diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..2aded5a
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,75 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+
+## [v4.0.5-1] - 2019-12-02
+### Changed
+- Upgrade to Redmine 4.0.5
+- Switch from WEBrick to Puma web server
+- Update [redmine_cas plugin](https://github.com/cloudogu/redmine_cas) to v1.2.14
+- Update [redmine_activerecord_session_store plugin](https://github.com/cloudogu/redmine_activerecord_session_store) to v0.1.0
+- Update [rubycas-client plugin](https://github.com/cloudogu/rubycas-client) to v2.3.15
+
+### Removed
+- Gem activerecord-deprecated_finders was removed as it is not maintained in Rails 5 any more. See https://github.com/rails/activerecord-deprecated_finders
+
+## [v3.4.11-1] - 2019-09-04
+### Changed
+- Update to Redmine 3.4.11
+
+## [v3.4.10-2] - 2019-05-27
+### Fixed
+- Fix bug "Thumbnails not visible any more" #20
+
+## [v3.4.10-1] - 2019-05-23
+### Changed
+- Upgrade to Redmine 3.4.10
+
+## [v3.4.8-2] - 2019-01-30
+### Fixed
+- Fix glitch during the release of v3.4.8-1
+
+## [v3.4.8-1] - 2019-01-30
+### Changed
+- Upgrade to Redmine 3.4.8
+
+## [v3.4.2-6] - 2018-11-16
+### Added
+- Introduces the NeedsBackup flag:
+    - included volumes: plugins, volumes
+    - not included volumes: logs
+
+## [v3.4.2-5] - 2018-05-27
+### Added
+- Add option for configurable mail address #9
+
+## [v3.4.2-4] - 2017-11-30
+### Fixed
+- Completes fix for bug regarding links to issues in generated mails #3
+
+## [v3.4.2-3] - 2017-11-23
+### Fixed
+- Fix for bug regarding links to issues in generated mails #3
+
+## [v3.4.2-2] - 2017-09-28
+### Changed
+- Update cas plugin to 1.2.13
+
+## [v3.4.2-1] - 2017-08-08
+### Changed
+- improve installation of core plugins
+    - Core plugins are now backed into the image and only manual installed plugins are installed durring startup.
+
+## [v3.3.2-4] - 2017-08-03
+### Changed
+- enabled gravatar and markdown by default
+- improve plugin and theme installation
+
+### Fixed
+- fix wrong url in notifications
+- fix group synchronization on api login
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 61ff3a0..b7e127b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,27 +1,34 @@
 # registry.cloudogu.com/official/redmine
-FROM registry.cloudogu.com/official/base:3.9.4-1
+FROM registry.cloudogu.com/official/base:3.9.4-2
 
 LABEL NAME="official/redmine" \
-   VERSION="3.4.11-1" \
+   VERSION="4.0.5-1" \
    maintainer="robert.auer@cloudogu.com"
 
+# This Dockerfile is based on https://github.com/docker-library/redmine/blob/master/4.0/alpine/Dockerfile
+
 # set environment variables
-ENV REDMINE_VERSION=3.4.11 \
-    CAS_PLUGIN_VERSION=1.2.13 \
-    ACTIVERECORD_SESSION_STORE_PLUGIN_VERSION=0.0.1 \
-    RUBYCASVERSION=2.3.13 \
+ENV REDMINE_VERSION=4.0.5 \
+    CAS_PLUGIN_VERSION=1.2.14 \
+    ACTIVERECORD_SESSION_STORE_PLUGIN_VERSION=0.1.0 \
+    RUBYCASVERSION=2.3.15 \
     USER=redmine \
     BASEDIR=/usr/share/webapps \
     WORKDIR=/usr/share/webapps/redmine \
-    SERVICE_TAGS=webapp
+    SERVICE_TAGS=webapp \
+    RAILS_ENV=production \
+    REDMINE_TARGZ_SHA256=64eabe6867fd5d14d1b4c584417b9b71fbb9b68a019400eeb03e1f2147c369e8 \
+    CAS_PLUGIN_TARGZ_SHA256=184cbb41abde38e85aae1f4f0117adf2f1eff061ccfe377c91c3545428c5ad46 \
+    ACTIVERECORD_TARGZ_SHA256=a5d3a5ac6c5329212621bab128a2f94b0ad6bb59084f3cc714786a297bcdc7ee \
+    RUBYCAS_TARGZ_SHA256=9ca9b2e020c4f12c3c7e87565b9aa19dda130912138d80ad6775e5bdc2d4ca66 \
+    RAILS_RELATIVE_URL_ROOT=/redmine \
+    CLOUDOGU_THEME_VERSION=2.8.0-1 \
+    THEME_TARGZ_SHA256=4bd81861bafecf27ed41316697c011dbf73b7379f547b1993b8898e210cff0db
 
