diff --git a/.gitmodules b/.gitmodules
index f808c89..cc00452 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -7,3 +7,12 @@
 [submodule "mod/etherpad/bbb-etherpad-plugin"]
 	path = mod/etherpad/bbb-etherpad-plugin
 	url = https://github.com/alangecker/bbb-etherpad-plugin
+[submodule "mod/bbb-pads/bbb-pads"]
+	path = mod/bbb-pads/bbb-pads
+	url = https://github.com/bigbluebutton/bbb-pads
+[submodule "mod/webhooks/bbb-webhooks"]
+	path = mod/webhooks/bbb-webhooks
+	url = https://github.com/bigbluebutton/bbb-webhooks
+[submodule "mod/nginx/bbb-playback"]
+	path = mod/nginx/bbb-playback
+	url = https://github.com/bigbluebutton/bbb-playback
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3015fd9..c2323f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## Unreleased
+- BigBlueButton v2.5 @alangecker [#207](https://github.com/bigbluebutton/docker/pull/207)
+- central `tags.env` file with the tag names of most BBB components @alangecker
+- Usage of [official docker build images](https://gitlab.senfcall.de/senfcall-public/docker-bbb-build) for building @alangecker
+- publish docker images @alangecker [#174](https://github.com/bigbluebutton/docker/issues/174)
+- etherpad: enforce bbb-pads session handling @pedrobmarin [#211](https://github.com/bigbluebutton/docker/pull/211)
+- etherpad: avoid icons overlapping @pedrobmarin [#210](https://github.com/bigbluebutton/docker/pull/210)
+- fix recordings which include presentation polls @lightweight [#205](https://github.com/bigbluebutton/docker/pull/205)
+
 ## Release v2.4.5 (2022-03-24)
 - Applied BBB v2.4.5 changes @alangecker 
 - New mute & unmute sounds by senfcall
diff --git a/README.md b/README.md
index d4fe3bb..1196dc9 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 
 # 📦 BigBlueButton 2.4 Docker
 
-Version: 2.4.5 | [Changelog](CHANGELOG.md) | [Issues](https://github.com/bigbluebutton/docker/issues)
+Version: 2.5.1 | [Changelog](CHANGELOG.md) | [Issues](https://github.com/bigbluebutton/docker/issues)
 
 ## Features
 - Easy installation
@@ -28,9 +28,11 @@ Version: 2.4.5 | [Changelog](CHANGELOG.md) | [Issues](https://github.com/bigblue
     4. Ensure docker-compose works and that you use a version ≥ 1.28 : `$ docker-compose --version`
 2. Clone this repository
    ```sh
-   $ git clone -b main --recurse-submodules https://github.com/bigbluebutton/docker.git bbb-docker
+   $ git clone --recurse-submodules https://github.com/bigbluebutton/docker.git bbb-docker
    $ cd bbb-docker
-   $ git submodule update --init
+
+   # use the more stable main branch (sometimes older)
+   $ git checkout main 
    ```
 3. Run setup:
    ```bash
diff --git a/docker-compose.tmpl.yml b/docker-compose.tmpl.yml
index b33e7b4..a65ec62 100644
--- a/docker-compose.tmpl.yml
+++ b/docker-compose.tmpl.yml
@@ -7,8 +7,12 @@ version: '3.6'
 
 # html5 templates
 x-html5-backend: &html5backend
-  build: mod/html5
-  image: bbb-html5
+  build: 
+    context: mod/html5
+    args:
+      BBB_BUILD_TAG: {{ .Env.BBB_BUILD_TAG }}
+      TAG_HTML5: {{ .Env.TAG_HTML5 }}
+  image: alangecker/bbb-docker-html5:{{ .Env.TAG_HTML5 }}
   restart: unless-stopped
   depends_on:
     - redis
@@ -17,7 +21,6 @@ x-html5-backend: &html5backend
   environment: &html5backend-env
     DOMAIN: ${DOMAIN}
     CLIENT_TITLE: ${CLIENT_TITLE}
-    ETHERPAD_API_KEY: ${ETHERPAD_API_KEY}
     LISTEN_ONLY_MODE: ${LISTEN_ONLY_MODE:-true}
     DISABLE_ECHO_TEST: ${DISABLE_ECHO_TEST:-false}
     AUTO_SHARE_WEBCAM: ${AUTO_SHARE_WEBCAM:-false}
@@ -39,7 +42,13 @@ x-html5-frontend: &html5frontend
 
 services:
   bbb-web:
-    build: mod/bbb-web
+    build: 
+      context: mod/bbb-web
+      args:
+        BBB_BUILD_TAG: {{ .Env.BBB_BUILD_TAG }}
+        TAG_COMMON_MESSAGE: {{ .Env.TAG_COMMON_MESSAGE }}
+        TAG_BBB_WEB: {{ .Env.TAG_BBB_WEB }}
+    image: alangecker/bbb-docker-web:{{ .Env.TAG_BBB_WEB }}
     restart: unless-stopped
     depends_on:
         - redis
@@ -62,7 +71,6 @@ services:
     volumes:
       - bigbluebutton:/var/bigbluebutton
       - vol-freeswitch:/var/freeswitch/meetings
-      - vol-kurento:/var/kurento
     networks:
       bbb-net:
         ipv4_address: 10.7.7.2
@@ -94,7 +102,12 @@ services:
 
 
   freeswitch:
-    build: mod/freeswitch
+    container_name: bbb-freeswitch
+    build: 
+      context: mod/freeswitch
+      args:
+        TAG_FS_CONFIG: {{ .Env.TAG_FS_CONFIG }}
+    image: alangecker/bbb-docker-freeswitch:{{ .Env.TAG_FS_CONFIG }}
     restart: unless-stopped
     cap_add:
       - IPC_LOCK
@@ -119,7 +132,11 @@ services:
     network_mode: host
 
   nginx:
-    build: mod/nginx
+    build:
+      context: mod/nginx
+      args:
+        TAG_LEARNING_DASHBOARD: {{ .Env.TAG_LEARNING_DASHBOARD }}
+    image: alangecker/bbb-docker-nginx:1.21-{{ .Env.TAG_PLAYBACK }}-{{ .Env.TAG_LEARNING_DASHBOARD }}
     restart: unless-stopped
     depends_on:
       - etherpad
@@ -134,11 +151,12 @@ services:
       - "host.docker.internal:10.7.7.1"
       - "bbb-web:10.7.7.2"
       - "etherpad:10.7.7.4"
-      - "webrtc-sfu:10.7.7.10"
+      - "webrtc-sfu:10.7.7.1"
       - "html5:10.7.7.11"
 
   etherpad:
     build: mod/etherpad
+    image: alangecker/bbb-docker-etherpad:1.8.18-2
     restart: unless-stopped
     depends_on:
       - redis
@@ -148,8 +166,21 @@ services:
       bbb-net:
         ipv4_address: 10.7.7.4
 
+  bbb-pads:
+    build: mod/bbb-pads
+    image: alangecker/bbb-docker-pads:{{ .Env.TAG_PADS }}
+    restart: unless-stopped
+    depends_on:
+      - redis
+      - etherpad
+    environment:
+      ETHERPAD_API_KEY: ${ETHERPAD_API_KEY}
+    networks:
+      bbb-net:
+        ipv4_address: 10.7.7.18
+
   redis:
-    image: redis:6.2-alpine
+    image: redis:7.0-alpine
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
@@ -161,7 +192,8 @@ services:
         ipv4_address: 10.7.7.5
 
   mongodb:
-    image: mongo:4.4
+    container_name: bbb-mongodb
+    image: mongo:5.0
     restart: unless-stopped
     volumes:
       - ./mod/mongo/mongod.conf:/etc/mongod.conf
@@ -176,51 +208,57 @@ services:
       bbb-net:
         ipv4_address: 10.7.7.6
 
+  #  TODO: remove as soon as not required anymore by webrtc-sfu
   kurento:
-    image: kurento/kurento-media-server:6.16
+    image: kurento/kurento-media-server:6.17
     restart: unless-stopped
-    environment:
-      KMS_STUN_IP: ${STUN_IP}
-      KMS_STUN_PORT: ${STUN_PORT}
-      KMS_MIN_PORT: 24577
-      KMS_MAX_PORT: 32768
-      KMS_TURN_URL:
-      KMS_NETWORK_INTERFACES: ${NETWORK_INTERFACE:-}
-      GST_DEBUG: 3,Kurento*:4,kms*:4,KurentoWebSocketTransport:5
     network_mode: host
     volumes:
       - vol-kurento:/var/kurento
 
   webrtc-sfu:
-    build:  mod/webrtc-sfu
+    build: 
+      context: mod/webrtc-sfu
+      args:
+        BBB_BUILD_TAG: {{ .Env.BBB_BUILD_TAG }}
+    image: alangecker/bbb-docker-webrtc-sfu:{{ .Env.TAG_WEBRTC_SFU }}
     restart: unless-stopped
     depends_on:
       - redis
-      - kurento
+      - freeswitch
     environment:
-      CLIENT_HOST: 0.0.0.0
-      KURENTO_NAME: kurento
-      REDIS_HOST: redis
-      FREESWITCH_IP: host.docker.internal
+      CLIENT_HOST: 10.7.7.1
+      REDIS_HOST: 10.7.7.5
+      FREESWITCH_IP: 10.7.7.1
       FREESWITCH_SIP_IP: ${EXTERNAL_IPv4}
-      ESL_IP: host.docker.internal
+      ESL_IP: 10.7.7.1
       ESL_PASSWORD: ${FSESL_PASSWORD:-ClueCon}
-      LOG_LEVEL: info
-      NODE_CONFIG: '{"kurento":[{"ip":"${EXTERNAL_IPv4}","url":"ws://kurento:8888/kurento"}]}'
-    ports:
-      - "127.0.0.1:3008:3008"
-    extra_hosts:
-      - host.docker.internal:10.7.7.1
-      - kurento:10.7.7.1
-    networks:
-      bbb-net:
-        ipv4_address: 10.7.7.10
+      # TODO: add mediasoup IPv6
+      # TODO: can listen to 0.0.0.0 for nat support? https://github.com/versatica/mediasoup/issues/487
+    {{ if .Env.EXTERNAL_IPv6 }}
+      MS_WEBRTC_LISTEN_IPS: '[{"ip":"{{ .Env.EXTERNAL_IPv6 }}", "announcedIp":"{{ .Env.EXTERNAL_IPv6 }}"}, {"ip":"${EXTERNAL_IPv4}", "announcedIp":"${EXTERNAL_IPv4}"}]'
+    {{else}}
+      MS_WEBRTC_LISTEN_IPS: '[{"ip":"${EXTERNAL_IPv4}", "announcedIp":"${EXTERNAL_IPv4}"}]'
+    {{end}}
+      MS_RTP_LISTEN_IP: '{"ip":"0.0.0.0", "announcedIp":"${EXTERNAL_IPv4}"}'
+    volumes:
+      - vol-mediasoup:/var/mediasoup
+    tmpfs:
+      - /var/log/bbb-webrtc-sfu
+    network_mode: host
 
