WhatsApp/Signal/Formstack/admin updates

2025-11-21 14:55:28 +01:00 · 2025-11-21 14:55:28 +01:00 · d0cc5a21de
commit d0cc5a21de
parent bcecf61a46
451 changed files with 16139 additions and 39623 deletions
--- a/docker/buildx/Dockerfile
+++ b/docker/buildx/Dockerfile
@ -1,3 +1,4 @@
+FROM node:22-alpine AS node
 FROM docker:git

 RUN set -ex; \
@ -5,7 +6,22 @@ RUN set -ex; \
  make \
  curl \
  bash \
-  jq  ;
+  jq \
+  libstdc++ ;
+
+# Copy Node.js 22 from official image
+COPY --from=node /usr/lib /usr/lib
+COPY --from=node /usr/local/lib /usr/local/lib
+COPY --from=node /usr/local/include /usr/local/include
+COPY --from=node /usr/local/bin /usr/local/bin
+
+# Prepare pnpm (corepack is already enabled in node:22-alpine)
+RUN corepack prepare pnpm@9.15.4 --activate
+
+# Set up pnpm home
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+
 COPY --from=docker/buildx-bin /buildx /usr/libexec/docker/cli-plugins/docker-buildx
 RUN docker buildx install
 RUN docker buildx version
--- a/docker/compose/bridge-whatsapp.yml
+++ b/docker/compose/bridge-whatsapp.yml
@ -0,0 +1,20 @@
+services:
+  bridge-whatsapp:
+    container_name: bridge-whatsapp
+    build:
+      context: ../../
+      dockerfile: ./apps/bridge-whatsapp/Dockerfile
+    image: registry.gitlab.com/digiresilience/link/link-stack/bridge-whatsapp:${LINK_STACK_VERSION}
+    restart: ${RESTART}
+    environment:
+      PORT: 5000
+      NODE_ENV: production
+      BRIDGE_FRONTEND_URL: http://link:3000/link
+    volumes:
+      - bridge-whatsapp-data:/home/node/baileys
+    ports:
+      - 5000:5000
+
+volumes:
+  bridge-whatsapp-data:
+    driver: local
--- a/docker/compose/bridge.yml
+++ b/docker/compose/bridge.yml
@ -4,38 +4,37 @@ x-global-vars: &common-global-variables
 x-bridge-vars: &common-bridge-variables
  DATABASE_HOST: "postgresql"
  DATABASE_NAME: "cdr"
+  DATABASE_PORT: "5432"
  DATABASE_USER: ${DATABASE_USER}
  DATABASE_ROOT_OWNER: "root"
  DATABASE_ROOT_PASSWORD: ${BRIDGE_DATABASE_ROOT_PASSWORD}
  DATABASE_OWNER: ${DATABASE_USER}
  DATABASE_PASSWORD: ${DATABASE_PASSWORD}
-  DATABASE_URL: "postgresql://bridge:${DATABASE_PASSWORD}@postgresql/cdr"
-  WORKER_DATABASE_URL: "postgresql://bridge:${DATABASE_PASSWORD}@postgresql/cdr"
-  SHADOW_DATABASE_URL: "postgresql://bridge:${DATABASE_PASSWORD}@postgresql/cdr_shadow"
-  ROOT_DATABASE_URL: "postgresql://bridge:${DATABASE_PASSWORD}@postgresql/template1"
-  APP_ROOT_DATABASE_URL: "postgresql://root:${BRIDGE_DATABASE_ROOT_PASSWORD}@postgresql/bridge"
-  DATABASE_AUTH_URL: "postgresql://app_graphile_auth:${BRIDGE_DATABASE_AUTHENTICATOR_PASSWORD}@postgresql/cdr"
+  DATABASE_URL: "postgresql://${DATABASE_USER}:${DATABASE_PASSWORD}@postgresql/cdr"
+  WORKER_DATABASE_URL: "postgresql://${DATABASE_USER}:${DATABASE_PASSWORD}@postgresql/cdr"
+  SHADOW_DATABASE_URL: "postgresql://${DATABASE_USER}:${DATABASE_PASSWORD}@postgresql/cdr_shadow"
+  ROOT_DATABASE_URL: "postgresql://${DATABASE_USER}:${DATABASE_PASSWORD}@postgresql/template1"
+  APP_ROOT_DATABASE_URL: "postgresql://zammad:${ZAMMAD_DATABASE_PASSWORD}@postgresql/zammad_production"
+  DATABASE_AUTH_URL: "postgresql://${DATABASE_USER}:${DATABASE_PASSWORD}@postgresql/cdr"
  FRONTEND_URL: ${BRIDGE_DOMAIN}
  API_URL: "http://bridge-api:3001"
  NEXTAUTH_URL: ${BRIDGE_DOMAIN}
  NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
  BRIDGE_SIGNAL_URL: ${BRIDGE_SIGNAL_URL}
+  BRIDGE_SIGNAL_AUTO_GROUPS: ${BRIDGE_SIGNAL_AUTO_GROUPS}
+  BRIDGE_WHATSAPP_URL: "http://bridge-whatsapp:5000"
+  LOG_LEVEL: "debug"
+  ZAMMAD_API_TOKEN: ${ZAMMAD_API_TOKEN}
+  ZAMMAD_URL: ${ZAMMAD_URL}
+  FORMSTACK_SHARED_SECRET: ${FORMSTACK_SHARED_SECRET}
+  FORMSTACK_FIELD_MAPPING: ${FORMSTACK_FIELD_MAPPING}