 # copy resource files
 COPY resources/ /
 
-# install theme, before the ownership is changed
-ADD packages/cloudogu.tar.gz ${WORKDIR}/public/themes
-
-RUN set -x \
+RUN set -eux -o pipefail \
  # add user and group
  && addgroup -S "${USER}" -g 1000 \
  && adduser -S -h "${WORKDIR}" -G "${USER}" -u 1000 -s /bin/bash "${USER}" \
@@ -58,43 +65,55 @@ RUN set -x \
  && 2>/dev/null 1>&2 gem update --system --quiet \
  # install redmine
  && mkdir -p ${WORKDIR} \
- && curl -L http://www.redmine.org/releases/redmine-${REDMINE_VERSION}.tar.gz | tar xfz - --strip-components=1 -C ${WORKDIR} \
+ && mkdir -p /redmine_source \
+ && wget "https://www.redmine.org/releases/redmine-${REDMINE_VERSION}.tar.gz" \
+ && echo "${REDMINE_TARGZ_SHA256} *redmine-${REDMINE_VERSION}.tar.gz" | sha256sum -c - \
+ && tar -xf redmine-${REDMINE_VERSION}.tar.gz --strip-components=1 -C ${WORKDIR} \
+ && mv redmine-${REDMINE_VERSION}.tar.gz /redmine_source/redmine-${REDMINE_VERSION}.tar.gz \
+ && mkdir -p ${WORKDIR}/app/assets/config && touch ${WORKDIR}/app/assets/config/manifest.js \
  # set temporary database configuration for bundle install
- && DATABASE_TYPE=postgresql \
-    DATABASE_IP=localhost \
-    DATABASE_DB=redmine \
-    DATABASE_USER=redmine \
-    DATABASE_USER_PASSWORD=redmine \
-    eval "echo \"$(cat  ${WORKDIR}/config/database.yml.tpl)\"" > ${WORKDIR}/config/database.yml \
- # Install (available) rubycas-client version
- && git clone https://github.com/cloudogu/rubycas-client.git \
+ && cp ${WORKDIR}/config/database.yml.tpl ${WORKDIR}/config/database.yml \
+ # Install rubycas-client
+ && wget -O v${RUBYCASVERSION}.tar.gz "https://github.com/cloudogu/rubycas-client/archive/v${RUBYCASVERSION}.tar.gz" \
+ && echo "${RUBYCAS_TARGZ_SHA256} *v${RUBYCASVERSION}.tar.gz" | sha256sum -c - \
+ && mkdir rubycas-client \
+ && tar xfz v${RUBYCASVERSION}.tar.gz --strip-components=1 -C rubycas-client \
+ && rm v${RUBYCASVERSION}.tar.gz \
  && cd rubycas-client \
  && gem build rubycas-client.gemspec \
  && gem install rubycas-client-${RUBYCASVERSION}.gem \
- && cd ..; rm -rf rubycas-client \
+ && cd .. \
+ && rm -rf rubycas-client \
  # install redmine required gems
  && echo 'gem "activerecord-session_store"' >> ${WORKDIR}/Gemfile \
- && echo 'gem "activerecord-deprecated_finders", require: "active_record/deprecated_finders"' >> ${WORKDIR}/Gemfile \
  # json gem missing in default installation?
  && echo 'gem "json"' >> ${WORKDIR}/Gemfile \
- # install required gems
- && cd ${WORKDIR}; RAILS_ENV="production" bundle install --without development test \
