_HOST=bbb.example.org
+#BBB_API_SECRET=APISECRET
+
 # ------ Api Secret -----------------------------------------------------------
 ## Generate your own SECRET! (or apply securize script)
 ## openssl rand -base64 32
@@ -113,6 +118,12 @@ NEXTCLOUD_ADMIN_PASSWORD=N3xtcl0ud
 NEXTCLOUD_POSTGRES_USER=nextcloud
 NEXTCLOUD_POSTGRES_PASSWORD=N3xtcl0ud
 
+### Comma-separated list of Nextcloud plugins that you want to enable/disable
+### These should be available from https://apps.nextcloud.com/
+### Example: NEXTCLOUD_PLUGINS_ENABLE=cospend,cookbook
+#NEXTCLOUD_PLUGINS_ENABLE=
+#NEXTCLOUD_PLUGINS_DISABLE
+
 ## WORDPRESS
 ##=============================================================================
 WORDPRESS_ADMIN_USER=admin

From b97071c72208933bb4a3bf4c8ed3f0ef18caefc8 Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Mon, 27 Feb 2023 19:38:41 +0100
Subject: [PATCH 07/18] [NC] Upgrade to Nextcloud 25.0.4

This still uses a fork of nextcloud/forms and reenables that plugin.

Since version 25 of Nextcloud uses the 2.X line of the nextcloud/mail
plugin, which already includes our patches, we can get rid of them to
easen future maintenance.
---
 dd-apps/docker/nextcloud/Dockerfile           |   6 +-
 dd-apps/docker/nextcloud/dd-patch             |   5 +-
 dd-apps/docker/nextcloud/nc-setup.sh          |  65 +++----
 .../docker/nextcloud/nc_mail/appinfo/info.xml |  75 --------
 .../nc_mail/lib/Command/UpdateAccount.php     | 179 ------------------
 .../nc_mail/lib/Db/MailAccountMapper.php      | 171 -----------------
 dd-apps/docker/nextcloud/nextcloud.yml        |   2 +-
 .../nextcloud/src/themes/dd/core/ddstyles.css |  14 ++
 .../nextcloud/src/themes/dd/core/js/navbar.js |   2 +-
 .../themes/dd/core/templates/layout.user.php  |  85 +++++----
 .../src/admin/static/templates/base.html      |   2 +-
 .../src/admin/static/templates/login.html     |   2 +-
 .../api/src/api/static/_templates/dd.css      |  10 +-
 dd.conf.sample                                |   2 +-
 14 files changed, 106 insertions(+), 514 deletions(-)
 delete mode 100644 dd-apps/docker/nextcloud/nc_mail/appinfo/info.xml
 delete mode 100644 dd-apps/docker/nextcloud/nc_mail/lib/Command/UpdateAccount.php
 delete mode 100644 dd-apps/docker/nextcloud/nc_mail/lib/Db/MailAccountMapper.php

diff --git a/dd-apps/docker/nextcloud/Dockerfile b/dd-apps/docker/nextcloud/Dockerfile
index dfdea19..6ade834 100644
--- a/dd-apps/docker/nextcloud/Dockerfile
+++ b/dd-apps/docker/nextcloud/Dockerfile
@@ -82,11 +82,9 @@ COPY saml.sh /
 COPY template.docx /
 
 ## Save current forms plugin hash
-#RUN sh -c 'curl -sL https://api.github.com/repos/3iPunt/nextcloud_forms/commits/STABLE_25 | jq  -r .sha > /forms.hash'
+RUN sh -c 'curl -sL https://api.github.com/repos/3iPunt/nextcloud_forms/commits/STABLE_25 | jq  -r .sha > /forms.hash'
 ## And current forms code
-#RUN sh -c 'curl -sL "https://github.com/3iPunt/nextcloud_forms/archive/$(cat /forms.hash).zip" > /forms.zip'
-# Mail app patches. To remove in NC 25
-COPY nc_mail/ /nc_mail/
+RUN sh -c 'curl -sL "https://github.com/3iPunt/nextcloud_forms/archive/$(cat /forms.hash).zip" > /forms.zip'
 
 # Setup cron as documented in:
 # https://github.com/nextcloud/docker/blob/master/.examples/dockerfiles/cron/fpm-alpine/Dockerfile
diff --git a/dd-apps/docker/nextcloud/dd-patch b/dd-apps/docker/nextcloud/dd-patch
index 72f2848..fb3241e 100644
--- a/dd-apps/docker/nextcloud/dd-patch
+++ b/dd-apps/docker/nextcloud/dd-patch
@@ -2,7 +2,4 @@
 # file	license	author	source
 nginx.conf	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/docker/04ab3157e4f1197a9f8f4b91cf2430586356dd9a/.examples/docker-compose/with-nginx-proxy/postgres/fpm/web/nginx.conf
 supervisord.conf	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/docker/04ab3157e4f1197a9f8f4b91cf2430586356dd9a/.examples/dockerfiles/cron/fpm-alpine/supervisord.conf
-nc_mail/appinfo/info.xml	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/v1.15.2/appinfo/info.xml
-nc_mail/lib/Command/UpdateAccount.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/1e777a1783254bd4b7f69f39a6c5123323f8b701/lib/Command/UpdateAccount.php
-nc_mail/lib/Db/MailAccountMapper.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/1e777a1783254bd4b7f69f39a6c5123323f8b701/lib/Db/MailAccountMapper.php
-src/themes/dd/core/templates/layout.user.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/server/v21.0.9/core/templates/layout.user.php
+src/themes/dd/core/templates/layout.user.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/server/v25.0.4/core/templates/layout.user.php
diff --git a/dd-apps/docker/nextcloud/nc-setup.sh b/dd-apps/docker/nextcloud/nc-setup.sh
index fa5c00c..7ea1356 100755
--- a/dd-apps/docker/nextcloud/nc-setup.sh
+++ b/dd-apps/docker/nextcloud/nc-setup.sh
@@ -20,7 +20,10 @@ plugin_status() {
 		printf "%s\t%s" "enabled" "${version}"
 	else
 		version="$(echo "${plugins_state}" | jq -r ".disabled.${plugin}")"
-		if [ "${version}" != "null" ]; then
+		is_available="$(echo "${plugins_state}" | jq -r \
+			--arg plugin "${plugin}" \
+			'.disabled | to_entries[] | select(.key == $plugin) | .key')"
+		if [ "${is_available}" = "${plugin}" ]; then
 			printf "%s\t%s" "disabled" "${version}"
 		else
 			printf "%s\t%s" "n/a" "n/a"
@@ -57,7 +60,7 @@ occupgrade
 # Operators should instead rely on the environment variables to ease deployment
 # EXTRA_PLUGINS_ENABLE and EXTRA_PLUGINS_DISABLE
 CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,ownpad,onlyoffice"
-CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles,forms"
+CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles"
 
 if [ "${DISABLE_CLAMAV:-true}" = "false" ]; then
 	CORE_PLUGINS_ENABLE="${CORE_PLUGINS_ENABLE},files_antivirus"
@@ -72,7 +75,7 @@ PLUGINS="${CORE_PLUGINS_ENABLE},${CORE_PLUGINS_DISABLE},${EXTRA_PLUGINS_ENABLE:-
 # Install all plugins
 # shellcheck disable=SC2086  # We do want multiple arguments
 for plugin in $(echo "${PLUGINS}" | tr ',' '\n'); do
-	if plugin_status "${plugin}" | grep -q "n/a"; then
+	if plugin_status "${plugin}" | grep -qE "^n/a"; then
 		echo "--> Installing ${plugin}"
 		./occ --no-warnings app:install "${plugin}"
 	fi
@@ -117,40 +120,32 @@ done
 
 occupgrade
 
-# Temporary patch while upstream lands our changes
-# See: https://github.com/nextcloud/mail/pull/6908
-for f in appinfo/info.xml lib/Command/UpdateAccount.php lib/Db/MailAccountMapper.php; do
-	install -m 0644 -o www-data -g www-data "/nc_mail/$f" "/var/www/html/custom_apps/mail/$f"
-done
-
-occupgrade
 
 ## Forms
-# TODO: This is broken in NC 24 due to:
-#   https://github.com/nextcloud/forms/pull/1149/files
-## TODO: request explanations and reduce upstream diff
-## This is what is being used: https://github.com/juanan3ip/form
-#FORMS_EXPECTED_HASH="$(cat /forms.hash)"
-#FORMS_DIR="/var/www/html/custom_apps/forms"
-#FORMS_HASH=""
-#if [ -f "${FORMS_DIR}.hash" ]; then
-#	FORMS_HASH="$(cat "${FORMS_DIR}.hash")"
-#fi
-#if [ "${FORMS_EXPECTED_HASH}" != "${FORMS_HASH}" ]; then
-#	# Remove old plugin
-#	rm -rf "${FORMS_DIR}"
-#	# Install new one
-#	unzip -o /forms.zip -d /tmp
-#	mv "/tmp/form-${FORMS_EXPECTED_HASH}" "${FORMS_DIR}"
-#	# Perform config / install
-#	npm --prefix "${FORMS_DIR}" install
-#	composer --ignore-platform-req=ext-dom -d"${FORMS_DIR}" install --no-dev -o
-#	# Place hash marker
-#	cp /forms.hash "${FORMS_DIR}.hash"
-#fi
-#if plugin_status "${plugin}" | grep -qE "^disabled"; then
-#	./occ app:enable forms
-#fi
+## This should be upstreamed, see:
+##    https://github.com/juanan3ip/form/issues/76
+## This is what is being used: https://github.com/3iPunt/nextcloud_forms
+FORMS_EXPECTED_HASH="$(cat /forms.hash)"
+FORMS_DIR="/var/www/html/custom_apps/forms"
+FORMS_HASH=""
+if [ -f "${FORMS_DIR}.hash" ]; then
+	FORMS_HASH="$(cat "${FORMS_DIR}.hash")"
+fi
+if [ "${FORMS_EXPECTED_HASH}" != "${FORMS_HASH}" ]; then
+	# Remove old plugin
+	rm -rf "${FORMS_DIR}"
+	# Install new one
+	unzip -o /forms.zip -d /tmp
+	mv "/tmp/nextcloud_forms-${FORMS_EXPECTED_HASH}" "${FORMS_DIR}"
+	# Perform config / install
+	npm --prefix "${FORMS_DIR}" install
+	composer --ignore-platform-req=ext-dom -d"${FORMS_DIR}" install --no-dev -o
+	# Place hash marker
+	cp /forms.hash "${FORMS_DIR}.hash"
+fi
+if plugin_status "${plugin}" | grep -qE "^disabled"; then
+	./occ app:enable forms
+fi
 #
 #occupgrade
 