   fsesl-akka:
-    build: mod/fsesl-akka
+    build: 
+      context: mod/fsesl-akka
+      args:
+        BBB_BUILD_TAG: {{ .Env.BBB_BUILD_TAG }}
+        TAG_COMMON_MESSAGE: {{ .Env.TAG_COMMON_MESSAGE }}
+        TAG_FSESL_AKKA: {{ .Env.TAG_FSESL_AKKA }}
+    image: alangecker/bbb-docker-fsesl-akka:{{ .Env.TAG_FSESL_AKKA }}
     restart: unless-stopped
     depends_on:
       - redis
+      - freeswitch
     environment:
       FSESL_PASSWORD: ${FSESL_PASSWORD:-ClueCon}
     networks:
@@ -228,7 +266,13 @@ services:
         ipv4_address: 10.7.7.14
 
   apps-akka:
-    build: mod/apps-akka
+    build: 
+      context: mod/apps-akka
+      args:
+        BBB_BUILD_TAG: {{ .Env.BBB_BUILD_TAG }}
+        TAG_COMMON_MESSAGE: {{ .Env.TAG_COMMON_MESSAGE }}
+        TAG_APPS_AKKA: {{ .Env.TAG_APPS_AKKA }}
+    image: alangecker/bbb-docker-apps-akka:{{ .Env.TAG_APPS_AKKA }}
     restart: unless-stopped
     depends_on:
       - redis
@@ -243,6 +287,7 @@ services:
 
   jodconverter:
     build: mod/jodconverter
+    image: alangecker/bbb-docker-jodconverter:latest
     restart: unless-stopped
     tmpfs:
       - /tmp
@@ -256,12 +301,14 @@ services:
 
   periodic:
     build: mod/periodic
+    image: alangecker/bbb-docker-periodic:v2.5.0-rc.1
     restart: unless-stopped
     depends_on:
       - mongodb
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - bigbluebutton:/var/bigbluebutton
+      - vol-mediasoup:/var/mediasoup
     tmpfs:
       - /var/log/bigbluebutton
     environment:
@@ -275,15 +322,22 @@ services:
 {{ if isTrue .Env.ENABLE_RECORDING }}
   # recordings
   recordings:
-    build: mod/recordings
+    build: 
+      context: mod/recordings
+      args:
+        BBB_BUILD_TAG: {{ .Env.BBB_BUILD_TAG }}
+        TAG_RECORDINGS: {{ .Env.TAG_RECORDINGS }}
+    image: alangecker/bbb-docker-recordings:{{ .Env.TAG_RECORDINGS }}
     restart: unless-stopped
     depends_on:
       - redis
+      - bbb-pads
     environment:
       DOMAIN: ${DOMAIN}
     volumes:
       - bigbluebutton:/var/bigbluebutton
       - vol-freeswitch:/var/freeswitch/meetings
+      - vol-mediasoup:/var/mediasoup
       - vol-kurento:/var/kurento
     tmpfs:
       - /var/log/bigbluebutton
@@ -297,6 +351,7 @@ services:
   # webhooks
   webhooks:
     build: mod/webhooks
+    image: alangecker/bbb-docker-webhooks:{{ .Env.TAG_WEBHOOKS }}
     restart: unless-stopped
     environment:
       DOMAIN: ${DOMAIN}
@@ -332,7 +387,7 @@ services:
 {{ if isTrue .Env.ENABLE_COTURN }}
   # coturn
   coturn:
-    image: instrumentisto/coturn:4.5
+    image: coturn/coturn:4.5-alpine
     restart: unless-stopped
     command:
       - "--external-ip=${EXTERNAL_IPv4}/${EXTERNAL_IPv4}"
@@ -349,6 +404,7 @@ services:
       - ./mod/coturn/turnserver.conf:/etc/coturn/turnserver.conf
     environment:
       ENABLE_HTTPS_PROXY:
+    user: root
     network_mode: host
 {{end}}
 
@@ -393,7 +449,7 @@ services:
 {{ if isTrue .Env.ENABLE_PROMETHEUS_EXPORTER }}
   # prometheus
   prometheus-exporter:
-    image: greenstatic/bigbluebutton-exporter:v0.7.0-preview2
+    image: greenstatic/bigbluebutton-exporter:latest
     restart: unless-stopped
     environment:
       API_BASE_URL: http://10.7.7.1:48087/bigbluebutton/api/
@@ -413,6 +469,7 @@ volumes:
   bigbluebutton:
   vol-freeswitch:
   vol-kurento:
+  vol-mediasoup:
   html5-static:
 {{ if isTrue .Env.ENABLE_HTTPS_PROXY }}
   ssl_data:
diff --git a/docs/development.md b/docs/development.md
index 4985548..d9dcb09 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -1,5 +1,13 @@
 # bbb-docker Development
 
+## Basics
+normally people start BBB with the pre-built docker images, but for developing you need to build them by yourself. For that you need to ensure that the submodules are also checked out:
+
+```sh
+$ git submodule update --init
+```
+
+
 ## Running
 you can run bbb-docker locally without any certificate issues with following `.env` configurations:
 
@@ -33,6 +41,8 @@ RAILS_SECRET=SuperRailsSecret
 
 - regenerate `docker-compose.yml` \
   `$ ./scripts/generate-compose`
+- build the images \
+  `$ docker-compose build`
 - you can than start it with \
   `$ docker-compose up -d`
 - view the logs with \
@@ -58,13 +68,14 @@ RAILS_SECRET=SuperRailsSecret
 ## How to do create a new update for a newer BBB release?
 This always consists out of following steps
 1. **Get an understanding about changes that happened and find out what changes to bbb-docker that require.** \
-    * Sometimes there are changes made which are not accessible in the [bigbluebutton/bigbluebutton](https://github.com/bigbluebutton/bigbluebutton) repo, so you should rather look through all the related commits in [alangecker/bbb-packages](https://github.com/alangecker/bbb-packages/commits/master)
-    * Before being overwhelmed: All these compiled `.js`,`.class`,etc. files are irrelevant to check! :)
+    * main source for that are the release notes in https://github.com/bigbluebutton/bigbluebutton/releases
 2. **Apply these changes to this project.** 
-    * Quite often you only need to set `TAG` to the corresponding release tag in [bigbluebutton/bigbluebutton](https://github.com/bigbluebutton/bigbluebutton) like `v2.2.31`. To avoid the unnecessary recreation of images, only change the TAG of those components, which actually received a change.
-    * New config variables are also quite common
-    * don't forget to checkout a newer version of `bbb-webrtc-sfu` if it also happened in the release. you can find out what the current version is [here](https://github.com/alangecker/bbb-packages/blob/v2.3.x/bbb-webrtc-sfu/data/usr/local/bigbluebutton/bbb-webrtc-sfu/package.json)
-    * if available, you can also think about switching to more recent images of kurento, etherpad, nginx, etc.
+    * Often you only need to update the TAGS in `tags.env`
+      * make sure only to switch to a newer tag if there were changes made avoid creating new (partialy big) images unnecessarily
+    * Also update submodules to the new state. 
+      * List of all submodules `git submodule`
+      * for the main submodules you can use `./scripts/checkout-submodules` to checkout the tags specified in `tags.env`
+      
 3. Test everything (with firefox **and** chromium/chrome)
     * Audio
     * Video
diff --git a/docs/network-config.md b/docs/network-config.md
index 889edb3..8382fb9 100644
--- a/docs/network-config.md
+++ b/docs/network-config.md
@@ -4,6 +4,7 @@ Services as configured.
 |Service | Network | IP address | Other Option |
 --- | --- | --- | --- 
 | bbb-web | bbb-net | 10.7.7.2 |
+| bbb-pads | bbb-net | 10.7.7.18 |
 | html5-backend-{{$i}} | bbb-net | 10.7.7.{{add 100 $i}}| Port {{ add 4000 $i }}
 | html5-frontend-{{$i}}| bbb-net | 10.7.7.{{add 200 $i}}| Port {{ add 4100 $i }}
 | freeswitch| network_mode: host | |
@@ -12,7 +13,7 @@ Services as configured.
 | redis | bbb-net | 10.7.7.5|
 | mongodb | bbb-net | 10.7.7.6|
 | kurento | network-mode: host | |
-| webrtc-sfu | bbb-net | 10.7.7.10|     ports:      - "127.0.0.1:3008:3008" <br />    extra_hosts:<br />      - host.docker.internal:10.7.7.1<br />      - kurento:10.7.7.1
+| webrtc-sfu | bbb-net |  | network_mode: host
 | fsesl-akka | bbb-net | 10.7.7.14 |
 | apps-akka | bbb-net | 10.7.7.15 |
 | libreoffice | bbb-net | 10.7.7.7 |
diff --git a/mod/apps-akka/Dockerfile b/mod/apps-akka/Dockerfile
index 038c30a..3ad648e 100644
--- a/mod/apps-akka/Dockerfile
+++ b/mod/apps-akka/Dockerfile
@@ -1,21 +1,19 @@
-FROM mozilla/sbt:8u212_1.2.8 AS builder
+ARG BBB_BUILD_TAG
+FROM gitlab.senfcall.de:5050/senfcall-public/docker-bbb-build:$BBB_BUILD_TAG AS builder
 
-RUN apt-get update && apt-get install -y subversion
+ARG TAG_COMMON_MESSAGE
 
 # download bbb-common-message
-ENV TAG_COMMON_MESSAGE v2.4.5
 RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_COMMON_MESSAGE/bbb-common-message /bbb-common-message \
-    && rm -rf /bbb-common-message/.svn
-
-# compile bbb-common-message
-RUN cd /bbb-common-message \
- && ./deploy.sh 
-
+    && cd /bbb-common-message \
+    && ./deploy.sh \
+    && rm -rf /bbb-common-message
 
 # ===================================================
 
-ENV TAG v2.4.5
-RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG/akka-bbb-apps /source \
+ARG TAG_APPS_AKKA
+
+RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_APPS_AKKA/akka-bbb-apps /source \
     && rm -rf /source/.svn
 
 # compile and unzip bin
@@ -25,24 +23,12 @@ RUN cd /source \
 
 # ===================================================
 
-FROM openjdk:8-jre-slim-bullseye
-
-RUN apt update && apt-get install -y wget gosu
-
-# install dockerize
-ENV DOCKERIZE_VERSION v0.6.1
-RUN wget -q https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && tar -C /usr/local/bin -xzvf dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
-
-RUN groupadd -g 998 bigbluebutton \
-    && useradd -m -u 998 -g bigbluebutton bigbluebutton
+FROM alangecker/bbb-docker-base-java
 
