Repository: owncloud/ocis
Pull request #3922 (2022-06-03 13:51:02)

[full-ci] update reva to v2.4.2-0.20220607110316-1e461b750389
bring https://github.com/cs3org/reva/pull/2919, https://github.com/cs3org/reva/pull/2904 and more to ocis

update-docs[bot]: Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a [changelog](https://github.com/owncloud/ocis/blob/master/changelog/README.md) item based on your changes.

sonarcloud[bot]: Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=3922)

[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=BUG)  
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=VULNERABILITY)  
[![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=3922&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=3922&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=3922&resolved=false&types=SECURITY_HOTSPOT)  
[![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=CODE_SMELL)

[![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=3922&metric=coverage&view=list) No Coverage information  
[![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=3922&metric=duplicated_lines_density&view=list) No Duplication information


sonarcloud[bot]: Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=3922)

[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=BUG)  
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=VULNERABILITY)  
[![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=3922&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=3922&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=3922&resolved=false&types=SECURITY_HOTSPOT)  
[![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3922&resolved=false&types=CODE_SMELL)

[![No Coverage information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/NoCoverageInfo-16px.png 'No Coverage information')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=3922&metric=coverage&view=list) No Coverage information  
[![No Duplication information](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/NoDuplicationInfo-16px.png 'No Duplication information')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=3922&metric=duplicated_lines_density&view=list) No Duplication information



Patch:
diff --git a/.drone.env b/.drone.env
index 2bea7fcd057..eea67dce03c 100644
--- a/.drone.env
+++ b/.drone.env
@@ -1,5 +1,5 @@
 # The test runner source for API tests
-CORE_COMMITID=b12c3feb26db052d6743f14d1d65c4876b2b24f9
+CORE_COMMITID=3e90678303c023a064a80809ed207af662b07ba0
 CORE_BRANCH=master
 
 # The test runner source for UI tests
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f024d0c31d..2b3e5463365 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,9 +9,7 @@ The following sections list the changes for unreleased.
 * Bugfix - Allow empty environment variables: [#3892](https://github.com/owncloud/ocis/pull/3892)
 * Bugfix - Inconsistency env var naming for LDAP filter configuration: [#3890](https://github.com/owncloud/ocis/issues/3890)
 * Bugfix - Fix LDAP insecure options: [#3897](https://github.com/owncloud/ocis/pull/3897)
-* Bugfix - Fix configuration validation for extensions' server commands: [#3911](https://github.com/owncloud/ocis/pull/3911)
 * Bugfix - Fix user autoprovisioning: [#3893](https://github.com/owncloud/ocis/issues/3893)
-* Bugfix - Fix the webdav URL of drive roots: [#3706](https://github.com/owncloud/ocis/issues/3706)
 * Enhancement - Add config option to provide TLS certificate: [#3818](https://github.com/owncloud/ocis/issues/3818)
 
 ## Details
@@ -47,17 +45,6 @@ The following sections list the changes for unreleased.
 
    https://github.com/owncloud/ocis/pull/3897
 
-* Bugfix - Fix configuration validation for extensions' server commands: [#3911](https://github.com/owncloud/ocis/pull/3911)
-
-   We've fixed the configuration validation for the extensions' server commands. Before that
-   fix error messages have occurred when started services which don't need certain
-   configuration values, that are needed for the oCIS fullstack command.
-
-   We now no longer do the common oCIS configuration validation for extensions' server commands
-   and now rely only on the extensions' validation function.
-
-   https://github.com/owncloud/ocis/pull/3911
-
 * Bugfix - Fix user autoprovisioning: [#3893](https://github.com/owncloud/ocis/issues/3893)
 
    We've fixed the autoprovsioning feature that was introduced in beta2. Due to a bug the role
@@ -66,13 +53,6 @@ The following sections list the changes for unreleased.
 
    https://github.com/owncloud/ocis/issues/3893
 
-* Bugfix - Fix the webdav URL of drive roots: [#3706](https://github.com/owncloud/ocis/issues/3706)
-
-   Fixed the webdav URL of drive roots in the graph API.
-
-   https://github.com/owncloud/ocis/issues/3706
-   https://github.com/owncloud/ocis/pull/3916
-
 * Enhancement - Add config option to provide TLS certificate: [#3818](https://github.com/owncloud/ocis/issues/3818)
 
    Added a config option to the graph service to provide a TLS certificate to be used to verify the
diff --git a/changelog/unreleased/fix-skip-validate-for-non-fullstack.md b/changelog/unreleased/fix-skip-validate-for-non-fullstack.md
deleted file mode 100644
index 898f9e668ad..00000000000
--- a/changelog/unreleased/fix-skip-validate-for-non-fullstack.md
+++ /dev/null
@@ -1,11 +0,0 @@
-Bugfix: Fix configuration validation for extensions' server commands
-
-We've fixed the configuration validation for the extensions' server commands.
-Before that fix error messages have occurred when started services which don't need
-certain configuration values, that are needed for the oCIS fullstack command.
-
-We now no longer do the common oCIS configuration validation for extensions' server
-commands and now rely only on the extensions' validation function.
-
-
-https://github.com/owncloud/ocis/pull/3911
diff --git a/changelog/unreleased/graph-webdav-url.md b/changelog/unreleased/graph-webdav-url.md
deleted file mode 100644
index 8e5a00e1270..00000000000
--- a/changelog/unreleased/graph-webdav-url.md
+++ /dev/null
@@ -1,6 +0,0 @@
-Bugfix: Fix the webdav URL of drive roots
-
-Fixed the webdav URL of drive roots in the graph API.
-
-https://github.com/owncloud/ocis/issues/3706
-https://github.com/owncloud/ocis/pull/3916
diff --git a/changelog/unreleased/update-reva.md b/changelog/unreleased/update-reva.md
new file mode 100644
index 00000000000..aa22a1ce7bb
--- /dev/null
+++ b/changelog/unreleased/update-reva.md
@@ -0,0 +1,5 @@
+Enhancement: update reva to version 2.4.2
+
+TODO
+
+https://github.com/owncloud/ocis/pull/3922
\ No newline at end of file
diff --git a/deployments/examples/oc10_ocis_parallel/docker-compose.yml b/deployments/examples/oc10_ocis_parallel/docker-compose.yml
index b13ce3a9b0e..92e97d37b2a 100644
--- a/deployments/examples/oc10_ocis_parallel/docker-compose.yml
+++ b/deployments/examples/oc10_ocis_parallel/docker-compose.yml
@@ -3,7 +3,7 @@ version: "3.7"
 
 services:
   traefik:
-    image: traefik:v2.6.6
+    image: traefik:v2.5
     networks:
       ocis-net:
         aliases:
diff --git a/deployments/examples/ocis_hello/docker-compose.yml b/deployments/examples/ocis_hello/docker-compose.yml
index ea494d32465..0b416104636 100644
--- a/deployments/examples/ocis_hello/docker-compose.yml
+++ b/deployments/examples/ocis_hello/docker-compose.yml
@@ -3,7 +3,7 @@ version: "3.7"
 
 services:
   traefik:
-    image: traefik:v2.6.6
+    image: traefik:v2.5
     networks:
       ocis-net:
         aliases:
diff --git a/deployments/examples/ocis_individual_services/.env b/deployments/examples/ocis_individual_services/.env
index 0fffd1ea3b9..3d8358a8b0b 100644
--- a/deployments/examples/ocis_individual_services/.env
+++ b/deployments/examples/ocis_individual_services/.env
@@ -7,51 +7,32 @@ INSECURE=true
 DEMO_USERS=true
 
 ### Traefik settings ###
-# Serve Traefik dashboard.
-TRAEFIK_DASHBOARD=false
-# Domain of Traefik, where you can find the dashboard.
+# Serve Traefik dashboard. Defaults to "false".
+TRAEFIK_DASHBOARD=
+# Domain of Traefik, where you can find the dashboard. Defaults to "traefik.owncloud.test"
 TRAEFIK_DOMAIN=
-# Basic authentication for the dashboard.
-TRAEFIK_BASIC_AUTH_USERS=admin
+# Basic authentication for the dashboard. Defaults to user "admin" and password "admin"
+TRAEFIK_BASIC_AUTH_USERS=
 # Email address for obtaining LetsEncrypt certificates, needs only be changed if this is a public facing server
 TRAEFIK_ACME_MAIL=
 
 ### oCIS settings ###
-# oCIS version.
-OCIS_DOCKER_TAG=latest
-# Domain of oCIS, where you can find the frontend.
+# oCIS version. Defaults to "latest"
+OCIS_DOCKER_TAG=
+# Domain of oCIS, where you can find the frontend. Defaults to "ocis.owncloud.test"
 OCIS_DOMAIN=
-# IDP LDAP bind password. Must be changed in order to have a secure oCIS. Must be identical to IDP_IDPSVC_PASSWORD
+# IDP LDAP bind password. Must be changed in order to have a secure oCIS. Defaults to "idp".
 IDP_LDAP_BIND_PASSWORD=
-# Storage LDAP bind password. Must be changed in order to have a secure oCIS.
+# Storage LDAP bind password. Must be changed in order to have a secure oCIS. Defaults to "reva".
 STORAGE_LDAP_BIND_PASSWORD=
-# JWT secret which is used for the storage provider. Must be changed in order to have a secure oCIS.
+# JWT secret which is used for the storage provider. Must be changed in order to have a secure oCIS. Defaults to "Pive-Fumkiu4"
 OCIS_JWT_SECRET=
-# Secret which is used for uploads to create transfer tokens. Must be changed in order to have a secure oCIS.
+# JWT secret which is used for uploads to create transfer tokens. Must be changed in order to have a secure oCIS. Defaults to "replace-me-with-a-transfer-secret"
 STORAGE_TRANSFER_SECRET=
-# Secret which is used for accessing the system storage. Must be different from the OCIS_JWT_SECRET. Must be changed in order to have a secure oCIS.
-STORAGE_SYSTEM_JWT_SECRET=
-# Machine auth api key secret. Must be changed in order to have a secure oCIS.
+# Machine auth api key secret. Must be changed in order to have a secure oCIS. Defaults to "change-me-please"
 OCIS_MACHINE_AUTH_API_KEY=
-# System user machine auth api key. Must be changed in order to have a secure oCIS.
-SYSTEM_USER_API_KEY=
-# Number of services to run for extensions, that currently can be easily scaled.
-OCIS_SCALE=1
-
-# IDM service user password, set to a random string.
-IDM_SVC_PASSWORD=
-# IDM Reva service user password, set to a random string.
-IDM_REVASVC_PASSWORD=
-# IDM IDP service user password, set to a random string.
-IDM_IDPSVC_PASSWORD=
-# System user id, set to a random string.
-SYSTEM_USER_ID=
-# Admin user id, set to a random UUIDv4.
-ADMIN_USER_ID=
-# Admin user password, set to random string.
-ADMIN_USER_PASSWORD=
-# Enable basic auth for proxy, set to bool.
-PROXY_ENABLE_BASIC_AUTH=
+# Number of services to run for extensions, that currently can be easily scaled. Defaults to 1.
+OCIS_SCALE=
 
