stack.basicstack.de/apps/opencloud/opencloud-deployment.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: opencloud
---
# OpenCloud Data Storage
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: opencloud-data
  namespace: opencloud
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: hcloud-volumes-encrypted
  resources:
    requests:
      storage: 100Gi
---
# OpenCloud Service
apiVersion: v1
kind: Service
metadata:
  name: opencloud
  namespace: opencloud
spec:
  type: ClusterIP
  selector:
    app: opencloud
  ports:
    - name: http
      port: 9200
      targetPort: 9200
      protocol: TCP
---
# OpenCloud Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opencloud
  namespace: opencloud
spec:
  replicas: 1
  selector:
    matchLabels:
      app: opencloud
  template:
    metadata:
      labels:
        app: opencloud
    spec:
      securityContext:
        fsGroup: 1000
        runAsUser: 1000
        runAsNonRoot: true
      initContainers:
      - name: init-dirs
        image: quay.io/opencloudeu/opencloud:7.2.0
        command:
          - sh
          - -c
          - |
            mkdir -p /var/lib/opencloud/data
        volumeMounts:
        - name: opencloud-data
          mountPath: /var/lib/opencloud
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
          runAsNonRoot: true
      containers:
      - name: opencloud
        image: quay.io/opencloudeu/opencloud:7.2.0
        command:
          - /usr/bin/opencloud
          - server
        env:
        # Basic configuration
        - name: OPENCLOUD_URL
          value: "https://opencloud.basicstack.de"
        - name: OPENCLOUD_LOG_LEVEL
          value: "debug"
        - name: OPENCLOUD_LOG_PRETTY
          value: "false"
        - name: OPENCLOUD_LOG_COLOR
          value: "false"

        # Data paths
        - name: OPENCLOUD_BASE_DATA_PATH
          value: "/var/lib/opencloud"
        - name: OPENCLOUD_CONFIG_DIR
          value: "/etc/opencloud"

        # Core secrets (token manager)
        - name: OC_TOKEN_MANAGER_JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-jwt-secret
              key: jwt-secret
        - name: OC_MACHINE_AUTH_API_KEY
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: machine-auth-api-key
        - name: OC_SYSTEM_USER_API_KEY
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: system-user-api-key
        - name: OC_TRANSFER_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: transfer-secret
        - name: OC_URL_SIGNING_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: url-signing-secret
        - name: OC_SYSTEM_USER_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: system-user-id
        - name: OC_ADMIN_USER_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: admin-user-id

        # OIDC Configuration
        - name: PROXY_OIDC_ISSUER
          value: "https://auth.basicstack.de"
        - name: PROXY_OIDC_INSECURE
          value: "false"
        - name: PROXY_USER_OIDC_CLAIM
          value: "preferred_username"
        - name: PROXY_USER_CS3_CLAIM
          value: "username"
        - name: PROXY_OIDC_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-oidc-secret
              key: oidc-client-id
        - name: PROXY_OIDC_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-oidc-secret
              key: oidc-client-secret

        # SMTP Configuration
        - name: NOTIFICATIONS_SMTP_HOST
          value: "mail.basicstack.de"
        - name: NOTIFICATIONS_SMTP_PORT
          value: "465"
        - name: NOTIFICATIONS_SMTP_SENDER
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-username
        - name: NOTIFICATIONS_SMTP_USERNAME
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-username
        - name: NOTIFICATIONS_SMTP_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-password
        - name: NOTIFICATIONS_SMTP_INSECURE
          value: "false"
        - name: NOTIFICATIONS_SMTP_AUTHENTICATION
          value: "login"
        - name: NOTIFICATIONS_SMTP_ENCRYPTION
          value: "ssl"

        # Storage configuration
        - name: GATEWAY_STORAGE_USERS_MOUNT_ID
          value: "/users"
        - name: STORAGE_USERS_MOUNT_ID
          value: "/users"
        - name: STORAGE_USERS_SERVICE_ACCOUNT_ID
          value: "599fd884-c9bb-45fa-b347-cf2c910d546a"
        - name: STORAGE_USERS_SERVICE_ACCOUNT_SECRET
          value: "v6uhy3NBcZQRzS8aG4qDcQHBGTbwsMCLglBpXrvPJBc="

        # IDM service user
        - name: IDM_SERVICE_USER_PASSWORD
          value: "v6uhy3NBcZQRzS8aG4qDcQHBGTbwsMCLglBpXrvPJBc="

        # Demo users disabled (use OIDC only)
        - name: IDM_CREATE_DEMO_USERS
          value: "false"
        - name: PROXY_ENABLE_BASIC_AUTH
          value: "false"

        # Admin user from OIDC
        - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
          value: "false"
        - name: GRAPH_USERNAME_MATCH
          value: "none"

        ports:
        - containerPort: 9200
          name: http
        volumeMounts:
        - name: opencloud-data
          mountPath: /var/lib/opencloud
        - name: opencloud-config
          mountPath: /etc/opencloud
          readOnly: true
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1000m"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 9200
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 5
          failureThreshold: 5
        readinessProbe:
          httpGet:
            path: /healthz
            port: 9200
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
      volumes:
      - name: opencloud-data
        persistentVolumeClaim:
          claimName: opencloud-data
      - name: opencloud-config
        configMap:
          name: opencloud-config
---
# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: opencloud
  namespace: opencloud
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: traefik
  tls:
  - hosts:
    - opencloud.basicstack.de
    secretName: opencloud-tls
  rules:
  - host: opencloud.basicstack.de
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: opencloud
            port:
              number: 9200