 COPY --from=builder /bbb-apps-akka-0.0.4 /bbb-apps-akka
 COPY bbb-apps-akka.conf /etc/bigbluebutton/bbb-apps-akka.conf.tmpl
 COPY logback.xml /bbb-apps-akka/conf/logback.xml
+COPY entrypoint.sh /entrypoint.sh
 
-WORKDIR /bbb-apps-akka
-CMD dockerize \
-    -template /etc/bigbluebutton/bbb-apps-akka.conf.tmpl:/etc/bigbluebutton/bbb-apps-akka.conf \
-    gosu bigbluebutton /bbb-apps-akka/bin/bbb-apps-akka
\ No newline at end of file
+USER bigbluebutton
+ENTRYPOINT /entrypoint.sh
diff --git a/mod/apps-akka/bbb-apps-akka.conf b/mod/apps-akka/bbb-apps-akka.conf
index a8c3499..d05cebc 100644
--- a/mod/apps-akka/bbb-apps-akka.conf
+++ b/mod/apps-akka/bbb-apps-akka.conf
@@ -6,8 +6,8 @@ redis {
 }
 
 services {
-  bbbWebAPI="https://{{ .Env.DOMAIN }}/bigbluebutton/api"
-  sharedSecret="{{ .Env.SHARED_SECRET }}"
+  bbbWebAPI="https://DOMAIN/bigbluebutton/api"
+  sharedSecret="SHARED_SECRET"
 }
 http {
   interface = "0.0.0.0"
diff --git a/mod/apps-akka/entrypoint.sh b/mod/apps-akka/entrypoint.sh
new file mode 100755
index 0000000..3938a7c
--- /dev/null
+++ b/mod/apps-akka/entrypoint.sh
@@ -0,0 +1,9 @@
+#!/bin/sh -e
+
+TARGET=/etc/bigbluebutton/bbb-apps-akka.conf
+cp /etc/bigbluebutton/bbb-apps-akka.conf.tmpl $TARGET
+sed -i "s/DOMAIN/$DOMAIN/" $TARGET
+sed -i "s/SHARED_SECRET/$SHARED_SECRET/" $TARGET
+
+cd /bbb-apps-akka
+/bbb-apps-akka/bin/bbb-apps-akka
\ No newline at end of file
diff --git a/mod/base-java/Dockerfile b/mod/base-java/Dockerfile
new file mode 100644
index 0000000..571126c
--- /dev/null
+++ b/mod/base-java/Dockerfile
@@ -0,0 +1,24 @@
+FROM openjdk:11-jre-slim-bullseye
+
+RUN apt-get update && apt-get install -y \
+        wget unzip gosu locales \
+        imagemagick xpdf-utils curl \
+    && sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen
+
+ENV LANG en_US.UTF-8  
+ENV LANGUAGE en_US:en  
+ENV LC_ALL en_US.UTF-8     
+
+# add user & group
+RUN groupadd -g 998 bigbluebutton \
+    && useradd -m -u 998 -g bigbluebutton bigbluebutton \
+    && mkdir /etc/bigbluebutton \
+    && chown bigbluebutton:bigbluebutton /etc/bigbluebutton
+
+# add dockerize
+ENV DOCKERIZE_VERSION v0.6.1
+RUN wget -q https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
+    && tar -C /usr/local/bin -xzvf dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
+    && rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
+
+
diff --git a/mod/bbb-pads/Dockerfile b/mod/bbb-pads/Dockerfile
new file mode 100644
index 0000000..fdabe95
--- /dev/null
+++ b/mod/bbb-pads/Dockerfile
@@ -0,0 +1,18 @@
+FROM node:14.19.1-bullseye-slim AS builder
+
+COPY ./bbb-pads /bbb-pads
+RUN cd /bbb-pads && rm -r .git && npm install --production
+
+
+RUN chmod 777 /bbb-pads/config
+# ------------------------------
+
+FROM node:14.19.1-bullseye-slim
+
+RUN apt update && apt install -y jq moreutils \
+    && useradd --uid 2003 --user-group bbb-pads
+
+COPY --from=builder /bbb-pads /bbb-pads
+USER bbb-pads
+COPY entrypoint.sh /entrypoint.sh
+ENTRYPOINT /entrypoint.sh
\ No newline at end of file
diff --git a/mod/bbb-pads/bbb-pads b/mod/bbb-pads/bbb-pads
new file mode 160000
index 0000000..3eb45a5
--- /dev/null
+++ b/mod/bbb-pads/bbb-pads
@@ -0,0 +1 @@
+Subproject commit 3eb45a5099fc3e9def055a8d236e52098777eb95
diff --git a/mod/bbb-pads/entrypoint.sh b/mod/bbb-pads/entrypoint.sh
new file mode 100755
index 0000000..9f93722
--- /dev/null
+++ b/mod/bbb-pads/entrypoint.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+TARGET=/bbb-pads/config/settings.json
+
+cp /bbb-pads/config/settings.json.template $TARGET
+sed -i "s/ETHERPAD_API_KEY/\"$ETHERPAD_API_KEY\"/g" $TARGET
+jq '.etherpad.host = "etherpad"' $TARGET | sponge $TARGET
+jq '.express.host = "0.0.0.0"' $TARGET | sponge $TARGET
+jq '.redis.host = "redis"' $TARGET | sponge $TARGET
+
+
+cd /bbb-pads
+export NODE_ENV=production
+npm start
\ No newline at end of file
diff --git a/mod/bbb-web/Dockerfile b/mod/bbb-web/Dockerfile
index 2f4c648..b27e0cc 100644
--- a/mod/bbb-web/Dockerfile
+++ b/mod/bbb-web/Dockerfile
@@ -1,33 +1,20 @@
-FROM mozilla/sbt:8u212_1.2.8 AS builder
+ARG BBB_BUILD_TAG
+FROM gitlab.senfcall.de:5050/senfcall-public/docker-bbb-build:$BBB_BUILD_TAG AS builder
 
-RUN apt-get update && apt-get install -y subversion
+ARG TAG_COMMON_MESSAGE
 
 # download bbb-common-message
-ENV TAG_COMMON_MESSAGE v2.4.5
 RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_COMMON_MESSAGE/bbb-common-message /bbb-common-message \
-    && rm -rf /bbb-common-message/.svn
-
-# compile bbb-common-message
-RUN cd /bbb-common-message \
- && ./deploy.sh 
+    && cd /bbb-common-message \
+    && ./deploy.sh \
+    && rm -rf /bbb-common-message
 
 # ===================================================
 
-# install grails
-RUN cd /opt \
- && wget -q https://github.com/grails/grails-core/releases/download/v3.3.9/grails-3.3.9.zip \
- && unzip grails-3.3.9.zip
-ENV PATH="/opt/grails-3.3.9/bin:${PATH}"
-
-# install gradle
-RUN cd /opt \
- && wget -q https://services.gradle.org/distributions/gradle-6.7-bin.zip \
- && unzip gradle-6.7-bin
-ENV PATH="/opt/gradle-6.7/bin:${PATH}"
+ARG TAG_BBB_WEB
 
 # download bbb-common-web
-ENV TAG_COMMON_WEB v2.4.5
-RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_COMMON_WEB/bbb-common-web /bbb-common-web \
+RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_BBB_WEB/bbb-common-web /bbb-common-web \
     && rm -rf /bbb-common-message/.svn
 
 # compile bbb-common-web
@@ -35,8 +22,7 @@ RUN cd /bbb-common-web \
  && ./deploy.sh
 
 # download bbb-web
-ENV TAG_WEB v2.4.5
-RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_WEB/bigbluebutton-web /bbb-web \
+RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_BBB_WEB/bigbluebutton-web /bbb-web \
     && rm -rf /bbb-web/.svn
 
 # compile bbb-web
@@ -50,28 +36,7 @@ RUN unzip -q /bbb-web/build/libs/bigbluebutton-0.10.0.war -d /dist
 
 
 # ===================================================
-FROM openjdk:8-jre-slim-bullseye
-
-RUN apt-get update && apt-get install -y \
-        wget unzip gosu locales \
-        imagemagick xpdf-utils curl
-
-# set locale
-RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen
-ENV LANG en_US.UTF-8  
-ENV LANGUAGE en_US:en  
-ENV LC_ALL en_US.UTF-8     
-
-
-# add user & group
-RUN groupadd -g 998 bigbluebutton && useradd -m -u 998 -g bigbluebutton bigbluebutton
-
-# add dockerize
-ENV DOCKERIZE_VERSION v0.6.1
-RUN wget -q https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && tar -C /usr/local/bin -xzvf dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
-
+FROM alangecker/bbb-docker-base-java
 
 # add blank presentation files and allow conversation to pdf/svg
 RUN mkdir -p /usr/share/bigbluebutton/blank \
diff --git a/mod/coturn/entrypoint.sh b/mod/coturn/entrypoint.sh
index c916cee..62cd126 100755
--- a/mod/coturn/entrypoint.sh
+++ b/mod/coturn/entrypoint.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 set -e 
+apk add jq su-exec
 if [ "$ENABLE_HTTPS_PROXY" == true ]; then
-  apk add jq
 
   while [ ! -f /etc/resty-auto-ssl/storage/file/*latest ]
   do
@@ -28,4 +28,4 @@ if [ "${1:0:1}" == '-' ]; then
   set -- turnserver "$@"
 fi
 
-exec $(eval "echo $@")
\ No newline at end of file
+su-exec nobody $(eval "echo $@")
\ No newline at end of file
diff --git a/mod/etherpad/Dockerfile b/mod/etherpad/Dockerfile
index 9462f8e..7573eed 100644
--- a/mod/etherpad/Dockerfile
+++ b/mod/etherpad/Dockerfile
@@ -1,4 +1,4 @@
-FROM etherpad/etherpad:1.8.17
+FROM etherpad/etherpad:1.8.18
 
