stack.basicstack.de/apps/opencloud/IMPLEMENTATION_STATUS.md

# OpenCloud Implementation Status

**Date:** 2026-07-04  
**Status:** Blocked - Initialization Required

## What We've Built

### Infrastructure (✓ Complete)
- Namespace: `opencloud`
- PersistentVolumeClaim: 100Gi encrypted hcloud volume
- Service: ClusterIP on port 9200
- Ingress: opencloud.basicstack.de with TLS (cert-manager)
- DNS: A record configured

### Secrets (✓ Complete)
All credentials stored as SealedSecrets:
- `opencloud-oidc-secret` - Pocket ID OIDC credentials
- `opencloud-smtp-secret` - SMTP credentials for notifications
- `opencloud-jwt-secret` - JWT token signing secret
- `opencloud-config-secrets` - Core OpenCloud secrets (machine auth, transfer secret, etc.)

### Pocket ID Integration (✓ Complete)
- Client ID: `2f3c0cea-697f-4dbc-9573-6f6e8adfd4b0`
- Group: `opencloud_admins`
- User: andreas.leinen@basicstack.de added to group
- Issuer: https://auth.basicstack.de

### Configuration Progress (⚠️  Partial)
We've created:
- Base `opencloud.yaml` ConfigMap with bash substitution for secrets
- Deployment with environment variable overrides
- Proper security contexts (runAsUser: 1000, fsGroup: 1000)

## The Problem

OpenCloud requires a comprehensive initialization configuration generated by `opencloud init`. Manual configuration via environment variables is insufficient because:

1. **Complex Service Dependencies**: OpenCloud consists of multiple microservices (IDM, Storage, Gateway, OCM, Graph, Proxy, etc.) that each require:
   - Service account IDs (UUIDs)
   - Service account secrets
   - Inter-service authentication credentials

2. **Initialization Cascade**: Each configuration fix reveals new required settings:
   - JWT secret → Storage mount ID → IDM password → Service account ID → OCM config → ...

3. **Documentation Gap**: The official documentation describes the config system but doesn't provide complete examples of all required fields for a minimal working deployment.

## Solutions Considered

### 1. Manual Environment Variables (Current Approach - Incomplete)
**Status:** Attempted but insufficient  
**Blocker:** Too many interdependent configuration items

### 2. Use `opencloud init` in Init Container
**Status:** Not yet implemented  
**Challenge:** Need to:
- Run `opencloud init` to generate complete config
- Extract the generated `opencloud.yaml`
- Merge it with our security secrets (from SealedSecrets)
- Mount the final config

**Implementation Approach:**
```yaml
initContainers:
- name: generate-config
  image: quay.io/opencloudeu/opencloud:7.2.0
  command: ["/bin/sh", "-c"]
  args:
    - |
      # Generate base config
      opencloud init --insecure true --force-overwrite
      
      # Apply secret overrides via sed/yq
      # (JWT, machine_auth, etc. from environment)
      
      # Copy to shared volume
      cp /etc/opencloud/*.yaml /config-out/
  volumeMounts:
    - name: config-volume
      mountPath: /config-out
```

### 3. Fork Official Helm Charts
**Status:** Not feasible  
**Reason:** Official charts are archived, production versions require business subscription

### 4. Switch to Alternative (Not Chosen)
User explicitly wants OpenCloud, not Nextcloud or ownCloud

## Recommended Next Steps

1. **Complete Configuration Initialization:**
   ```bash
   # Run opencloud init locally to generate complete config
   docker run --rm \
     -v ./config:/etc/opencloud \
     quay.io/opencloudeu/opencloud:7.2.0 \
     opencloud init --insecure true
   
   # Review generated opencloud.yaml
   # Extract all required configuration keys
   # Add them to our ConfigMap with bash substitution for secrets
   ```

2. **Update ConfigMap** with complete configuration structure from `opencloud init` output

3. **Test Deployment** with complete configuration

4. **Configure Backup** to Hetzner bucket (once deployment is stable)

## Current Errors

Latest pod error:
```
The service account id has not been configured for ocm. 
Make sure your /etc/opencloud config contains the proper values 
(e.g. by using 'opencloud init --diff' and applying the patch 
or setting a value manually in the config/corresponding environment variable).
```

Previous errors (now resolved):
- ✓ JWT secret not set
- ✓ Storage users mount ID not configured
- ✓ IDM service user password not set
- ✓ Service account ID for storage-users not configured

## Files Created

- `opencloud-deployment.yaml` - Main Kubernetes deployment
- `opencloud-configmap.yaml` - Base configuration with bash substitution
- `opencloud-config-sealed.yaml` - Core secrets (sealed)
- `opencloud-oidc-sealed.yaml` - OIDC credentials (sealed)
- `opencloud-smtp-sealed.yaml` - SMTP credentials (sealed)
- `opencloud-jwt-sealed.yaml` - JWT secret (sealed)
- `seal-config-secrets.sh` - Helper script for sealing secrets
- `README.md` - Deployment documentation
- `IMPLEMENTATION_STATUS.md` - This file

## References

- OpenCloud Configuration System: https://docs.opencloud.eu/docs/next/dev/server/configuration/config-system/
- Installation Guide (German): https://tech-support.koeln/de/blog/opencloud-vs-nextcloud-ersteindruck-und-installation
- GitHub Repository: https://github.com/opencloud-eu/opencloud