  # override environment to run redmine with a context path "/redmine"
  && mv ${WORKDIR}/config/environment.ces.rb ${WORKDIR}/config/environment.rb \
  # install core plugins
  && mkdir -p "${WORKDIR}/plugins" \
  # install cas plugin
  && mkdir "${WORKDIR}/plugins/redmine_cas" \
- && curl -sL \
-    https://github.com/cloudogu/redmine_cas/archive/${CAS_PLUGIN_VERSION}.tar.gz \
-  | tar xfz - --strip-components=1 -C "${WORKDIR}/plugins/redmine_cas" \
+ && wget -O v${CAS_PLUGIN_VERSION}.tar.gz "https://github.com/cloudogu/redmine_cas/archive/v${CAS_PLUGIN_VERSION}.tar.gz" \
+ && echo "${CAS_PLUGIN_TARGZ_SHA256} *v${CAS_PLUGIN_VERSION}.tar.gz" | sha256sum -c - \
+ && tar xfz v${CAS_PLUGIN_VERSION}.tar.gz --strip-components=1 -C "${WORKDIR}/plugins/redmine_cas" \
+ && rm v${CAS_PLUGIN_VERSION}.tar.gz \
+ # install Cloudogu theme
+ && mkdir -p "${WORKDIR}/public/themes/Cloudogu" \
+ && wget -O v${CLOUDOGU_THEME_VERSION}.tar.gz "https://github.com/cloudogu/PurpleMine2/releases/download/v${CLOUDOGU_THEME_VERSION}/CloudoguRedmineTheme-${CLOUDOGU_THEME_VERSION}.tar.gz" \
+ && echo "${THEME_TARGZ_SHA256} *v${CLOUDOGU_THEME_VERSION}.tar.gz" | sha256sum -c - \
+ && tar xfz v${CLOUDOGU_THEME_VERSION}.tar.gz --strip-components=1 -C "${WORKDIR}/public/themes/Cloudogu" \
+ && rm v${CLOUDOGU_THEME_VERSION}.tar.gz \
  # install redmine_activerecord_session_store to be able to invalidate sessions after cas logout
  && mkdir "${WORKDIR}/plugins/redmine_activerecord_session_store" \
- && curl -sL \
-    https://github.com/pencil/redmine_activerecord_session_store/archive/v${ACTIVERECORD_SESSION_STORE_PLUGIN_VERSION}.tar.gz \
-  | tar xfz - --strip-components=1 -C "${WORKDIR}/plugins/redmine_activerecord_session_store" \
- # install plugin gems
- && cd ${WORKDIR}; RAILS_ENV="production" bundle install --without development test \
+ && wget -O v${ACTIVERECORD_SESSION_STORE_PLUGIN_VERSION}.tar.gz "https://github.com/cloudogu/redmine_activerecord_session_store/archive/v${ACTIVERECORD_SESSION_STORE_PLUGIN_VERSION}.tar.gz" \
+ && echo "${ACTIVERECORD_TARGZ_SHA256} *v${ACTIVERECORD_SESSION_STORE_PLUGIN_VERSION}.tar.gz" | sha256sum -c - \
+ && tar xfz v${ACTIVERECORD_SESSION_STORE_PLUGIN_VERSION}.tar.gz --strip-components=1 -C "${WORKDIR}/plugins/redmine_activerecord_session_store" \
+ && rm v${ACTIVERECORD_SESSION_STORE_PLUGIN_VERSION}.tar.gz \
+ # install required and plugin gems
+ && cd ${WORKDIR} \
+ && bundle install --without development test \
+ && gem install puma \
  # cleanup
  && gem cleanup all \
  && rm -rf /root/* /tmp/* $(gem env gemdir)/cache \
@@ -107,7 +126,7 @@ WORKDIR ${WORKDIR}
 # expose application port
 EXPOSE 3000
 