 services:
-  bridge-frontend:
-    build:
-      context: ../../
-      dockerfile: ./apps/bridge-frontend/Dockerfile
-    container_name: bridge-frontend
-    restart: ${RESTART}
-    ports:
-      - 8006:3000
-    environment: *common-bridge-variables
-
  bridge-worker:
    build:
      context: ../../
      dockerfile: ./apps/bridge-worker/Dockerfile
    container_name: bridge-worker
+    image: registry.gitlab.com/digiresilience/link/link-stack/bridge-worker:${LINK_STACK_VERSION}
    restart: ${RESTART}
    environment: *common-bridge-variables
--- a/docker/compose/leafcutter.yml
+++ b/docker/compose/leafcutter.yml
@ -1,15 +0,0 @@
-services:
-  leafcutter:
-    container_name: leafcutter
-    restart: ${RESTART}
-    build:
-      context: ../../
-      dockerfile: ./apps/leafcutter/Dockerfile
-    image: registry.gitlab.com/digiresilience/link/link-stack/leafcutter:${LINK_STACK_VERSION}
-    expose:
-      - "3000"
-    ports:
-      - "8005:3000"
-    environment:
-      NEXTAUTH_URL: ${LINK_URL}
-      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
--- a/docker/compose/link.yml
+++ b/docker/compose/link.yml
@ -14,11 +14,11 @@ services:
      ZAMMAD_API_TOKEN: ${ZAMMAD_API_TOKEN}
      ZAMMAD_VIRUAL_HOST: ${ZAMMAD_VIRTUAL_HOST}
      LINK_URL: ${LINK_URL}
-      LEAFCUTTER_URL: https://lc.digiresilience.org
      BRIDGE_URL: http://bridge-frontend:3000
      BRIDGE_SIGNAL_URL: http://signal-cli-rest-api:8080
-      BRIDGE_WHATSAPP_URL: http://bridge-whatsapp:3000
+      BRIDGE_WHATSAPP_URL: http://bridge-whatsapp:5000
      ZAMMAD_URL: http://zammad-nginx:8080
+      REDIS_URL: "redis://zammad-redis:6379"
      NEXTAUTH_URL: ${LINK_URL}/api/auth
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      NEXTAUTH_AUDIENCE: ${NEXTAUTH_AUDIENCE}
@ -32,3 +32,5 @@ services:
      DATABASE_USER: ${DATABASE_USER}
      DATABASE_PASSWORD: ${DATABASE_PASSWORD}
      DATABASE_URL: ${DATABASE_URL}
+      FORMSTACK_SHARED_SECRET: ${FORMSTACK_SHARED_SECRET}
+      LOG_LEVEL: debug
--- a/docker/compose/opensearch.yml
+++ b/docker/compose/opensearch.yml
@ -6,8 +6,8 @@ services:
    restart: ${RESTART}
    environment:
      - discovery.type=single-node
-      # - plugins.security.ssl.transport.enforce_hostname_verification=false
-      # - plugins.security.ssl.transport.resolve_hostname=false
+      - plugins.security.ssl.transport.enforce_hostname_verification=false
+      - plugins.security.ssl.transport.resolve_hostname=false
      - cluster.routing.allocation.disk.watermark.low=3gb
      - cluster.routing.allocation.disk.watermark.high=2gb
      - cluster.routing.allocation.disk.watermark.flood_stage=500mb
@ -31,8 +31,8 @@ services:
      - opensearch-data:/usr/share/opensearch/data
      - ../opensearch/config.yml:/usr/share/opensearch/config/opensearch-security/config.yml
    ports:
-      - 9200:9200
-      - 9600:9600
+      - 127.0.0.1:9200:9200
+      - 127.0.0.1:9600:9600

