Configure and use openDesk

openDesk is a configurable digital workplace deployed by AUTARQ: e-mail and calendar, files, video conferences, chat, notes, wiki and project management behind one portal and one login. Your organization gets its own openDesk instance with its own user directory. You decide which components it contains and how it is configured. AUTARQ deploys exactly that stack.

Before you start

You need an openDesk order and the organization Owner or Admin portal role to submit or change its configuration. Other organization members can view it. Have your desired components, domain choices, branding and an external recovery email for your administrator ready. Enterprise Edition also needs its applicable licences.

The openDesk user directory is separate from portal people and Chat access.

How it works

1. Order openDesk in Order services. The order enters PENDING.
2. Configure your stack. My Services lists openDesk with the status Configuration required and a Configure openDesk button. The same button appears in the pending-order notice and on the order page.
3. Submit the configuration. The service shows Awaiting approval while the internal team reviews the order. Until the deployment starts you can still open View or change configuration and submit again.
4. Approval and deployment. Whichever comes last, order approval or configuration submission, starts the deployment. The service shows Deploying and then Running.

Approval does not start a deployment before you have submitted the configuration.

Step 1: Components

Every category offers the upstream component, where available an alternative, or None.

Category	Options	Preselected
Groupware	OX App Suite (with Dovecot, Postfix), None	OX App Suite
Files	Nextcloud, None	Nextcloud
Meetings	Jitsi, None	Jitsi
Chat	Element (Matrix/Synapse), None	Element
Notes	Notes (La Suite Docs), None	None
Knowledge	XWiki, None	XWiki
Projects	OpenProject, None	OpenProject
Office	Collabora Online, Euro-Office, None	Collabora
AI assistant	F13, Autarq Chat, None	None
Mobile device management	Relution, None	None
Ticketing	Zammad, None	None

Alternatives marked Coming soon (SOGo, openCloud, BigBlueButton, Etherpad, BookStack, Planka) are shown for orientation and cannot be selected yet.

Each tile carries a maturity badge:

• openDesk: component of the upstream openDesk distribution.
• AUTARQ addon: operated and integrated by AUTARQ, production ready.
• Beta: AUTARQ addon without full openDesk single sign-on yet. F13 runs with its own login; Zammad has no single sign-on yet.
• AUTARQ service: AUTARQ’s central service, linked to your openDesk instead of installed into it (Autarq Chat).

Autarq Chat as AI assistant

Autarq Chat stays AUTARQ’s central service. It is not deployed into your openDesk; choosing it adds an Autarq Chat tile to your openDesk portal that opens Autarq Chat in a new tab.

• Your colleagues sign in with AUTARQ ID, not with the openDesk login.
• Everyone who uses Autarq Chat needs a seat in your Autarq Chat plan.
• If your organization already has Autarq Chat (an order that is still awaiting approval counts), it is linked: nothing is ordered. The tile says so.
• If it has none, submitting the configuration also orders Autarq Chat Starter (trial period) for your organization, with the same checks as in the product catalogue. AUTARQ approves that order like any other. You see a confirmation with the order number after submitting. Submitting again never orders a second Autarq Chat.
• If Autarq Chat cannot be ordered or is not available on the platform, the submit is rejected with a message and nothing is saved. Choose another option or contact support.
• Choosing another AI option, or none, removes the portal tile with the next update. An Autarq Chat order that already exists stays as it is; manage or cancel it under My Services.

After you submit, the service page of your openDesk shows the linked Autarq Chat: awaiting approval while the order is pending, then a link to its service page.

Extensions

Some categories carry an on/off extension:

• Diagrams (CryptPad) in Office, on by default.
• Whiteboard (NeoBoard) in Chat, off by default.
• AI minutes and transcription (Jitsi Skynet) in Meetings, off by default, Beta.

Rules

The configurator checks your selection while you click and names the problem:

• Office (Collabora or Euro-Office) and CryptPad need Files = Nextcloud, because the document integration lives in Nextcloud.
• NeoBoard needs Chat = Element. Skynet needs Meetings = Jitsi.
• At least one of Groupware, Files, Meetings, Chat, Notes, Knowledge or Projects must stay selected.

Turning off a component also switches off the extensions that depend on it.

Step 2: Settings

Only settings of selected components are shown. Every setting is preset with the product default, and anything you leave at the default is not written to your deployment. The sections are collapsible, a search field finds a setting by name, and Show changed only lists just the settings that differ from the default.