 # If you want to use debugging and tracing with this stack,
 # you need uncomment following line. Please see documentation at
diff --git a/deployments/examples/ocis_individual_services/config/accounts/entrypoint-override.sh b/deployments/examples/ocis_individual_services/config/accounts/entrypoint-override.sh
new file mode 100755
index 00000000000..4b890128c06
--- /dev/null
+++ b/deployments/examples/ocis_individual_services/config/accounts/entrypoint-override.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+
+set -e
+
+ocis accounts server&
+sleep 10
+
+echo "##################################################"
+echo "change default secrets:"
+
+# IDP
+IDP_USER_UUID=$(ocis accounts list | grep "| Kopano IDP " | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o)
+echo "  IDP user UUID: $IDP_USER_UUID"
+ocis accounts update --password $IDP_LDAP_BIND_PASSWORD $IDP_USER_UUID
+
+# REVA
+REVA_USER_UUID=$(ocis accounts list | grep " | Reva Inter " | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o)
+echo "  Reva user UUID: $REVA_USER_UUID"
+ocis accounts update --password $STORAGE_LDAP_BIND_PASSWORD $REVA_USER_UUID
+
+echo "default secrets changed"
+echo "##################################################"
+
+wait # wait for accounts service to exit
diff --git a/deployments/examples/ocis_individual_services/config/proxy/proxy.yaml b/deployments/examples/ocis_individual_services/config/proxy/proxy.yaml
index 9e2e22e7f6b..c2395889805 100644
--- a/deployments/examples/ocis_individual_services/config/proxy/proxy.yaml
+++ b/deployments/examples/ocis_individual_services/config/proxy/proxy.yaml
@@ -1,59 +1,51 @@
-
-policies:
-- name: ocis
-  routes:
-  - endpoint: /
-    backend: http://web:9100
-  - endpoint: /.well-known/
-    backend: http://idp:9130
-  - endpoint: /konnect/
-    backend: http://idp:9130
-  - endpoint: /signin/
-    backend: http://idp:9130
-  - endpoint: /archiver
-    backend: http://frontend:9140
-  - type: regex
-    endpoint: /ocs/v[12].php/cloud/user/signing-key
-    backend: http://ocs:9110
-  - endpoint: /ocs/
-    backend: http://frontend:9140
-  - type: query
-    endpoint: /remote.php/?preview=1
-    backend: http://webdav:9115
-  - method: REPORT
-    endpoint: /remote.php/dav/
-    backend: http://webdav:9115
-  - type: query
-    endpoint: /dav/?preview=1
-    backend: http://webdav:9115
-  - type: query
-    endpoint: /webdav/?preview=1
-    backend: http://webdav:9115
-  - endpoint: /remote.php/
-    service: com.owncloud.web.ocdav
-  - endpoint: /dav/
-    service: com.owncloud.web.ocdav
-  - endpoint: /webdav/
-    service: com.owncloud.web.ocdav
-  - endpoint: /status.php
-    service: com.owncloud.web.ocdav
-  - endpoint: /index.php/
-    service: com.owncloud.web.ocdav
-  - endpoint: /apps/
-    service: com.owncloud.web.ocdav
-  - endpoint: /data
-    backend: http://frontend:9140
-  - endpoint: /app/
-    backend: http://frontend:9140
-  - endpoint: /graph/
-    backend: http://graph:9120
-  - endpoint: /graph-explorer
-    backend: http://graph-explorer:9135
-  - endpoint: /api/v0/settings
-    backend: http://settings:9190
-  - endpoint: /settings.js
-    backend: http://settings:9190
-
+---
 policy_selector:
   static:
     policy: ocis
+policies:
+  - name: ocis
+    routes:
+      - endpoint: "/"
+        backend: http://web:9100
+      - endpoint: "/.well-known/"
+        backend: http://idp:9130
+      - endpoint: "/konnect/"
+        backend: http://idp:9130
+      - endpoint: "/signin/"
+        backend: http://idp:9130
+      - type: regex
+        endpoint: "/ocs/v[12].php/cloud/(users?|groups)"
+        backend: http://ocs:9110
+      - endpoint: "/ocs/"
+        backend: http://storage-frontend:9140
+      - type: query
+        endpoint: "/remote.php/?preview=1"
+        backend: http://webdav:9115
+      - endpoint: "/remote.php/"
+        backend: http://storage-frontend:9140
+      - endpoint: "/dav/"
+        backend: http://storage-frontend:9140
+      - endpoint: "/webdav/"
+        backend: http://storage-frontend:9140
+      - endpoint: "/status.php"
+        backend: http://storage-frontend:9140
+      - endpoint: "/index.php/"
+        backend: http://storage-frontend:9140
+      - endpoint: "/data"
+        backend: http://storage-frontend:9140
+      - endpoint: "/app/"
+        backend: http://storage-frontend:9140
+      - endpoint: "/archiver"
+        backend: http://storage-frontend:9140
+      - endpoint: "/graph/"
+        backend: http://graph:9120
+      - endpoint: "/graph-explorer/"
+        backend: http://graph-explorer:9135
+      - endpoint: "/api/v0/accounts"
+        backend: http://accounts:9181
+      - endpoint: "/accounts.js"
+        backend: http://accounts:9181
+      - endpoint: "/api/v0/settings"
+        backend: http://settings:9190
+      - endpoint: "/settings.js"
+        backend: http://settings:9190
diff --git a/deployments/examples/ocis_individual_services/docker-compose.yml b/deployments/examples/ocis_individual_services/docker-compose.yml
index 55ccfd16b63..24b7840cedc 100644
--- a/deployments/examples/ocis_individual_services/docker-compose.yml
+++ b/deployments/examples/ocis_individual_services/docker-compose.yml
@@ -1,27 +1,13 @@
 ---
 version: "3.7"
 
-volumes:
-  traefik-certs: null
-  ocis-store: null
-  ocis-storage-system: null
-  ocis-storage-users: null
-  ocis-sharing: null
-  ocis-thumbnails: null
-  ocis-idm: null
-  ocis-nats: null
-  ocis-search: null
-
-networks:
-  ocis-net:
-
 services:
   traefik:
-    image: traefik:v2.6.6
+    image: traefik:v2.5
     networks:
       ocis-net:
         aliases:
-          - ${OCIS_DOMAIN}
+          - ${OCIS_DOMAIN:-ocis.owncloud.test}
     command:
       - "--log.level=${TRAEFIK_LOG_LEVEL:-ERROR}"
       # letsencrypt configuration
@@ -29,7 +15,7 @@ services:
       - "--certificatesResolvers.http.acme.storage=/certs/acme.json"
       - "--certificatesResolvers.http.acme.httpChallenge.entryPoint=http"
       # enable dashboard
-      - "--api.dashboard=${TRAEFIK_DASHBOARD:-false}"
+      - "--api.dashboard=true"
       # define entrypoints
       - "--entryPoints.http.address=:80"
       - "--entryPoints.http.http.redirections.entryPoint.to=https"
@@ -56,7 +42,7 @@ services:
       driver: "local"
     restart: always
 
-  app-registry:
+  proxy:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
       replicas: ${OCIS_SCALE:-1}
@@ -64,150 +50,42 @@ services:
       ocis-net:
     entrypoint:
       - ocis
-      - app-registry
+      - proxy
       - server
     environment:
-      APP_REGISTRY_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      APP_REGISTRY_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      APP_REGISTRY_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
-
-      APP_REGISTRY_JWT_SECRET: ${OCIS_JWT_SECRET}
-
-      APP_REGISTRY_GRPC_ADDR: 0.0.0.0:9242
-      REVA_GATEWAY: gateway:9142
-
-    logging:
-      driver: "local"
-    restart: always
+      PROXY_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      PROXY_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      PROXY_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-  app-provider:
-    image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
-    deploy:
-      replicas: ${OCIS_SCALE:-1}
-    networks:
-      ocis-net:
-    entrypoint:
-      - ocis
-      - app-provider
-      - server
-    environment:
-      APPPROVIDER_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      APPPROVIDER_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      APPPROVIDER_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      PROXY_TLS: "false" # do not use SSL between Traefik and oCIS
 
-      APP_PROVIDER_GRPC_ADDR: 0.0.0.0:9164
-      APP_PROVIDER_EXTERNAL_ADDR: app-provider:9164
+      REVA_GATEWAY: storage-gateway:9142
 
-      REVA_GATEWAY: gateway:9142
-      APP_PROVIDER_JWT_SECRET: ${OCIS_JWT_SECRET}
-    logging:
-      driver: "local"
-    restart: always
+      PROXY_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      PROXY_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY:-change-me-please}
+      PROXY_INSECURE_BACKENDS: "false"
 