  opensearch-dashboards:
    container_name: opensearch-dashboards
@ -40,17 +40,17 @@ services:
    image: registry.gitlab.com/digiresilience/link/link-stack/opensearch-dashboards:${LINK_STACK_VERSION}
    restart: ${RESTART}
    ports:
-      - 5601:5601
+      - 127.0.0.1:5601:5601
    expose:
      - "5601"
    volumes:
      - ../opensearch-dashboards/opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
    environment:
      OPENSEARCH_HOSTS: '["https://opensearch:9200"]'
-      # OPENSEARCH_SECURITY_AUTH_TYPE: "proxy"
-      # OPENSEARCH_SECURITY_PROXYCACHE_USER_HEADER: "x-proxy-user"
-      # OPENSEARCH_SECURITY_PROXYCACHE_ROLES_HEADER: "x-proxy-roles"
-      # OPENSEARCH_REQUESTHEADERSALLOWLIST: '["securitytenant","Authorization","x-forwarded-for","x-proxy-user","x-proxy-roles"]'
+      OPENSEARCH_SECURITY_AUTH_TYPE: "proxy"
+      OPENSEARCH_SECURITY_PROXYCACHE_USER_HEADER: "x-proxy-user"
+      OPENSEARCH_SECURITY_PROXYCACHE_ROLES_HEADER: "x-proxy-roles"
+      OPENSEARCH_REQUESTHEADERSALLOWLIST: '["securitytenant","Authorization","x-forwarded-for","x-proxy-user","x-proxy-roles"]'

 volumes:
  opensearch-data:
--- a/docker/compose/postgresql.yml
+++ b/docker/compose/postgresql.yml
@ -48,7 +48,7 @@ services:
    image: registry.gitlab.com/digiresilience/link/link-stack/postgresql:${LINK_STACK_VERSION}
    restart: ${RESTART}
    ports:
-      - 5432:5432
+      - 5433:5432
    volumes:
      - postgresql-data:/var/lib/postgresql/data

--- a/docker/compose/signal-cli-rest-api.yml
+++ b/docker/compose/signal-cli-rest-api.yml
@ -1,7 +1,8 @@
 services:
  signal-cli-rest-api:
+    container_name: signal-cli-rest-api
+    build: ../signal-cli-rest-api
    image: registry.gitlab.com/digiresilience/link/link-stack/signal-cli-rest-api:develop
-    platform: linux/amd64
    environment:
      - MODE=normal
    volumes:
--- a/docker/compose/zammad.yml
+++ b/docker/compose/zammad.yml
@ -14,10 +14,14 @@ x-zammad-vars: &common-zammad-variables
  ELASTICSEARCH_PASS: ${OPENSEARCH_ADMIN_PASSWORD}
  ELASTICSEARCH_SSL_VERIFY: "false" # this doesn't set es_ssl_verify as expected, but ideally it would
  ELASTICSEARCH_SCHEMA: "https"
+  BRIDGE_SIGNAL_AUTO_GROUPS: ${BRIDGE_SIGNAL_AUTO_GROUPS}
+
+x-zammad-args: &common-zammad-args
+  EMBEDDED: "true"
+  LINK_HOST: ${LINK_HOST}