-HEALTHCHECK CMD [ $(doguctl healthy redmine; EXIT_CODE=$?; echo ${EXIT_CODE}) == 0 ]
+HEALTHCHECK CMD [ $(doguctl healthy redmine; echo $?) == 0 ]
 
 # start
-CMD /startup.sh
+CMD ["/startup.sh"]
diff --git a/Jenkinsfile b/Jenkinsfile
index ab0eea8..6c649a5 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -20,7 +20,7 @@ node('vagrant') {
 
         stage('Lint') {
             lintDockerfile()
-            shellCheck("./resources/pre-upgrade.sh ./resources/startup.sh ./resources/post-upgrade.sh")
+            shellCheck("./resources/startup.sh ./resources/post-upgrade.sh ./resources/pre-upgrade.sh ./resources/util.sh")
         }
 
         try {
diff --git a/LICENSE b/LICENSE
index 38f268c..300d066 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2017 Cloudogu
+Copyright (c) 2019 Cloudogu
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/dogu.json b/dogu.json
index 67ef86f..8db08c4 100644
--- a/dogu.json
+++ b/dogu.json
@@ -1,6 +1,6 @@
 {
   "Name": "official/redmine",
-  "Version": "3.4.11-1",
+  "Version": "4.0.5-1",
   "DisplayName": "Redmine",
   "Description": "Redmine is a flexible project management web application",
   "Category": "Development Apps",
@@ -35,15 +35,17 @@
   "ServiceAccounts": [{
     "Type": "postgresql"
   }],
-  "HealthCheck": {
+  "HealthChecks": [{
     "Type": "tcp",
     "Port": 3000
-  },
-  "ExposedCommands": [{
-    "Name": "pre-upgrade",
-    "Command": "/pre-upgrade.sh"
   },{
+    "Type": "state"
+  }],
+  "ExposedCommands": [{
     "Name": "post-upgrade",
     "Command": "/post-upgrade.sh"
+  },{
+    "Name": "pre-upgrade",
+    "Command": "/pre-upgrade.sh"
   }]
 }
diff --git a/integrationTests/expectations.js b/integrationTests/expectations.js
index 78d7624..67180a1 100644
--- a/integrationTests/expectations.js
+++ b/integrationTests/expectations.js
@@ -10,9 +10,9 @@ exports.expectState = function(state) {
 }
 
 exports.expectCasLogin = function(url) {
-  expect(url).toBe(config.baseUrl + '/cas/login?service=https%3A%2F%2F' + config.fqdn + '%2Fredmine%2Fcas%3Fref%3D%252Fredmine');
+  expect(url).toBe(config.baseUrl + '/cas/login?service=https%3A%2F%2F' + config.fqdn + '%2Fredmine%2Fcas%3Fref%3D%252Fredmine%252F');
 }
 