-  notifications:
-    image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
-    deploy:
-      replicas: ${OCIS_SCALE:-1}
-    networks:
-      ocis-net:
-    entrypoint:
-      - ocis
-      - notifications
-      - server
-    environment:
-      NOTIFICATIONS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      NOTIFICATIONS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      NOTIFICATIONS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      PROXY_OIDC_INSECURE: "${INSECURE:-false}"
+      PROXY_OIDC_ISSUER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
 
-      REVA_GATEWAY: gateway:9142
-      NOTIFICATIONS_EVENTS_ENDPOINT: nats:9233
-      NOTIFICATIONS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY}
-    logging:
-      driver: "local"
-    restart: always
+      PROXY_AUTOPROVISION_ACCOUNTS: "true"
 
-  idm:
-    image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
-    deploy:
-      replicas: 1
-    networks:
-      ocis-net:
+      PROXY_HTTP_ADDR: 0.0.0.0:9200
     volumes:
-      - ocis-idm:/var/lib/ocis
-    entrypoint:
-      - ocis
-      - idm
-      - server
-    environment:
-      IDM_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      IDM_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      IDM_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
-
-      IDM_LDAPS_ADDR: 0.0.0.0:9235
-      IDM_ADMIN_USER_ID: ${ADMIN_USER_ID}
-      IDM_ADMIN_PASSWORD: ${ADMIN_USER_PASSWORD}
-      IDM_SVC_PASSWORD: ${IDM_SVC_PASSWORD}
-      IDM_REVASVC_PASSWORD:  ${IDM_REVASVC_PASSWORD}
-      IDM_IDPSVC_PASSWORD:  ${IDM_IDPSVC_PASSWORD}
-
-
-      IDM_CREATE_DEMO_USERS: ${DEMO_USERS:-false}
-
-      IDM_JWT_SECRET: ${OCIS_JWT_SECRET}
-    logging:
-      driver: "local"
-    restart: always
-
-  ocdav:
-    image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
-    deploy:
-      replicas: ${OCIS_SCALE:-1}
-    networks:
-      ocis-net:
-    entrypoint:
-      - ocis
-      - ocdav
-      - server
-    environment:
-      OCDAV_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      OCDAV_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      OCDAV_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
-
-      OCDAV_HTTP_ADDR: 0.0.0.0:8080
-
-      OCDAV_PUBLIC_URL: ${OCIS_DOMAIN}
-
-      REVA_GATEWAY: gateway:9142
-      OCDAV_JWT_SECRET: ${OCIS_JWT_SECRET}
-
-      OCDAV_INSECURE: ${INSECURE:-true}
-    logging:
-      driver: "local"
-    restart: always
-
-  graph-explorer:
-    image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
-    deploy:
-      replicas: ${OCIS_SCALE:-1}
-    networks:
-      ocis-net:
-    entrypoint:
-      - ocis
-      - graph-explorer
-      - server
-    environment:
-      GRAPH_EXPLOER_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      GRAPH_EXPLOER_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      GRAPH_EXPLOER_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
-
-      GRAPH_EXPLORER_HTTP_ADDR: 0.0.0.0:9135
-      GRAPH_EXPLORER_ISSUER: https://${OCIS_DOMAIN}
-      GRAPH_EXPLORER_GRAPH_URL_BASE: https://${OCIS_DOMAIN}
+      - "./config/proxy/proxy.yaml:/etc/ocis/proxy.yaml"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.ocis.entrypoints=https"
+      - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test\
+        }`)"
+      - "traefik.http.routers.ocis.tls.certresolver=http"
+      - "traefik.http.routers.ocis.service=ocis"
+      - "traefik.http.services.ocis.loadbalancer.server.port=9200"
     logging:
       driver: "local"
     restart: always
 
-  audit:
+  nats:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
       replicas: 1
@@ -215,80 +93,74 @@ services:
       ocis-net:
     entrypoint:
       - ocis
-      - audit
+      - nats-server
       - server
     environment:
-      AUDIT_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      AUDIT_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      AUDIT_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      NATS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      NATS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      NATS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      AUDIT_EVENTS_ENDPOINT: nats:9233
+      NATS_NATS_HOST: 0.0.0.0
+      NATS_NATS_PORT: 9233
     logging:
       driver: "local"
     restart: always
 
-  proxy:
+  accounts:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
-      replicas: ${OCIS_SCALE:-1}
+      replicas: 1
     networks:
       ocis-net:
     entrypoint:
-      - ocis
-      - proxy
-      - server
+      - /bin/sh
+      - /entrypoint-override.sh
+    #entrypoint:
+    #  - ocis
+    #  - accounts
+    #  - server
     environment:
-      PROXY_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      PROXY_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      PROXY_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
-
-      PROXY_TLS: "false" # do not use SSL between Traefik and oCIS
+      ACCOUNTS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      ACCOUNTS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      ACCOUNTS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      REVA_GATEWAY: gateway:9142
+      ACCOUNTS_HTTP_ADDR: 0.0.0.0:9181
+      ACCOUNTS_GRPC_ADDR: 0.0.0.0:9180
 
-      PROXY_JWT_SECRET: ${OCIS_JWT_SECRET}
-      PROXY_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY}
+      ACCOUNTS_STORAGE_BACKEND: cs3
+      ACCOUNTS_STORAGE_CS3_PROVIDER_ADDR: storage-system:9215
 
-      PROXY_OIDC_INSECURE: "${INSECURE:-true}"
-      PROXY_OIDC_ISSUER: https://${OCIS_DOMAIN}
-
-      PROXY_INSECURE_BACKENDS: true
-      PROXY_HTTP_ADDR: 0.0.0.0:9200
-
-      PROXY_ENABLE_BASIC_AUTH: ${PROXY_ENABLE_BASIC_AUTH:-true}
+      IDP_LDAP_BIND_PASSWORD: ${IDP_LDAP_BIND_PASSWORD:-idp}
+      STORAGE_LDAP_BIND_PASSWORD: ${STORAGE_LDAP_BIND_PASSWORD:-reva}
 
+      ACCOUNTS_JWT_SECRET: ${OCIS_METADATA_JWT_SECRET:-Pive-Fumkiu4}
+      # demo users
+      ACCOUNTS_DEMO_USERS_AND_GROUPS: "${DEMO_USERS:-false}"  # deprecated, remove after switching to LibreIDM
     volumes:
-      - "./config/proxy/proxy.yaml:/etc/ocis/proxy.yaml"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.ocis.entrypoints=https"
-      - "traefik.http.routers.ocis.rule=Host(`${OCIS_DOMAIN}`)"
-      - "traefik.http.routers.ocis.tls.certresolver=http"
-      - "traefik.http.routers.ocis.service=ocis"
-      - "traefik.http.services.ocis.loadbalancer.server.port=9200"
+      - ./config/accounts/entrypoint-override.sh:/entrypoint-override.sh
     logging:
       driver: "local"
     restart: always
 
-  nats:
+  glauth:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
-      replicas: 1
+      replicas: ${OCIS_SCALE:-1}
     networks:
       ocis-net:
-    volumes:
-      - "ocis-nats:/var/lib/ocis"
     entrypoint:
       - ocis
-      - nats
+      - glauth
       - server
     environment:
-      NATS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      NATS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      NATS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      GLAUTH_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      GLAUTH_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      GLAUTH_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      NATS_NATS_HOST: 0.0.0.0
+      GLAUTH_LDAP_ADDR: 0.0.0.0:9125
+      GLAUTH_LDAPS_ADDR: 0.0.0.0:9126
 
+      GLAUTH_BACKEND_INSECURE: "true"
     logging:
       driver: "local"
     restart: always
@@ -310,11 +182,11 @@ services:
 
       IDP_HTTP_ADDR: 0.0.0.0:9130
 
-      IDP_LDAP_URI: ldaps://idm:9235
-      IDP_LDAP_BIND_PASSWORD: ${IDM_IDPSVC_PASSWORD}
+      IDP_LDAP_URI: ldap://glauth:9125
+      IDP_LDAP_BIND_PASSWORD: ${IDP_LDAP_BIND_PASSWORD:-idp}
 
-      IDP_ISS: https://${OCIS_DOMAIN}
-      IDP_INSECURE: "${INSECURE:-true}"
+      IDP_ISS: https://${OCIS_DOMAIN:-ocis.owncloud.test}
+      IDP_INSECURE: "${INSECURE:-false}"
     logging:
       driver: "local"
     restart: always
@@ -336,40 +208,13 @@ services:
 
       OCS_HTTP_ADDR: 0.0.0.0:9110
 
-      OCS_ACCOUNT_BACKEND_TYPE: cs3
-      OCS_IDM_ADDRESS: https://${OCIS_DOMAIN}
+      OCS_ACCOUNT_BACKEND_TYPE: accounts
+      OCS_IDM_ADDRESS: https://${OCIS_DOMAIN:-ocis.owncloud.test}
 
-      OCS_JWT_SECRET: ${OCIS_JWT_SECRET}
-      OCS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY}
+      OCS_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      OCS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY:-change-me-please}
 
-      REVA_GATEWAY: gateway:9142
-    logging:
-      driver: "local"
-    restart: always
-
-  search:
-    image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
-    deploy:
-      replicas: ${OCIS_SCALE:-1}
-    networks:
-      ocis-net:
-    volumes:
-      - "ocis-search:/var/lib/ocis"
-    entrypoint:
-      - ocis
-      - search
-      - server
-    environment:
-      SEARCH_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      SEARCH_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      SEARCH_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
-
-      SEARCH_GRPC_ADDR: 0.0.0.0:9220
-
-      REVA_GATEWAY: gateway:9142
-      SEARCH_EVENTS_ENDPOINT: nats:9233
-
-      SEARCH_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
@@ -377,7 +222,7 @@ services:
   settings:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
-      replicas: ${OCIS_SCALE:-1}
+      replicas: 1
     networks:
       ocis-net:
     entrypoint:
@@ -392,16 +237,9 @@ services:
       SETTINGS_HTTP_ADDR: 0.0.0.0:9190
       SETTINGS_GRPC_ADDR: 0.0.0.0:9191
 