 services:
  zammad-init:
-    platform: linux/x86_64
    container_name: zammad-init
    command: ["zammad-init"]
    depends_on:
@ -29,7 +33,7 @@ services:
    build:
      context: ../zammad
      args:
-        EMBEDDED: "true"
+        <<: *common-zammad-args
    image: registry.gitlab.com/digiresilience/link/link-stack/zammad:${LINK_STACK_VERSION}
    restart: on-failure
    user: 0:0
@ -47,7 +51,6 @@ services:
      <<: *common-global-variables

  zammad-nginx:
-    platform: linux/x86_64
    container_name: zammad-nginx
    command: ["zammad-nginx"]
    expose:
@ -59,7 +62,7 @@ services:
    build:
      context: ../zammad
      args:
-        EMBEDDED: "true"
+        <<: *common-zammad-args
    image: registry.gitlab.com/digiresilience/link/link-stack/zammad:${LINK_STACK_VERSION}
    restart: ${RESTART}
    environment:
@ -72,7 +75,6 @@ services:
      - zammad-var:/opt/zammad/var:ro

  zammad-railsserver:
-    platform: linux/x86_64
    container_name: zammad-railsserver
    command: ["zammad-railsserver"]
    depends_on:
@ -84,7 +86,7 @@ services:
    build:
      context: ../zammad
      args:
-        EMBEDDED: "true"
+        <<: *common-zammad-args
    image: registry.gitlab.com/digiresilience/link/link-stack/zammad:${LINK_STACK_VERSION}
    restart: ${RESTART}
    volumes:
@ -102,7 +104,6 @@ services:
      - redis-data:/data

  zammad-scheduler:
-    platform: linux/x86_64
    container_name: zammad-scheduler
    command: ["zammad-scheduler"]
    depends_on:
@ -114,7 +115,7 @@ services:
    build:
      context: ../zammad
      args:
-        EMBEDDED: "true"
+        <<: *common-zammad-args
    image: registry.gitlab.com/digiresilience/link/link-stack/zammad:${LINK_STACK_VERSION}
    restart: ${RESTART}
    volumes:
@ -122,7 +123,6 @@ services:
      - zammad-storage:/opt/zammad/storage

  zammad-websocket:
-    platform: linux/x86_64
    container_name: zammad-websocket
    command: ["zammad-websocket"]
    depends_on:
@ -134,7 +134,7 @@ services:
    build:
      context: ../zammad
      args:
-        EMBEDDED: "true"
+        <<: *common-zammad-args
    image: registry.gitlab.com/digiresilience/link/link-stack/zammad:${LINK_STACK_VERSION}
    restart: ${RESTART}
    volumes:
--- a/docker/memcached/Dockerfile
+++ b/docker/memcached/Dockerfile
@ -1 +1 @@
-FROM memcached:1.6.31-bookworm
+FROM memcached:1.6.34-bookworm
--- a/docker/nginx-proxy/Dockerfile
+++ b/docker/nginx-proxy/Dockerfile
@ -1 +1 @@
-FROM nginxproxy/nginx-proxy:1.6.1
+FROM nginxproxy/nginx-proxy:1.6.4
--- a/docker/opensearch-dashboards/opensearch_dashboards.yml
+++ b/docker/opensearch-dashboards/opensearch_dashboards.yml
@ -20,5 +20,5 @@ opensearch_security.multitenancy.tenants.preferred: [Private, Global]
 # opensearch_security.readonly_mode.roles: [kibana_read_only]
 opensearch_security.cookie.secure: false
 server.host: "0.0.0.0"
-server.basePath: "/dashboards"
+server.basePath: "/link/dashboards"
 server.rewriteBasePath: false
--- a/docker/redis/Dockerfile
+++ b/docker/redis/Dockerfile
@ -1 +1 @@
-FROM redis:7.4.0-bookworm
+FROM redis:7.4.2-bookworm
--- a/docker/scripts/docker.js
+++ b/docker/scripts/docker.js
@ -1,31 +1,38 @@
 const { spawn } = require("child_process");
+const path = require('path');

