76 lines
2.2 KiB
Markdown
76 lines
2.2 KiB
Markdown
|
# OpenCloud (Nextcloud) Deployment
|
||
|
|
|
||
|
|
OpenCloud is a Nextcloud-based cloud collaboration platform deployed at https://opencloud.basicstack.de
|
||
|
|
|
||
|
|
## Components
|
||
|
|
|
||
|
|
- **Nextcloud 29**: Main application (Apache-based)
|
||
|
|
- **PostgreSQL 16**: Database backend
|
||
|
|
- **Redis 7**: Caching layer
|
||
|
|
|
||
|
|
## Authentication
|
||
|
|
|
||
|
|
- **Pocket ID OIDC Integration**
|
||
|
|
- Client ID: `2f3c0cea-697f-4dbc-9573-6f6e8adfd4b0`
|
||
|
|
- Authorized Group: `opencloud_admins`
|
||
|
|
- Users: andreas.leinen@basicstack.de
|
||
|
|
|
||
|
|
## Storage
|
||
|
|
|
||
|
|
- Database: 10Gi encrypted hcloud volume
|
||
|
|
- Nextcloud Data: 50Gi encrypted hcloud volume
|
||
|
|
|
||
|
|
## SMTP Configuration
|
||
|
|
|
||
|
|
- Server: mail.basicstack.de:465 (SSL)
|
||
|
|
- Account: opencloud@basicstack.de
|
||
|
|
- Credentials stored in `opencloud-smtp-secret` (SealedSecret)
|
||
|
|
|
||
|
|
## Backups
|
||
|
|
|
||
|
|
Daily backup configured to Hetzner S3 bucket at 2 AM using restic.
|
||
|
|
|
||
|
|
**Note**: Backup secret `opencloud-backup-secret` needs to be created with S3 credentials:
|
||
|
|
- `access-key`: S3 access key
|
||
|
|
- `secret-key`: S3 secret key
|
||
|
|
- `restic-password`: Restic repository encryption password
|
||
|
|
|
||
|
|
## Deployment Files
|
||
|
|
|
||
|
|
- `opencloud-deployment.yaml`: Main application stack (namespace, PVCs, services, ingress)
|
||
|
|
- `opencloud-db-sealed.yaml`: Database credentials
|
||
|
|
- `opencloud-admin-sealed.yaml`: Nextcloud admin credentials
|
||
|
|
- `opencloud-oidc-sealed.yaml`: Pocket ID OIDC credentials
|
||
|
|
- `opencloud-smtp-sealed.yaml`: SMTP credentials
|
||
|
|
- `opencloud-backup.yaml`: Daily backup CronJob (requires S3 credentials)
|
||
|
|
|
||
|
|
## Post-Deployment Configuration
|
||
|
|
|
||
|
|
After deploying, configure OIDC in Nextcloud:
|
||
|
|
|
||
|
|
1. Install the "OpenID Connect user backend" app
|
||
|
|
2. Configure the provider:
|
||
|
|
- Identifier: `PocketID`
|
||
|
|
- Client ID: (from sealed secret)
|
||
|
|
- Client Secret: (from sealed secret)
|
||
|
|
- Discovery URL: `https://auth.basicstack.de/.well-known/openid-configuration`
|
||
|
|
|
||
|
|
## Deployment Commands
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# Apply all manifests
|
||
|
|
kubectl apply -f opencloud-deployment.yaml
|
||
|
|
kubectl apply -f opencloud-db-sealed.yaml
|
||
|
|
kubectl apply -f opencloud-admin-sealed.yaml
|
||
|
|
kubectl apply -f opencloud-oidc-sealed.yaml
|
||
|
|
kubectl apply -f opencloud-smtp-sealed.yaml
|
||
|
|
|
||
|
|
# Optional: Apply backup (requires S3 secret first)
|
||
|
|
# kubectl apply -f opencloud-backup.yaml
|
||
|
|
```
|
||
|
|
|
||
|
|
## DNS
|
||
|
|
|
||
|
|
- A record: `opencloud.basicstack.de` → `178.105.17.239`
|
||
|
|
- TLS certificate managed by cert-manager (Let's Encrypt)
|