-      SETTINGS_JWT_SECRET: ${OCIS_JWT_SECRET}
-
-      OCIS_SYSTEM_USER_API_KEY: ${SYSTEM_USER_API_KEY}
-      OCIS_SYSTEM_USER_ID: ${SYSTEM_USER_ID}
-
-      SETTINGS_ADMIN_USER_ID: ${ADMIN_USER_ID}
-
-      STORAGE_GATEWAY_GRPC_ADDR: storage-system:9215
-      STORAGE_GRPC_ADDR: storage-system:9215
-
+      SETTINGS_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+    volumes:
+      - "ocis-settings:/var/lib/ocis"
     logging:
       driver: "local"
     restart: always
@@ -422,9 +260,8 @@ services:
       STORE_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
       STORE_GRPC_ADDR: 0.0.0.0:9460
-
     volumes:
-      - "ocis-store:/var/lib/ocis"
+      - "ocis-settings:/var/lib/ocis"
     logging:
       driver: "local"
     restart: always
@@ -445,14 +282,13 @@ services:
       THUMBNAILS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
       THUMBNAILS_GRPC_ADDR: 0.0.0.0:9185
-      THUMBNAILS_HTTP_ADDR: 0.0.0.0:9186
-      THUMBNAILS_DATA_ENDPOINT: http://thumbnails:9186/thumbnails/data
+
       THUMBNAILS_CS3SOURCE_INSECURE: "true"
-      REVA_GATEWAY: gateway:9142
+      REVA_GATEWAY: storage-gateway:9142
 
     volumes:
       # optional shared thumbnail cache between services
-      - "ocis-thumbnails:/var/lib/ocis"
+      - "ocis-settings:/var/lib/ocis"
     logging:
       driver: "local"
     restart: always
@@ -474,10 +310,9 @@ services:
 
       WEB_HTTP_ADDR: 0.0.0.0:9100
 
-      WEB_OIDC_AUTHORITY: https://${OCIS_DOMAIN}
-      WEB_UI_THEME_SERVER: https://${OCIS_DOMAIN}
-      WEB_UI_CONFIG_SERVER: https://${OCIS_DOMAIN}
-      WEB_OIDC_METADATA_URL: https://${OCIS_DOMAIN}/.well-known/openid-configuration
+      WEB_OIDC_AUTHORITY: https://${OCIS_DOMAIN:-ocis.owncloud.test}
+      WEB_UI_THEME_SERVER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
+      WEB_UI_CONFIG_SERVER: https://${OCIS_DOMAIN:-ocis.owncloud.test}
     logging:
       driver: "local"
     restart: always
@@ -499,8 +334,8 @@ services:
 
       WEBDAV_HTTP_ADDR: 0.0.0.0:9115
 
-      OCIS_PUBLIC_URL: https://${OCIS_DOMAIN}
-      REVA_GATEWAY: gateway:9142
+      OCIS_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
@@ -521,17 +356,12 @@ services:
       GRAPH_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
       GRAPH_HTTP_ADDR: 0.0.0.0:9120
-      GRAPH_SPACES_WEBDAV_BASE: https://${OCIS_DOMAIN}
-
-      GRAPH_LDAP_URI: ldaps://idm:9235
-      GRAPH_LDAP_BIND_PASSWORD: ${IDM_SVC_PASSWORD}
-      GRAPH_LDAP_INSECURE: true # TODO: fix me https://github.com/owncloud/ocis/issues/3818
-      REVA_GATEWAY: gateway:9142
+      GRAPH_SPACES_WEBDAV_BASE: https://${OCIS_DOMAIN:-ocis.owncloud.test}
 
-      GRAPH_EVENTS_ENDPOINT: nats:9233
-
-      GRAPH_JWT_SECRET: ${OCIS_JWT_SECRET}
+      REVA_GATEWAY: storage-gateway:9142
+      GRAPH_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
 
+      GRAPH_LDAP_URI: ldap://glauth:9125
     logging:
       driver: "local"
     restart: always
@@ -539,7 +369,7 @@ services:
   storage-system:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
-      replicas: ${OCIS_SCALE:-1}
+      replicas: 1
     networks:
       ocis-net:
     entrypoint:
@@ -547,31 +377,29 @@ services:
       - storage-system
       - server
     environment:
-      STORAGE_SYSTEM_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      STORAGE_SYSTEM_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      STORAGE_SYSTEM_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      STORAGE_SYSTEM_DATAPROVIDER_INSECURE: "${INSECURE:-false}"
+      STORAGE_HOME_DATAPROVIDER_INSECURE: "${INSECURE:-false}"
 
       STORAGE_SYSTEM_GRPC_ADDR: 0.0.0.0:9215
       STORAGE_SYSTEM_HTTP_ADDR: 0.0.0.0:9216
       STORAGE_SYSTEM_DATA_SERVER_URL: http://storage-system:9216/data
 
-      STORAGE_SYSTEM_JWT_SECRET: ${STORAGE_SYSTEM_JWT_SECRET}
+      STORAGE_JWT_SECRET: ${OCIS_METADATA_JWT_SECRET:-Pive-Fumkiu4}
+      STORAGE_TRANSFER_SECRET: ${STORAGE_TRANSFER_SECRET:-replace-me-with-a-transfer-secret}
 
-      OCIS_SYSTEM_USER_ID: ${SYSTEM_USER_ID}
       STORAGE_SYSTEM_DRIVER: ocis
 
-      OCIS_SYSTEM_USER_API_KEY: ${SYSTEM_USER_API_KEY}
-
-      REVA_GATEWAY: gateway:9142
+      REVA_GATEWAY: storage-gateway:9142
     volumes:
       - "ocis-storage-system:/var/lib/ocis"
     logging:
       driver: "local"
     restart: always
 
-  auth-basic:
+  storage-authbasic:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
       replicas: ${OCIS_SCALE:-1}
@@ -579,30 +407,23 @@ services:
       ocis-net:
     entrypoint:
       - ocis
-      - auth-basic
+      - storage-auth-basic
       - server
     environment:
-      AUTH_BASIC_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      AUTH_BASIC_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      AUTH_BASIC_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
-
-      AUTH_BASIC_GRPC_ADDR: 0.0.0.0:9146
-      REVA_GATEWAY: gateway:9142
-      STORAGE_AUTH_BASIC_ENDPOINT: auth-basic:9146
-
-      AUTH_BASIC_JWT_SECRET: ${OCIS_JWT_SECRET}
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      AUTH_BASIC_LDAP_URI: ldaps://idm:9235
-      AUTH_BASIC_LDAP_CACERT: ""
-      AUTH_BASIC_LDAP_INSECURE: "true"
-      AUTH_BASIC_LDAP_BIND_PASSWORD: ${IDM_REVASVC_PASSWORD}
-      AUTH_BASIC_IDP_URL: https://${OCIS_DOMAIN}
+      STORAGE_AUTH_BASIC_GRPC_ADDR: 0.0.0.0:9146
+      STORAGE_AUTH_BASIC_ENDPOINT: storage-authbasic:9146
 
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
 
-  auth-machine:
+  storage-authmachine:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
       replicas: ${OCIS_SCALE:-1}
@@ -610,23 +431,23 @@ services:
       ocis-net:
     entrypoint:
       - ocis
-      - auth-machine
+      - storage-auth-machine
       - server
     environment:
-      AUTH_MACHINE_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      AUTH_MACHINE_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      AUTH_MACHINE_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      AUTH_MACHINE_GRPC_ADDR: 0.0.0.0:9166
+      STORAGE_AUTH_MACHINE_GRPC_ADDR: 0.0.0.0:9148
+      STORAGE_AUTH_MACHINE_ENDPOINT: storage-authmachine:9148
 
-      AUTH_MACHINE_JWT_SECRET: ${OCIS_JWT_SECRET}
-      AUTH_MACHINE_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY}
-      REVA_GATEWAY: gateway:9142
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
 
-  auth-bearer:
+  storage-authbearer:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
       replicas: ${OCIS_SCALE:-1}
@@ -634,19 +455,18 @@ services:
       ocis-net:
     entrypoint:
       - ocis
-      - auth-bearer
+      - storage-auth-bearer
       - server
     environment:
-      AUTH_BEARER_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      AUTH_BEARER_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      AUTH_BEARER_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      AUTH_BEARER_GRPC_ADDR: 0.0.0.0:9148
-
-      AUTH_BEARER_JWT_SECRET: ${OCIS_JWT_SECRET}
-      REVA_GATEWAY: gateway:9142
-      AUTH_BEARER_OIDC_ISSUER: https://${OCIS_DOMAIN}
+      STORAGE_AUTH_BEARER_GRPC_ADDR: 0.0.0.0:9166
+      STORAGE_AUTH_BEARER_ENDPOINT: storage-authbearer:9166
 
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
@@ -662,16 +482,18 @@ services:
       - storage-shares
       - server
     environment:
-      STORAGE_SHARES_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      STORAGE_SHARES_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      STORAGE_SHARES_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
       STORAGE_SHARES_GRPC_ADDR: 0.0.0.0:9154
+      STORAGE_SHARES_ENDPOINT: storage-shares:9154
 
-      STORAGE_SHARES_USER_SHARE_PROVIDER_ENDPOINT: sharing:9150
+      STORAGE_SHARING_ENDPOINT: storage-sharing:9150
 
-      STORAGE_SHARES_JWT_SECRET: ${OCIS_JWT_SECRET}
-      REVA_GATEWAY: gateway:9142
+      STORAGE_TRANSFER_SECRET: ${STORAGE_TRANSFER_SECRET:-replace-me-with-a-transfer-secret}
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
@@ -679,7 +501,7 @@ services:
   storage-users:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
-      replicas: ${OCIS_SCALE:-1}
+      replicas: 1
     networks:
       ocis-net:
     entrypoint:
@@ -687,26 +509,23 @@ services:
       - storage-users
       - server
     environment:
-      STORAGE_USERS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      STORAGE_USERS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      STORAGE_USERS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
       STORAGE_USERS_DATAPROVIDER_INSECURE: "${INSECURE:-false}"
 