 USER root
 
@@ -8,10 +8,11 @@ RUN apt-get update \
 USER etherpad
 
 RUN npm install  \
-    ep_cursortrace@3.1.15 \
+    ep_cursortrace@3.1.16 \
     git+https://github.com/mconf/ep_pad_ttl.git#360136cd38493dd698435631f2373cbb7089082d \
-    git+https://github.com/mconf/ep_redis_publisher.git#1d903bf900dd53ebc5347f9583b6e240cf754d63 \
-    ep_disable_chat@0.0.7 \
+    git+https://github.com/mconf/ep_redis_publisher.git#a30a48e4bc1e501b5b102884b9a0b26c30798484 \
+    ep_disable_chat@0.0.8 \
+    ep_auth_session@1.1.1 \
 # remove npm lockfile, because somehow it prevents etherpad from detecting the manual added plugin ep_bigbluebutton_patches
     && rm package-lock.json
 
diff --git a/mod/etherpad/bbb-etherpad-skin b/mod/etherpad/bbb-etherpad-skin
index 91b052c..8328b77 160000
--- a/mod/etherpad/bbb-etherpad-skin
+++ b/mod/etherpad/bbb-etherpad-skin
@@ -1 +1 @@
-Subproject commit 91b052c2cc4c169f2e381538e4342e894f944dbe
+Subproject commit 8328b7744abe664e44b7802142eaa48fade63eae
diff --git a/mod/etherpad/settings.json b/mod/etherpad/settings.json
index e04f529..11442c6 100644
--- a/mod/etherpad/settings.json
+++ b/mod/etherpad/settings.json
@@ -280,7 +280,7 @@
    * If this option is enabled, a user must have a session to access pads.
    * This effectively allows only group pads to be accessed.
    */
-  "requireSession": false,
+  "requireSession": true,
 
   /*
    * Users may edit pads but not create new ones.
@@ -288,7 +288,7 @@
    * Pad creation is only via the API.
    * This applies both to group pads and regular pads.
    */
-  "editOnly": false,
+  "editOnly": true,
 
   /*
    * If true, all css & js will be minified before sending to the client.
@@ -576,9 +576,10 @@
   "toolbar": {
     "left": [
       ["bold", "italic", "underline", "strikethrough"],
-      ["orderedlist", "unorderedlist", "undo", "redo"]
+      ["orderedlist", "unorderedlist", "undo", "redo"],
+      ["importexport"]
     ],
-    "right": [["importexport"]]
+    "right": [[]]
   },
 
   /*
diff --git a/mod/freeswitch/Dockerfile b/mod/freeswitch/Dockerfile
index 98b9b1f..6480b23 100644
--- a/mod/freeswitch/Dockerfile
+++ b/mod/freeswitch/Dockerfile
@@ -5,11 +5,7 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     subversion curl wget ca-certificates gnupg gnupg2 lsb-release unzip
 
-# install dockerize
-ENV DOCKERIZE_VERSION v0.6.1
-RUN wget -q https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && tar -C /usr/local/bin -xzvf dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
+COPY --from=alangecker/bbb-docker-base-java /usr/local/bin/dockerize /usr/local/bin/dockerize
 
 
 # install freeswitch
@@ -47,8 +43,8 @@ RUN wget -q https://gitlab.senfcall.de/senfcall-public/mute-and-unmute-sounds/-/
 # git sparse-checkout is not yet available with buster and there
 # is no other sane way of downloading a single directory via git
 
-ENV TAG v2.3.4
-RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG/bbb-voice-conference/config/freeswitch/conf /etc/freeswitch \
+ARG TAG_FS_CONFIG
+RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_FS_CONFIG/bbb-voice-conference/config/freeswitch/conf /etc/freeswitch \
     && rm -rf /etc/freeswitch/.svn
 
 # the current available freeswitch-mod-opusfile is broken,
diff --git a/mod/freeswitch/conf/autoload_configs/acl.conf.xml b/mod/freeswitch/conf/autoload_configs/acl.conf.xml
index 41b2095..78628d8 100644
--- a/mod/freeswitch/conf/autoload_configs/acl.conf.xml
+++ b/mod/freeswitch/conf/autoload_configs/acl.conf.xml
@@ -23,6 +23,7 @@
       <node type="allow" cidr="127.0.0.1/32"/>
       <node type="allow" cidr="10.0.0.0/8"/>
       <node type="allow" cidr="192.168.0.0/16"/>
+      <node type="allow" cidr="172.16.0.0/12" />
       <node type="allow" cidr="$${external_ip_v4}/32"/>
     </list>
 
diff --git a/mod/fsesl-akka/Dockerfile b/mod/fsesl-akka/Dockerfile
index 428b39d..61494d1 100644
--- a/mod/fsesl-akka/Dockerfile
+++ b/mod/fsesl-akka/Dockerfile
@@ -1,28 +1,23 @@
-FROM mozilla/sbt:8u212_1.2.8 AS builder
+ARG BBB_BUILD_TAG
+FROM gitlab.senfcall.de:5050/senfcall-public/docker-bbb-build:$BBB_BUILD_TAG AS builder
 
-RUN apt-get update && apt-get install -y subversion
+ARG TAG_COMMON_MESSAGE
 
 # download bbb-common-message
-ENV TAG_COMMON_MESSAGE v2.4.5
 RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_COMMON_MESSAGE/bbb-common-message /bbb-common-message \
-    && rm -rf /bbb-common-message/.svn
-
-# compile bbb-common-message
-RUN cd /bbb-common-message \
- && ./deploy.sh 
-
+    && cd /bbb-common-message \
+    && ./deploy.sh \
+    && rm -rf /bbb-common-message
 
 # ===================================================
-ENV TAG_FSESL v2.4.5
-RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_FSESL/bbb-fsesl-client /bbb-fsesl-client \
+ARG TAG_FSESL_AKKA
+RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_FSESL_AKKA/bbb-fsesl-client /bbb-fsesl-client \
     && rm -rf /bbb-fsesl-client/.svn
 
 RUN cd /bbb-fsesl-client \
     && ./deploy.sh
 
-
-ENV TAG v2.4.5
-RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG/akka-bbb-fsesl /source \
+RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_FSESL_AKKA/akka-bbb-fsesl /source \
     && rm -rf /source/.svn
 
 # compile and unzip bin
@@ -32,25 +27,12 @@ RUN unzip /source/target/universal/bbb-fsesl-akka-0.0.2.zip -d /
 
 # # ===================================================
 
-FROM openjdk:8-jre-slim-bullseye
-
-RUN apt update && apt-get install -y wget gosu
-
-# install dockerize
-ENV DOCKERIZE_VERSION v0.6.1
-RUN wget -q https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && tar -C /usr/local/bin -xzvf dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
-
-
-RUN groupadd -g 1007 fsesl-akka \
-    && useradd -m -u 1007 -g fsesl-akka fsesl-akka
+FROM alangecker/bbb-docker-base-java
 
 COPY --from=builder /bbb-fsesl-akka-0.0.2 /bbb-fsesl-akka
 COPY bbb-fsesl-akka.conf /etc/bigbluebutton/bbb-fsesl-akka.conf.tmpl
 COPY logback.xml /bbb-fsesl-akka/conf/logback.xml
+COPY entrypoint.sh /entrypoint.sh
 
-WORKDIR /bbb-fsesl-akka
-CMD dockerize \
-    -template /etc/bigbluebutton/bbb-fsesl-akka.conf.tmpl:/etc/bigbluebutton/bbb-fsesl-akka.conf \
-    gosu fsesl-akka /bbb-fsesl-akka/bin/bbb-fsesl-akka
\ No newline at end of file
+USER bigbluebutton
+ENTRYPOINT /entrypoint.sh
\ No newline at end of file
diff --git a/mod/fsesl-akka/bbb-fsesl-akka.conf b/mod/fsesl-akka/bbb-fsesl-akka.conf
index 59c2948..ed1b475 100644
--- a/mod/fsesl-akka/bbb-fsesl-akka.conf
+++ b/mod/fsesl-akka/bbb-fsesl-akka.conf
@@ -5,7 +5,7 @@ include "/bbb-fsesl-akka/conf/application.conf"
 freeswitch {
     esl {
         host="10.7.7.1"
-        password="{{ default .Env.FSESL_PASSWORD "ClueCon" }}"
+        password="FSESL_PASSWORD"
     }
 }
 
diff --git a/mod/fsesl-akka/entrypoint.sh b/mod/fsesl-akka/entrypoint.sh
new file mode 100755
index 0000000..2000ce3
--- /dev/null
+++ b/mod/fsesl-akka/entrypoint.sh
@@ -0,0 +1,9 @@
+#!/bin/sh -e
+
+TARGET=/etc/bigbluebutton/bbb-fsesl-akka.conf
+
+cp /etc/bigbluebutton/bbb-fsesl-akka.conf.tmpl $TARGET
+sed -i "s/FSESL_PASSWORD/$FSESL_PASSWORD/" $TARGET
+
+cd /bbb-fsesl-akka
+/bbb-fsesl-akka/bin/bbb-fsesl-akka
\ No newline at end of file
diff --git a/mod/html5/Dockerfile b/mod/html5/Dockerfile
index 0a26397..9364fed 100644
--- a/mod/html5/Dockerfile
+++ b/mod/html5/Dockerfile
@@ -1,44 +1,34 @@
-FROM node:14.18.1-bullseye-slim AS builder
+ARG BBB_BUILD_TAG
+FROM gitlab.senfcall.de:5050/senfcall-public/docker-bbb-build:$BBB_BUILD_TAG AS builder
 
-RUN apt-get update && apt-get install -y wget curl subversion python3 build-essential
-RUN groupadd -g 2000 meteor && useradd -m -u 2001 -g meteor meteor
+# RUN groupadd -g 2000 meteor && useradd -m -u 2001 -g meteor meteor
+# USER meteor
 
+ARG TAG_HTML5
+RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_HTML5/bigbluebutton-html5 /source \
+    && cd /source \
+    && meteor npm ci --production \
+    && METEOR_DISABLE_OPTIMISTIC_CACHING=1 meteor build --architecture os.linux.x86_64 --allow-superuser  --directory /app \
+    && rm -rf /source
 
-# download dockerize
-ENV DOCKERIZE_VERSION v0.6.1
-RUN wget -q https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && tar -C /usr/local/bin -xzvf dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
-
-USER meteor
-ENV METEOR_VERSION 2.5
-RUN curl -sL https://install.meteor.com?release=$METEOR_VERSION | sed s/--progress-bar/-sL/g | /bin/sh
-
-ENV TAG v2.4.5
-RUN cd ~ \
-    && svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG/bigbluebutton-html5 \
-    && mv ~/bigbluebutton-html5 ~/source \
-    && cd ~/source \
-    && ~/.meteor/meteor npm ci --production \
-    && METEOR_DISABLE_OPTIMISTIC_CACHING=1  ~/.meteor/meteor build --architecture os.linux.x86_64 --directory ~/app \
-    && rm -rf ~/source
-
-RUN cd ~/app/bundle/programs/server \
+RUN cd /app/bundle/programs/server \
     && npm install --production
     
+RUN sed -i "s/VERSION/$TAG_HTML5/" /app/bundle/programs/web.browser/head.html \
+    && find /app/bundle/programs/web.browser -name '*.js' -exec gzip -k -f -9 '{}' \; \
+    && find /app/bundle/programs/web.browser -name '*.css' -exec gzip -k -f -9 '{}' \; \
+    && find /app/bundle/programs/web.browser -name '*.wasm' -exec gzip -k -f -9 '{}' \;
+
 # ------------------------------
 