 exports.expectCasLogout = function(url) {
-  expect(url).toBe(config.baseUrl + '/cas/logout?destination=https%3A%2F%2F' + config.fqdn + '%2Fredmine&gateway=true');
+  expect(url).toBe(config.baseUrl + '/cas/logout?destination=https%3A%2F%2F' + config.fqdn + '%2Fredmine%2F&gateway=true');
 }
diff --git a/packages/cloudogu.tar.gz b/packages/cloudogu.tar.gz
deleted file mode 100644
index dfa9a8c..0000000
Binary files a/packages/cloudogu.tar.gz and /dev/null differ
diff --git a/resources/LICENSE b/resources/LICENSE
new file mode 100644
index 0000000..300d066
--- /dev/null
+++ b/resources/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 Cloudogu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/resources/post-upgrade.sh b/resources/post-upgrade.sh
index ff2ba65..a7b0776 100755
--- a/resources/post-upgrade.sh
+++ b/resources/post-upgrade.sh
@@ -3,21 +3,52 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
+# import util functions:
+# - create_secrets_yml
+# - render_config_ru_template
+# - render_database_yml_template
+# - render_configuration_yml_template
+# - exec_rake
+#
+# import util variables:
+# - RAILS_ENV
+# - REDMINE_LANG
+#
+# shellcheck disable=SC1091
+source /util.sh
+
 FROM_VERSION="${1}"
 TO_VERSION="${2}"
 
+echo "Executing Redmine post-upgrade from ${FROM_VERSION} to ${TO_VERSION}"
+
 if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
+  echo "FROM and TO versions are the same; Exiting..."
   exit 0
 fi
 
-function exec_rake() {
-  RAILS_ENV="production" REDMINE_LANG="en" rake --trace -f "${WORKDIR}"/Rakefile "$*"
-}
+echo "Making sure config/secrets.yml exists..."
+create_secrets_yml
+
+echo "Rendering config.ru template..."
+render_config_ru_template
+
+echo "Rendering database.yml template..."
+render_database_yml_template
 
-echo "executing update ${FROM_VERSION} to ${TO_VERSION}"
+echo "Generating configuration.yml from template..."
+render_configuration_yml_template
 
-echo "migrate database ..."
+echo "Migrating database..."
 exec_rake db:migrate
 
-echo "migrate plugins ..."
+echo "Migrating plugins..."
 exec_rake redmine:plugins:migrate
+
+echo "Clearing cache..."
+exec_rake tmp:cache:clear
+
+echo "Set registry flag so startup script can start afterwards..."
+doguctl state "upgrade done"
+
+echo "Redmine post-upgrade done"
diff --git a/resources/pre-upgrade.sh b/resources/pre-upgrade.sh
index a646c9b..ef8d7db 100755
--- a/resources/pre-upgrade.sh
+++ b/resources/pre-upgrade.sh
@@ -1,20 +1,19 @@
 #!/bin/bash
-
-# older installation of redmine exposed the core plugins to the
-# plugin volume, these exposed plugin could be old and must be
-# removed.
-
 set -o errexit
 set -o nounset
 set -o pipefail
 
-PLUGIN_DIRECTORY="${WORKDIR}/plugins"
-CORE_PLUGINS="redmine_activerecord_session_store redmine_cas"
+FROM_VERSION="${1}"
+TO_VERSION="${2}"
+
+echo "Executing Redmine pre-upgrade from ${FROM_VERSION} to ${TO_VERSION}"
+
+if [ "${FROM_VERSION}" = "${TO_VERSION}" ]; then
+  echo "FROM and TO versions are the same; Exiting..."
+  exit 0
+fi
+
+echo "Set registry flag so startup script waits for post-upgrade to finish..."
+doguctl state "upgrading"
 