       STORAGE_USERS_DRIVER: ocis
 
       STORAGE_USERS_GRPC_ADDR: 0.0.0.0:9157
-      STORAGE_USERS_HTTP_ADDR: 0.0.0.0:9158
+      STORAGE_USERS_ENDPOINT: storage-users:9157
 
+      STORAGE_USERS_HTTP_ADDR: 0.0.0.0:9158
       STORAGE_USERS_DATA_SERVER_URL: http://storage-users:9158/data
 
-      STORAGE_USERS_PERMISSION_ENDPOINT: settings:9191
-      STORAGE_USERS_EVENTS_ENDPOINT: nats:9233
-
-      REVA_GATEWAY: gateway:9142
-
-      STORAGE_USERS_JWT_SECRET: ${OCIS_JWT_SECRET}
-
+      STORAGE_TRANSFER_SECRET: ${STORAGE_TRANSFER_SECRET:-replace-me-with-a-transfer-secret}
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     volumes:
       - "ocis-storage-users:/var/lib/ocis"
     logging:
@@ -721,22 +540,23 @@ services:
       ocis-net:
     entrypoint:
       - ocis
-      - storage-publiclink
+      - storage-public-link
       - server
     environment:
-      STORAGE_PUBLICLINK_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      STORAGE_PUBLICLINK_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      STORAGE_PUBLICLINK_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      STORAGE_PUBLICLINK_GRPC_ADDR: 0.0.0.0:9178
+      STORAGE_PUBLIC_LINK_ENDPOINT: storage-publiclink:9178
+      STORAGE_PUBLIC_LINK_GRPC_ADDR: 0.0.0.0:9178
 
-      STORAGE_PUBLICLINK_JWT_SECRET: ${OCIS_JWT_SECRET}
-      REVA_GATEWAY: gateway:9142
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
 
-  sharing:
+  storage-sharing:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
       replicas: 1
@@ -744,24 +564,27 @@ services:
       ocis-net:
     entrypoint:
       - ocis
-      - sharing
+      - storage-sharing
       - server
     environment:
-      SHARING_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      SHARING_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      SHARING_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      SHARING_GRPC_ADDR: 0.0.0.0:9150
+      STORAGE_SHARING_ENDPOINT: storage-sharing:9150
+      STORAGE_SHARING_GRPC_ADDR: 0.0.0.0:9150
 
-      SHARING_EVENTS_ENDPOINT: nats:9233
+      STORAGE_SHARING_USER_DRIVER: json
+      STORAGE_SHARING_USER_JSON_FILE: /var/lib/ocis/storage/sharing/shares.json
+      STORAGE_SHARING_PUBLIC_DRIVER: json
+      STORAGE_SHARING_PUBLIC_JSON_FILE: /var/lib/ocis/storage/sharing/publicshares.json
 
-      SHARING_JWT_SECRET: ${OCIS_JWT_SECRET}
-      REVA_GATEWAY: gateway:9142
+      STORAGE_SHARING_EVENTS_ADDRESS: nats:9233
 
-      SHARING_USER_DRIVER: json
-      SHARING_PUBLIC_DRIVER: json
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     volumes:
-      - "ocis-sharing:/var/lib/ocis"
+      - "ocis-storage-sharing:/var/lib/ocis"
     logging:
       driver: "local"
     restart: always
@@ -777,20 +600,21 @@ services:
       - users
       - server
     environment:
-      USERS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      USERS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      USERS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      USERS_GRPC_ADDR: 0.0.0.0:9144
-      USERS_LDAP_URI: ldaps://idm:9235
-      USERS_LDAP_CACERT: ""
-      USERS_LDAP_INSECURE: ${INSECURE:-true}
-      USERS_LDAP_BIND_PASSWORD: ${IDM_REVASVC_PASSWORD}
-      USERS_IDP_URL: https://${OCIS_DOMAIN}
+      STORAGE_USERPROVIDER_ENDPOINT: users:9144
+      STORAGE_USERPROVIDER_ADDR: 0.0.0.0:9144
 
-      REVA_GATEWAY: gateway:9142
+      STORAGE_USERPROVIDER_DRIVER: ldap
+      STORAGE_LDAP_URI: "ldaps://glauth:9126"
+      STORAGE_LDAP_INSECURE: "true"
+      STORAGE_LDAP_BIND_PASSWORD: ${STORAGE_LDAP_BIND_PASSWORD:-reva}
+      STORAGE_LDAP_IDP: https://${OCIS_DOMAIN:-ocis.owncloud.test}
 
-      USERS_JWT_SECRET: ${OCIS_JWT_SECRET}
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
@@ -806,26 +630,26 @@ services:
       - groups
       - server
     environment:
-      GROUPS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      GROUPS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      GROUPS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
-
-      GROUPS_GRPC_ADDR: 0.0.0.0:9160
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      GROUPS_LDAP_URI: ldaps://idm:9235
-      GROUPS_LDAP_CACERT: ""
-      GROUPS_LDAP_INSECURE: ${INSECURE:-true}
-      GROUPS_LDAP_BIND_PASSWORD: ${IDM_REVASVC_PASSWORD}
-      GROUPS_IDP_URL: https://${OCIS_DOMAIN}
+      STORAGE_GROUPPROVIDER_ENDPOINT: groups:9160
+      STORAGE_GROUPPROVIDER_ADDR: 0.0.0.0:9160
 
-      REVA_GATEWAY: gateway:9142
+      STORAGE_GROUPPROVIDER_DRIVER: ldap
+      STORAGE_LDAP_URI: "ldaps://glauth:9126"
+      STORAGE_LDAP_INSECURE: "true"
+      STORAGE_LDAP_BIND_PASSWORD: ${STORAGE_LDAP_BIND_PASSWORD:-reva}
+      STORAGE_LDAP_IDP: https://${OCIS_DOMAIN:-ocis.owncloud.test}
 
-      GROUPS_JWT_SECRET: ${OCIS_JWT_SECRET}
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
 
-  frontend:
+  storage-frontend:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
       replicas: ${OCIS_SCALE:-1}
@@ -833,26 +657,30 @@ services:
       ocis-net:
     entrypoint:
       - ocis
-      - frontend
+      - storage-frontend
       - server
     environment:
-      FRONTEND_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      FRONTEND_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      FRONTEND_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      STORAGE_FRONTEND_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      STORAGE_FRONTEND_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      STORAGE_FRONTEND_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
-      FRONTEND_HTTP_ADDR: 0.0.0.0:9140
-      FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN}
+      # FIXME this now lives in a dedicated service
+      APP_PROVIDER_WOPI_INSECURE: "true"
+      STORAGE_FRONTEND_ARCHIVER_INSECURE: "true"
+      STORAGE_FRONTEND_OCDAV_INSECURE: "true"
 
-      FRONTEND_JWT_SECRET: ${OCIS_JWT_SECRET}
-      REVA_GATEWAY: gateway:9142
-      FRONTEND_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY}
-      STORAGE_TRANSFER_SECRET: ${STORAGE_TRANSFER_SECRET}
+      STORAGE_FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}
+      STORAGE_FRONTEND_HTTP_ADDR: 0.0.0.0:9140
 
+      STORAGE_SHARING_ENDPOINT: storage-sharing:9150
+
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
+      REVA_GATEWAY: storage-gateway:9142
     logging:
       driver: "local"
     restart: always
 
-  gateway:
+  storage-gateway:
     image: owncloud/ocis:${OCIS_DOCKER_TAG:-latest}
     deploy:
       replicas: ${OCIS_SCALE:-1}
@@ -860,31 +688,47 @@ services:
       ocis-net:
     entrypoint:
       - ocis
-      - gateway
+      - storage-gateway
       - server
     environment:
-      GATEWAY_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
-      GATEWAY_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      GATEWAY_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
+      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-error}"
+      OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
+      OCIS_LOG_PRETTY: "${OCIS_LOG_PRETTY:-false}"
 
       GATEWAY_GRPC_ADDR: 0.0.0.0:9142
 
-      GATEWAY_FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN}
-
-      GATEWAY_USERS_ENDPOINT: users:9144
-      GATEWAY_GROUPS_ENDPOINT: groups:9160
-      GATEWAY_AUTH_BASIC_ENDPOINT: auth-basic:9146
-      GATEWAY_AUTH_BEARER_ENDPOINT: auth-bearer:9148
-      GATEWAY_AUTH_MACHINE_ENDPOINT: auth-machine:9166
-      GATEWAY_PERMISSIONS_ENDPOINT: settings:9191
-      GATEWAY_SHARING_ENDPOINT: sharing:9150
-      GATEWAY_STORAGE_PUBLIC_LINK_ENDPOINT: storage-publiclink:9178
-      GATEWAY_STORAGE_USERS_ENDPOINT: storage-users:9157
-      GATEWAY_STORAGE_SHARES_ENDPOINT: storage-shares:9154
-      GATEWAY_APP_REGISTRY_ENDPOINT: app-registry:9242
-
-      GATEWAY_JWT_SECRET: ${OCIS_JWT_SECRET}
-      STORAGE_TRANSFER_SECRET: ${STORAGE_TRANSFER_SECRET}
+      REVA_GATEWAY: storage-gateway:9142
+
+      STORAGE_USERS_ENDPOINT: storage-users:9157
+
+      STORAGE_PUBLIC_LINK_ENDPOINT: storage-publiclink:9178
+
+      STORAGE_AUTH_BASIC_ENDPOINT: storage-authbasic:9146
+      STORAGE_AUTH_BEARER_ENDPOINT: storage-authbearer:9166
+      STORAGE_AUTH_MACHINE_ENDPOINT: storage-authmachine:9148
+
+      STORAGE_SHARES_ENDPOINT: storage-shares:9154
+      STORAGE_SHARING_ENDPOINT: sharing:9150
+
+      STORAGE_GROUPPROVIDER_ENDPOINT: groups:9160
+      STORAGE_USERPROVIDER_ENDPOINT: users:9144
+      STORAGE_PERMISSIONS_ENDPOINT: settings:9191
+
+      STORAGE_FRONTEND_PUBLIC_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}
+
+      STORAGE_TRANSFER_SECRET: ${STORAGE_TRANSFER_SECRET:-replace-me-with-a-transfer-secret}
+      STORAGE_JWT_SECRET: ${OCIS_JWT_SECRET:-Pive-Fumkiu4}
     logging:
       driver: "local"
     restart: always
+
+volumes:
+  traefik-certs: null
+  ocis-settings: null
+  ocis-store: null
+  ocis-storage-system: null
+  ocis-storage-users: null
+  ocis-storage-sharing: null
+
+networks:
+  ocis-net:
diff --git a/deployments/examples/ocis_keycloak/docker-compose.yml b/deployments/examples/ocis_keycloak/docker-compose.yml
index 25c550c60ff..334a8304f7e 100644
--- a/deployments/examples/ocis_keycloak/docker-compose.yml
+++ b/deployments/examples/ocis_keycloak/docker-compose.yml
@@ -3,7 +3,7 @@ version: "3.7"
 
