stack.basicstack.de/apps/opencloud/README.md

# OpenCloud Deployment

**Status:** In Progress - Configuration Initialization Needed

## Overview

Deployment of OpenCloud v7.2.0, a modern Go-based file sharing platform, configured with Pocket ID OIDC authentication.

## Configuration Approach

OpenCloud uses a cloud-native configuration system (12-Factor App principles):
1. Base configuration in `/etc/opencloud/opencloud.yaml` (from ConfigMap)
2. Secrets injected via environment variables (highest precedence)
3. All sensitive credentials stored as SealedSecrets

Reference: https://docs.opencloud.eu/docs/next/dev/server/configuration/config-system/

## Deployed Components

- ✓ Namespace: `opencloud`
- ✓ PVC: 100Gi encrypted hcloud volume
- ✓ ConfigMap: Base opencloud.yaml configuration
- ✓ SealedSecrets: OIDC, SMTP, JWT, and config secrets
- ✓ Ingress: opencloud.basicstack.de with TLS
- ✓ Service and Deployment manifests

## Pocket ID Integration

- Client ID: `2f3c0cea-697f-4dbc-9573-6f6e8adfd4b0`
- Group: `opencloud_admins`
- User: andreas.leinen@basicstack.de
- OIDC Issuer: https://auth.basicstack.de

## Files

- `opencloud-deployment.yaml` - Main Kubernetes deployment
- `opencloud-configmap.yaml` - Base configuration file
- `opencloud-config-sealed.yaml` - **⚠️  NEEDS SEALING** - Core secrets (machine auth, transfer secret, etc.)
- `opencloud-oidc-sealed.yaml` - OIDC credentials (sealed)
- `opencloud-smtp-sealed.yaml` - SMTP credentials (sealed)
- `opencloud-jwt-sealed.yaml` - JWT token secret (sealed)
- `seal-config-secrets.sh` - Helper script to seal config secrets

## Next Steps

1. **Seal the config secrets:**
   ```bash
   cd apps/opencloud
   bash seal-config-secrets.sh
   ```

2. **Apply all manifests:**
   ```bash
   kubectl apply -f opencloud-configmap.yaml
   kubectl apply -f opencloud-config-sealed.yaml  # After sealing!
   kubectl apply -f opencloud-oidc-sealed.yaml
   kubectl apply -f opencloud-smtp-sealed.yaml
   kubectl apply -f opencloud-jwt-sealed.yaml
   kubectl apply -f opencloud-deployment.yaml
   ```

3. **Verify deployment:**
   ```bash
   kubectl get pods -n opencloud
   kubectl logs -n opencloud deployment/opencloud
   ```

4. **Test login:**
   - Navigate to https://opencloud.basicstack.de
   - Login with andreas.leinen@basicstack.de via Pocket ID

## TODO

- [ ] Seal opencloud-config-secrets
- [ ] Configure daily backup to Hetzner bucket
- [ ] Test OIDC authentication
- [ ] Test file upload/download
- [ ] Test SMTP notifications