-for CP in ${CORE_PLUGINS}; do
-  CP_DIR="${PLUGIN_DIRECTORY}/${CP}"
-  if [ -d "${CP_DIR}" ]; then
-    echo "remove old installation of ${CP}"
-    rm -rf "${CP_DIR}"
-  fi
-done
\ No newline at end of file
+echo "Redmine pre-upgrade done"
diff --git a/resources/redmine_source/LICENSE b/resources/redmine_source/LICENSE
new file mode 100644
index 0000000..d159169
--- /dev/null
+++ b/resources/redmine_source/LICENSE
@@ -0,0 +1,339 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
diff --git a/resources/startup.sh b/resources/startup.sh
index c6bdf21..eabc6d0 100755
--- a/resources/startup.sh
+++ b/resources/startup.sh
@@ -3,6 +3,28 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
+# import util functions:
+# - create_secrets_yml
+# - render_config_ru_template
+# - render_database_yml_template
+# - render_configuration_yml_template
+# - exec_rake
+#
+# import util variables:
+# - RAILS_ENV
+# - REDMINE_LANG
+#
+# shellcheck disable=SC1091
+source /util.sh
+
+# check whether post-upgrade script is still running
+while [[ "$(doguctl state)" == "upgrading" ]]; do
+  echo "Upgrade script is running. Waiting..."
+  sleep 3
+done
+
+doguctl state "installing"
+
 echo "get variables for templates"
 FQDN=$(doguctl config --global fqdn)
 DOMAIN=$(doguctl config --global domain)
@@ -14,10 +36,6 @@ DATABASE_USER=$(doguctl config -e sa-postgresql/username)
 DATABASE_USER_PASSWORD=$(doguctl config -e sa-postgresql/password)
 DATABASE_DB=$(doguctl config -e sa-postgresql/database)
 
-echo "set redmine environment variables"
-RAILS_ENV=production
-REDMINE_LANG=en
-
 echo "get plugin locations"
 PLUGIN_STORE="/var/tmp/redmine/plugins"
 PLUGIN_DIRECTORY="${WORKDIR}/plugins"
@@ -28,10 +46,6 @@ function sql(){
   PGPASSWORD="${DATABASE_USER_PASSWORD}" psql --host "postgresql" --username "${DATABASE_USER}" --dbname "${DATABASE_DB}" -1 -c "${1}"
 }
 
-function exec_rake() {
-  RAILS_ENV="${RAILS_ENV}" REDMINE_LANG="${REDMINE_LANG}" rake --trace -f "${WORKDIR}"/Rakefile "$*"
-}
-
 function install_plugins(){
   echo "installing plugins"
 
@@ -71,17 +85,14 @@ function install_plugin(){
   cp -rf "${SOURCE}" "${TARGET}"
 }
 
-# adjust redmine database.yml
-doguctl template "${WORKDIR}/config/database.yml.tpl" "${WORKDIR}/config/database.yml"
+echo "render config.ru template"
+render_config_ru_template
 
-# insert secret_key_base into secrets.yml
-if [ ! -f "${WORKDIR}/config/initializers/secret_token.rb" ]; then
-  exec_rake generate_secret_token
-  # TODO do we need the steps below?
-  SECRETKEYBASE=$(grep secret_key_base "${WORKDIR}"/config/initializers/secret_token.rb | awk -F \' '{print $2}' )
-  doguctl config -e secret_key_base "${SECRETKEYBASE}"
-  doguctl template "${WORKDIR}/config/secrets.yml.tpl" "${WORKDIR}/config/secrets.yml"
-fi
+echo "render database.yml template"
+render_database_yml_template
+
+# Make sure secrets.yml exists
+create_secrets_yml
 
 # export variables for auth_source_cas.rb
 export FQDN
@@ -102,7 +113,7 @@ sleep 10
 if 2>/dev/null 1>&2 sql "select count(*) from settings;"; then
   echo "Redmine (database) has been installed already."
   # update FQDN in settings
-  # we need to update the fqdn on every start, bacause of possible changes
+  # we need to update the fqdn on every start, because of possible changes
   sql "UPDATE settings SET value='${HOSTNAME_SETTING}' WHERE name='host_name';"
   sql "UPDATE settings SET value=E'--- !ruby/hash:ActionController::Parameters \\nenabled: 1 \\ncas_url: https://${FQDN}/cas \\nattributes_mapping: firstname=givenName&lastname=surname&mail=mail \\nautocreate_users: 1' WHERE name='plugin_redmine_cas';" > /dev/null 2>&1
 else
@@ -159,8 +170,8 @@ if [ ! -e "${WORKDIR}"/stylesheets ]; then
   ln -s "${WORKDIR}"/public/* "${WORKDIR}"
 fi
 