 services:
   traefik:
-    image: traefik:v2.6.6
+    image: traefik:v2.5
     networks:
       ocis-net:
         aliases:
diff --git a/deployments/examples/ocis_ldap/docker-compose.yml b/deployments/examples/ocis_ldap/docker-compose.yml
index 81d611d9370..fbdc1dbb903 100644
--- a/deployments/examples/ocis_ldap/docker-compose.yml
+++ b/deployments/examples/ocis_ldap/docker-compose.yml
@@ -3,7 +3,7 @@ version: "3.7"
 
 services:
   traefik:
-    image: traefik:v2.6.6
+    image: traefik:v2.5
     networks:
       ocis-net:
         aliases:
diff --git a/deployments/examples/ocis_s3/docker-compose.yml b/deployments/examples/ocis_s3/docker-compose.yml
index ed5b0ec3d5c..74cb876a6e1 100644
--- a/deployments/examples/ocis_s3/docker-compose.yml
+++ b/deployments/examples/ocis_s3/docker-compose.yml
@@ -3,7 +3,7 @@ version: "3.7"
 
 services:
   traefik:
-    image: traefik:v2.6.6
+    image: traefik:v2.5
     networks:
       ocis-net:
         aliases:
diff --git a/deployments/examples/ocis_traefik/docker-compose.yml b/deployments/examples/ocis_traefik/docker-compose.yml
index b32a90f7bd6..7bdc41ad0f6 100644
--- a/deployments/examples/ocis_traefik/docker-compose.yml
+++ b/deployments/examples/ocis_traefik/docker-compose.yml
@@ -3,7 +3,7 @@ version: "3.7"
 
 services:
   traefik:
-    image: traefik:v2.6.6
+    image: traefik:v2.5
     networks:
       ocis-net:
         aliases:
diff --git a/deployments/examples/ocis_wopi/docker-compose.yml b/deployments/examples/ocis_wopi/docker-compose.yml
index f89038035d9..af3cb4a4a85 100644
--- a/deployments/examples/ocis_wopi/docker-compose.yml
+++ b/deployments/examples/ocis_wopi/docker-compose.yml
@@ -3,7 +3,7 @@ version: "3.7"
 
 services:
   traefik:
-    image: traefik:v2.6.6
+    image: traefik:v2.5
     networks:
       ocis-net:
         aliases:
diff --git a/extensions/graph/pkg/service/v0/drives.go b/extensions/graph/pkg/service/v0/drives.go
index 1880f99d8fb..0b3993d01fa 100644
--- a/extensions/graph/pkg/service/v0/drives.go
+++ b/extensions/graph/pkg/service/v0/drives.go
@@ -7,7 +7,6 @@ import (
 	"math"
 	"net/http"
 	"net/url"
-	"path"
 	"sort"
 	"strconv"
 	"strings"
@@ -582,9 +581,8 @@ func (g Graph) cs3StorageSpaceToDrive(ctx context.Context, baseURL *url.URL, spa
 		// TODO read from StorageSpace ... needs Opaque for now
 		// TODO how do we build the url?
 		// for now: read from request
-		webDavURL := *baseURL
-		webDavURL.Path = path.Join(webDavURL.Path, spaceID)
-		drive.Root.WebDavUrl = libregraph.PtrString(webDavURL.String())
+		webDavURL := baseURL.String() + spaceID
+		drive.Root.WebDavUrl = &webDavURL
 	}
 
 	// TODO The public space has no owner ... should we even show it?
diff --git a/go.mod b/go.mod
index 1fa123ed667..2606d43f9d4 100644
--- a/go.mod
+++ b/go.mod
@@ -7,10 +7,10 @@ require (
 	github.com/Masterminds/semver v1.5.0
 	github.com/ReneKroon/ttlcache/v2 v2.11.0
 	github.com/blevesearch/bleve/v2 v2.3.2
-	github.com/blevesearch/bleve_index_api v1.0.2
+	github.com/blevesearch/bleve_index_api v1.0.1
 	github.com/coreos/go-oidc/v3 v3.2.0
-	github.com/cs3org/go-cs3apis v0.0.0-20220412090512-93c5918b4bde
-	github.com/cs3org/reva/v2 v2.4.2-0.20220601110755-6b47effc3759
+	github.com/cs3org/go-cs3apis v0.0.0-20220512100524-551800f020d8
+	github.com/cs3org/reva/v2 v2.4.2-0.20220607110316-1e461b750389
 	github.com/disintegration/imaging v1.6.2
 	github.com/go-chi/chi/v5 v5.0.7
 	github.com/go-chi/cors v1.2.1
@@ -34,7 +34,7 @@ require (
 	github.com/gofrs/uuid v4.2.0+incompatible
 	github.com/golang-jwt/jwt/v4 v4.4.1
 	github.com/golang/protobuf v1.5.2
-	github.com/gookit/config/v2 v2.1.2
+	github.com/gookit/config/v2 v2.1.1
 	github.com/gorilla/mux v1.8.0
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.10.2
 	github.com/justinas/alice v1.2.0
diff --git a/go.sum b/go.sum
index eb32122670d..9cb18cb92f0 100644
--- a/go.sum
+++ b/go.sum
@@ -178,9 +178,8 @@ github.com/bits-and-blooms/bitset v1.2.1/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edY
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
 github.com/blevesearch/bleve/v2 v2.3.2 h1:BJUnMhi2nrkl+vboHmKfW+9l+tJSj39HeWa5c3BN3/Y=
 github.com/blevesearch/bleve/v2 v2.3.2/go.mod h1:96+xE5pZUOsr3Y4vHzV1cBC837xZCpwLlX0hrrxnvIg=
+github.com/blevesearch/bleve_index_api v1.0.1 h1:nx9++0hnyiGOHJwQQYfsUGzpRdEVE5LsylmmngQvaFk=
 github.com/blevesearch/bleve_index_api v1.0.1/go.mod h1:fiwKS0xLEm+gBRgv5mumf0dhgFr2mDgZah1pqv1c1M4=
-github.com/blevesearch/bleve_index_api v1.0.2 h1:rO736FwEPMVY1mGi7d4n7CgBB3+tB7uYN7QTjR+Ij+s=
-github.com/blevesearch/bleve_index_api v1.0.2/go.mod h1:fiwKS0xLEm+gBRgv5mumf0dhgFr2mDgZah1pqv1c1M4=
 github.com/blevesearch/go-metrics v0.0.0-20190826022208-cac0b30c2563/go.mod h1:9eJDeqxJ3E7WnLebQUlPD7ZjSce7AnDb9vjGmMCbD0A=
 github.com/blevesearch/go-porterstemmer v1.0.3 h1:GtmsqID0aZdCSNiY8SkuPJ12pD4jI+DdXTAn4YRcHCo=
 github.com/blevesearch/go-porterstemmer v1.0.3/go.mod h1:angGc5Ht+k2xhJdZi511LtmxuEf0OVpvUUNrwmM1P7M=
@@ -296,10 +295,10 @@ github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3p
 github.com/crewjam/saml v0.4.6 h1:XCUFPkQSJLvzyl4cW9OvpWUbRf0gE7VUpU8ZnilbeM4=
 github.com/crewjam/saml v0.4.6/go.mod h1:ZBOXnNPFzB3CgOkRm7Nd6IVdkG+l/wF+0ZXLqD96t1A=
 github.com/cs3org/cato v0.0.0-20200828125504-e418fc54dd5e/go.mod h1:XJEZ3/EQuI3BXTp/6DUzFr850vlxq11I6satRtz0YQ4=
-github.com/cs3org/go-cs3apis v0.0.0-20220412090512-93c5918b4bde h1:WrD9O8ZaWvsm0eBzpzVBIuczDhqVq50Nmjc7PGHHA9Y=
-github.com/cs3org/go-cs3apis v0.0.0-20220412090512-93c5918b4bde/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
-github.com/cs3org/reva/v2 v2.4.2-0.20220601110755-6b47effc3759 h1:caNJk02Z1S/49qJVYsxBXYxyrMVRpJgNbxux/5P09Jc=
-github.com/cs3org/reva/v2 v2.4.2-0.20220601110755-6b47effc3759/go.mod h1:uGeTncJa3FISh8AERkbZYVNXFV40PjYyRht5L09i+LQ=
+github.com/cs3org/go-cs3apis v0.0.0-20220512100524-551800f020d8 h1:31jPSD5BOjc4+h4xK1e+NFf34gtwHEexor3V7JbdcPM=
+github.com/cs3org/go-cs3apis v0.0.0-20220512100524-551800f020d8/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
+github.com/cs3org/reva/v2 v2.4.2-0.20220607110316-1e461b750389 h1:4UylXWCA1/KrxAP4xyQYDAXULMawx3EwgEPZoL5UbI0=
+github.com/cs3org/reva/v2 v2.4.2-0.20220607110316-1e461b750389/go.mod h1:XflInIn7f9DbWrdFgQjfzQEN5ctdBBc1+OEn15zNDeo=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
@@ -636,8 +635,8 @@ github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pf
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
 github.com/gookit/color v1.5.0 h1:1Opow3+BWDwqor78DcJkJCIwnkviFi+rrOANki9BUFw=
 github.com/gookit/color v1.5.0/go.mod h1:43aQb+Zerm/BWh2GnrgOQm7ffz7tvQXEKV6BFMl7wAo=
-github.com/gookit/config/v2 v2.1.2 h1:qPW58LTY8CTOnHFN9r9q2NU3jk+6UQ+JYWV6x2JepH4=
-github.com/gookit/config/v2 v2.1.2/go.mod h1:IPaiN75J82aoFsavbpK8SazWLQ0Y4QOYjucqA3ggiVM=
+github.com/gookit/config/v2 v2.1.1 h1:pVeNDfvpFC62mvMk5vYDLNmPxtjYIok4I0r7iq7TY50=
+github.com/gookit/config/v2 v2.1.1/go.mod h1:IPaiN75J82aoFsavbpK8SazWLQ0Y4QOYjucqA3ggiVM=
 github.com/gookit/goutil v0.5.0/go.mod h1:pq1eTibwb2wN96jrci0xy7xogWzzo9CihOQJEAvz4yQ=
 github.com/gookit/goutil v0.5.2 h1:1IbfIUiRV+Y+5IdgBeb/O7hWvq8OnnP1+sB/Ua2Q6jE=
 github.com/gookit/goutil v0.5.2/go.mod h1:pq1eTibwb2wN96jrci0xy7xogWzzo9CihOQJEAvz4yQ=
diff --git a/ocis-pkg/config/parser/parse.go b/ocis-pkg/config/parser/parse.go
index 0354b222b0f..e10ca0b6c38 100644
--- a/ocis-pkg/config/parser/parse.go
+++ b/ocis-pkg/config/parser/parse.go
@@ -11,7 +11,7 @@ import (
 // ParseConfig loads the ocis configuration and
 // copies applicable parts into the commons part, from
 // where the extensions can copy it into their own config
-func ParseConfig(cfg *config.Config, skipValidate bool) error {
+func ParseConfig(cfg *config.Config) error {
 	_, err := config.BindSourcesToStructs("ocis", cfg)
 	if err != nil {
 		return err
@@ -29,10 +29,6 @@ func ParseConfig(cfg *config.Config, skipValidate bool) error {
 