 const app = process.argv[2];
 const command = process.argv[3];

 const files = {
-  all: ["zammad", "postgresql", "bridge", "opensearch", "leafcutter", "link", "signal-cli-rest-api"],
+  all: ["zammad", "postgresql", "bridge", "opensearch", "link", "signal-cli-rest-api"],
  linkDev: ["zammad", "postgresql", "opensearch"],
  link: ["zammad", "postgresql", "opensearch", "link"],
  linkOnly: ["link"],
-  leafcutterDev: ["opensearch"],
-  leafcutter: ["opensearch", "leafcutter"],
  opensearch: ["opensearch"],
  bridgeDev: ["zammad", "postgresql", "signal-cli-rest-api"],
  bridge: ["zammad", "postgresql", "bridge", "signal-cli-rest-api"],
  zammad: ["zammad", "postgresql", "opensearch"],
 };

+
+const envFile = path.resolve(process.cwd(), '.env');
 const finalFiles = files[app]
  .map((file) => ['-f', `docker/compose/${file}.yml`]).flat();
-const finalCommand = command === "up" ? ["up", "-d"] : [command];

-const dockerCompose = spawn('docker', ['compose', '--env-file', '.env', ...finalFiles, ...finalCommand]);
+// Add bridge-dev.yml for dev commands that include zammad
+const devAppsWithZammad = ['linkDev', 'bridgeDev', 'all'];
+if (devAppsWithZammad.includes(app) && files[app].includes('zammad')) {
+  finalFiles.push('-f', 'docker-compose.bridge-dev.yml');
+}
+
+const finalCommand = command === "up" ? ["up", "-d", "--remove-orphans"] : [command];
+const dockerCompose = spawn('docker', ['compose', '--env-file', envFile, ...finalFiles, ...finalCommand]);

 dockerCompose.stdout.on('data', (data) => {
-  console.log(`${data}`);
+  console.info(`${data}`);
 });

 dockerCompose.stderr.on('data', (data) => {
-  console.log(`${data}`);
+  console.info(`${data}`);
 });
--- a/docker/signal-cli-rest-api/Dockerfile
+++ b/docker/signal-cli-rest-api/Dockerfile
@ -1 +1 @@
-FROM bbernhard/signal-cli-rest-api:0.176-dev
+FROM bbernhard/signal-cli-rest-api:0.95
--- a/docker/zammad/Dockerfile
+++ b/docker/zammad/Dockerfile
@ -1,40 +1,124 @@
-ARG ZAMMAD_VERSION=6.3.1
+ARG ZAMMAD_VERSION=6.5.2

-FROM node:22-slim as node
+FROM node:22-slim AS node

 FROM zammad/zammad-docker-compose:${ZAMMAD_VERSION} AS builder
+USER root
+
+# Copy Node.js from node image
 COPY --from=node /opt /opt
 COPY --from=node /usr/local/bin /usr/local/bin
+COPY --from=node /usr/local/lib /usr/local/lib
+COPY --from=node /usr/lib /usr/lib
+
 SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
+
+# Install pnpm for package management
+RUN npm install -g pnpm
+RUN pnpm --version
+
+ENV ZAMMAD_DIR=/opt/zammad
 WORKDIR ${ZAMMAD_DIR}
+
+# Copy addons and installation scripts
 RUN mkdir -p /opt/zammad/contrib/link/addons
 COPY addons contrib/link/addons
 COPY setup.rb contrib/link/setup.rb
 COPY install.rb contrib/link/install.rb