diff --git a/dd-apps/docker/nextcloud/nc_mail/appinfo/info.xml b/dd-apps/docker/nextcloud/nc_mail/appinfo/info.xml
deleted file mode 100644
index 920028d..0000000
--- a/dd-apps/docker/nextcloud/nc_mail/appinfo/info.xml
+++ /dev/null
@@ -1,75 +0,0 @@
-<?xml version="1.0"?>
-<info xmlns:xsi= "http://www.w3.org/2001/XMLSchema-instance"
-      xsi:noNamespaceSchemaLocation="https://apps.nextcloud.com/schema/apps/info.xsd">
-	<id>mail</id>
-	<name>Mail</name>
-	<summary>💌 A mail app for Nextcloud</summary>
-	<description><![CDATA[**💌 A mail app for Nextcloud**
-
-- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.
-- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.
-- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.
-- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://horde.org) libraries.
-- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!
-	]]></description>
-	<version>1.15.2</version>
-	<licence>agpl</licence>
-	<author>Greta Doçi</author>
-	<author homepage="https://github.com/nextcloud/groupware">Nextcloud Groupware Team</author>
-	<namespace>Mail</namespace>
-	<documentation>
-		<user>https://github.com/nextcloud/mail/blob/main/doc/user.md</user>
-		<admin>https://github.com/nextcloud/mail/blob/main/doc/admin.md</admin>
-		<developer>https://github.com/nextcloud/mail/blob/main/doc/developer.md</developer>
-	</documentation>
-	<category>social</category>
-	<category>office</category>
-	<website>https://github.com/nextcloud/mail#readme</website>
-	<bugs>https://github.com/nextcloud/mail/issues</bugs>
-	<repository type="git">https://github.com/nextcloud/mail.git</repository>
-	<screenshot>https://user-images.githubusercontent.com/1374172/79554966-278e1600-809f-11ea-82ea-7a0d72a2704f.png</screenshot>
-	<dependencies>
-		<php min-version="7.4" max-version="8.1" />
-		<nextcloud min-version="23" max-version="25" />
-	</dependencies>
-	<background-jobs>
-		<job>OCA\Mail\BackgroundJob\CleanupJob</job>
-		<job>OCA\Mail\BackgroundJob\OutboxWorkerJob</job>
-	</background-jobs>
-	<repair-steps>
-		<post-migration>
-			<step>OCA\Mail\Migration\AddMissingDefaultTags</step>
-			<step>OCA\Mail\Migration\AddMissingMessageIds</step>
-			<step>OCA\Mail\Migration\FixCollectedAddresses</step>
-			<step>OCA\Mail\Migration\FixBackgroundJobs</step>
-			<step>OCA\Mail\Migration\MakeItineraryExtractorExecutable</step>
-			<step>OCA\Mail\Migration\ProvisionAccounts</step>
-			<step>OCA\Mail\Migration\RepairMailTheads</step>
-		</post-migration>
-	</repair-steps>
-	<commands>
-		<command>OCA\Mail\Command\AddMissingTags</command>
-		<command>OCA\Mail\Command\CleanUp</command>
-		<command>OCA\Mail\Command\CreateAccount</command>
-		<command>OCA\Mail\Command\CreateTagMigrationJobEntry</command>
-		<command>OCA\Mail\Command\DeleteAccount</command>
-		<command>OCA\Mail\Command\DiagnoseAccount</command>
-		<command>OCA\Mail\Command\ExportAccount</command>
-		<command>OCA\Mail\Command\ExportAccountThreads</command>
-		<command>OCA\Mail\Command\SyncAccount</command>
-		<command>OCA\Mail\Command\TrainAccount</command>
-		<command>OCA\Mail\Command\Thread</command>
-		<command>OCA\Mail\Command\UpdateAccount</command>
-	</commands>
-	<settings>
-		<admin>OCA\Mail\Settings\AdminSettings</admin>
-	</settings>
-	<navigations>
-		<navigation>
-			<name>Mail</name>
-			<route>mail.page.index</route>
-			<icon>mail.svg</icon>
-			<order>3</order>
-		</navigation>
-	</navigations>
-</info>
diff --git a/dd-apps/docker/nextcloud/nc_mail/lib/Command/UpdateAccount.php b/dd-apps/docker/nextcloud/nc_mail/lib/Command/UpdateAccount.php
deleted file mode 100644
index 45cf1f7..0000000
--- a/dd-apps/docker/nextcloud/nc_mail/lib/Command/UpdateAccount.php
+++ /dev/null
@@ -1,179 +0,0 @@
-<?php
-
-/**
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Maadix
- *
- * Mail
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program.  If not, see <http://www.gnu.org/licenses/>
- *
- */
-
-namespace OCA\Mail\Command;
-
-use OCA\Mail\Db\MailAccountMapper;
-use OCP\Security\ICrypto;
-use OCP\AppFramework\Db\DoesNotExistException;
-use Symfony\Component\Console\Command\Command;
-use Symfony\Component\Console\Input\InputArgument;
-use Symfony\Component\Console\Input\InputOption;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Output\OutputInterface;
-
-class UpdateAccount extends Command {
-	public const ARGUMENT_ACCOUNT_ID = 'account-id';
-	public const ARGUMENT_NAME = 'name';
-	public const ARGUMENT_EMAIL = 'email';
-	public const ARGUMENT_AUTH_METHOD = 'auth-method';
-	public const ARGUMENT_IMAP_HOST = 'imap-host';
-	public const ARGUMENT_IMAP_PORT = 'imap-port';
-	public const ARGUMENT_IMAP_SSL_MODE = 'imap-ssl-mode';
-	public const ARGUMENT_IMAP_USER = 'imap-user';
-	public const ARGUMENT_IMAP_PASSWORD = 'imap-password';
-	public const ARGUMENT_SMTP_HOST = 'smtp-host';
-	public const ARGUMENT_SMTP_PORT = 'smtp-port';
-	public const ARGUMENT_SMTP_SSL_MODE = 'smtp-ssl-mode';
-	public const ARGUMENT_SMTP_USER = 'smtp-user';
-	public const ARGUMENT_SMTP_PASSWORD = 'smtp-password';
-
-
-	/** @var mapper */
-	private $mapper;
-
-	/** @var ICrypto */
-	private $crypto;
-
-	public function __construct(MailAccountMapper $mapper, ICrypto $crypto) {
-		parent::__construct();
-
-		$this->mapper = $mapper;
-		$this->crypto = $crypto;
-	}
-
-	/**
-	 * @return void
-	 */
-	protected function configure() {
-		$this->setName('mail:account:update');
-		$this->setDescription('Update a user\'s IMAP account');
-		$this->addArgument(self::ARGUMENT_ACCOUNT_ID, InputArgument::REQUIRED);
-
-		$this->addOption(self::ARGUMENT_NAME, '', InputOption::VALUE_OPTIONAL);
-		$this->addOption(self::ARGUMENT_EMAIL, '', InputOption::VALUE_OPTIONAL);
-
-		$this->addOption(self::ARGUMENT_IMAP_HOST, '', InputOption::VALUE_OPTIONAL);
-		$this->addOption(self::ARGUMENT_IMAP_PORT, '', InputOption::VALUE_OPTIONAL);
-		$this->addOption(self::ARGUMENT_IMAP_SSL_MODE, '', InputOption::VALUE_OPTIONAL);
-		$this->addOption(self::ARGUMENT_IMAP_USER, '', InputOption::VALUE_OPTIONAL);
-		$this->addOption(self::ARGUMENT_IMAP_PASSWORD, '', InputOption::VALUE_OPTIONAL);
-
-		$this->addOption(self::ARGUMENT_SMTP_HOST, '', InputOption::VALUE_OPTIONAL);
-		$this->addOption(self::ARGUMENT_SMTP_PORT, '', InputOption::VALUE_OPTIONAL);
-		$this->addOption(self::ARGUMENT_SMTP_SSL_MODE, '', InputOption::VALUE_OPTIONAL);
-		$this->addOption(self::ARGUMENT_SMTP_USER, '', InputOption::VALUE_OPTIONAL);
-		$this->addOption(self::ARGUMENT_SMTP_PASSWORD, '', InputOption::VALUE_OPTIONAL);
-
-		$this->addOption(self::ARGUMENT_AUTH_METHOD, '', InputOption::VALUE_OPTIONAL);
-	}
-
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		$accountId = (int)$input->getArgument(self::ARGUMENT_ACCOUNT_ID);
-
-		$name = $input->getOption(self::ARGUMENT_NAME);
-		$email = $input->getOption(self::ARGUMENT_EMAIL);
-
-		$imapHost = $input->getOption(self::ARGUMENT_IMAP_HOST);
-		$imapPort = $input->getOption(self::ARGUMENT_IMAP_PORT);
-		$imapSslMode = $input->getOption(self::ARGUMENT_IMAP_SSL_MODE);
-		$imapUser = $input->getOption(self::ARGUMENT_IMAP_USER);
-		$imapPassword = $input->getOption(self::ARGUMENT_IMAP_PASSWORD);
-
-		$smtpHost = $input->getOption(self::ARGUMENT_SMTP_HOST);
-		$smtpPort = $input->getOption(self::ARGUMENT_SMTP_PORT);
-		$smtpSslMode = $input->getOption(self::ARGUMENT_SMTP_SSL_MODE);
-		$smtpUser = $input->getOption(self::ARGUMENT_SMTP_USER);
-		$smtpPassword = $input->getOption(self::ARGUMENT_SMTP_PASSWORD);
-		$authMethod = $input->getOption(self::ARGUMENT_AUTH_METHOD);
-
-		try {
-			$mailAccount = $this->mapper->findById($accountId);
-		} catch (DoesNotExistException $e) {
-			$output->writeln("<error>No Email Account found with ID $accountId </error>");
-			return 1;
-		}
-
-		$output->writeLn("<info>Found account with email: " . $mailAccount->getEmail() . "</info>");
-
-		//ACCOUNT OPTIONS
-		if ($input->getOption(self::ARGUMENT_NAME)) {
-			$mailAccount->setName($name);
-		}
-		if ($input->getOption(self::ARGUMENT_EMAIL)) {
-			$mailAccount->setEmail($email);
-		}
-
-		//AUTH METHOD
-		if ($input->getOption(self::ARGUMENT_AUTH_METHOD)) {
-			$mailAccount->setAuthMethod($authMethod);
-		}
-
-		//INBOUND
-		if ($input->getOption(self::ARGUMENT_IMAP_HOST)) {
-			$mailAccount->setInboundHost($imapHost);
-		}
-
-		if ($input->getOption(self::ARGUMENT_IMAP_PORT)) {
-			$mailAccount->setInboundPort((int) $imapPort);
-		}
-
-		if ($input->getOption(self::ARGUMENT_IMAP_SSL_MODE)) {
-			$mailAccount->setInboundSslMode($imapSslMode);
-		}
-
-		if ($input->getOption(self::ARGUMENT_IMAP_PASSWORD)) {
-			$mailAccount->setInboundPassword($this->crypto->encrypt($imapPassword));
-		}
-
-		if ($input->getOption(self::ARGUMENT_SMTP_USER)) {
-			$mailAccount->setInboundUser($imapUser);
-		}
-
-		// OUTBOUND
-
-		if ($input->getOption(self::ARGUMENT_SMTP_HOST)) {
-			$mailAccount->setOutboundHost($smtpHost);
-		}
-
-		if ($input->getOption(self::ARGUMENT_SMTP_PORT)) {
-			$mailAccount->setOutboundPort((int) $smtpPort);
-		}
-
-		if ($input->getOption(self::ARGUMENT_SMTP_SSL_MODE)) {
-			$mailAccount->setOutboundSslMode($smtpSslMode);
-		}
-
-		if ($input->getOption(self::ARGUMENT_SMTP_PASSWORD)) {
-			$mailAccount->setOutboundPassword($this->crypto->encrypt($smtpPassword));
-		}
-
-		if ($input->getOption(self::ARGUMENT_SMTP_USER)) {
-			$mailAccount->setOutboundUser($smtpUser);
-		}
-
-		$this->mapper->save($mailAccount);
-
-		$output->writeln("<info>Account " . $mailAccount->getEmail() . " with ID  $accountId  succesfully updated </info>");
-		return 0;
-	}
-}
diff --git a/dd-apps/docker/nextcloud/nc_mail/lib/Db/MailAccountMapper.php b/dd-apps/docker/nextcloud/nc_mail/lib/Db/MailAccountMapper.php
deleted file mode 100644
index 626708e..0000000
--- a/dd-apps/docker/nextcloud/nc_mail/lib/Db/MailAccountMapper.php
+++ /dev/null
@@ -1,171 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-/**
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Christoph Wurst <wurst.christoph@gmail.com>
- * @author Lukas Reschke <lukas@owncloud.com>
- * @author Thomas Müller <thomas.mueller@tmit.eu>
- *
- * Mail
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program.  If not, see <http://www.gnu.org/licenses/>
- *
- */
-
-namespace OCA\Mail\Db;
-
-use OCP\AppFramework\Db\DoesNotExistException;
-use OCP\AppFramework\Db\MultipleObjectsReturnedException;
-use OCP\AppFramework\Db\QBMapper;
-use OCP\DB\QueryBuilder\IQueryBuilder;
-use OCP\IDBConnection;
-use OCP\IUser;
-
-/**
- * @template-extends QBMapper<MailAccount>
- */
-class MailAccountMapper extends QBMapper {
-	/**
-	 * @param IDBConnection $db
-	 */
-	public function __construct(IDBConnection $db) {
-		parent::__construct($db, 'mail_accounts');
-	}
-
-	/** Finds an Mail Account by id
-	 *
-	 * @param string $userId
-	 * @param int $accountId
-	 *
-	 * @return MailAccount
-	 *
-	 * @throws DoesNotExistException
-	 */
-	public function find(string $userId, int $accountId): MailAccount {
-		$qb = $this->db->getQueryBuilder();
-		$query = $qb
-			->select('*')
-			->from($this->getTableName())
-			->where($qb->expr()->eq('user_id', $qb->createNamedParameter($userId)))
-			->andWhere($qb->expr()->eq('id', $qb->createNamedParameter($accountId)));
-
-		return $this->findEntity($query);
-	}
-
-	/**
-	 * Finds an mail account by id
-	 *
-	 * @return MailAccount
-	 * @throws DoesNotExistException
-	 */
-	public function findById(int $id): MailAccount {
-		$qb = $this->db->getQueryBuilder();
-		$query = $qb
-			->select('*')
-			->from($this->getTableName())
-			->where($qb->expr()->eq('id', $qb->createNamedParameter($id)));
-
-		return $this->findEntity($query);
-	}
-
-	/**
-	 * Finds all Mail Accounts by user id existing for this user
-	 *
-	 * @param string $userId the id of the user that we want to find
-	 *
-	 * @return MailAccount[]
-	 */
-	public function findByUserId(string $userId): array {
-		$qb = $this->db->getQueryBuilder();
-		$query = $qb
-			->select('*')
-			->from($this->getTableName())
-			->where($qb->expr()->eq('user_id', $qb->createNamedParameter($userId)));
-
-		return $this->findEntities($query);
-	}
-
-	/**
-	 * @throws DoesNotExistException
-	 * @throws MultipleObjectsReturnedException
-	 */
-	public function findProvisionedAccount(IUser $user): MailAccount {
-		$qb = $this->db->getQueryBuilder();
-
-		$query = $qb
-			->select('*')
-			->from($this->getTableName())
-			->where(
-				$qb->expr()->eq('user_id', $qb->createNamedParameter($user->getUID())),
-				$qb->expr()->isNotNull('provisioning_id')
-			);
-
-		return $this->findEntity($query);
-	}
-
-	/**
-	 * Saves an User Account into the database
-	 *
-	 * @param MailAccount $account
-	 *
-	 * @return MailAccount
-	 */
-	public function save(MailAccount $account): MailAccount {
-		if ($account->getId() === null) {
-			return $this->insert($account);
-		}
-
-		return $this->update($account);
-	}
-
-	public function deleteProvisionedAccounts(int $provisioningId): void {
-		$qb = $this->db->getQueryBuilder();
-
-		$delete = $qb->delete($this->getTableName())
-			->where($qb->expr()->eq('provisioning_id', $qb->createNamedParameter($provisioningId, IQueryBuilder::PARAM_INT)));
-
-		$delete->execute();
-	}
-
-	public function deleteProvisionedAccountsByUid(string $uid): void {
-		$qb = $this->db->getQueryBuilder();
-
-		$delete = $qb->delete($this->getTableName())
-			->where(
-				$qb->expr()->eq('user_id', $qb->createNamedParameter($uid)),
-				$qb->expr()->isNotNull('provisioning_id')
-			);
-
-		$delete->execute();
-	}
-
-	public function getAllAccounts(): array {
-		$qb = $this->db->getQueryBuilder();
-		$query = $qb
-			->select('*')
-			->from($this->getTableName());
-
-		return $this->findEntities($query);
-	}
-
-	public function getAllUserIdsWithAccounts(): array {
-		$qb = $this->db->getQueryBuilder();
-		$query = $qb
-			->selectDistinct('user_id')
-			->from($this->getTableName());
-
-		return $this->findEntities($query);
-	}
-}
diff --git a/dd-apps/docker/nextcloud/nextcloud.yml b/dd-apps/docker/nextcloud/nextcloud.yml
index b4b3d9a..76b2374 100644
--- a/dd-apps/docker/nextcloud/nextcloud.yml
+++ b/dd-apps/docker/nextcloud/nextcloud.yml
@@ -26,7 +26,7 @@ services:
       dockerfile: Dockerfile
       args:
         # Update dd.conf.sample when bumping this version in main
-        - IMG=${NEXTCLOUD_IMG_OVERRIDE-nextcloud:24.0.10-fpm-alpine}
+        - IMG=${NEXTCLOUD_IMG_OVERRIDE-nextcloud:25.0.4-fpm-alpine}
     container_name: dd-apps-nextcloud-app
     image: registry.dd-work.space/dd/apps-nextcloud:${DD_BUILD:-latest}
     restart: unless-stopped
diff --git a/dd-apps/docker/nextcloud/src/themes/dd/core/ddstyles.css b/dd-apps/docker/nextcloud/src/themes/dd/core/ddstyles.css
index f890999..55aebba 100644
--- a/dd-apps/docker/nextcloud/src/themes/dd/core/ddstyles.css
+++ b/dd-apps/docker/nextcloud/src/themes/dd/core/ddstyles.css
@@ -1,3 +1,17 @@
 [data-action="onlyofficeDocxf"]{
     display: none !important;
 }
+
+/* Fix logo misplacement */
+header#header a#nextcloud {
+    margin-left: 0;
+}
+/* Force visual aesthetic */
+body#body-user header#header {
+    background-image: none !important;
+}
+/* Fix icon colours */
+header#header #navbar-nextcloud span.material-design-icon,
+header#header #navbar-nextcloud #contactsmenu div.menutoggle::before {
+    filter: invert();
+}
diff --git a/dd-apps/docker/nextcloud/src/themes/dd/core/js/navbar.js b/dd-apps/docker/nextcloud/src/themes/dd/core/js/navbar.js
index 9e72ea5..b9c00ee 100644
--- a/dd-apps/docker/nextcloud/src/themes/dd/core/js/navbar.js
+++ b/dd-apps/docker/nextcloud/src/themes/dd/core/js/navbar.js
@@ -23,7 +23,7 @@ document.addEventListener("DOMContentLoaded", () => {
     base_url = `${window.location.protocol}//${window.location.host.replace(/^nextcloud\./, 'api.')}`
     $.getJSON(`${base_url}/json`, (result) => {
         if (result.logo) {
-            $("#navbar-logo img").attr('src', result.logo)
+            $("#navbar-logo #nextcloud img").attr('src', result.logo)
         }
         if (result.product_logo) {
             $("#product-logo img").attr("src", result.product_logo)
diff --git a/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php b/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
index 4ab08df..896946d 100644
--- a/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
+++ b/dd-apps/docker/nextcloud/src/themes/dd/core/templates/layout.user.php
@@ -21,25 +21,30 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 */
 	$api_url = "https://" . preg_replace('/^nextcloud\./', 'api.', $_SERVER['HTTP_HOST']);
-	$avatar_url = "https://" . preg_replace('/^nextcloud\./', 'sso.', $_SERVER['HTTP_HOST']) . "/auth/realms/master/avatar-provider";
 