-FROM node:14.18.1-alpine
+FROM node:14.19.1-alpine
 
 RUN addgroup -g 2000 meteor && \
     adduser -D -u 2001 -G meteor meteor && \
     apk add su-exec
-COPY --from=builder /usr/local/bin/dockerize /usr/local/bin/dockerize
-COPY --from=builder --chown=meteor:meteor /home/meteor/app/bundle /app
+COPY --from=alangecker/bbb-docker-base-java /usr/local/bin/dockerize /usr/local/bin/dockerize
+COPY --from=builder --chown=meteor:meteor /app/bundle /app
 COPY entrypoint.sh /entrypoint.sh
 COPY bbb-html5.yml /app/bbb-html5.yml.tmpl
 
 ENTRYPOINT ["/entrypoint.sh"]
-
-# lets set the tag again, so that it is include in the image for later version retrieval
-ENV TAG v2.4.5
diff --git a/mod/html5/bbb-html5.yml b/mod/html5/bbb-html5.yml
index 5194e43..baf6de8 100644
--- a/mod/html5/bbb-html5.yml
+++ b/mod/html5/bbb-html5.yml
@@ -1,5 +1,6 @@
 public:
   app:
+    bbbServerVersion: {{ .Env.TAG_HTML5 }}-docker
     listenOnlyMode: {{ .Env.LISTEN_ONLY_MODE }}
     skipCheck: {{ .Env.DISABLE_ECHO_TEST }}
     clientTitle: {{ .Env.CLIENT_TITLE }}
@@ -13,15 +14,11 @@ public:
   chat:
     enabled: {{ .Env.CHAT_ENABLED }}
     startClosed: {{ .Env.CHAT_START_CLOSED }}
-  note:
+  pads:
     url: https://{{ .Env.DOMAIN }}/pad
 private:
   app:
     host: 0.0.0.0
-  etherpad:
-    apikey: {{ .Env.ETHERPAD_API_KEY }}
-    host: etherpad
-    port: 9001
   redis:
     host: redis
     port: '6379'
diff --git a/mod/html5/entrypoint.sh b/mod/html5/entrypoint.sh
index bb4d61a..ce10bdb 100755
--- a/mod/html5/entrypoint.sh
+++ b/mod/html5/entrypoint.sh
@@ -11,7 +11,7 @@ export BIND_IP=0.0.0.0
 export LANG=en_US.UTF-8
 export INSTANCE_MAX=1
 export ENVIRONMENT_TYPE=production
-export NODE_VERSION=node-v12.16.1-linux-x64
+export NODE_VERSION=node-v14.19.1-linux-x64
 export BBB_HTML5_LOCAL_SETTINGS=/app/bbb-html5.yml
 
 if [ "$DEV_MODE" == true ]; then
@@ -26,7 +26,7 @@ fi
 
 # if container is the first frontend, do some additional tasks
 if [ "$BBB_HTML5_ROLE" == "frontend" ] && [ "$INSTANCE_ID" == "1" ]; then
-    # delete potential old settings.yml
+
 
     # copy static files into volume for direct access by nginx
     # https://github.com/bigbluebutton/bigbluebutton/issues/10739
diff --git a/mod/mongo/init-replica.sh b/mod/mongo/init-replica.sh
index e572796..188cdda 100755
--- a/mod/mongo/init-replica.sh
+++ b/mod/mongo/init-replica.sh
@@ -4,10 +4,20 @@ set -e
 
 host=${HOSTNAME:-$(hostname -f)}
 
+# shut down again
+mongod --pidfilepath /tmp/docker-entrypoint-temp-mongod.pid --shutdown
+# restart again binding to 0.0.0.0 to allow a replset with 10.7.7.6
+mongod --oplogSize 8 --replSet rs0 --noauth \
+   --config /tmp/docker-entrypoint-temp-config.json \
+   --bind_ip 0.0.0.0 --port 27017 \
+   --tlsMode disabled \
+   --logpath /proc/1/fd/1 --logappend \
+   --pidfilepath /tmp/docker-entrypoint-temp-mongod.pid --fork
+
 # init replset with defaults
-mongo local --eval "rs.initiate({
+mongo 10.7.7.6 --eval "rs.initiate({
    _id: 'rs0',
-   members: [ { _id: 0, host: '127.0.0.1:27017' } ]
+   members: [ { _id: 0, host: '10.7.7.6:27017' } ]
 })"
 
 echo "Waiting to become a master"
diff --git a/mod/nginx/Dockerfile b/mod/nginx/Dockerfile
index 4beccb2..e7788eb 100644
--- a/mod/nginx/Dockerfile
+++ b/mod/nginx/Dockerfile
@@ -4,13 +4,11 @@ RUN apk add subversion git
 
 # --------------------
 
-ENV TAG_LEARNING_DASHBOARD v2.4.5
+ARG TAG_LEARNING_DASHBOARD
 RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_LEARNING_DASHBOARD/bbb-learning-dashboard /bbb-learning-dashboard && rm -r /bbb-learning-dashboard/.svn
 RUN cd /bbb-learning-dashboard && npm ci && npm run build
 
-ENV TAG_PLAYBACK v3.3.0
-ENV REACT_APP_BBB_PLAYBACK_BUILD=$TAG_PLAYBACK
-RUN svn checkout https://github.com/bigbluebutton/bbb-playback/tags/$TAG_PLAYBACK /bbb-playback && rm -r /bbb-playback/.svn
+COPY ./bbb-playback /bbb-playback
 RUN cd /bbb-playback && npm ci && npm run build
 
 # --------------------
diff --git a/mod/nginx/bbb-playback b/mod/nginx/bbb-playback
new file mode 160000
index 0000000..4031c8e
--- /dev/null
+++ b/mod/nginx/bbb-playback
@@ -0,0 +1 @@
+Subproject commit 4031c8e5ff80c05cc6dec9b977c9df4a2cc51b35
diff --git a/mod/nginx/bbb/notes.nginx b/mod/nginx/bbb/notes.nginx
index 95bde11..bc37eed 100644
--- a/mod/nginx/bbb/notes.nginx
+++ b/mod/nginx/bbb/notes.nginx
@@ -1,5 +1,10 @@
 # https://github.com/ether/etherpad-lite/wiki/How-to-put-Etherpad-Lite-behind-a-reverse-Proxy
 location /pad/p/ {
+    # Avoid setting the user name from the embedded URL
+    if ($arg_userName) {
+        return 401;
+    }
+
     rewrite /pad/p/(.*) /p/$1 break;
     rewrite ^/pad/p$ /pad/p/ permanent;
     proxy_pass http://etherpad:9001/p;
@@ -13,7 +18,17 @@ location /pad/p/ {
     proxy_set_header X-Forwarded-Proto $scheme; # for EP to set secure cookie flag when https is used
     proxy_http_version 1.1;
 
-    auth_request /bigbluebutton/connection/validatePad;
+    auth_request /bigbluebutton/connection/checkAuthorization;
+    auth_request_set $auth_status $upstream_status;
+}
+
+location /pad/auth_session {
+    rewrite /pad/auth_session(.*) /auth_session$1 break;
+    proxy_pass http://etherpad:9001/;
+    proxy_pass_header Server;
+    proxy_set_header Host $host;
+    proxy_buffering off;
+    auth_request /bigbluebutton/connection/checkAuthorization;
     auth_request_set $auth_status $upstream_status;
 }
 
diff --git a/mod/nginx/bbb/podcast.nginx b/mod/nginx/bbb/podcast.nginx
new file mode 100644
index 0000000..7d8c0a8
--- /dev/null
+++ b/mod/nginx/bbb/podcast.nginx
@@ -0,0 +1,22 @@
+#
+# BigBlueButton open source conferencing system - http://www.bigbluebutton.org/
+#
+# Copyright (c) 2012 BigBlueButton Inc. and by respective authors (see below).
+#
+# This program is free software; you can redistribute it and/or modify it under the
+# terms of the GNU Lesser General Public License as published by the Free Software
+# Foundation; either version 3.0 of the License, or (at your option) any later
+# version.
+#
+# BigBlueButton is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License along
+# with BigBlueButton; if not, see <http://www.gnu.org/licenses/>.
+#
+
+        location /podcast {
+                root    /var/bigbluebutton/published;
+                index  index.html index.htm;
+        }
\ No newline at end of file
diff --git a/mod/nginx/bbb/webrtc-sfu.nginx b/mod/nginx/bbb/webrtc-sfu.nginx
index 71a5a00..c226485 100644
--- a/mod/nginx/bbb/webrtc-sfu.nginx
+++ b/mod/nginx/bbb/webrtc-sfu.nginx
@@ -6,7 +6,7 @@ location /bbb-webrtc-sfu {
     auth_request_set $meeting_id $sent_http_meeting_id;
     auth_request_set $voice_bridge $sent_http_voice_bridge;
 
-    proxy_pass http://webrtc-sfu:3008;
+    proxy_pass http://10.7.7.1:3008;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "Upgrade";
diff --git a/mod/periodic/Dockerfile b/mod/periodic/Dockerfile
index 56fea76..184cc89 100644
--- a/mod/periodic/Dockerfile
+++ b/mod/periodic/Dockerfile
@@ -1,16 +1,9 @@
 FROM debian:bullseye-slim
 
-# -- install mongo cli
-RUN apt-get update \
-    && apt-get install -y wget libcurl4 \
-    && wget https://repo.mongodb.org/apt/debian/dists/buster/mongodb-org/4.2/main/binary-amd64/mongodb-org-shell_4.2.6_amd64.deb \
-    && dpkg -i mongodb*.deb \
-    && rm mongodb*.deb
-
 # -- install docker cli
 COPY --from=library/docker:latest /usr/local/bin/docker /usr/bin/docker
 
-COPY bbb-remove-old-recordings bbb-restart-kms bbb-resync-freeswitch entrypoint.sh /
+COPY bbb-remove-old-recordings bbb-resync-freeswitch entrypoint.sh /
 
