Groupware in front of a mail platform
OX App Suite from Open-Xchange provides web mail, calendar, contacts and tasks, with file, document and encryption modules available depending on the license. Java middleware handles login, permissions and data access, and a JavaScript web interface presents it in the browser. Mail itself lives in an IMAP backend, typically Dovecot, which is also part of the Open-Xchange portfolio. App Suite is the groupware component of openDesk, the German public-sector workplace suite.
In October 2025 the state government of Schleswig-Holstein reported completing its move from Microsoft Exchange and Outlook to Open-Xchange and Thunderbird, covering more than 40,000 mailboxes. A move like that is a program of work: clients, directory, calendars, mail flow and user support change together, and the server install is one part of it.
Components of an App Suite 8 deployment
App Suite 8 runs on Kubernetes and is installed with Helm charts. Several dependencies sit outside the charts and need their own owners.
| Component | Role | Planning note |
|---|---|---|
| Kubernetes and Istio | Runs the App Suite services. Open-Xchange lists Istio as a required component and its recommended ingress. | Kubernetes and Istio versions are supported in a window of the latest stable release and the two before it. Nodes must be x86_64. |
| Middleware | Java services for authentication, data access, permissions and the provisioning APIs. | Scales by role. Open-Xchange recommends keeping each Java service at or below 4 GB of memory. |
| MariaDB or Galera Cluster | Stores configuration, contexts, users, calendar and contact data. | MariaDB with the InnoDB engine is the supported database. Check the supported series for the release you install. |
| Redis | Caching and sessions. | Deployed through an operator by default, or managed separately when the platform team already runs Redis. |
| IMAP and SMTP backend | Stores and delivers mail. Feature availability depends on the backend and its version. | Some features need Dovecot Pro capabilities, for example scheduled sending. |
| File and object storage | Holds files, attachments and caches. | NFS can serve small and mid-sized setups. For large ones Open-Xchange suggests S3, Ceph RadosGW or Scality RING object storage. |
| Optional services | Document and image converters, spell check, Documents and a WOPI server for Collabora Online. | Enable only the modules your license includes, and size each one. |
Confirm the license package before sizing
Production App Suite 8 deployments are licensed and supported through Open-Xchange or its partners. Optional modules such as Drive, Documents, Guard, the Exchange ActiveSync connector and AI integration are included only when your agreement names them, and some carry separate terms. Open-Xchange notes that the ActiveSync connector may also need an agreement with Microsoft.
Settle the package first. It decides which charts you enable, which clients you support and what you test. Ask early how registry access, release channels and support work for an isolated network, since those answers shape the build pipeline.
Choose a release channel
Open-Xchange ships major releases on a four-week cadence. Each is supported for 12 weeks, until the third following release is available. Teams on this channel need a routine for testing and rolling out an upgrade about once a month.
Long-term support releases are planned yearly and supported until the next LTS plus six months. Some components are outside LTS coverage, including the Exchange ActiveSync connector, PDF export and video conferencing integration. Check the support commitment against the modules you license.
Patch releases carry severity 1 and 2 bug fixes and security fixes for supported releases. Track notices for the middleware, the mail backend, Istio and MariaDB separately, because each has its own release stream.
Plan identity across web, mail and mobile clients
App Suite supports single sign-on with OpenID Connect, and Open-Xchange also documents SAML. Browser login is the simpler part. Desktop and mobile clients connect over IMAP, SMTP, CalDAV and CardDAV, and each needs an authentication method that fits your identity provider and the mail backend. Decide which clients are supported and how each one signs in before the pilot.
Map the user lifecycle end to end. App Suite groups users into contexts, managed through provisioning APIs and command-line tools. When a person joins, which system creates the user and mailbox? When they leave, which step disables web login, desktop mail and mobile sync together? Test with a leaver account and confirm a disabled identity can no longer sync mail on a phone.
Plan an Exchange migration as four workstreams
Mail is usually the largest dataset. Calendars and clients are where users notice the change.
Mail data
Copy mailboxes over IMAP in staged passes, with a final delta at cutover. Record folder mapping, size limits, shared mailboxes and archives. A few very large mailboxes can set the timeline more than the user count.
Calendars and contacts
Move calendars, recurring meetings, resources and delegate permissions with a tested tool. Check time zones and recurring exceptions on sample accounts.
Clients
Decide which clients you support: the App Suite web interface, Thunderbird or another desktop client, and mobile devices over CalDAV and CardDAV or a licensed ActiveSync connector. Prepare configuration profiles before cutover.
Mail flow
Plan MX changes, SPF, DKIM and DMARC records, relays for applications that send mail, and a coexistence period. Agree how free/busy lookups behave while users sit on both systems.
Harden the platform and the mail edge
Separate the public Istio ingress from management endpoints, and keep the provisioning APIs and admin tooling on a management network. Use TLS for the database connection where your release supports it, and encrypt IMAP and SMTP. Keep database, Redis and mail backend credentials in the cluster secret store with defined rotation.
Treat mail as an attack surface: spam and malware filtering, rate limits on submission, and alerts on unusual login patterns. Open-Xchange recommends central logging (for example Fluent Bit with Graylog) and metrics with Prometheus and Grafana. Wire both before go-live so the first incident has data to work with.
OX App Suite operating ownership
Everyone uses groupware every day. Ownership has to cover the cluster, the mail backend and the people who answer user questions.
Platform
- Run Kubernetes, Istio, MariaDB and Redis within supported versions.
- Keep etcd on at least three nodes and the cluster on a flat, low-latency network, as Open-Xchange recommends.
- Test node loss and database failover.
Mail backend
- Monitor IMAP and SMTP latency, queue depth and storage growth.
- Keep backend and middleware versions in a supported combination.
- Run delivery tests after any change to relays or DNS.
Recovery
- Back up MariaDB, mail storage, file or object storage and Helm values together.
- Restore one context to an isolated environment and sign in as a test user.
- Record how long the mail store takes to restore.
Change
- Read release notes for each release you adopt.
- Upgrade a staging cluster with representative data first.
- Tell users about interface changes before they see them.
OX App Suite questions
Can we run App Suite 8 without Kubernetes?
App Suite 8 is delivered as containers with Helm charts, and Open-Xchange uses Kubernetes as its standard platform. Plan for a Kubernetes cluster with Istio, and for a team that can operate it.
Do we need Dovecot?
App Suite needs an IMAP backend. Some features depend on the backend and its version, and some need Dovecot Pro. Check the features you need against the backend you plan to run.
Can it run on an isolated network?
Open-Xchange documents an air-gapped installation that mirrors images and Helm charts into local registries. The mirroring step needs internet access somewhere, so plan a controlled transfer path.
Can App Suite open office documents in the browser?
The App Suite stack includes a WOPI server component that connects to a Collabora Online discovery URL. Size and operate Collabora as its own service.
Scope and handover
DeployOpen plans the cluster and its dependencies, deploys App Suite with the modules your license includes, integrates SSO and the mail backend, sets up backups and monitoring, and helps plan the migration. The work changes with mailbox count and size, the number of contexts, client types, coexistence needs, isolated network requirements and the release channel.
Handover covers Helm values and chart versions, Istio configuration, database and Redis topology, mail backend versions, the provisioning procedure, SSO settings, backup and restore results, the release channel and upgrade runbook, and the user support route. It includes a joiner and leaver test across web, desktop and mobile clients, because those flows depend on several systems at once.