 	// Remove user menu Settings item for non-administrator users
 	if(!array_key_exists('core_apps', $_["settingsnavigation"])){
 		unset($_["settingsnavigation"]["settings"]);
 	}
-?>
-<!DOCTYPE html>
+
+$getUserAvatar = static function (int $size) use ($_): string {
+	$avatar_url = "https://" . preg_replace('/^nextcloud\./', 'sso.', $_SERVER['HTTP_HOST']) . "/auth/realms/master/avatar-provider";
+	return $avatar_url;
+}
+
+?><!DOCTYPE html>
 <html class="ng-csp" data-placeholder-focus="false" lang="<?php p($_['language']); ?>" data-locale="<?php p($_['locale']); ?>" >
 	<head data-user="<?php p($_['user_uid']); ?>" data-user-displayname="<?php p($_['user_displayname']); ?>" data-requesttoken="<?php p($_['requesttoken']); ?>">
 		<meta charset="utf-8">
 		<title>
 			<?php
+				p(!empty($_['pageTitle'])?$_['pageTitle'].' - ':'');
 				p(!empty($_['application'])?$_['application'].' - ':'');
 				p($theme->getTitle());
 			?>
 		</title>
-		<meta http-equiv="X-UA-Compatible" content="IE=edge">
-		<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
+		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
+
 		<?php if ($theme->getiTunesAppId() !== '') { ?>
 		<meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>">
 		<?php } ?>
@@ -54,9 +59,9 @@
 		<link rel="mask-icon" sizes="any" href="<?php print_unescaped(image_path($_['appid'], 'favicon-mask.svg')); ?>" color="<?php p($theme->getColorPrimary()); ?>">
 		<link rel="manifest" href="<?php print_unescaped(image_path($_['appid'], 'manifest.json')); ?>">
 		<link rel="stylesheet" href="<?php p($api_url) ?>/css/font-awesome-4.7.0/css/font-awesome.min.css">
-		<link rel="stylesheet" href="<?php p($api_url) ?>/css/dd.css">
-		<link rel="stylesheet" href="/themes/dd/core/ddstyles.css">
-        <script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" src="/themes/dd/core/js/navbar.js"></script>
+		<link rel="stylesheet" href="<?php p($api_url) ?>/css/dd.css?2303">
+		<link rel="stylesheet" href="/themes/dd/core/ddstyles.css?2303">
+		<script nonce="<?php p(\OC::$server->getContentSecurityPolicyNonceManager()->getNonce()) ?>" src="/themes/dd/core/js/navbar.js"></script>
 		<?php emit_css_loading_tags($_); ?>
 		<?php emit_script_loading_tags($_); ?>
 		<?php print_unescaped($_['headers']); ?>
@@ -69,34 +74,36 @@
 			}
 		</style>
 	</head>
-	<body id="<?php p($_['bodyid']);?>">
+	<?php array_push($_['enabledThemes'], "light");?>
+	<body id="<?php p($_['bodyid']);?>" <?php foreach ($_['enabledThemes'] as $themeId) {
+				p("data-theme-$themeId ");
+			}?> data-themes=<?php p(join(',', $_['enabledThemes'])) ?>>
 	<?php include 'layout.noscript.warning.php'; ?>
 