Group	Main settings
General	Default language (German or English), time zone, admin list size and automatic loading.
Branding	Product name, slogan, primary colour, logos and signet; see Branding.
Mail	Mail domain (empty means the instance host name), no-reply sender, additional mail domains, DKIM signing, optional SMTP relay (host, port, user name, password).
Security	Password length (8 to 64) and character rules, two-factor authentication for all users or additional groups, new-device login notification, audit logs, session idle timeout and maximum lifetime, “remember me”, offline (app) session lifetimes.
Single sign-on	One external OIDC identity provider; optionally enforce it as the only login.
Integrations	Your own OIDC applications (up to 10) and the UDM REST API for user provisioning.
Portal	Links to legal notice, privacy statement, support, documentation and feedback, welcome message, news feed, login requirement, custom tiles (up to 20) and announcements (up to 10).
Groupware	Mail categories, quotas, sharing rules, send-as for shared accounts, recipient limits, external mail clients.
Files	Share-link rules and expiry, retention of trash and file versions, forbidden characters in file names.
Office	Default document format, macro security level, AI endpoint for document assistance.
Chat	Matrix domain, Matrix ID format, upload size, federation.
Meetings	Telephone dial-in (SIP) with server, account and password.
Storage	Mail and knowledge storage sizes.
Edition	Enterprise Edition and its licences; see Enterprise Edition.

Details worth knowing:

• DKIM. AUTARQ generates the signing key (or you provide your own) and shows the DNS TXT record to create for your mail domain. Mail signing only works once the record exists.
• Single sign-on. Enter the endpoints or let the configurator fill them from the discovery URL.
• Portal links. Each of the five links is either the default, your own HTTPS URL, or hidden.
• Custom tiles. Each tile has a name and description in German and English, an HTTPS link, an SVG icon (up to 20 KiB), an option to open in a new tab and optionally the groups that see it.
• Storage. The default mail storage is derived from your seats and the mailbox quota.

Credentials (SMTP password, AI API key, SSO client secret, SIP password and similar) are write-only; see How your credentials are stored. Leave the field empty to keep the product default or an earlier value.

AUTARQ addons (Euro-Office, Skynet, F13, Relution, Zammad) have no customer settings; AUTARQ operates them. Relution follows the language setting.

Step 3: Administrator

openDesk keeps an internal break-glass account for AUTARQ. You get your own administrator account:

• User name: lower case, starts with a letter, 3 to 32 characters (letters, digits ., _, -). Reserved names such as administrator, admin or root are refused.
• First name, last name and a recovery e-mail address outside the new instance, which is used to reset the password.
• Password: at least 12 characters or your configured minimum if it is longer, with lower case, upper case, a digit and a special character, and not containing the user name. A checklist shows each requirement while you type.

The password is sent once with your configuration and is never shown or stored in your draft. After the first successful deployment AUTARQ removes it; see How your credentials are stored.

The account becomes member of the Domain Admins group. Administrators must enrol a second factor (one-time password app) at their first login. This account manages users and groups: create work accounts for your colleagues in the openDesk portal. The account is created once and is not reset by later deployments; if you lose the password, use the recovery e-mail.

Step 4: Review and submit

The summary lists the selected components, every setting that differs from the default and the administrator data (without the password). Confirm the checkbox and submit. Your choices are saved as a draft after every step so you can leave and continue later; passwords are never part of the draft.

Once the deployment has started, you change the configuration from the service page; see Changing the configuration after deployment. Owners and admins of your organization can change it; other members can view it.

Before the deployment starts, when you submit again, enter the administrator password again: it is never stored in the draft and never shown.

Branding

The Branding group makes your openDesk look like your organization. A live preview shows the effect while you edit.

Setting	Rules
Product name	1 to 40 characters; the characters " \ $ # {` `} < > are not allowed.
Slogan	Up to 80 characters.
Primary colour	Hex colour (#RRGGBB). Its contrast with white must reach 4.5:1, because white text sits on it. AUTARQ computes the lighter tints from it.

Upload	Format and limit
Header logo	SVG, up to 50 KiB.
Header logo, inverted	Optional SVG, up to 50 KiB, for dark backgrounds.
Signet	SVG, or PNG of at least 512 px. AUTARQ generates the favicons and app icons from it.
Login background	Image at least 1920 px wide. It is compressed to at most 150 KiB.

All uploads together may not exceed 300 KiB. Uploaded SVGs are sanitised: scripts, event handlers and external references are removed. SVGs with nested use references, with costly filters (feTurbulence, feConvolveMatrix, feMorphology) and with CSS that loads images (image-set(), src(), quoted strings) are refused. Raster images must be PNG, JPEG or WebP; other formats such as TIFF or GIF are refused. Without an upload, openDesk keeps its default.

Branding covers what openDesk themes: the portal, the login page and the components that follow the openDesk theme. Collabora in the Enterprise Edition is not branded. Uploads take effect with the next deployment or Apply changes.