-USER root
-RUN sed -i '/script\/build\/cleanup\.sh/d' contrib/docker/setup.sh
-RUN contrib/docker/setup.sh builder
-ARG EMBEDDED=false
-RUN if [ "$EMBEDDED" = "true" ] ; then sed -i '/location \/ {/i \
-\    \n\
-\    location /link {\n\
-\        proxy_pass http://link:3000;\n\
-\        proxy_set_header Host $host;\n\
-\        proxy_set_header X-Real-IP $remote_addr;\n\
-\        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n\
-\        proxy_set_header X-Forwarded-Proto https;\n\
-\    }\n' ${ZAMMAD_DIR}/contrib/nginx/zammad.conf; fi
-RUN sed -i '/^[[:space:]]*# es config/a\
-  echo "about to reinstall..."\n\
-  bundle exec rails runner /opt/zammad/contrib/link/setup.rb\n\
-  bundle exec rake zammad:package:migrate\n\
- ' /docker-entrypoint.sh
-RUN ZAMMAD_SAFE_MODE=1 DATABASE_URL=postgresql://zammad:/zammad bundle exec rails runner /opt/zammad/contrib/link/install.rb
-RUN ZAMMAD_SAFE_MODE=1 DATABASE_URL=postgresql://zammad:/zammad bundle exec rake assets:precompile
+# Install system dependencies
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    git \
+    && rm -rf /var/lib/apt/lists/*