 RUN chmod +x bbb-remove-old-recordings
 
diff --git a/mod/periodic/bbb-restart-kms b/mod/periodic/bbb-restart-kms
deleted file mode 100755
index 3787ade..0000000
--- a/mod/periodic/bbb-restart-kms
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/bin/bash
-
-# Source:
-# https://github.com/alangecker/bbb-packages/blob/f83431c227be2c95025ea81083baeaa87667b170/bbb-webrtc-sfu/data/etc/cron.hourly/bbb-restart-kms
-
-#
-# Restart Kurento every 24+ hours
-#
-
-if [ ! -f /tmp/bbb-kms-last-restart.txt ]; then
-  date +%Y-%m-%d\ %H:%M:%S > /tmp/bbb-kms-last-restart.txt
-  exit
-fi
-
-users=$(mongo --quiet mongodb://10.7.7.6:27017/meteor --eval "db.users.count()")
-echo "currently active users: $users"
-
-if [ "$users" -eq 0 ]; then
-
-  # Make sure 24 hours have passed since last restart
-
-  # Seconds since epoch for last restart
-  dt1=$(cat /tmp/bbb-kms-last-restart.txt)
-  t1=`date --date="$dt1" +%s`
-
-  # Current seconds since epoch
-  dt2=`date +%Y-%m-%d\ %H:%M:%S`
-  t2=`date --date="$dt2" +%s`
-
-  # Hours since last restart
-  let "tDiff=$t2-$t1"
-  let "hDiff=$tDiff/3600"
-
-  if [ "$hDiff" -ge 24 ]; then
-    echo "scheduled restart of kurento after 24h"
-    CONTAINER_ID=$(docker ps | grep kurento | awk '{print $1}')
-    docker restart $CONTAINER_ID
-    date +%Y-%m-%d\ %H:%M:%S > /tmp/bbb-kms-last-restart.txt
-  fi
-fi
diff --git a/mod/periodic/bbb-resync-freeswitch b/mod/periodic/bbb-resync-freeswitch
index 5e0c138..ee3d087 100755
--- a/mod/periodic/bbb-resync-freeswitch
+++ b/mod/periodic/bbb-resync-freeswitch
@@ -2,5 +2,4 @@
 
 # https://github.com/bigbluebutton/bigbluebutton/pull/9597/files
 
-CONTAINER_ID=$(docker ps | grep freeswitch | awk '{print $1}')
-docker exec -it $CONTAINER_ID fs_cli -H 10.7.7.1 -P 8021 -x 'fsctl sync_clock_when_idle'
\ No newline at end of file
+docker exec -it bbb-freeswitch fs_cli -H 10.7.7.1 -P 8021 -x 'fsctl sync_clock_when_idle'
\ No newline at end of file
diff --git a/mod/periodic/entrypoint.sh b/mod/periodic/entrypoint.sh
index dd060d8..cc3bbb0 100755
--- a/mod/periodic/entrypoint.sh
+++ b/mod/periodic/entrypoint.sh
@@ -7,8 +7,6 @@ history=5
 
 while :
 do
-	# restart kurento after 24h
-	/bbb-restart-kms
 
 	# resync freeswitch
 	/bbb-resync-freeswitch
diff --git a/mod/recordings/Dockerfile b/mod/recordings/Dockerfile
index 1a02483..ad401b3 100644
--- a/mod/recordings/Dockerfile
+++ b/mod/recordings/Dockerfile
@@ -1,5 +1,5 @@
 
-FROM ruby:2.5-slim-buster
+FROM ruby:2.7-slim-buster
 
 # install apt dependencies
 RUN apt-get update && apt-get install -y \
@@ -23,6 +23,7 @@ RUN apt-get update && apt-get install -y \
     supervisor \
     locales \
     locales-all
+# TODO: missing packages
 
 ENV LC_ALL en_US.UTF-8
 ENV LANG en_US.UTF-8
@@ -45,25 +46,29 @@ RUN wget -q https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VE
     && tar -C /usr/local/bin -xzvf dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
     && rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
 
+# add yq for bbb-record
+RUN  wget -q https://github.com/mikefarah/yq/releases/download/3.4.1/yq_linux_amd64 -O /usr/bin/yq \
+    && chmod +x /usr/bin/yq
+
 RUN mkdir -p \
     /usr/local/bigbluebutton \
     /usr/local/bigbluebutton/core \
     /etc/bigbluebutton
 
-ENV TAG v2.4.4
+ARG TAG_RECORDINGS
 
 # add bbb-record-core (lib, scripts and Gemfile)
 RUN cd /usr/local/bigbluebutton/core \
-    && svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG/record-and-playback/core/lib \
-    && svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG/record-and-playback/core/scripts \
+    && svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_RECORDINGS/record-and-playback/core/lib \
+    && svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_RECORDINGS/record-and-playback/core/scripts \
     && rm -rf /usr/local/bigbluebutton/core/*/.svn \
-    && wget https://raw.githubusercontent.com/bigbluebutton/bigbluebutton/$TAG/record-and-playback/core/Gemfile.lock \
-    && wget https://raw.githubusercontent.com/bigbluebutton/bigbluebutton/$TAG/record-and-playback/core/Gemfile \
-    && wget https://raw.githubusercontent.com/bigbluebutton/bigbluebutton/$TAG/record-and-playback/core/Rakefile
+    && wget https://raw.githubusercontent.com/bigbluebutton/bigbluebutton/$TAG_RECORDINGS/record-and-playback/core/Gemfile.lock \
+    && wget https://raw.githubusercontent.com/bigbluebutton/bigbluebutton/$TAG_RECORDINGS/record-and-playback/core/Gemfile \
+    && wget https://raw.githubusercontent.com/bigbluebutton/bigbluebutton/$TAG_RECORDINGS/record-and-playback/core/Rakefile
 
 # add bbb-playback-presentation scripts
 RUN cd /tmp \
-    && svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG/record-and-playback/presentation/scripts \
+    && svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG_RECORDINGS/record-and-playback/presentation/scripts \
     && rsync -av /tmp/scripts/ /usr/local/bigbluebutton/core/scripts/ \
     && rm -rf /tmp/scripts
 
@@ -84,11 +89,11 @@ RUN sed -i 's|Journald::Logger\.new.*|Logger.new("/var/log/bigbluebutton/recordi
 
 # add bbb-record with some adjustments so bbb-record works in this environment
 RUN cd /usr/bin \
-    && wget https://raw.githubusercontent.com/bigbluebutton/bigbluebutton/$TAG/bigbluebutton-config/bin/bbb-record \
+    && wget https://raw.githubusercontent.com/bigbluebutton/bigbluebutton/$TAG_RECORDINGS/bigbluebutton-config/bin/bbb-record \
     && chmod +x /usr/bin/bbb-record \
     && sed -i 's/^BBB_WEB.*/BBB_WEB=""/' /usr/bin/bbb-record \
     && sed -i 's/systemctl.*//' /usr/bin/bbb-record \
-    && echo "BIGBLUEBUTTON_RELEASE=$TAG" > /etc/bigbluebutton/bigbluebutton-release
+    && echo "BIGBLUEBUTTON_RELEASE=$TAG_RECORDINGS" > /etc/bigbluebutton/bigbluebutton-release
 
 # create user
 # the ID should match the one creating the files in `core`
diff --git a/mod/recordings/bigbluebutton.yml b/mod/recordings/bigbluebutton.yml
index c023382..e93228d 100644
--- a/mod/recordings/bigbluebutton.yml
+++ b/mod/recordings/bigbluebutton.yml
@@ -7,7 +7,7 @@ raw_screenshare_src: /usr/share/red5/webapps/screenshare/streams
 raw_webrtc_deskshare_src: /usr/share/red5/webapps/video-broadcast/streams
 raw_deskshare_src: /var/bigbluebutton/deskshare
 raw_presentation_src: /var/bigbluebutton
-notes_endpoint: http://etherpad:9001/p
+notes_endpoint: http://bbb-pads:9002/p
 # Specify the notes formats we archive
 # txt, doc and odt are also supported
 notes_formats:
diff --git a/mod/recordings/supervisord.conf b/mod/recordings/supervisord.conf
index aa71b41..4780d47 100644
--- a/mod/recordings/supervisord.conf
+++ b/mod/recordings/supervisord.conf
@@ -4,7 +4,7 @@ user=root
 [program:rasque_workers]
 command=rake resque:workers
 directory=/usr/local/bigbluebutton/core/scripts
-environment=QUEUE="rap:archive,rap:publish,rap:process,rap:sanity,rap:captions,rap:events",COUNT="1",VVERBOSE="1"
+environment=QUEUE="rap:archive,rap:publish,rap:process,rap:sanity,rap:captions,rap:events",COUNT="1",VVERBOSE="1",HOME="/home/bigbluebutton"
 user=bigbluebutton
 stdout_logfile=/dev/fd/1
 stdout_logfile_maxbytes=0
@@ -15,6 +15,7 @@ stderr_logfile_maxbytes=0
 [program:rap_starter]
 command=bundle exec ruby /usr/local/bigbluebutton/core/scripts/rap-starter.rb
 directory=/usr/local/bigbluebutton/core/scripts
+environment=HOME="/home/bigbluebutton"
 user=bigbluebutton
 stdout_logfile=/dev/fd/1
 stdout_logfile_maxbytes=0
@@ -25,6 +26,7 @@ stderr_logfile_maxbytes=0
 [program:rap_caption_inbox]
 command=bundle exec ruby /usr/local/bigbluebutton/core/scripts/rap-caption-inbox.rb
 directory=/usr/local/bigbluebutton/core/scripts
+environment=HOME="/home/bigbluebutton"
 user=bigbluebutton
 stdout_logfile=/dev/fd/1
 stdout_logfile_maxbytes=0
diff --git a/mod/webhooks/Dockerfile b/mod/webhooks/Dockerfile
index 9d3efbd..ee62cc2 100644
--- a/mod/webhooks/Dockerfile
+++ b/mod/webhooks/Dockerfile
@@ -1,26 +1,25 @@
-FROM node:14-alpine
-
-# download dockerize
-ENV DOCKERIZE_VERSION v0.6.1
-RUN wget -q https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && tar -C /usr/local/bin -xzvf dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
-    && apk add subversion \
-    && mkdir /app \
-    && adduser -D -u 2002 -g webhooks webhooks \
-    && chown webhooks:webhooks /app
-
-USER webhooks
+FROM node:14.18.3-bullseye-slim AS builder
 
 
-ENV TAG v2.4.0
-RUN svn checkout https://github.com/bigbluebutton/bigbluebutton/tags/$TAG/bbb-webhooks /app \
-    && rm -rf /app/.svn \
-    && cd /app && npm install --production
+RUN apt-get update && apt-get install -y git wget
 
+RUN  wget -q https://github.com/mikefarah/yq/releases/download/v4.25.1/yq_linux_amd64 -O /usr/bin/yq \
+    && chmod +x /usr/bin/yq
+
+COPY ./bbb-webhooks /bbb-webhooks
+RUN cd /bbb-webhooks && npm install --production
+
+RUN chmod 777 /bbb-webhooks/config
+# ------------------------------
+
+FROM node:14.18.3-bullseye-slim
+RUN useradd --uid 2004 --user-group bbb-webhooks
+
+COPY --from=builder /usr/bin/yq /usr/bin/yq
+COPY --from=builder /bbb-webhooks /bbb-webhooks
 COPY entrypoint.sh /entrypoint.sh
-COPY config.yml /app/config/default.yml.tmpl
 