 		<?php foreach ($_['initialStates'] as $app => $initialState) { ?>
 			<input type="hidden" id="initial-state-<?php p($app); ?>" value="<?php p(base64_encode($initialState)); ?>">
 		<?php }?>
 
-		<a href="#app-content" class="button primary skip-navigation skip-content"><?php p($l->t('Skip to main content')); ?></a>
-		<a href="#app-navigation" class="button primary skip-navigation"><?php p($l->t('Skip to navigation of app')); ?></a>
-
-		<div id="notification-container">
-			<div id="notification"></div>
+		<div id="skip-actions">
+			<?php if ($_['id-app-content'] !== null) { ?><a href="<?php p($_['id-app-content']); ?>" class="button primary skip-navigation skip-content"><?php p($l->t('Skip to main content')); ?></a><?php } ?>
+			<?php if ($_['id-app-navigation'] !== null) { ?><a href="<?php p($_['id-app-navigation']); ?>" class="button primary skip-navigation"><?php p($l->t('Skip to navigation of app')); ?></a><?php } ?>
 		</div>
+
 		<header role="banner" id="header">
-            
-			<div id="navbar-logo" class="header-left">
-				<a href="<?php print_unescaped(link_to('', 'index.php')); ?>"
+			<div class="header-left" id="navbar-logo">
+				<a href="<?php print_unescaped($_['logoUrl'] ?: link_to('', 'index.php')); ?>"
 					id="nextcloud">
 					<img src="<?php p($api_url) ?>/img/logo.png" alt="" style="height: 39px;">
 				</a>
+
+				<!--<nav id="header-left__appmenu"></nav>-->
 			</div>
 
-			<div id="navbar-nextcloud" class="header-right">      
-
-				<div id="notifications"></div>
+			<div class="header-right" id="navbar-nextcloud">
 				<div id="unified-search"></div>
+				<div id="notifications"></div>
 				<div id="contactsmenu">
-					<div class="icon-contacts menutoggle" tabindex="0" role="button"
+					<div class="menutoggle" tabindex="0" role="button"
 					aria-haspopup="true" aria-controls="contactsmenu-menu" aria-expanded="false">
 						<span class="hidden-visually"><?php p($l->t('Contacts'));?></span>
 					</div>
@@ -105,27 +112,34 @@
 				</div>
 				<div id="settings">
 					<div id="expand" tabindex="0" role="button" class="menutoggle"
-						aria-label="<?php p($l->t('Settings'));?>"
+						aria-label="<?php p($l->t('Open settings menu'));?>"
 						aria-haspopup="true" aria-controls="expanddiv" aria-expanded="false">
-						<div class="avatardiv<?php if ($_['userAvatarSet']) {
+						<div id="avatardiv-menu" class="avatardiv<?php if ($_['userAvatarSet']) {
 				print_unescaped(' avatardiv-shown');
 			} else {
 				print_unescaped('" style="display: none');
-			} ?>">
-							<?php if ($_['userAvatarSet']): ?>
+			} ?>"
+							 data-user="<?php p($_['user_uid']); ?>"
+							 data-displayname="<?php p($_['user_displayname']); ?>"
+			<?php
+			if ($_['userAvatarSet']) {
+				$avatar32 = $getUserAvatar(32); ?> data-avatar="<?php p($avatar32); ?>"
+			<?php
+			} ?>>
+							<?php
+							if ($_['userAvatarSet']) {?>
 								<img alt="" width="32" height="32"
-								src="<?php p($avatar_url)?>"
+								src="<?php p($avatar32);?>"
+								srcset="<?php p($getUserAvatar(64));?> 2x, <?php p($getUserAvatar(128));?> 4x"
 								>
-							<?php endif; ?>
+							<?php } ?>
 						</div>
-						<div id="expandDisplayName" class="icon-settings-white"></div>
 					</div>
-					<nav class="settings-menu" id="expanddiv" style="display:none;"
-						aria-label="<?php p($l->t('Settings menu'));?>">
+					<nav class="settings-menu" id="expanddiv" style="display:none;">
 					<ul>
 					<?php foreach ($_['settingsnavigation'] as $entry):?>
 						<li data-id="<?php p($entry['id']); ?>">
-							<a href="<?php print_unescaped($entry['href']); ?>"
+							<a href="<?php print_unescaped($entry['href'] !== '' ? $entry['href'] : '#'); ?>"
 								<?php if ($entry["active"]): ?> class="active"<?php endif; ?>>
 								<img alt="" src="<?php print_unescaped($entry['icon'] . '?v=' . $_['versionHash']); ?>">
 								<?php p($entry['name']) ?>
@@ -153,9 +167,12 @@
 			<input class="confirm" value="<?php p($l->t('Confirm')); ?>" type="submit">
 		</form>
 
-		<div id="content" class="app-<?php p($_['appid']) ?>" role="main">
+		<main id="content" class="app-<?php p($_['appid']) ?>">
+			<h1 class="hidden-visually">
+				<?php p($l->t('%s\'s homepage', [$theme->getName()])); ?>
+			</h1>
 			<?php print_unescaped($_['content']); ?>
-		</div>
-
+		</main>
+		<div id="profiler-toolbar"></div>
 	</body>
 </html>
diff --git a/dd-sso/admin/src/admin/static/templates/base.html b/dd-sso/admin/src/admin/static/templates/base.html
index cecd08c..6f40a6d 100644
--- a/dd-sso/admin/src/admin/static/templates/base.html
+++ b/dd-sso/admin/src/admin/static/templates/base.html
@@ -52,7 +52,7 @@
     <!-- Custom Theme Style -->
     <link href="/build/css/custom.css" rel="stylesheet">
     <!-- Isard Style Sheet-->
-    <link href="/static/dd.css" rel="stylesheet">
+    <link href="/static/dd.css?2303" rel="stylesheet">
   </head>
 
   <body class="nav-md">
diff --git a/dd-sso/admin/src/admin/static/templates/login.html b/dd-sso/admin/src/admin/static/templates/login.html
index 5460f46..4b58b2a 100644
--- a/dd-sso/admin/src/admin/static/templates/login.html
+++ b/dd-sso/admin/src/admin/static/templates/login.html
@@ -41,7 +41,7 @@
     <!-- Custom Theme Style -->
     <link href="/build/css/custom.min.css" rel="stylesheet">
     <!-- Isard Style Sheet-->
-    <link href="/static/dd.css" rel="stylesheet">
+    <link href="/static/dd.css?2303" rel="stylesheet">
   </head>
     
   <body class="login">
diff --git a/dd-sso/docker/api/src/api/static/_templates/dd.css b/dd-sso/docker/api/src/api/static/_templates/dd.css
index d474494..4cc547d 100644
--- a/dd-sso/docker/api/src/api/static/_templates/dd.css
+++ b/dd-sso/docker/api/src/api/static/_templates/dd.css
@@ -67,12 +67,6 @@
     margin-right: 16px;
 }
 
-#navbar-nextcloud #unified-search svg {
-    fill: black;
-    width: 16px;
-    height: 16px;
-}
-
 #navbar-nextcloud #unified-search a.header-menu__trigger .magnify-icon {
     width: 16px;
     height: 16px;
@@ -178,6 +172,8 @@
 #header div#navbar-menu-apps {
     display: flex;
     align-items: center;
+    width: 50px;
+    margin-right: 10px;
 }
 
 #header #navbar-menu-apps #menu-apps-btn {
@@ -187,7 +183,7 @@
     border-radius: 5px;
     background-color: #f0f0f0;
     position: relative;
-    left: -15px;
+    margin: auto;
     top: 1px;
     display: flex;
     align-items: center;
diff --git a/dd.conf.sample b/dd.conf.sample
index c2f71ba..25e8056 100644
--- a/dd.conf.sample
+++ b/dd.conf.sample
@@ -169,7 +169,7 @@ MOODLE_MEMORY_LIMIT=128M
 ## NEXTCLOUD
 # If enabled overrides nextcloud.yaml default image.
 # You usually do not want to change this, but instead rely on DD's version.
-#NEXTCLOUD_IMG_OVERRIDE=nextcloud:24.0.10-fpm-alpine
+#NEXTCLOUD_IMG_OVERRIDE=nextcloud:25.0.4-fpm-alpine
 
 ## ONLYOFFICE
 ONLYOFFICE_IMG=alehoho/oo-ce-docker-license:6.3.1.32

From 2f7cde952abff9e659aa22590ba6f9931e20853e Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Tue, 14 Mar 2023 10:32:16 +0100
Subject: [PATCH 08/18] [NC] Disable ownpad app as requested by schools