-# Generate configuration.yml from template (e.g. for config of mail transport)
-doguctl template "${WORKDIR}/config/configuration.yml.tpl" "${WORKDIR}/config/configuration.yml"
+echo "Generate configuration.yml from template"
+render_configuration_yml_template
 
 # remove old pid
 RPID="${WORKDIR}/tmp/pids/server.pid"
@@ -168,12 +179,14 @@ if [ -f "${RPID}" ]; then
   rm -f "${RPID}"
 fi
 
-# besure temp, file and log folders are writable
-# TODO should tmp a volume, because of performance?
+# make sure temp, file and log folders are writable
+# TODO should tmp be a volume, because of performance?
 mkdir -p tmp tmp/pdf public/plugin_assets
 chown -R "${USER}":"${USER}" files log tmp public/plugin_assets
 chmod -R 755 files log tmp public/plugin_assets
 
+doguctl state "ready"
+
 # Start redmine
 echo "Starting redmine..."
-exec su - redmine -c "FQDN=${FQDN} ADMIN_GROUP=${ADMIN_GROUP} bundle exec ruby bin/rails server webrick -e ${RAILS_ENV} -b 0.0.0.0"
+exec su - redmine -c "FQDN=${FQDN} ADMIN_GROUP=${ADMIN_GROUP} puma -e ${RAILS_ENV} -p 3000"
\ No newline at end of file
diff --git a/resources/usr/share/webapps/redmine/config.ru.tpl b/resources/usr/share/webapps/redmine/config.ru.tpl
new file mode 100644
index 0000000..5479592
--- /dev/null
+++ b/resources/usr/share/webapps/redmine/config.ru.tpl
@@ -0,0 +1,6 @@
+# This file is used by Rack-based servers to start the application.
+
+require ::File.expand_path('../config/environment',  __FILE__)
+map ENV['RAILS_RELATIVE_URL_ROOT'] || '/' do
+  run Rails.application
+end
\ No newline at end of file
diff --git a/resources/usr/share/webapps/redmine/config/additional_environment.rb b/resources/usr/share/webapps/redmine/config/additional_environment.rb
index a44e6c2..3b600f3 100644
--- a/resources/usr/share/webapps/redmine/config/additional_environment.rb
+++ b/resources/usr/share/webapps/redmine/config/additional_environment.rb
@@ -8,6 +8,6 @@
 #   ...
 #
 
-# configure redmine to log to stdout
+ # log to STDOUT (https://github.com/docker-library/redmine/issues/108)
 config.logger = Logger.new(STDOUT)
 config.log_level = :info
diff --git a/resources/usr/share/webapps/redmine/config/environment.ces.rb b/resources/usr/share/webapps/redmine/config/environment.ces.rb
index e737c06..be299b8 100644
--- a/resources/usr/share/webapps/redmine/config/environment.ces.rb
+++ b/resources/usr/share/webapps/redmine/config/environment.ces.rb
@@ -10,9 +10,8 @@
   exit 1
 end
 
-RedmineApp::Application.routes.default_scope = '/redmine'
-
 # Initialize the Rails application
 Rails.application.initialize!
 