+RUN mkdir /bbb-webhooks/log && chmod 777 /bbb-webhooks/log
+USER bbb-webhooks
 ENTRYPOINT /entrypoint.sh
 
-
diff --git a/mod/webhooks/bbb-webhooks b/mod/webhooks/bbb-webhooks
new file mode 160000
index 0000000..2eb5e44
--- /dev/null
+++ b/mod/webhooks/bbb-webhooks
@@ -0,0 +1 @@
+Subproject commit 2eb5e4471083f9f99e969d5d19a44529ec735808
diff --git a/mod/webhooks/config.yml b/mod/webhooks/config.yml
deleted file mode 100644
index 0d2446e..0000000
--- a/mod/webhooks/config.yml
+++ /dev/null
@@ -1,70 +0,0 @@
-# Shared secret of your BigBlueButton server.
-bbb:
-  serverDomain: {{ .Env.DOMAIN }}
-  sharedSecret: {{ .Env.SHARED_SECRET }}
-  # Whether to use Auth2.0 or not, Auth2.0 sends the sharedSecret whithin an Authorization header as a bearer
-  auth2_0: true  
-  apiPath: /bigbluebutton/api
-
-# The port in which the API server will run.
-server:
-  bind: 0.0.0.0
-  port: 3005
-
-# Web hooks configs
-hooks:
-  channels:
-    - from-akka-apps-redis-channel
-    - from-bbb-web-redis-channel
-    - from-akka-apps-chat-redis-channel
-    - bigbluebutton:from-bbb-apps:meeting
-    - bigbluebutton:from-bbb-apps:users
-    - bigbluebutton:from-bbb-apps:chat
-    - bigbluebutton:from-rap
-  # IP where permanent hook will post data (more than 1 URL means more than 1 permanent hook)
-  permanentURLs: []
-  # How many messages will be enqueued to be processed at the same time
-  queueSize: 10000
-  # Allow permanent hooks to receive raw message, which is the message straight from BBB
-  getRaw: false
-  # If set to higher than 1, will send events on the format:
-  # "event=[{event1},{event2}],timestamp=000" or "[{event1},{event2}]" (based on using auth2_0 or not)
-  # when there are more than 1 event on the queue at the moment of processing the queue.
-  multiEvent: 1
-  # Retry intervals for failed attempts for perform callback calls.
-  # In ms. Totals to around 5min.
-  retryIntervals:
-    - 100
-    - 500
-    - 1000
-    - 2000
-    - 4000
-    - 8000
-    - 10000
-    - 30000
-    - 60000
-    - 60000
-    - 60000
-    - 60000
-  # Reset permanent interval when exceeding maximum attemps
-  permanentIntervalReset: 8
-  # Hook's request module timeout for socket conn establishment and/or responses (ms)
-  requestTimeout: 5000
-
-# Mappings of internal to external meeting IDs
-mappings:
-  cleanupInterval: 10000 # 10 secs, in ms
-  timeout: 86400000 # 24 hours, in ms
-
-# Redis
-redis:
-  host: redis
-  port: 6379
-  keys:
-    hookPrefix: bigbluebutton:webhooks:hook
-    hooks: bigbluebutton:webhooks:hooks
-    mappings: bigbluebutton:webhooks:mappings
-    mappingPrefix: bigbluebutton:webhooks:mapping
-    eventsPrefix: bigbluebutton:webhooks:events
-    userMaps: bigbluebutton:webhooks:userMaps
-    userMapPrefix: bigbluebutton:webhooks:userMap
\ No newline at end of file
diff --git a/mod/webhooks/entrypoint.sh b/mod/webhooks/entrypoint.sh
index 79131c2..22107ac 100755
--- a/mod/webhooks/entrypoint.sh
+++ b/mod/webhooks/entrypoint.sh
@@ -1,9 +1,17 @@
 #!/bin/sh
+set -e
+TARGET=/bbb-webhooks/config/production.yml
+cp /bbb-webhooks/config/default.example.yml $TARGET
+
+yq e -i ".bbb.sharedSecret = \"$SHARED_SECRET\"" $TARGET
+yq e -i ".bbb.serverDomain = \"$DOMAIN\"" $TARGET
+yq e -i ".bbb.auth2_0 = true" $TARGET
+yq e -i ".server.bind = \"0.0.0.0\"" $TARGET
+yq e -i ".hooks.getRaw = false" $TARGET
+yq e -i ".redis.host = \"redis\"" $TARGET
 
 export NODE_ENV=production
-cd /app
-dockerize \
-    -wait tcp://redis:6379 \
-    -template /app/config/default.yml.tmpl:/app/config/default.yml \
-    node app.js
+
+cd /bbb-webhooks
+node app.js
 
diff --git a/mod/webrtc-sfu/Dockerfile b/mod/webrtc-sfu/Dockerfile
index 72884c4..e8d3263 100644
--- a/mod/webrtc-sfu/Dockerfile
+++ b/mod/webrtc-sfu/Dockerfile
@@ -1,36 +1,35 @@
-FROM node:14-bullseye-slim
+ARG BBB_BUILD_TAG
+FROM gitlab.senfcall.de:5050/senfcall-public/docker-bbb-build:$BBB_BUILD_TAG AS builder
 
 
-RUN apt-get update && apt-get -y install \
-  git \
-  make \
-  python \
-  python3-pip \
-  g++ \
-  ffmpeg
-
 RUN useradd --uid 2004 --user-group webrtc-sfu 
 
-ADD ./bbb-webrtc-sfu app
+ADD ./bbb-webrtc-sfu /app
 
-WORKDIR app
 
 ENV NODE_ENV production
 
-
 # due to the git submodule npm install crashes with following error:
 # npm ERR! fatal: Not a git repository: ../.git/modules/bbb-webrtc-sfu
 # we simply delete the .git file
-RUN cp config/default.example.yml config/production.yml \
- && chown -R webrtc-sfu:webrtc-sfu config \
+RUN cd /app \
+ && cp config/default.example.yml config/production.yml \
  && rm .git \
  && npm install --unsafe-perm \
  && npm cache clear --force \
  && rm -rf node_modules/mediasoup/worker/out/Release/subprojects \
  && rm -rf node_modules/mediasoup/worker/out/Release/mediasoup-worker.p \
  && rm -rf node_modules/mediasoup/worker/out/Release/deps
-COPY docker-entrypoint.sh /app/docker-entrypoint.sh
+
+
+# =============================
+FROM node:14.19.1-bullseye-slim
+RUN useradd --uid 2004 --user-group webrtc-sfu 
+ENV NODE_ENV production
+
+COPY --from=builder /app /app
+RUN chown -R webrtc-sfu:webrtc-sfu /app/config
 
 USER webrtc-sfu
-ENTRYPOINT [ "./docker-entrypoint.sh" ]
+WORKDIR /app
 CMD [ "npm", "start" ]
diff --git a/mod/webrtc-sfu/bbb-webrtc-sfu b/mod/webrtc-sfu/bbb-webrtc-sfu
index 3dc34eb..07723a9 160000
--- a/mod/webrtc-sfu/bbb-webrtc-sfu
+++ b/mod/webrtc-sfu/bbb-webrtc-sfu
@@ -1 +1 @@
-Subproject commit 3dc34eb558ce2f0e230c358580d8e7e1cd9b8f67
+Subproject commit 07723a95bf350181fcb87b5e8c9ebc53eb6d8de6
diff --git a/mod/webrtc-sfu/docker-entrypoint.sh b/mod/webrtc-sfu/docker-entrypoint.sh
deleted file mode 100755
index 243593c..0000000
--- a/mod/webrtc-sfu/docker-entrypoint.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/sh -e
-
-sed -i "s|^\(localIpAddress\):.*|\1: \"10.7.7.10\"|g" config/production.yml
-export KURENTO_IP="10.7.7.1"
-
-exec "$@"
diff --git a/sample.env b/sample.env
index 78e945d..f83534d 100644
--- a/sample.env
+++ b/sample.env
@@ -59,11 +59,6 @@ DOMAIN=bbb.example.com
 EXTERNAL_IPv4=144.76.97.10
 EXTERNAL_IPv6=
 
-# setting the network interface speeds up kurentos WebRTC connection time,
-# but currently also disables IPv6 for Kurento
-# (https://github.com/Kurento/bugtracker/issues/500)
-#NETWORK_INTERFACE=ens3
-
 # STUN SERVER
 # stun.freeswitch.org
 STUN_IP=216.93.246.18
@@ -88,7 +83,7 @@ SIP_IP_ALLOWLIST=
 CLIENT_TITLE=BigBlueButton
 
 # use following lines to replace the default welcome message and footer
-WELCOME_MESSAGE="Welcome to <b>%%CONFNAME%%</b>!<br><br>For help on using BigBlueButton see these (short) <a href='https://www.bigbluebutton.org/html5' target='_blank'><u>tutorial videos</u></a>.<br><br>To join the audio bridge click the phone button.  Use a headset to avoid causing background noise for others."
+WELCOME_MESSAGE="Welcome to <b>%%CONFNAME%%</b>!<br><br>For help on using BigBlueButton see these (short) <a href='https://www.bigbluebutton.org/html5' target='_blank'><u>tutorial videos</u></a>.<br><br>To join the audio bridge click the speaker button.  Use a headset to avoid causing background noise for others."
 WELCOME_FOOTER="This server is running <a href='https://docs.bigbluebutton.org/'' target='_blank'><u>BigBlueButton</u></a>."
 