Enterprise Edition

The Edition group offers the openDesk Enterprise Edition. It needs a ZenDiS subscription and access to its container registry, and you can only choose it at the first deployment. It cannot be switched on later, and it cannot be switched off again.

With Enterprise Edition selected, the configurator asks for:

Input	Needed when
Registry user name and password	Always
Nubus licence	Always
Nextcloud subscription key	Files = Nextcloud
OpenProject token	Projects = OpenProject. The token is bound to the host projects.<your openDesk host>; the configurator shows the expected host.
XWiki licence and XWiki Pro licence	Knowledge = XWiki. Each licence must be a single line.

Instead of typing the keys you can upload the enterprise.yaml file you received from ZenDiS; AUTARQ reads the keys from it and fills the matching fields.

The Enterprise Edition also adds chat settings: restrict chat to approved apps, block legacy logins, allow Element X and Element Desktop, additional allowed apps, chat archiving and Element Supervision.

AUTARQ generates and keeps the keys that encrypt your mail. You never enter or see them.

How your credentials are stored

Passwords, API keys, licences and keys, for example the SMTP relay password, the AI API key, the SSO client secret, your own DKIM key and all Enterprise Edition inputs, are write-only:

• They are stored only as Kubernetes Secrets in AUTARQ’s cluster, one set per order item. They never enter the Deploy App database, the order data, logs or workflow parameters.
• They are never shown again. A stored credential shows stored on with its date.
• You can replace a stored credential at any time. Optional credentials can also be removed.
• The administrator password is removed after the first successful deployment.
• Leave a field empty to keep the stored value.

Your openDesk in My Services

Open My Services → openDesk. The page shows:

• the current status and next step;
• the selected component per category with its maturity;
• once deployed: the portal address, your administrator user name and the first-login hints;
• the installed version.

Updates

If AUTARQ has released a newer openDesk version, the page shows Update available with the version numbers. If upstream openDesk has published a release that AUTARQ is still validating, the page says so and links to the upstream release notes. Updates are applied by AUTARQ.

Test mode

When the service shows test mode, it uses a render-only deployment. The complete deployment pipeline runs and renders the configuration, but nothing is started in the cluster, so there is no portal to open. The page shows a Test mode banner.

Changing the configuration after deployment

After the first deployment you can keep adjusting your openDesk. Owners and admins of your organization can change the configuration; other members can view it.

1. Open My Services → openDesk and select Change settings. The configurator opens in edit mode with your current configuration.
2. Change what you need. Fields that cannot change after the first deployment are read-only and show the reason.
3. Select Apply changes. A confirmation dialog explains the update: the affected services restart one after another, which takes some minutes. The service shows Updating until it is done.

There are no drafts in edit mode: nothing is saved until you apply. Uploaded branding files and changed credentials roll out with the next Apply changes, not earlier.

What can change

Kind	Fields	In edit mode
First deployment only	Mail domain, Matrix domain, immutable Matrix ID setting, Enterprise Edition, administrator account, SSO alias	Read-only
Grow only	Storage sizes (mail, knowledge)	Can only be increased
Add only	Additional 2FA groups, additional mail domains	Entries can be added, not removed
Components	Selection per category	Can be added, not removed
AUTARQ addons	Euro-Office, F13, Relution, Zammad, Skynet	Fixed; the choice cannot be changed

Everything else, including branding, portal, mail, security and SSO settings, stays editable. Credentials can be replaced, and optional ones removed; see How your credentials are stored.

Good to know

• Two-factor groups are one-way. Groups you add under additional 2FA groups cannot be removed again, and switching off “two-factor authentication for all users” later does not turn it off for users who already have it.
• Enforcing single sign-on switches off local login, including AUTARQ’s break-glass administrator access. Only turn it on once the external identity provider works for your administrators. Users are matched by user name and must already exist in openDesk.
• External mail clients (IMAP, SMTP) need the AUTARQ mail gateway. Enabling the setting does not guarantee that your mail server is reachable from outside.
• The Enterprise Edition cannot be switched on or off later. Decide before the first deployment.
• An SMTP relay must support STARTTLS. Port 465 (implicit TLS) is not supported.
• Branding applies to what openDesk themes. Collabora in the Enterprise Edition keeps its own look.
• Each organization can order openDesk once.

Verify your workplace

After deployment, open the portal from My Services, sign in with your own openDesk administrator and complete the required second-factor setup. Check the selected apps and a representative action in each needed component. For mail, verify the displayed DNS record and the required external-client gateway before relying on external delivery or client access.

If you linked Autarq Chat, verify that service and its seat access separately. Test mode produces configuration only and cannot prove a running workplace. Use service troubleshooting for failed or pending setup.