-Redmine::Utils::relative_url_root = "/redmine"
+ENV['RAILS_RELATIVE_URL_ROOT'] = "/redmine"
+Redmine::Utils::relative_url_root = ENV['RAILS_RELATIVE_URL_ROOT']
\ No newline at end of file
diff --git a/resources/util.sh b/resources/util.sh
new file mode 100644
index 0000000..e11f0c9
--- /dev/null
+++ b/resources/util.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+set -o errexit
+set -o nounset
+set -o pipefail
+
+echo "setting redmine environment variables..."
+RAILS_ENV=production
+REDMINE_LANG=en
+
+function exec_rake() {
+  RAILS_ENV="${RAILS_ENV}" REDMINE_LANG="${REDMINE_LANG}" rake --trace -f "${WORKDIR}"/Rakefile "$*"
+}
+
+function create_secrets_yml() {
+if [ ! -f "${WORKDIR}/config/secrets.yml" ]; then
+  if [[ $(doguctl config -e secret_key_base > /dev/null; echo $?) -ne 0 ]]; then
+    # secret_key_base has not been initialized yet
+    echo "Generating secret token..."
+    exec_rake generate_secret_token
+    SECRETKEYBASE=$(grep secret_key_base "${WORKDIR}"/config/initializers/secret_token.rb | awk -F \' '{print $2}' )
+    doguctl config -e secret_key_base "${SECRETKEYBASE}"
+    rm "${WORKDIR}/config/initializers/secret_token.rb"
+  fi
+  # secret_key_base is stored in registry, but secrets.yml is missing
+  # this happens after a restore of the dogu, because the config folder is not backed up
+  echo "Rendering config/secrets.yml..."
+  doguctl template "${WORKDIR}/config/secrets.yml.tpl" "${WORKDIR}/config/secrets.yml"
+fi
+}
+
+function render_config_ru_template() {
+    doguctl template "${WORKDIR}/config.ru.tpl" "${WORKDIR}/config.ru"
+}
+
+function render_database_yml_template() {
+    doguctl template "${WORKDIR}/config/database.yml.tpl" "${WORKDIR}/config/database.yml"
+}
+
+function render_configuration_yml_template() {
+    doguctl template "${WORKDIR}/config/configuration.yml.tpl" "${WORKDIR}/config/configuration.yml"
+}
diff --git a/spec/goss/goss.yaml b/spec/goss/goss.yaml
index e32050d..5611055 100644
--- a/spec/goss/goss.yaml
+++ b/spec/goss/goss.yaml
@@ -4,16 +4,50 @@ file:
     owner: root
     group: root
     filetype: file
-  /usr/share/webapps/redmine/public/themes/Cloudogu:
+  /pre-upgrade.sh:
     exists: true
-    filetype: directory
+    owner: root
+    group: root
+    filetype: file
+  /post-upgrade.sh:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
+  /util.sh:
+    exists: true
+    owner: root
+    group: root
+    filetype: file
   /usr/share/webapps/redmine:
     exists: true
     filetype: directory
+  /usr/share/webapps/redmine/config/initializers/secret_token.rb:
+    exists: false
+  /usr/share/webapps/redmine/config/secrets.yml:
+    exists: true
+    filetype: file
   /usr/share/webapps/redmine/config/environment.rb:
     exists: true
     filetype: file
-contains: ["RedmineApp::Application.routes.default_scope = '/redmine'"]
+    contains: ["ENV['RAILS_RELATIVE_URL_ROOT'] = \"/redmine\""]
+    contains: ["Redmine::Utils::relative_url_root = ENV['RAILS_RELATIVE_URL_ROOT']"]
+  /usr/share/webapps/redmine/config/database.yml:
+    exists: true
+    filetype: file
+    contains: ["production:"]
+  /usr/share/webapps/redmine/config.ru:
+    exists: true
+    filetype: file
+    contains: ["map ENV['RAILS_RELATIVE_URL_ROOT'] || '/' do"]
+  /usr/share/webapps/redmine/config/additional_environment.rb:
+    exists: true
+    filetype: file
+    contains: ["config.logger = Logger.new(STDOUT)"]
+    contains: ["config.log_level = :info"]
+  /usr/share/webapps/redmine/public/themes/Cloudogu:
+    exists: true
+    filetype: directory
 package:
   git:
     installed: true
@@ -45,5 +79,5 @@ port:
   tcp:3000:
     listening: true
 process:
-  ruby:
+  puma:
     running: true