---
 dd-apps/docker/nextcloud/nc-setup.sh | 23 ++---------------------
 1 file changed, 2 insertions(+), 21 deletions(-)

diff --git a/dd-apps/docker/nextcloud/nc-setup.sh b/dd-apps/docker/nextcloud/nc-setup.sh
index 7ea1356..e5674de 100755
--- a/dd-apps/docker/nextcloud/nc-setup.sh
+++ b/dd-apps/docker/nextcloud/nc-setup.sh
@@ -59,8 +59,8 @@ occupgrade
 # These cannot be edited from outside of the DD project
 # Operators should instead rely on the environment variables to ease deployment
 # EXTRA_PLUGINS_ENABLE and EXTRA_PLUGINS_DISABLE
-CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,ownpad,onlyoffice"
-CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles"
+CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,onlyoffice"
+CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles,ownpad"
 
 if [ "${DISABLE_CLAMAV:-true}" = "false" ]; then
 	CORE_PLUGINS_ENABLE="${CORE_PLUGINS_ENABLE},files_antivirus"
@@ -173,27 +173,8 @@ sed -i.orig \
 	-e 's/\(^\s*"Let.s go!" : [^¡]*\)¡\?\([^!]*\)!\(.*\)$/\1\2\3/' \
 	/var/www/html/custom_apps/bbb/l10n/*.json
 
-# Patches / fixes for Ownpad
-## Fix mimetypemapping for ownpad
-MIMETYPEMAPPINGJSON="/var/www/html/config/mimetypemapping.json"
-if ! grep -q "application/x-ownpad" "${MIMETYPEMAPPINGJSON}"; then
-	jq '. + {"pad": ["application/x-ownpad"], "calc": ["application/x-ownpad"]}' \
-		/var/www/html/resources/config/mimetypemapping.dist.json > "${MIMETYPEMAPPINGJSON}"
-	# We have to tell NC about this change as documented here:
-	# https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html#maintenance-commands
-	./occ maintenance:mimetype:update-db
-fi
-## Open pads on new tab/window
-OWNPADJS="/var/www/html/custom_apps/ownpad/js/ownpad.js"
-if ! grep -q viewerDD "${OWNPADJS}"; then
-	## TODO: Upstream this as a toggeable setting
-	sed -i.orig 's/^\(\s*\)var viewer = \(OC.generateUrl.*\)/\1var viewerDD = \2; window.open(viewerDD); return;/' "${OWNPADJS}"
-fi
-
 # Settings
 echo "--> Applying custom settings"
-./occ --no-warnings config:app:set -n ownpad ownpad_etherpad_enable --value="yes"
-./occ --no-warnings config:app:set -n ownpad ownpad_etherpad_host --value="https://pad.$DOMAIN"
 
 ./occ --no-warnings config:app:set -n onlyoffice DocumentServerUrl --value="https://oof.$DOMAIN"
 ./occ --no-warnings config:app:set -n onlyoffice jwt_secret --value="secret"

From b7400afc7b4afc18dda2277164fa7ae86e84bafb Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Tue, 14 Mar 2023 10:42:31 +0100
Subject: [PATCH 09/18] [NC] Enable video previews as requested by schools

---
 dd-apps/docker/nextcloud/nc-setup.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/dd-apps/docker/nextcloud/nc-setup.sh b/dd-apps/docker/nextcloud/nc-setup.sh
index e5674de..b7095ae 100755
--- a/dd-apps/docker/nextcloud/nc-setup.sh
+++ b/dd-apps/docker/nextcloud/nc-setup.sh
@@ -51,6 +51,20 @@ cat > "${STATIC_CFG}" <<EOF
   'skeletondirectory' => '',
   'theme' => 'dd',
   'allow_local_remote_servers' => true,
+  'enabledPreviewProviders' => [
+    'OC\\Preview\\PNG',
+    'OC\\Preview\\JPEG',
+    'OC\\Preview\\GIF',
+    'OC\\Preview\\BMP',
+    'OC\\Preview\\XBitmap',
+    'OC\\Preview\\MP3',
+    'OC\\Preview\\TXT',
+    'OC\\Preview\\MarkDown',
+    'OC\\Preview\\OpenDocument',
+    'OC\\Preview\\Krita',
+    'OC\\Preview\\Movie',
+    'OC\\Preview\\MP4',
+  ],
 );
 EOF
 

From 4a785009c556a426f0fcbd7d41d79d9a5b5c0c6e Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Tue, 14 Mar 2023 10:56:51 +0100
Subject: [PATCH 10/18] [docs] UPDATING: document upgrade to NC 25.0.4

Along with the newly supported dd.conf variables and the docker image
rework.
---
 UPDATING.md | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/UPDATING.md b/UPDATING.md
index 93511ee..9dbe57d 100644
--- a/UPDATING.md
+++ b/UPDATING.md
@@ -24,6 +24,40 @@ little to no impact.
 
 ## 2023
 
+### 2023-03 - Nextcloud 25.0.4 + NC Docker rework
+
+Update version to 25.0.4 and rework its docker image.
+
+The image now manages volumes and configuration in a better fashion,
+thanks to that we achieve an image that is closer to the original one, but
+gets the plugins that we want and the configuration that we want for
+integration with DD.
+
+You can now define `BBB_HOST` and `BBB_API_SECRET` as variables in dd.conf,
+which are used to configure the corresponding plugin on Nextcloud.
+
+You can also define a list of custom plugins to enable/disable in Nextcloud
+with the dd.conf variables: `NEXTCLOUD_PLUGINS_ENABLE`,
+`NEXTCLOUD_PLUGINS_DISABLE`. See `dd.conf.sample` for more information.
+
+If upgrading from previous versions, you probably will want to check the
+permissions assigned to the `user_saml` plugin directory.
+You can also force its reinstallation with proper permissions with:
+
+    # Usually SRC_FOLDER in dd.conf is /opt/DD/src
+    rm -rf "${SRC_FOLDER:-/opt/DD/src}/nextcloud/custom_apps/user_saml/"
+    # Restart the NC container (only if previous command runs after upgrade)
+    # docker-compose restart dd-apps-nextcloud-app
+
+
+Upgrade from a commit that includes Nextcloud major version 24 (see previous
+UPGRADE messages) with:
+
+    # Upgrade to NC version 24.0.10 (latest 24 minor on 2023-03-14)
+    ./dd-ctl update a27f44262b9e4d37b21265a20575e8aa2dd78cb0
+    # Upgrade to NC version 25.0.4  (latest 25 minor on 2023-03-14)
+    ./dd-ctl update 7e2c748f51674968719f5abbf442477678d614c7
+
 ### 2023-02 - Nextcloud 24.0.10
 
 Update version to 24.0.10

From d90b432e06bd7daa1b2122691323a32a29f0d0f3 Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Fri, 31 Mar 2023 10:16:22 +0200
Subject: [PATCH 11/18] [stress-tests] Adapt for NC 25

This still supports NC24

While there, configure JMeter to restart threads instead of stopping them.

This keeps the load on the target server.
---
 stress-tests/dd-stress-test.tpl.jmx |  8 ++++----
 stress-tests/dd-tests-selenium.py   | 12 ++++++++----
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/stress-tests/dd-stress-test.tpl.jmx b/stress-tests/dd-stress-test.tpl.jmx
index 060d0d8..b05b8b8 100644
--- a/stress-tests/dd-stress-test.tpl.jmx
+++ b/stress-tests/dd-stress-test.tpl.jmx
@@ -139,7 +139,7 @@
       </ConfigTestElement>
       <hashTree/>
       <ThreadGroup guiclass="ThreadGroupGui" testclass="ThreadGroup" testname="SAML Login Method" enabled="true">
-        <stringProp name="ThreadGroup.on_sample_error">stopthread</stringProp>
+        <stringProp name="ThreadGroup.on_sample_error">startnextloop</stringProp>
         <elementProp name="ThreadGroup.main_controller" elementType="LoopController" guiclass="LoopControlPanel" testclass="LoopController" testname="Loop Controller" enabled="true">
           <boolProp name="LoopController.continue_forever">false</boolProp>
           <intProp name="LoopController.loops">-1</intProp>
@@ -192,8 +192,8 @@
           <stringProp name="TestPlan.comments">Send response from login to SP for processing</stringProp>
         </ModuleController>
         <hashTree/>
-        <ResultCollector guiclass="SummaryReport" testclass="ResultCollector" testname="Summary Report 20 users" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
+        <ResultCollector guiclass="SummaryReport" testclass="ResultCollector" testname="Summary Report N users" enabled="true">
+          <boolProp name="ResultCollector.error_logging">true</boolProp>
           <objProp>
             <name>saveConfig</name>
             <value class="SampleSaveConfiguration">
@@ -230,7 +230,7 @@
         </ResultCollector>
         <hashTree/>
         <ResultCollector guiclass="RespTimeGraphVisualizer" testclass="ResultCollector" testname="Response Time Graph" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
+          <boolProp name="ResultCollector.error_logging">true</boolProp>
           <objProp>
             <name>saveConfig</name>
             <value class="SampleSaveConfiguration">
diff --git a/stress-tests/dd-tests-selenium.py b/stress-tests/dd-tests-selenium.py
index 2dc94af..2c57501 100644
--- a/stress-tests/dd-tests-selenium.py
+++ b/stress-tests/dd-tests-selenium.py
@@ -20,6 +20,9 @@ from selenium.webdriver.chrome.options import Options as ChromeOptions
 from typing import Any, Dict, Iterable, List
 
 
+STEP_TIMEOUT_SECONDS = 40
+
+
 class DDSession:
     driver: webdriver.Chrome
 
@@ -28,7 +31,7 @@ class DDSession:
         instance: str,
         users_file: str,
         out_dir: pathlib.Path,
-        stepTimeoutSeconds: int = 20,
+        stepTimeoutSeconds: int = STEP_TIMEOUT_SECONDS,
     ):
         self.instance = instance
         self.users_file = [
@@ -177,6 +180,7 @@ class DDSession:
             lambda d: (
                 d.find_elements(By.ID, "kc-form-login")
                 + d.find_elements(By.ID, "menu-apps-icon")
+                + d.find_elements(By.ID, "menu-apps-btn")
             )
         )
 
@@ -213,7 +217,7 @@ class DDSession:
         self.screenshot("OnlyOffice", "Opening")
 