 # use following line for an additional SIP dial-in message
diff --git a/scripts/checkout-submodules b/scripts/checkout-submodules
new file mode 100755
index 0000000..6724ea0
--- /dev/null
+++ b/scripts/checkout-submodules
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# checkouts submodules based on the tag
+# provided in `tags.env`
+
+
+set -e
+cd "$(dirname "$0")/.."
+
+export $(cat tags.env | sed 's/#.*//g' | xargs)
+
+function checkout {
+    path=$1
+    ref=$2
+    pushd $path
+    git checkout $ref
+    popd > /dev/null
+}
+
+checkout mod/webrtc-sfu/bbb-webrtc-sfu $TAG_WEBRTC_SFU
+checkout mod/nginx/bbb-playback $TAG_PLAYBACK
+checkout mod/bbb-pads/bbb-pads $TAG_PADS
+checkout mod/webhooks/bbb-webhooks $TAG_WEBHOOKS
+
+echo ""
+echo "# git submodule"
+git submodule
\ No newline at end of file
diff --git a/scripts/generate-compose b/scripts/generate-compose
index bd7d710..7beb472 100755
--- a/scripts/generate-compose
+++ b/scripts/generate-compose
@@ -33,10 +33,26 @@ if [ "$ENABLE_COTURN" == true ]; then
   fi
 fi
 
+export $(cat tags.env | sed 's/#.*//g' | xargs)
+
 docker run  \
     --rm  \
     -v $(pwd)/docker-compose.tmpl.yml:/docker-compose.tmpl.yml \
+    -e BBB_BUILD_TAG=${BBB_BUILD_TAG} \
+    -e TAG_COMMON_MESSAGE=${TAG_COMMON_MESSAGE} \
+    -e TAG_APPS_AKKA=${TAG_APPS_AKKA} \
+    -e TAG_FSESL_AKKA=${TAG_FSESL_AKKA} \
+    -e TAG_BBB_WEB=${TAG_BBB_WEB} \
+    -e TAG_HTML5=${TAG_HTML5} \
+    -e TAG_FS_CONFIG=${TAG_FS_CONFIG} \
+    -e TAG_LEARNING_DASHBOARD=${TAG_LEARNING_DASHBOARD} \
+    -e TAG_RECORDINGS=${TAG_RECORDINGS} \
+    -e TAG_WEBRTC_SFU=${TAG_WEBRTC_SFU} \
+    -e TAG_WEBHOOKS=${TAG_WEBHOOKS} \
+    -e TAG_PLAYBACK=${TAG_PLAYBACK} \
+    -e TAG_PADS=${TAG_PADS} \
     -e DEV_MODE=${DEV_MODE:-false} \
+    -e EXTERNAL_IPv6=${EXTERNAL_IPv6:-} \
     -e ENABLE_RECORDING=${ENABLE_RECORDING:-false} \
     -e REMOVE_OLD_RECORDING=${REMOVE_OLD_RECORDING:-false} \
     -e RECORDING_MAX_AGE_DAYS=${RECORDING_MAX_AGE_DAYS:-14} \
diff --git a/scripts/print-versions b/scripts/print-versions
deleted file mode 100755
index b11419c..0000000
--- a/scripts/print-versions
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/bin/bash
-set -e
-
-CORE_IMAGE=$(docker-compose images -q core)
-FREESWITCH_IMAGE=$(docker-compose images -q freeswitch)
-HTML5_IMAGE=$(docker-compose images -q html5)
-KURENTO_IMAGE=$(docker-compose images -q kurento)
-ETHERPAD_IMAGE=$(docker-compose images -q etherpad)
-MONGO_IMAGE=$(docker-compose images -q mongodb)
-REDIS_IMAGE=$(docker-compose images -q redis)
-
-if [[ -z $CORE_IMAGE ]]
-then 
-    echo "this script only works if containers are created"
-    echo "either start BigBlueButton with"
-    echo "  $ docker-compose up -d"
-    echo "or at least create the containers with"
-    echo "  $ docker-compose create"
-    exit 1
-fi
-
-
-
-echo "bigbluebutton-docker"
-echo "    commit: $(git rev-parse --short HEAD) ($(git log -1 --pretty=%B | head -n 1))"
-echo "    branch: $(git rev-parse --abbrev-ref HEAD)"
-echo ""
-
-echo "core"
-docker run --rm --entrypoint /bin/sh $CORE_IMAGE -c "dpkg -l 'bbb-*' | grep ii | cut -c 5-42 | sed 's/bbb-/    bbb-/g'"
-echo ""
-
-echo "etherpad"
-ETHERPAD_VERSION=$(docker run --rm --entrypoint cat $ETHERPAD_IMAGE /opt/etherpad-lite/src/package.json | grep version | awk -F'"' '{print $4}')
-echo "    version: $ETHERPAD_VERSION"
-echo ""
-
-echo "freeswitch"
-FREESWITCH_VERSION=$(docker run --rm --entrypoint freeswitch $FREESWITCH_IMAGE -version | cut -c 21-)
-FREESWTICH_CONFIG_VERSION=$(docker image inspect $FREESWITCH_IMAGE | grep GIT_TAG= | head -n 1 | xargs | cut -c 9-)
-echo "    build:  $FREESWITCH_VERSION"
-echo "    config: $FREESWTICH_CONFIG_VERSION"
-echo ""
-
-echo "html5"
-HTML5_VERSION=$(docker image inspect $HTML5_IMAGE | grep TAG= | head -n 1 | xargs | cut -c 5-)
-echo "    version: $HTML5_VERSION"
-echo ""
-
-echo "kurento"
-KURENTO_VERSION=$(docker run --rm --entrypoint kurento-media-server $KURENTO_IMAGE --version | grep Kurento | sed 's/Kurento Media Server version: //')
-echo "    version: $KURENTO_VERSION"
-echo ""
-
-echo "mongodb"
-MONGO_VERSION=$(docker image inspect $MONGO_IMAGE | grep MONGO_VERSION | head -n 1 | xargs | cut -c 15-)
-echo "    version: $MONGO_VERSION"
-echo ""
-
-# TODO:
-# - nginx
-# - periodic 
-
-echo "redis"
-REDIS_VERSION=$(docker image inspect $REDIS_IMAGE | grep REDIS_VERSION | head -n 1 | xargs | cut -c 15-)
-echo "    version: $REDIS_VERSION"
-echo ""
-
-echo "webrtc-sfu"
-SFU_VERSION=$(cd bbb-webrtc-sfu && cat package.json | grep version | awk -F\" '{print $4}')
-SFU_COMMIT=$(cd bbb-webrtc-sfu && git rev-parse --short HEAD)
-echo "    version: $SFU_VERSION"
-echo "    commit:  $SFU_COMMIT"
diff --git a/scripts/publish b/scripts/publish
new file mode 100755
index 0000000..41b475f
--- /dev/null
+++ b/scripts/publish
@@ -0,0 +1,51 @@
+#!/bin/bash
+
+set -e
+cd "$(dirname "$0")/.."
+
+# load .env
+if [ -f .env ]
+then
+  # exclude WELCOME_MESSAGE && WELCOME_FOOTER && CLIENT_TITLE because it may contain invalid characters
+  export $(cat .env | sed 's/#.*//g' | grep -v "WELCOME_FOOTER" | grep -v "WELCOME_MESSAGE" | grep -v "CLIENT_TITLE" | xargs)
+fi
+
+if [ -z "$ENABLE_WEBHOOKS" ]; then
+    echo "ERROR: ENABLE_WEBHOOKS must be set to true, otherwise the image would not be built"
+    exit 1
+fi
+
+if [ -z "$ENABLE_RECORDING" ]; then
+    echo "ERROR: ENABLE_RECORDING must be set to true, otherwise the image would not be built"
+    exit 1
+fi
+
+
+# generate compose file
+./scripts/generate-compose
+
+# ensure submodules are matching tags.env
+./scripts/checkout-submodules
+
+# build and push java base image
+docker build -t alangecker/bbb-docker-base-java:latest mod/base-java
+
+# buld and push other images
+docker-compose build
+
+# push images
+docker push alangecker/bbb-docker-base-java:latest
+docker-compose push \
+    html5-backend-1 \
+    bbb-web \
+    freeswitch \
+    apps-akka \
+    bbb-pads \
+    etherpad \
+    fsesl-akka \
+    jodconverter \
+    nginx \
+    periodic \
+    recordings \
+    webhooks \
+    webrtc-sfu
diff --git a/scripts/upgrade b/scripts/upgrade
old mode 100755
new mode 100644
index d1fab6a..b950c48
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -15,11 +15,6 @@ then
 
 else
 
-    echo ""
-    echo "# pull newest git submodules"
-    git submodule init
-    git submodule update
-
     echo ""
     echo "# recreate docker-compose.yml"
     ./scripts/generate-compose
@@ -27,19 +22,14 @@ else
     echo ""
     echo "# pull newest images"
     docker-compose pull --ignore-pull-failures
-
-    echo ""
-    echo "# rebuild images"
-
-    # rebuild everything which got modified
-    docker-compose build --pull
+    
 
     COMMIT_HASH=$(git rev-parse --short HEAD)
     BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD)
-    
+
     echo ""
     echo "-------------------------------------"
-    echo "images successfully rebuilt!"
+    echo "update is ready!"
     echo "we are on $COMMIT_HASH ($BRANCH_NAME)"
     echo ""
     echo "use following command for restarting bbb:"
diff --git a/scripts/upgrade-and-build b/scripts/upgrade-and-build
new file mode 100755
index 0000000..8f7b0e9
--- /dev/null
+++ b/scripts/upgrade-and-build
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+set -e
+cd $(dirname $0)/..
+
+if [ -z $RESTARTED ]
+then
+
+    echo "# pull newest bigblugbutton-docker.git"
+    git pull
+
+    # restart script, since it might have changed.
+    RESTARTED=1 ./scripts/upgrade-and-build
+    exit
+
+else
+
+    echo ""
+    echo "# pull newest git submodules"
+    git submodule init
+    git submodule update
+
+    echo ""
+    echo "# recreate docker-compose.yml"
+    ./scripts/generate-compose
+
+    echo ""
+    echo "# pull newest images"
+    docker-compose pull --ignore-pull-failures
+
+    echo ""
+    echo "# rebuild images"
+    docker build -t alangecker/bbb-docker-base-java:latest mod/base-java
+
+    # rebuild everything which got modified
+    docker-compose build
+
+    COMMIT_HASH=$(git rev-parse --short HEAD)
+    BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD)
+    
+    echo ""
+    echo "-------------------------------------"
+    echo "images successfully rebuilt!"
+    echo "we are on $COMMIT_HASH ($BRANCH_NAME)"
+    echo ""
+    echo "use following command for restarting bbb:"
+    echo "    $ docker-compose up -d"
+    echo "-------------------------------------"
+fi
\ No newline at end of file
diff --git a/tags.env b/tags.env
new file mode 100644
index 0000000..530d760
--- /dev/null
+++ b/tags.env
@@ -0,0 +1,27 @@
+# after changing a tag always run following commands to apply
+# - ./scripts/generate-compose
+# - docker-compose build
+
+
+# https://gitlab.senfcall.de/senfcall-public/docker-bbb-build
+BBB_BUILD_TAG=v2022-03-30
+
+# https://github.com/bigbluebutton/bigbluebutton
+TAG_COMMON_MESSAGE=v2.5.0
+TAG_APPS_AKKA=v2.5.0
+TAG_FSESL_AKKA=v2.5.0
+TAG_BBB_WEB=v2.5.0
+TAG_HTML5=v2.5.1
+TAG_RECORDINGS=v2.5.0
+
+TAG_LEARNING_DASHBOARD=v2.5.0
+TAG_FS_CONFIG=v2.5.0
+
+
+# individual git submodules
+# use `./scripts/checkout-submodules` to ensure, that the submodules
+# match the provided tags here
+TAG_WEBRTC_SFU=v2.8.2
+TAG_WEBHOOKS=v2.6.0
+TAG_PLAYBACK=v4.0.0
+TAG_PADS=v1.2.1
\ No newline at end of file