 	EnsureCommons(cfg)
 
-	if skipValidate {
-		return nil
-	}
-
 	return Validate(cfg)
 }
 
diff --git a/ocis/pkg/command/app-provider.go b/ocis/pkg/command/app-provider.go
index 0ebd0272451..38716eb7ddf 100644
--- a/ocis/pkg/command/app-provider.go
+++ b/ocis/pkg/command/app-provider.go
@@ -18,7 +18,7 @@ func AppProviderCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.AppProvider.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.AppProvider.Commons = cfg.Commons
diff --git a/ocis/pkg/command/app-registry.go b/ocis/pkg/command/app-registry.go
index a859f035286..c366edf83d7 100644
--- a/ocis/pkg/command/app-registry.go
+++ b/ocis/pkg/command/app-registry.go
@@ -18,7 +18,7 @@ func AppRegistryCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.AppRegistry.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.AppRegistry.Commons = cfg.Commons
diff --git a/ocis/pkg/command/audit.go b/ocis/pkg/command/audit.go
index 3978adf5152..0ad70292e65 100644
--- a/ocis/pkg/command/audit.go
+++ b/ocis/pkg/command/audit.go
@@ -18,7 +18,7 @@ func AuditCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Audit.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Audit.Commons = cfg.Commons
diff --git a/ocis/pkg/command/auth-basic.go b/ocis/pkg/command/auth-basic.go
index 1a61993d36b..ae36c5cdc8e 100644
--- a/ocis/pkg/command/auth-basic.go
+++ b/ocis/pkg/command/auth-basic.go
@@ -18,7 +18,7 @@ func AuthBasicCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.AuthBasic.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.AuthBasic.Commons = cfg.Commons
diff --git a/ocis/pkg/command/auth-bearer.go b/ocis/pkg/command/auth-bearer.go
index d30be5f6d5e..7681feb741c 100644
--- a/ocis/pkg/command/auth-bearer.go
+++ b/ocis/pkg/command/auth-bearer.go
@@ -18,7 +18,7 @@ func AuthBearerCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.AuthBearer.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.AuthBearer.Commons = cfg.Commons
diff --git a/ocis/pkg/command/auth-machine.go b/ocis/pkg/command/auth-machine.go
index 485e7ddd026..3d8b820b4b1 100644
--- a/ocis/pkg/command/auth-machine.go
+++ b/ocis/pkg/command/auth-machine.go
@@ -18,7 +18,7 @@ func AuthMachineCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.AuthMachine.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.AuthMachine.Commons = cfg.Commons
diff --git a/ocis/pkg/command/frontend.go b/ocis/pkg/command/frontend.go
index cd31c90bb23..a452acfdbfd 100644
--- a/ocis/pkg/command/frontend.go
+++ b/ocis/pkg/command/frontend.go
@@ -18,7 +18,7 @@ func FrontendCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Frontend.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Frontend.Commons = cfg.Commons
diff --git a/ocis/pkg/command/gateway.go b/ocis/pkg/command/gateway.go
index 2e7e8b08dbf..b8ef9d66b32 100644
--- a/ocis/pkg/command/gateway.go
+++ b/ocis/pkg/command/gateway.go
@@ -18,7 +18,7 @@ func GatewayCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Gateway.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Gateway.Commons = cfg.Commons
diff --git a/ocis/pkg/command/graph-explorer.go b/ocis/pkg/command/graph-explorer.go
index 0f7a8f2cf74..ded382c6ac0 100644
--- a/ocis/pkg/command/graph-explorer.go
+++ b/ocis/pkg/command/graph-explorer.go
@@ -18,7 +18,7 @@ func GraphExplorerCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.GraphExplorer.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.GraphExplorer.Commons = cfg.Commons
diff --git a/ocis/pkg/command/graph.go b/ocis/pkg/command/graph.go
index fd604075ce2..6e923003971 100644
--- a/ocis/pkg/command/graph.go
+++ b/ocis/pkg/command/graph.go
@@ -18,7 +18,7 @@ func GraphCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Graph.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Graph.Commons = cfg.Commons
diff --git a/ocis/pkg/command/groups.go b/ocis/pkg/command/groups.go
index efce3edcfcd..4be4fe6c973 100644
--- a/ocis/pkg/command/groups.go
+++ b/ocis/pkg/command/groups.go
@@ -18,7 +18,7 @@ func GroupsCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Groups.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Groups.Commons = cfg.Commons
diff --git a/ocis/pkg/command/idm.go b/ocis/pkg/command/idm.go
index 70d116f41ce..d5cec2a2341 100644
--- a/ocis/pkg/command/idm.go
+++ b/ocis/pkg/command/idm.go
@@ -18,7 +18,7 @@ func IDMCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.IDM.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.IDM.Commons = cfg.Commons
diff --git a/ocis/pkg/command/idp.go b/ocis/pkg/command/idp.go
index 71923b108b9..e81f3f899d1 100644
--- a/ocis/pkg/command/idp.go
+++ b/ocis/pkg/command/idp.go
@@ -18,7 +18,7 @@ func IDPCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.IDP.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.IDP.Commons = cfg.Commons
diff --git a/ocis/pkg/command/nats.go b/ocis/pkg/command/nats.go
index 31575f5e01a..0fec2f10a2e 100644
--- a/ocis/pkg/command/nats.go
+++ b/ocis/pkg/command/nats.go
@@ -18,7 +18,7 @@ func NatsCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Nats.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Nats.Commons = cfg.Commons
diff --git a/ocis/pkg/command/notifications.go b/ocis/pkg/command/notifications.go
index a5580bde554..de65b4a89a9 100644
--- a/ocis/pkg/command/notifications.go
+++ b/ocis/pkg/command/notifications.go
@@ -18,7 +18,7 @@ func NotificationsCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Notifications.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Notifications.Commons = cfg.Commons
diff --git a/ocis/pkg/command/ocdav.go b/ocis/pkg/command/ocdav.go
index 57f5e73140c..1c5573152b4 100644
--- a/ocis/pkg/command/ocdav.go
+++ b/ocis/pkg/command/ocdav.go
@@ -18,7 +18,7 @@ func OCDavCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.OCDav.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.OCDav.Commons = cfg.Commons
diff --git a/ocis/pkg/command/ocs.go b/ocis/pkg/command/ocs.go
index 8b5065a4fcd..ca1bfd40d70 100644
--- a/ocis/pkg/command/ocs.go
+++ b/ocis/pkg/command/ocs.go
@@ -18,7 +18,7 @@ func OCSCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.OCS.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.OCS.Commons = cfg.Commons
diff --git a/ocis/pkg/command/proxy.go b/ocis/pkg/command/proxy.go
index 51eb65b2a0e..9b43562d81c 100644
--- a/ocis/pkg/command/proxy.go
+++ b/ocis/pkg/command/proxy.go
@@ -18,7 +18,7 @@ func ProxyCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Proxy.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Proxy.Commons = cfg.Commons
diff --git a/ocis/pkg/command/search.go b/ocis/pkg/command/search.go
index f19e6a607f6..0998b8cf34d 100644
--- a/ocis/pkg/command/search.go
+++ b/ocis/pkg/command/search.go
@@ -18,7 +18,7 @@ func SearchCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Search.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Search.Commons = cfg.Commons
diff --git a/ocis/pkg/command/server.go b/ocis/pkg/command/server.go
index 2ca6399006f..d5483498312 100644
--- a/ocis/pkg/command/server.go
+++ b/ocis/pkg/command/server.go
@@ -17,7 +17,7 @@ func Server(cfg *config.Config) *cli.Command {
 		Usage:    "start a fullstack server (runtime and all extensions in supervised mode)",
 		Category: "fullstack",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, false); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 				return err
 			}
diff --git a/ocis/pkg/command/settings.go b/ocis/pkg/command/settings.go
index 4c6257f5d4b..9b732823db8 100644
--- a/ocis/pkg/command/settings.go
+++ b/ocis/pkg/command/settings.go
@@ -18,7 +18,7 @@ func SettingsCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Settings.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Settings.Commons = cfg.Commons
diff --git a/ocis/pkg/command/sharing.go b/ocis/pkg/command/sharing.go
index a3feca244a8..84ece22a29a 100644
--- a/ocis/pkg/command/sharing.go
+++ b/ocis/pkg/command/sharing.go
@@ -18,7 +18,7 @@ func SharingCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Sharing.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Sharing.Commons = cfg.Commons
diff --git a/ocis/pkg/command/storage-publiclink.go b/ocis/pkg/command/storage-publiclink.go
index a120d71e663..e858d29351f 100644
--- a/ocis/pkg/command/storage-publiclink.go
+++ b/ocis/pkg/command/storage-publiclink.go
@@ -18,7 +18,7 @@ func StoragePublicLinkCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.StoragePublicLink.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.StoragePublicLink.Commons = cfg.Commons
diff --git a/ocis/pkg/command/storage-shares.go b/ocis/pkg/command/storage-shares.go
index 8c066096b21..955284098d2 100644
--- a/ocis/pkg/command/storage-shares.go
+++ b/ocis/pkg/command/storage-shares.go
@@ -18,7 +18,7 @@ func StorageSharesCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.StorageShares.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.StorageShares.Commons = cfg.Commons
diff --git a/ocis/pkg/command/storage-system.go b/ocis/pkg/command/storage-system.go
index 72d61cf0f34..639f68e5173 100644
--- a/ocis/pkg/command/storage-system.go
+++ b/ocis/pkg/command/storage-system.go
@@ -18,7 +18,7 @@ func StorageSystemCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.StorageSystem.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.StorageSystem.Commons = cfg.Commons
diff --git a/ocis/pkg/command/storage-users.go b/ocis/pkg/command/storage-users.go
index 44a1486129c..79ab201e7f7 100644
--- a/ocis/pkg/command/storage-users.go
+++ b/ocis/pkg/command/storage-users.go
@@ -18,7 +18,7 @@ func StorageUsersCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.StorageUsers.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.StorageUsers.Commons = cfg.Commons
diff --git a/ocis/pkg/command/store.go b/ocis/pkg/command/store.go
index addde0baf86..f0ca9e55c2f 100644
--- a/ocis/pkg/command/store.go
+++ b/ocis/pkg/command/store.go
@@ -19,7 +19,7 @@ func StoreCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Store.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Store.Commons = cfg.Commons
diff --git a/ocis/pkg/command/thumbnails.go b/ocis/pkg/command/thumbnails.go
index 82ec98f28ae..3c7a288f905 100644
--- a/ocis/pkg/command/thumbnails.go
+++ b/ocis/pkg/command/thumbnails.go
@@ -18,7 +18,7 @@ func ThumbnailsCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Thumbnails.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Thumbnails.Commons = cfg.Commons
diff --git a/ocis/pkg/command/users.go b/ocis/pkg/command/users.go
index f1cce21b6c8..fd93235c7a9 100644
--- a/ocis/pkg/command/users.go
+++ b/ocis/pkg/command/users.go
@@ -18,7 +18,7 @@ func UsersCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Users.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Users.Commons = cfg.Commons
diff --git a/ocis/pkg/command/web.go b/ocis/pkg/command/web.go
index 1255b71c7ba..35c2d9dd392 100644
--- a/ocis/pkg/command/web.go
+++ b/ocis/pkg/command/web.go
@@ -18,7 +18,7 @@ func WebCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.Web.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.Web.Commons = cfg.Commons
diff --git a/ocis/pkg/command/webdav.go b/ocis/pkg/command/webdav.go
index d747f567b5f..a8919b23b53 100644
--- a/ocis/pkg/command/webdav.go
+++ b/ocis/pkg/command/webdav.go
@@ -19,7 +19,7 @@ func WebDAVCommand(cfg *config.Config) *cli.Command {
 		Usage:    helper.SubcommandDescription(cfg.WebDAV.Service.Name),
 		Category: "extensions",
 		Before: func(c *cli.Context) error {
-			if err := parser.ParseConfig(cfg, true); err != nil {
+			if err := parser.ParseConfig(cfg); err != nil {
 				fmt.Printf("%v", err)
 			}
 			cfg.WebDAV.Commons = cfg.Commons