         # Wait for OnlyOffice to start loading
-        oofCSS = "div.app-onlyoffice #app iframe"
+        oofCSS = ".app-onlyoffice #app iframe"
         WebDriverWait(self.driver, timeout=self.stepTimeoutSeconds).until(
             lambda d: d.find_elements(By.CSS_SELECTOR, oofCSS)
         )
@@ -292,13 +296,13 @@ def main_test(
     users_file: io.TextIOWrapper,
     out_dir: pathlib.Path,
     duration: int,
-    stepTimeoutSeconds: int = 20,
+    stepTimeoutSeconds: int = STEP_TIMEOUT_SECONDS,
 ) -> DDSession:
     session = DDSession(
         instance=instance,
         users_file=users_file.read(),
         out_dir=out_dir,
-        stepTimeoutSeconds=20,
+        stepTimeoutSeconds=stepTimeoutSeconds,
     )
 
     first_run = True

From e401b47c84be5c71b102a02f3d9d505bc6b1106b Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Wed, 11 Jan 2023 18:19:09 +0100
Subject: [PATCH 12/18] cherry-pick 010a04bf conflicts solved

---
 dd-apps/docker/nextcloud/Dockerfile  |   6 +-
 dd-apps/docker/nextcloud/dd-patch    |   5 +-
 dd-apps/docker/nextcloud/nc-setup.sh | 100 +++++++++++++++------------
 3 files changed, 63 insertions(+), 48 deletions(-)

diff --git a/dd-apps/docker/nextcloud/Dockerfile b/dd-apps/docker/nextcloud/Dockerfile
index 6ade834..dfdea19 100644
--- a/dd-apps/docker/nextcloud/Dockerfile
+++ b/dd-apps/docker/nextcloud/Dockerfile
@@ -82,9 +82,11 @@ COPY saml.sh /
 COPY template.docx /
 
 ## Save current forms plugin hash
-RUN sh -c 'curl -sL https://api.github.com/repos/3iPunt/nextcloud_forms/commits/STABLE_25 | jq  -r .sha > /forms.hash'
+#RUN sh -c 'curl -sL https://api.github.com/repos/3iPunt/nextcloud_forms/commits/STABLE_25 | jq  -r .sha > /forms.hash'
 ## And current forms code
-RUN sh -c 'curl -sL "https://github.com/3iPunt/nextcloud_forms/archive/$(cat /forms.hash).zip" > /forms.zip'
+#RUN sh -c 'curl -sL "https://github.com/3iPunt/nextcloud_forms/archive/$(cat /forms.hash).zip" > /forms.zip'
+# Mail app patches. To remove in NC 25
+COPY nc_mail/ /nc_mail/
 
 # Setup cron as documented in:
 # https://github.com/nextcloud/docker/blob/master/.examples/dockerfiles/cron/fpm-alpine/Dockerfile
diff --git a/dd-apps/docker/nextcloud/dd-patch b/dd-apps/docker/nextcloud/dd-patch
index fb3241e..72f2848 100644
--- a/dd-apps/docker/nextcloud/dd-patch
+++ b/dd-apps/docker/nextcloud/dd-patch
@@ -2,4 +2,7 @@
 # file	license	author	source
 nginx.conf	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/docker/04ab3157e4f1197a9f8f4b91cf2430586356dd9a/.examples/docker-compose/with-nginx-proxy/postgres/fpm/web/nginx.conf
 supervisord.conf	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/docker/04ab3157e4f1197a9f8f4b91cf2430586356dd9a/.examples/dockerfiles/cron/fpm-alpine/supervisord.conf
-src/themes/dd/core/templates/layout.user.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/server/v25.0.4/core/templates/layout.user.php
+nc_mail/appinfo/info.xml	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/v1.15.2/appinfo/info.xml
+nc_mail/lib/Command/UpdateAccount.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/1e777a1783254bd4b7f69f39a6c5123323f8b701/lib/Command/UpdateAccount.php
+nc_mail/lib/Db/MailAccountMapper.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/1e777a1783254bd4b7f69f39a6c5123323f8b701/lib/Db/MailAccountMapper.php
+src/themes/dd/core/templates/layout.user.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/server/v21.0.9/core/templates/layout.user.php
diff --git a/dd-apps/docker/nextcloud/nc-setup.sh b/dd-apps/docker/nextcloud/nc-setup.sh
index b7095ae..fa5c00c 100755
--- a/dd-apps/docker/nextcloud/nc-setup.sh
+++ b/dd-apps/docker/nextcloud/nc-setup.sh
@@ -20,10 +20,7 @@ plugin_status() {
 		printf "%s\t%s" "enabled" "${version}"
 	else
 		version="$(echo "${plugins_state}" | jq -r ".disabled.${plugin}")"
-		is_available="$(echo "${plugins_state}" | jq -r \
-			--arg plugin "${plugin}" \
-			'.disabled | to_entries[] | select(.key == $plugin) | .key')"
-		if [ "${is_available}" = "${plugin}" ]; then
+		if [ "${version}" != "null" ]; then
 			printf "%s\t%s" "disabled" "${version}"
 		else
 			printf "%s\t%s" "n/a" "n/a"
@@ -51,20 +48,6 @@ cat > "${STATIC_CFG}" <<EOF
   'skeletondirectory' => '',
   'theme' => 'dd',
   'allow_local_remote_servers' => true,
-  'enabledPreviewProviders' => [
-    'OC\\Preview\\PNG',
-    'OC\\Preview\\JPEG',
-    'OC\\Preview\\GIF',
-    'OC\\Preview\\BMP',
-    'OC\\Preview\\XBitmap',
-    'OC\\Preview\\MP3',
-    'OC\\Preview\\TXT',
-    'OC\\Preview\\MarkDown',
-    'OC\\Preview\\OpenDocument',
-    'OC\\Preview\\Krita',
-    'OC\\Preview\\Movie',
-    'OC\\Preview\\MP4',
-  ],
 );
 EOF
 
@@ -73,8 +56,8 @@ occupgrade
 # These cannot be edited from outside of the DD project
 # Operators should instead rely on the environment variables to ease deployment
 # EXTRA_PLUGINS_ENABLE and EXTRA_PLUGINS_DISABLE
-CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,onlyoffice"
-CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles,ownpad"
+CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,ownpad,onlyoffice"
+CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles,forms"
 
 if [ "${DISABLE_CLAMAV:-true}" = "false" ]; then
 	CORE_PLUGINS_ENABLE="${CORE_PLUGINS_ENABLE},files_antivirus"
@@ -89,7 +72,7 @@ PLUGINS="${CORE_PLUGINS_ENABLE},${CORE_PLUGINS_DISABLE},${EXTRA_PLUGINS_ENABLE:-
 # Install all plugins
 # shellcheck disable=SC2086  # We do want multiple arguments
 for plugin in $(echo "${PLUGINS}" | tr ',' '\n'); do
-	if plugin_status "${plugin}" | grep -qE "^n/a"; then
+	if plugin_status "${plugin}" | grep -q "n/a"; then
 		echo "--> Installing ${plugin}"
 		./occ --no-warnings app:install "${plugin}"
 	fi
@@ -134,32 +117,40 @@ done
 
 occupgrade
 
+# Temporary patch while upstream lands our changes
+# See: https://github.com/nextcloud/mail/pull/6908
+for f in appinfo/info.xml lib/Command/UpdateAccount.php lib/Db/MailAccountMapper.php; do
+	install -m 0644 -o www-data -g www-data "/nc_mail/$f" "/var/www/html/custom_apps/mail/$f"
+done
+
+occupgrade
 
 ## Forms
-## This should be upstreamed, see:
-##    https://github.com/juanan3ip/form/issues/76
-## This is what is being used: https://github.com/3iPunt/nextcloud_forms
-FORMS_EXPECTED_HASH="$(cat /forms.hash)"
-FORMS_DIR="/var/www/html/custom_apps/forms"
-FORMS_HASH=""
-if [ -f "${FORMS_DIR}.hash" ]; then
-	FORMS_HASH="$(cat "${FORMS_DIR}.hash")"
-fi
-if [ "${FORMS_EXPECTED_HASH}" != "${FORMS_HASH}" ]; then
-	# Remove old plugin
-	rm -rf "${FORMS_DIR}"
-	# Install new one
-	unzip -o /forms.zip -d /tmp
-	mv "/tmp/nextcloud_forms-${FORMS_EXPECTED_HASH}" "${FORMS_DIR}"
-	# Perform config / install
-	npm --prefix "${FORMS_DIR}" install
-	composer --ignore-platform-req=ext-dom -d"${FORMS_DIR}" install --no-dev -o
-	# Place hash marker
-	cp /forms.hash "${FORMS_DIR}.hash"
-fi
-if plugin_status "${plugin}" | grep -qE "^disabled"; then
-	./occ app:enable forms
-fi
+# TODO: This is broken in NC 24 due to:
+#   https://github.com/nextcloud/forms/pull/1149/files
+## TODO: request explanations and reduce upstream diff
+## This is what is being used: https://github.com/juanan3ip/form
+#FORMS_EXPECTED_HASH="$(cat /forms.hash)"
+#FORMS_DIR="/var/www/html/custom_apps/forms"
+#FORMS_HASH=""
+#if [ -f "${FORMS_DIR}.hash" ]; then
+#	FORMS_HASH="$(cat "${FORMS_DIR}.hash")"
+#fi
+#if [ "${FORMS_EXPECTED_HASH}" != "${FORMS_HASH}" ]; then
+#	# Remove old plugin
+#	rm -rf "${FORMS_DIR}"
+#	# Install new one
+#	unzip -o /forms.zip -d /tmp
+#	mv "/tmp/form-${FORMS_EXPECTED_HASH}" "${FORMS_DIR}"
+#	# Perform config / install
+#	npm --prefix "${FORMS_DIR}" install
+#	composer --ignore-platform-req=ext-dom -d"${FORMS_DIR}" install --no-dev -o
+#	# Place hash marker
+#	cp /forms.hash "${FORMS_DIR}.hash"
+#fi
+#if plugin_status "${plugin}" | grep -qE "^disabled"; then
+#	./occ app:enable forms
+#fi
 #
 #occupgrade
 
@@ -187,8 +178,27 @@ sed -i.orig \
 	-e 's/\(^\s*"Let.s go!" : [^¡]*\)¡\?\([^!]*\)!\(.*\)$/\1\2\3/' \
 	/var/www/html/custom_apps/bbb/l10n/*.json
 
+# Patches / fixes for Ownpad
+## Fix mimetypemapping for ownpad
+MIMETYPEMAPPINGJSON="/var/www/html/config/mimetypemapping.json"
+if ! grep -q "application/x-ownpad" "${MIMETYPEMAPPINGJSON}"; then
+	jq '. + {"pad": ["application/x-ownpad"], "calc": ["application/x-ownpad"]}' \
+		/var/www/html/resources/config/mimetypemapping.dist.json > "${MIMETYPEMAPPINGJSON}"
+	# We have to tell NC about this change as documented here:
+	# https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html#maintenance-commands
+	./occ maintenance:mimetype:update-db
+fi
+## Open pads on new tab/window
+OWNPADJS="/var/www/html/custom_apps/ownpad/js/ownpad.js"
+if ! grep -q viewerDD "${OWNPADJS}"; then
+	## TODO: Upstream this as a toggeable setting
+	sed -i.orig 's/^\(\s*\)var viewer = \(OC.generateUrl.*\)/\1var viewerDD = \2; window.open(viewerDD); return;/' "${OWNPADJS}"
+fi
+
 # Settings
 echo "--> Applying custom settings"
+./occ --no-warnings config:app:set -n ownpad ownpad_etherpad_enable --value="yes"
+./occ --no-warnings config:app:set -n ownpad ownpad_etherpad_host --value="https://pad.$DOMAIN"
 
