diff --git a/Makefile b/Makefile
index 3f3d02c53fe..7aa13ed0689 100644
--- a/Makefile
+++ b/Makefile
@@ -30,6 +30,7 @@ OCIS_MODULES = \
 	services/gateway \
 	services/graph \
 	services/groups \
+	services/hub \
 	services/idm \
 	services/idp \
 	services/invitations \
diff --git a/docs/helpers/configenvextractor.go b/docs/helpers/configenvextractor.go
index 46178d9982a..26625725a43 100644
--- a/docs/helpers/configenvextractor.go
+++ b/docs/helpers/configenvextractor.go
@@ -66,9 +66,9 @@ func runIntermediateCode(intermediateCodePath string) {
 	defaultPath := "~/.ocis"
 	os.Setenv("OCIS_BASE_DATA_PATH", defaultPath)
 	os.Setenv("OCIS_CONFIG_DIR", path.Join(defaultPath, "config"))
-	out, err := exec.Command("go", "run", intermediateCodePath).Output()
+	out, err := exec.Command("go", "run", intermediateCodePath).CombinedOutput()
 	if err != nil {
-		log.Fatal(err)
+		log.Fatal(err, string(out))
 	}
 	fmt.Println(string(out))
 }
diff --git a/services/hub/Makefile b/services/hub/Makefile
new file mode 100644
index 00000000000..1cfb346c132
--- /dev/null
+++ b/services/hub/Makefile
@@ -0,0 +1,37 @@
+SHELL := bash
+NAME := hub
+
+include ../../.make/recursion.mk
+
+############ tooling ############
+ifneq (, $(shell command -v go 2> /dev/null)) # suppress `command not found warnings` for non go targets in CI
+include ../../.bingo/Variables.mk
+endif
+
+############ go tooling ############
+include ../../.make/go.mk
+
+############ release ############
+include ../../.make/release.mk
+
+############ docs generate ############
+include ../../.make/docs.mk
+
+.PHONY: docs-generate
+docs-generate: config-docs-generate
+
+############ generate ############
+include ../../.make/generate.mk
+
+.PHONY: ci-go-generate
+ci-go-generate: # CI runs ci-node-generate automatically before this target
+
+.PHONY: ci-node-generate
+ci-node-generate:
+
+############ licenses ############
+.PHONY: ci-node-check-licenses
+ci-node-check-licenses:
+
+.PHONY: ci-node-save-licenses
+ci-node-save-licenses:
diff --git a/services/hub/README.md b/services/hub/README.md
new file mode 100644
index 00000000000..eb53dc65890
--- /dev/null
+++ b/services/hub/README.md
@@ -0,0 +1,12 @@
+# Hub Service
+
+The hub service provides `server sent events` (`sse`) functionality to clients
+
+## Subscribing
+
+A client can use the `hub/sse` endpoint to subscribe to events. This will open a http(s) connection for the server to send events to subscribed clients. These events can inform clients about various changes on the server like: file uploads, shares, space memberships, etc.
+
+## Available Events
+For a complete and up-to-date list of available events see `/services/hub/pkg/service/events.go`.
+
+Note that for the time being, the `hub` service only serves the `UploadReady` event which is emitted when postprocessing a file has finished and the file is available for user access.
diff --git a/services/hub/pkg/config/config.go b/services/hub/pkg/config/config.go
index 600aad9ed84..ffa3b286105 100644
--- a/services/hub/pkg/config/config.go
+++ b/services/hub/pkg/config/config.go
@@ -16,7 +16,7 @@ type Config struct {
 	Events       Events          `yaml:"events"`
 	Reva         *shared.Reva    `yaml:"reva"`
 
-	MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY;SEARCH_MACHINE_AUTH_API_KEY" desc:"Machine auth API key used to validate internal requests necessary for the access to resources from other services."`
+	MachineAuthAPIKey string `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY;HUB_MACHINE_AUTH_API_KEY" desc:"Machine auth API key used to validate internal requests necessary for the access to resources from other services."`
 }
 
 // Service defines the available service configuration.
@@ -38,9 +38,9 @@ type TokenManager struct {
 
 // Events combines the configuration options for the event bus.
 type Events struct {
-	Endpoint             string `yaml:"endpoint" env:"NOTIFICATIONS_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
-	Cluster              string `yaml:"cluster" env:"NOTIFICATIONS_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
-	TLSInsecure          bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;NOTIFICATIONS_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates."`
-	TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"NOTIFICATIONS_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided NOTIFICATIONS_EVENTS_TLS_INSECURE will be seen as false."`
-	EnableTLS            bool   `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;NOTIFICATIONS_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.."`
+	Endpoint             string `yaml:"endpoint" env:"HUB_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture."`
+	Cluster              string `yaml:"cluster" env:"HUB_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system."`
+	TLSInsecure          bool   `yaml:"tls_insecure" env:"OCIS_INSECURE;HUB_EVENTS_TLS_INSECURE" desc:"Whether the server should skip the client certificate verification during the TLS handshake."`
+	TLSRootCACertificate string `yaml:"tls_root_ca_certificate" env:"HUB_EVENTS_TLS_ROOT_CA_CERTIFICATE" desc:"The root CA certificate used to validate the server's TLS certificate. If provided HUB_EVENTS_TLS_INSECURE will be seen as false."`
+	EnableTLS            bool   `yaml:"enable_tls" env:"OCIS_EVENTS_ENABLE_TLS;HUB_EVENTS_ENABLE_TLS" desc:"Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services."`
 }
diff --git a/services/hub/pkg/config/defaults/defaultconfig.go b/services/hub/pkg/config/defaults/defaultconfig.go
index a4f274ffc7d..14d3b55cc5a 100644
--- a/services/hub/pkg/config/defaults/defaultconfig.go
+++ b/services/hub/pkg/config/defaults/defaultconfig.go
@@ -7,6 +7,14 @@ import (
 	"github.com/owncloud/ocis/v2/services/hub/pkg/config"
 )
 
+// FullDefaultConfig used by doc generation
+func FullDefaultConfig() *config.Config {
+	cfg := DefaultConfig()
+	EnsureDefaults(cfg)
+	Sanitize(cfg)
+	return cfg
+}
+
 // DefaultConfig returns the default config
 func DefaultConfig() *config.Config {
 	return &config.Config{
diff --git a/services/proxy/pkg/config/defaults/defaultconfig.go b/services/proxy/pkg/config/defaults/defaultconfig.go
index f38ca170c52..ab93d4653b3 100644
--- a/services/proxy/pkg/config/defaults/defaultconfig.go
+++ b/services/proxy/pkg/config/defaults/defaultconfig.go
@@ -11,7 +11,7 @@ import (
 	"github.com/owncloud/ocis/v2/services/proxy/pkg/config"
 )
 
-// FullDefaultConfig returns a fully initialized default configuration
+// FullDefaultConfig used by docs generation
 func FullDefaultConfig() *config.Config {
 	cfg := DefaultConfig()
 	EnsureDefaults(cfg)
@@ -19,7 +19,7 @@ func FullDefaultConfig() *config.Config {
 	return cfg
 }
 
-// DefaultConfig returns a basic default configuration
+// DefaultConfig returns the proxys default config
 func DefaultConfig() *config.Config {
 	return &config.Config{
 		Debug: config.Debug{
@@ -82,7 +82,7 @@ func DefaultConfig() *config.Config {
 	}
 }
 
-// DefaultPolicies returns the default proxy policies.
+// DefaultPolicies returns the default routing policies
 func DefaultPolicies() []config.Policy {
 	return []config.Policy{
 		{