Test patch:
diff --git a/deployments/continuous-deployment-config/ocis_individual_services/latest.yml b/deployments/continuous-deployment-config/ocis_individual_services/latest.yml
index 527549da258..76428fa94b8 100644
--- a/deployments/continuous-deployment-config/ocis_individual_services/latest.yml
+++ b/deployments/continuous-deployment-config/ocis_individual_services/latest.yml
@@ -38,19 +38,6 @@
           OCIS_DOMAIN: ocis.ocis-individual-services.latest.owncloud.works
           DEMO_USERS: "true"
           COMPOSE_FILE: docker-compose.yml:monitoring_tracing/docker-compose-additions.yml
-          IDP_LDAP_BIND_PASSWORD: "elirwlketrwe53453rt"
-          STORAGE_LDAP_BIND_PASSWORD: "ekrwelkjrtlkwertjlkertkert3423"
-          OCIS_JWT_SECRET: "kdfjlkertlk234534534589345"
-          OCIS_MACHINE_AUTH_API_KEY: "rekwelkrjttwer534534-5"
-          SYSTEM_USER_API_KEY: "ekrjwelrtj235345345g,mdfglk.ert"
-          IDM_SVC_PASSWORD: "kljrhewrlkj3479734534t"
-          IDM_REVASVC_PASSWORD: "lklkjhuihir2342839i90o4dsadsd"
-          IDM_IDPSVC_PASSWORD: "jrhekr3453458734tkjert"
-          OCIS_SYSTEM_USER_ID: "d9d0f4d1-fe3c-457e-92e3-e18b3b366bbe"
-          SYSTEM_USER_ID: "3693ecf8-4164-4879-bdf3-ea3425df3c6e"
-          ADMIN_USER_ID: "09246a85-682a-4cd5-996d-8e8d2aca50af"
-          ADMIN_USER_PASSWORD: "admin"
-          PROXY_ENABLE_BASIC_AUTH: "true"
       - name: monitoring
         git_url: https://github.com/owncloud-devops/monitoring-tracing-client.git
         ref: master
diff --git a/extensions/graph/pkg/service/v0/graph_test.go b/extensions/graph/pkg/service/v0/graph_test.go
index 89ce1fb0241..a2c7dc74bee 100644
--- a/extensions/graph/pkg/service/v0/graph_test.go
+++ b/extensions/graph/pkg/service/v0/graph_test.go
@@ -7,7 +7,6 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"time"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
@@ -246,12 +245,11 @@ var _ = Describe("Graph", func() {
 			Expect(err).ToNot(HaveOccurred())
 			Expect(len(response["value"])).To(Equal(1))
 			value := response["value"][0]
-			webdavURL, _ := url.PathUnescape(*value.Root.WebDavUrl)
 			Expect(*value.DriveAlias).To(Equal("mountpoint/new-folder"))
 			Expect(*value.DriveType).To(Equal("mountpoint"))
 			Expect(*value.Id).To(Equal("prID$aID!differentID"))
 			Expect(*value.Name).To(Equal("New Folder"))
-			Expect(webdavURL).To(Equal("https://localhost:9200/dav/spaces/prID$aID!differentID"))
+			Expect(*value.Root.WebDavUrl).To(Equal("https://localhost:9200/dav/spaces/prID$aID!differentID"))
 			Expect(*value.Root.ETag).To(Equal("101112131415"))
 			Expect(*value.Root.Id).To(Equal("prID$aID!differentID"))
 			Expect(*value.Root.RemoteItem.ETag).To(Equal("123456789"))
diff --git a/tests/acceptance/expected-failures-API-on-OCIS-storage.md b/tests/acceptance/expected-failures-API-on-OCIS-storage.md
index c448942aea0..c457e3df6a9 100644
--- a/tests/acceptance/expected-failures-API-on-OCIS-storage.md
+++ b/tests/acceptance/expected-failures-API-on-OCIS-storage.md
@@ -1328,11 +1328,6 @@ And other missing implementation of favorites
 - [apiWebdavUploadTUS/optionsRequest.feature:85](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiWebdavUploadTUS/optionsRequest.feature#L85)
 - [apiWebdavUploadTUS/optionsRequest.feature:100](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiWebdavUploadTUS/optionsRequest.feature#L100)
 
-#### [Share inaccessible if folder with same name was deleted and recreated](https://github.com/owncloud/ocis/issues/1787)
-
-- [apiShareReshareToShares1/reShare.feature:259](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiShareReshareToShares1/reShare.feature#L259)
-- [apiShareReshareToShares1/reShare.feature:260](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiShareReshareToShares1/reShare.feature#L260)
-
 #### [Trying to accept a share with invalid ID gives incorrect OCS and HTTP status](https://github.com/owncloud/ocis/issues/2111)
 
 - [apiShareOperationsToShares2/shareAccessByID.feature:85](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiShareOperationsToShares2/shareAccessByID.feature#L85)