 ./occ --no-warnings config:app:set -n onlyoffice DocumentServerUrl --value="https://oof.$DOMAIN"
 ./occ --no-warnings config:app:set -n onlyoffice jwt_secret --value="secret"

From 7c8390370badfcc05dd4193ae3ffc905e6242abd Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Mon, 27 Feb 2023 19:38:41 +0100
Subject: [PATCH 13/18] cherry-pick 7196db9c conflicts solved

---
 dd-apps/docker/nextcloud/Dockerfile    |  6 +--
 dd-apps/docker/nextcloud/dd-patch      |  5 +-
 dd-apps/docker/nextcloud/nc-setup.sh   | 65 ++++++++++++--------------
 dd-apps/docker/nextcloud/nextcloud.yml |  2 +-
 dd.conf.sample                         |  2 +-
 5 files changed, 35 insertions(+), 45 deletions(-)

diff --git a/dd-apps/docker/nextcloud/Dockerfile b/dd-apps/docker/nextcloud/Dockerfile
index dfdea19..6ade834 100644
--- a/dd-apps/docker/nextcloud/Dockerfile
+++ b/dd-apps/docker/nextcloud/Dockerfile
@@ -82,11 +82,9 @@ COPY saml.sh /
 COPY template.docx /
 
 ## Save current forms plugin hash
-#RUN sh -c 'curl -sL https://api.github.com/repos/3iPunt/nextcloud_forms/commits/STABLE_25 | jq  -r .sha > /forms.hash'
+RUN sh -c 'curl -sL https://api.github.com/repos/3iPunt/nextcloud_forms/commits/STABLE_25 | jq  -r .sha > /forms.hash'
 ## And current forms code
-#RUN sh -c 'curl -sL "https://github.com/3iPunt/nextcloud_forms/archive/$(cat /forms.hash).zip" > /forms.zip'
-# Mail app patches. To remove in NC 25
-COPY nc_mail/ /nc_mail/
+RUN sh -c 'curl -sL "https://github.com/3iPunt/nextcloud_forms/archive/$(cat /forms.hash).zip" > /forms.zip'
 
 # Setup cron as documented in:
 # https://github.com/nextcloud/docker/blob/master/.examples/dockerfiles/cron/fpm-alpine/Dockerfile
diff --git a/dd-apps/docker/nextcloud/dd-patch b/dd-apps/docker/nextcloud/dd-patch
index 72f2848..b0018a7 100644
--- a/dd-apps/docker/nextcloud/dd-patch
+++ b/dd-apps/docker/nextcloud/dd-patch
@@ -2,7 +2,4 @@
 # file	license	author	source
 nginx.conf	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/docker/04ab3157e4f1197a9f8f4b91cf2430586356dd9a/.examples/docker-compose/with-nginx-proxy/postgres/fpm/web/nginx.conf
 supervisord.conf	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/docker/04ab3157e4f1197a9f8f4b91cf2430586356dd9a/.examples/dockerfiles/cron/fpm-alpine/supervisord.conf
-nc_mail/appinfo/info.xml	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/v1.15.2/appinfo/info.xml
-nc_mail/lib/Command/UpdateAccount.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/1e777a1783254bd4b7f69f39a6c5123323f8b701/lib/Command/UpdateAccount.php
-nc_mail/lib/Db/MailAccountMapper.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/mail/1e777a1783254bd4b7f69f39a6c5123323f8b701/lib/Db/MailAccountMapper.php
-src/themes/dd/core/templates/layout.user.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/server/v21.0.9/core/templates/layout.user.php
+src/themes/dd/core/templates/layout.user.php	AGPL-3.0-or-later	https://github.com/nextcloud/	https://raw.githubusercontent.com/nextcloud/server/v25.0.5/core/templates/layout.user.php
diff --git a/dd-apps/docker/nextcloud/nc-setup.sh b/dd-apps/docker/nextcloud/nc-setup.sh
index fa5c00c..7ea1356 100755
--- a/dd-apps/docker/nextcloud/nc-setup.sh
+++ b/dd-apps/docker/nextcloud/nc-setup.sh
@@ -20,7 +20,10 @@ plugin_status() {
 		printf "%s\t%s" "enabled" "${version}"
 	else
 		version="$(echo "${plugins_state}" | jq -r ".disabled.${plugin}")"
-		if [ "${version}" != "null" ]; then
+		is_available="$(echo "${plugins_state}" | jq -r \
+			--arg plugin "${plugin}" \
+			'.disabled | to_entries[] | select(.key == $plugin) | .key')"
+		if [ "${is_available}" = "${plugin}" ]; then
 			printf "%s\t%s" "disabled" "${version}"
 		else
 			printf "%s\t%s" "n/a" "n/a"
@@ -57,7 +60,7 @@ occupgrade
 # Operators should instead rely on the environment variables to ease deployment
 # EXTRA_PLUGINS_ENABLE and EXTRA_PLUGINS_DISABLE
 CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,ownpad,onlyoffice"
-CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles,forms"
+CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles"
 
 if [ "${DISABLE_CLAMAV:-true}" = "false" ]; then
 	CORE_PLUGINS_ENABLE="${CORE_PLUGINS_ENABLE},files_antivirus"
@@ -72,7 +75,7 @@ PLUGINS="${CORE_PLUGINS_ENABLE},${CORE_PLUGINS_DISABLE},${EXTRA_PLUGINS_ENABLE:-
 # Install all plugins
 # shellcheck disable=SC2086  # We do want multiple arguments
 for plugin in $(echo "${PLUGINS}" | tr ',' '\n'); do
-	if plugin_status "${plugin}" | grep -q "n/a"; then
+	if plugin_status "${plugin}" | grep -qE "^n/a"; then
 		echo "--> Installing ${plugin}"
 		./occ --no-warnings app:install "${plugin}"
 	fi
@@ -117,40 +120,32 @@ done
 
 occupgrade
 
-# Temporary patch while upstream lands our changes
-# See: https://github.com/nextcloud/mail/pull/6908
-for f in appinfo/info.xml lib/Command/UpdateAccount.php lib/Db/MailAccountMapper.php; do
-	install -m 0644 -o www-data -g www-data "/nc_mail/$f" "/var/www/html/custom_apps/mail/$f"
-done
-
-occupgrade
 
 ## Forms
-# TODO: This is broken in NC 24 due to:
-#   https://github.com/nextcloud/forms/pull/1149/files
-## TODO: request explanations and reduce upstream diff
-## This is what is being used: https://github.com/juanan3ip/form
-#FORMS_EXPECTED_HASH="$(cat /forms.hash)"
-#FORMS_DIR="/var/www/html/custom_apps/forms"
-#FORMS_HASH=""
-#if [ -f "${FORMS_DIR}.hash" ]; then
-#	FORMS_HASH="$(cat "${FORMS_DIR}.hash")"
-#fi
-#if [ "${FORMS_EXPECTED_HASH}" != "${FORMS_HASH}" ]; then
-#	# Remove old plugin
-#	rm -rf "${FORMS_DIR}"
-#	# Install new one
-#	unzip -o /forms.zip -d /tmp
-#	mv "/tmp/form-${FORMS_EXPECTED_HASH}" "${FORMS_DIR}"
-#	# Perform config / install
-#	npm --prefix "${FORMS_DIR}" install
-#	composer --ignore-platform-req=ext-dom -d"${FORMS_DIR}" install --no-dev -o
-#	# Place hash marker
-#	cp /forms.hash "${FORMS_DIR}.hash"
-#fi
-#if plugin_status "${plugin}" | grep -qE "^disabled"; then
-#	./occ app:enable forms
-#fi
+## This should be upstreamed, see:
+##    https://github.com/juanan3ip/form/issues/76
+## This is what is being used: https://github.com/3iPunt/nextcloud_forms
+FORMS_EXPECTED_HASH="$(cat /forms.hash)"
+FORMS_DIR="/var/www/html/custom_apps/forms"
+FORMS_HASH=""
+if [ -f "${FORMS_DIR}.hash" ]; then
+	FORMS_HASH="$(cat "${FORMS_DIR}.hash")"
+fi
+if [ "${FORMS_EXPECTED_HASH}" != "${FORMS_HASH}" ]; then
+	# Remove old plugin
+	rm -rf "${FORMS_DIR}"
+	# Install new one
+	unzip -o /forms.zip -d /tmp
+	mv "/tmp/nextcloud_forms-${FORMS_EXPECTED_HASH}" "${FORMS_DIR}"
+	# Perform config / install
+	npm --prefix "${FORMS_DIR}" install
+	composer --ignore-platform-req=ext-dom -d"${FORMS_DIR}" install --no-dev -o
+	# Place hash marker
+	cp /forms.hash "${FORMS_DIR}.hash"
+fi
+if plugin_status "${plugin}" | grep -qE "^disabled"; then
+	./occ app:enable forms
+fi
 #
 #occupgrade
 
diff --git a/dd-apps/docker/nextcloud/nextcloud.yml b/dd-apps/docker/nextcloud/nextcloud.yml
index 76b2374..e8d0acd 100644
--- a/dd-apps/docker/nextcloud/nextcloud.yml
+++ b/dd-apps/docker/nextcloud/nextcloud.yml
@@ -26,7 +26,7 @@ services:
       dockerfile: Dockerfile
       args:
         # Update dd.conf.sample when bumping this version in main
-        - IMG=${NEXTCLOUD_IMG_OVERRIDE-nextcloud:25.0.4-fpm-alpine}
+        - IMG=${NEXTCLOUD_IMG_OVERRIDE-nextcloud:25.0.5-fpm-alpine}
     container_name: dd-apps-nextcloud-app
     image: registry.dd-work.space/dd/apps-nextcloud:${DD_BUILD:-latest}
     restart: unless-stopped
diff --git a/dd.conf.sample b/dd.conf.sample
index 25e8056..5825151 100644
--- a/dd.conf.sample
+++ b/dd.conf.sample
@@ -169,7 +169,7 @@ MOODLE_MEMORY_LIMIT=128M
 ## NEXTCLOUD
 # If enabled overrides nextcloud.yaml default image.
 # You usually do not want to change this, but instead rely on DD's version.
-#NEXTCLOUD_IMG_OVERRIDE=nextcloud:25.0.4-fpm-alpine
+#NEXTCLOUD_IMG_OVERRIDE=nextcloud:25.0.5-fpm-alpine
 