-FROM zammad/zammad-docker-compose:${ZAMMAD_VERSION} as runner
-USER ${ZAMMAD_USER}
-COPY --from=builder --chown=zammad:zammad ${ZAMMAD_DIR} ${ZAMMAD_DIR}
-COPY --from=builder /usr/local/bundle /usr/local/bundle
+# Install Ruby gems (they should already be installed in the base image)
+RUN bundle check || bundle install --jobs 8
+
+# Install Node packages
+RUN pnpm install --frozen-lockfile
+
+# CRITICAL: Install addons
+# This extracts addon files including CoffeeScript, Vue components, TypeScript, and CSS
+RUN ruby contrib/link/install.rb
+
+# Fix OpenSearch compatibility: Replace 'flattened' with 'flat_object'
+# Elasticsearch uses 'flattened' but OpenSearch uses 'flat_object'
+# Without this fix, search index creation fails with:
+#   [o.o.c.m.MetadataCreateIndexService] failed on parsing mappings on index creation
+#   org.opensearch.index.mapper.MapperParsingException: Failed to parse mapping [_doc]:
+#   No handler for type [flattened] declared on field [preferences]
+# See: https://github.com/zammad/zammad/blob/bfd2f5befc3aec3fe607a5b6146788ec9af461e4/lib/search_index_backend.rb#L896
+RUN sed -i "s/'flattened'/'flat_object'/g" /opt/zammad/lib/search_index_backend.rb
+
+# Precompile assets with addon CoffeeScript files included
+# Use ZAMMAD_SAFE_MODE=1 and dummy DATABASE_URL to avoid needing real database
+RUN touch db/schema.rb && \
+    ZAMMAD_SAFE_MODE=1 DATABASE_URL=postgresql://zammad:/zammad bundle exec rake assets:precompile
+
+# Run additional setup for addons
+RUN bundle exec rails runner /opt/zammad/contrib/link/setup.rb || true
+
+# Clean up build artifacts
+RUN rm -rf tmp/cache node_modules/.cache
+ARG EMBEDDED=false
+ARG LINK_HOST=http://link:3000
+# Add nginx proxy configuration for embedded mode
+# Insert location block before the final closing brace
+RUN if [ "$EMBEDDED" = "true" ] ; then \
+    sed -i '$ d' /opt/zammad/contrib/nginx/zammad.conf && \
+    echo "" >> /opt/zammad/contrib/nginx/zammad.conf && \
+    echo "  location /link {" >> /opt/zammad/contrib/nginx/zammad.conf && \
+    echo "    proxy_pass ${LINK_HOST};" >> /opt/zammad/contrib/nginx/zammad.conf && \
+    echo "    proxy_set_header Host \$host;" >> /opt/zammad/contrib/nginx/zammad.conf && \
+    echo "    proxy_set_header X-Real-IP \$remote_addr;" >> /opt/zammad/contrib/nginx/zammad.conf && \
+    echo "    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;" >> /opt/zammad/contrib/nginx/zammad.conf && \
+    echo "    proxy_set_header X-Forwarded-Proto https;" >> /opt/zammad/contrib/nginx/zammad.conf && \
+    echo "  }" >> /opt/zammad/contrib/nginx/zammad.conf && \
+    echo "}" >> /opt/zammad/contrib/nginx/zammad.conf; \
+fi
+
+FROM zammad/zammad-docker-compose:${ZAMMAD_VERSION} AS runner
+USER root
+
+# Install Node.js and npm in runner for asset compilation at runtime
+# Using Node from Debian repository for simplicity
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends nodejs npm && \
+    rm -rf /var/lib/apt/lists/* && \
+    npm install -g pnpm
+
+# Copy only the modified/added files from builder
+# Copy addon files that were installed
+COPY --from=builder --chown=zammad:zammad /opt/zammad/app/frontend/apps/desktop/pages/ticket/components/TicketDetailView/ /opt/zammad/app/frontend/apps/desktop/pages/ticket/components/TicketDetailView/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/app/frontend/shared/entities/ticket-article/action/plugins/ /opt/zammad/app/frontend/shared/entities/ticket-article/action/plugins/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/db/addon/ /opt/zammad/db/addon/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/app/assets/ /opt/zammad/app/assets/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/app/controllers/*cdr* /opt/zammad/app/controllers/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/app/jobs/*cdr* /opt/zammad/app/jobs/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/app/models/channel/driver/*cdr* /opt/zammad/app/models/channel/driver/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/app/models/ticket/article/*cdr* /opt/zammad/app/models/ticket/article/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/app/policies/controllers/*cdr* /opt/zammad/app/policies/controllers/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/config/initializers/*cdr* /opt/zammad/config/initializers/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/config/routes/*cdr* /opt/zammad/config/routes/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/lib/cdr* /opt/zammad/lib/
+# CRITICAL: Copy modified search_index_backend.rb with OpenSearch fix
+COPY --from=builder --chown=zammad:zammad /opt/zammad/lib/search_index_backend.rb /opt/zammad/lib/search_index_backend.rb
+COPY --from=builder --chown=zammad:zammad /opt/zammad/public/assets/images/icons/*cdr* /opt/zammad/public/assets/images/icons/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/app/views/mailer/ticket_create/ /opt/zammad/app/views/mailer/ticket_create/
+COPY --from=builder --chown=zammad:zammad /opt/zammad/public/assets/images/logo* /opt/zammad/public/assets/images/
+
+# Copy the nginx config if embedded mode was used
+COPY --from=builder --chown=zammad:zammad /opt/zammad/contrib/nginx/zammad.conf /opt/zammad/contrib/nginx/zammad.conf
+
+# Copy the link setup scripts and addons
+COPY --from=builder --chown=zammad:zammad /opt/zammad/contrib/link/ /opt/zammad/contrib/link/
+
+# CRITICAL: Copy compiled assets that include our CoffeeScript changes
+# The builder stage compiles assets at line 47, we must copy them to runner
+COPY --from=builder --chown=zammad:zammad /opt/zammad/public/assets/ /opt/zammad/public/assets/
+
+# Copy the modified entrypoint script
 COPY --from=builder /docker-entrypoint.sh /docker-entrypoint.sh
+
+USER zammad
--- a/docker/zammad/install.rb
+++ b/docker/zammad/install.rb
@ -1,5 +1,8 @@
 # frozen_string_literal: true

+require 'json'
+require 'base64'
+
 ROOT = '/opt/zammad'

 def _read_file(file, fullpath: false)
--- a/docker/zammad/setup.rb
+++ b/docker/zammad/setup.rb
@ -1,7 +1,7 @@
 # frozen_string_literal: true

 # uninstall
-package_names = %w[Hardening Leafcutter Bridge]
+package_names = %w[Hardening Bridge]

 package_names.each do |name|
  puts "Attempting to uninstall #{name} package..."