 ## ONLYOFFICE
 ONLYOFFICE_IMG=alehoho/oo-ce-docker-license:6.3.1.32

From e16a537f53e0997df047c819276abf3cb984b7cd Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Tue, 14 Mar 2023 10:32:16 +0100
Subject: [PATCH 14/18] [NC] Disable ownpad app as requested by schools

---
 dd-apps/docker/nextcloud/nc-setup.sh | 23 ++---------------------
 1 file changed, 2 insertions(+), 21 deletions(-)

diff --git a/dd-apps/docker/nextcloud/nc-setup.sh b/dd-apps/docker/nextcloud/nc-setup.sh
index 7ea1356..e5674de 100755
--- a/dd-apps/docker/nextcloud/nc-setup.sh
+++ b/dd-apps/docker/nextcloud/nc-setup.sh
@@ -59,8 +59,8 @@ occupgrade
 # These cannot be edited from outside of the DD project
 # Operators should instead rely on the environment variables to ease deployment
 # EXTRA_PLUGINS_ENABLE and EXTRA_PLUGINS_DISABLE
-CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,ownpad,onlyoffice"
-CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles"
+CORE_PLUGINS_ENABLE="user_saml,bruteforcesettings,polls,calendar,spreed,bbb,mail,onlyoffice"
+CORE_PLUGINS_DISABLE="firstrunwizard,recommendations,dashboard,circles,ownpad"
 
 if [ "${DISABLE_CLAMAV:-true}" = "false" ]; then
 	CORE_PLUGINS_ENABLE="${CORE_PLUGINS_ENABLE},files_antivirus"
@@ -173,27 +173,8 @@ sed -i.orig \
 	-e 's/\(^\s*"Let.s go!" : [^¡]*\)¡\?\([^!]*\)!\(.*\)$/\1\2\3/' \
 	/var/www/html/custom_apps/bbb/l10n/*.json
 
-# Patches / fixes for Ownpad
-## Fix mimetypemapping for ownpad
-MIMETYPEMAPPINGJSON="/var/www/html/config/mimetypemapping.json"
-if ! grep -q "application/x-ownpad" "${MIMETYPEMAPPINGJSON}"; then
-	jq '. + {"pad": ["application/x-ownpad"], "calc": ["application/x-ownpad"]}' \
-		/var/www/html/resources/config/mimetypemapping.dist.json > "${MIMETYPEMAPPINGJSON}"
-	# We have to tell NC about this change as documented here:
-	# https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/occ_command.html#maintenance-commands
-	./occ maintenance:mimetype:update-db
-fi
-## Open pads on new tab/window
-OWNPADJS="/var/www/html/custom_apps/ownpad/js/ownpad.js"
-if ! grep -q viewerDD "${OWNPADJS}"; then
-	## TODO: Upstream this as a toggeable setting
-	sed -i.orig 's/^\(\s*\)var viewer = \(OC.generateUrl.*\)/\1var viewerDD = \2; window.open(viewerDD); return;/' "${OWNPADJS}"
-fi
-
 # Settings
 echo "--> Applying custom settings"
-./occ --no-warnings config:app:set -n ownpad ownpad_etherpad_enable --value="yes"
-./occ --no-warnings config:app:set -n ownpad ownpad_etherpad_host --value="https://pad.$DOMAIN"
 
 ./occ --no-warnings config:app:set -n onlyoffice DocumentServerUrl --value="https://oof.$DOMAIN"
 ./occ --no-warnings config:app:set -n onlyoffice jwt_secret --value="secret"

From ce61cfffbe9b0466ee6312ddd5199b7459da6d30 Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Tue, 14 Mar 2023 10:42:31 +0100
Subject: [PATCH 15/18] [NC] Enable video previews as requested by schools

---
 dd-apps/docker/nextcloud/nc-setup.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/dd-apps/docker/nextcloud/nc-setup.sh b/dd-apps/docker/nextcloud/nc-setup.sh
index e5674de..b7095ae 100755
--- a/dd-apps/docker/nextcloud/nc-setup.sh
+++ b/dd-apps/docker/nextcloud/nc-setup.sh
@@ -51,6 +51,20 @@ cat > "${STATIC_CFG}" <<EOF
   'skeletondirectory' => '',
   'theme' => 'dd',
   'allow_local_remote_servers' => true,
+  'enabledPreviewProviders' => [
+    'OC\\Preview\\PNG',
+    'OC\\Preview\\JPEG',
+    'OC\\Preview\\GIF',
+    'OC\\Preview\\BMP',
+    'OC\\Preview\\XBitmap',
+    'OC\\Preview\\MP3',
+    'OC\\Preview\\TXT',
+    'OC\\Preview\\MarkDown',
+    'OC\\Preview\\OpenDocument',
+    'OC\\Preview\\Krita',
+    'OC\\Preview\\Movie',
+    'OC\\Preview\\MP4',
+  ],
 );
 EOF
 

From ccf5f8b1de64fd6ca9010cb22f93f294c76592b1 Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Fri, 31 Mar 2023 10:38:02 +0200
Subject: [PATCH 16/18] [NC] Add FORCED_LANGUAGE setting

This has been requested by schools.
---
 dd-apps/docker/nextcloud/nc-setup.sh   | 3 ++-
 dd-apps/docker/nextcloud/nextcloud.yml | 1 +
 dd.conf.sample                         | 5 ++++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/dd-apps/docker/nextcloud/nc-setup.sh b/dd-apps/docker/nextcloud/nc-setup.sh
index b7095ae..5ab35eb 100755
--- a/dd-apps/docker/nextcloud/nc-setup.sh
+++ b/dd-apps/docker/nextcloud/nc-setup.sh
@@ -47,7 +47,8 @@ cat > "${STATIC_CFG}" <<EOF
 /** DD-customised static settings
   */
 \$CONFIG = array(
-  'default_language' => 'ca',
+  'default_language' => '${FORCED_LANGUAGE}',
+  'force_language' => '${FORCED_LANGUAGE}',
   'skeletondirectory' => '',
   'theme' => 'dd',
   'allow_local_remote_servers' => true,
diff --git a/dd-apps/docker/nextcloud/nextcloud.yml b/dd-apps/docker/nextcloud/nextcloud.yml
index e8d0acd..7c4e037 100644
--- a/dd-apps/docker/nextcloud/nextcloud.yml
+++ b/dd-apps/docker/nextcloud/nextcloud.yml
@@ -79,6 +79,7 @@ services:
       # Operator preferences
       - EXTRA_PLUGINS_ENABLE=${NEXTCLOUD_PLUGINS_ENABLE:-}
       - EXTRA_PLUGINS_DISABLE=${NEXTCLOUD_PLUGINS_DISABLE:-}
+      - FORCED_LANGUAGE=${FORCED_LANGUAGE:-ca}
     networks:
       - dd_net
 
diff --git a/dd.conf.sample b/dd.conf.sample
index 5825151..82d313b 100644
--- a/dd.conf.sample
+++ b/dd.conf.sample
@@ -122,7 +122,10 @@ NEXTCLOUD_POSTGRES_PASSWORD=N3xtcl0ud
 ### These should be available from https://apps.nextcloud.com/
 ### Example: NEXTCLOUD_PLUGINS_ENABLE=cospend,cookbook
 #NEXTCLOUD_PLUGINS_ENABLE=
-#NEXTCLOUD_PLUGINS_DISABLE
+#NEXTCLOUD_PLUGINS_DISABLE=
+#
+### This language will be forced (currently only Nextcloud)
+#FORCED_LANGUAGE=ca
 
 ## WORDPRESS
 ##=============================================================================

From edca0320247521ac2ea7a44a06a58a186fbd4305 Mon Sep 17 00:00:00 2001
From: Evilham <contact@evilham.com>
Date: Tue, 14 Mar 2023 10:56:51 +0100
Subject: [PATCH 17/18] cherry-pick b61286cf conflicts solved

---
 UPDATING.md | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/UPDATING.md b/UPDATING.md
index 9dbe57d..dc0a970 100644
--- a/UPDATING.md
+++ b/UPDATING.md
@@ -24,9 +24,9 @@ little to no impact.
 
 ## 2023
 
-### 2023-03 - Nextcloud 25.0.4 + NC Docker rework
+### 2023-03 - Nextcloud 25.0.5 + NC Docker rework
 
-Update version to 25.0.4 and rework its docker image.
+Update version to 25.0.5 and rework its docker image
 
 The image now manages volumes and configuration in a better fashion,
 thanks to that we achieve an image that is closer to the original one, but
@@ -54,9 +54,10 @@ Upgrade from a commit that includes Nextcloud major version 24 (see previous
 UPGRADE messages) with:
 
     # Upgrade to NC version 24.0.10 (latest 24 minor on 2023-03-14)
-    ./dd-ctl update a27f44262b9e4d37b21265a20575e8aa2dd78cb0
-    # Upgrade to NC version 25.0.4  (latest 25 minor on 2023-03-14)
-    ./dd-ctl update 7e2c748f51674968719f5abbf442477678d614c7
+    # Note this commit already includes the reworked image
+    ./dd-ctl update 010a04bf37d75b39cf24bcc2b80c81023e037f78
+    # Upgrade to NC version 25.0.5  (latest 25 minor on 2023-03-31)
+    ./dd-ctl update a4f51d102396ebc0883882dfbcebd9e08f60a7b8
 
 ### 2023-02 - Nextcloud 24.0.10
 

From bdffd5a73321e998d2515713840ae18f9148a268 Mon Sep 17 00:00:00 2001
From: elena <elena@tresipunt.com>
Date: Wed, 12 Apr 2023 10:24:00 +0000
Subject: [PATCH 18/18] NC 25 upgrading hashes changed because of the cherry
 picks made

---
 UPDATING.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/UPDATING.md b/UPDATING.md
index dc0a970..1db11bc 100644
--- a/UPDATING.md
+++ b/UPDATING.md
@@ -55,9 +55,9 @@ UPGRADE messages) with:
 
     # Upgrade to NC version 24.0.10 (latest 24 minor on 2023-03-14)
     # Note this commit already includes the reworked image
-    ./dd-ctl update 010a04bf37d75b39cf24bcc2b80c81023e037f78
+    ./dd-ctl update e401b47c84be5c71b102a02f3d9d505bc6b1106b
     # Upgrade to NC version 25.0.5  (latest 25 minor on 2023-03-31)
-    ./dd-ctl update a4f51d102396ebc0883882dfbcebd9e08f60a7b8
+    ./dd-ctl update ce61cfffbe9b0466ee6312ddd5199b7459da6d30
 
 ### 2023-02 - Nextcloud 24.0.10