basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/opencloud/opencloud-configmap.yaml

44 lines
1.2 KiB
YAML
Raw Normal View History

Add OpenCloud deployment (partial implementation) Infrastructure and secrets complete, needs configuration initialization. Created: - Complete Kubernetes manifests (deployment, service, ingress, PVC) - SealedSecrets for OIDC, SMTP, JWT, and core configuration - Base opencloud.yaml ConfigMap with bash substitution - Pocket ID integration (client + opencloud_admins group) - DNS configured (opencloud.basicstack.de) Status: Blocked on OpenCloud initialization - OpenCloud requires comprehensive config from 'opencloud init' - Manual environment variable configuration insufficient - Multiple interdependent service configurations needed - See IMPLEMENTATION_STATUS.md for details and next steps Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-04 19:35:08 +00:00
---
apiVersion: v1
kind: ConfigMap
metadata:
name: opencloud-config
namespace: opencloud
data:
opencloud.yaml: |
fix(opencloud): remove external LDAP config, use IDM for user storage Graph service was routing auto-provisioning to external OpenLDAP which lacks the OpenCloud schema (openCloudUUID: attribute type undefined). The explicit graph.identity.ldap, users.drivers.ldap, and groups.drivers.ldap sections in opencloud.yaml overrode the default IDM LDAP, causing user creation to fail. Remove all external LDAP sections so Graph/Users/Groups default to IDM's internal LDAP, which has the full OpenCloud schema. IDM is already running. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 15:37:46 +00:00
# OpenCloud Configuration - Pocket ID OIDC auth, IDM for internal user storage
Add OpenCloud deployment (partial implementation) Infrastructure and secrets complete, needs configuration initialization. Created: - Complete Kubernetes manifests (deployment, service, ingress, PVC) - SealedSecrets for OIDC, SMTP, JWT, and core configuration - Base opencloud.yaml ConfigMap with bash substitution - Pocket ID integration (client + opencloud_admins group) - DNS configured (opencloud.basicstack.de) Status: Blocked on OpenCloud initialization - OpenCloud requires comprehensive config from 'opencloud init' - Manual environment variable configuration insufficient - Multiple interdependent service configurations needed - See IMPLEMENTATION_STATUS.md for details and next steps Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-04 19:35:08 +00:00
fix(opencloud): remove external LDAP config, use IDM for user storage Graph service was routing auto-provisioning to external OpenLDAP which lacks the OpenCloud schema (openCloudUUID: attribute type undefined). The explicit graph.identity.ldap, users.drivers.ldap, and groups.drivers.ldap sections in opencloud.yaml overrode the default IDM LDAP, causing user creation to fail. Remove all external LDAP sections so Graph/Users/Groups default to IDM's internal LDAP, which has the full OpenCloud schema. IDM is already running. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 15:37:46 +00:00
# Proxy service - OIDC via Pocket ID
Add OpenCloud deployment (partial implementation) Infrastructure and secrets complete, needs configuration initialization. Created: - Complete Kubernetes manifests (deployment, service, ingress, PVC) - SealedSecrets for OIDC, SMTP, JWT, and core configuration - Base opencloud.yaml ConfigMap with bash substitution - Pocket ID integration (client + opencloud_admins group) - DNS configured (opencloud.basicstack.de) Status: Blocked on OpenCloud initialization - OpenCloud requires comprehensive config from 'opencloud init' - Manual environment variable configuration insufficient - Multiple interdependent service configurations needed - See IMPLEMENTATION_STATUS.md for details and next steps Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-04 19:35:08 +00:00
proxy:
oidc:
issuer: https://auth.basicstack.de
insecure: false
Enable OIDC auto-provisioning for OpenCloud Problem: Users still routed to /login page instead of OIDC redirect. Root cause: auto_provision_accounts was disabled in proxy OIDC config. Changes: - proxy.oidc.auto_provision_accounts: true (enable auto-provisioning) - proxy.oidc.user_oidc_claim: email (user identification claim) - proxy.oidc.role_assignment: Added OIDC role mapper for groups - proxy.enable_basic_auth: false (explicitly disable basic auth) Result: Users will be auto-created on first OIDC login with group-based roles. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 08:38:07 +00:00
auto_provision_accounts: true
Implement ConfigMap mount with init container for envsubst Added init-config container that: - Uses alpine with envsubst to expand environment variables - Reads ConfigMap template from /etc/opencloud-template - Writes expanded config to emptyDir at /etc/opencloud-processed - Main container mounts processed config at /etc/opencloud Simplified ConfigMap to only essential LDAP configuration: - Graph service LDAP (external OpenLDAP) - Users/Groups service LDAP configuration - Removed default values (env vars override anyway) - Only placeholder remains This follows OpenCloud's config precedence: 1. opencloud.yaml (base config) 2. Environment variables (highest precedence) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-05 13:39:15 +00:00
user_oidc_claim: preferred_username
enable_basic_auth: false
Add OpenCloud deployment (partial implementation) Infrastructure and secrets complete, needs configuration initialization. Created: - Complete Kubernetes manifests (deployment, service, ingress, PVC) - SealedSecrets for OIDC, SMTP, JWT, and core configuration - Base opencloud.yaml ConfigMap with bash substitution - Pocket ID integration (client + opencloud_admins group) - DNS configured (opencloud.basicstack.de) Status: Blocked on OpenCloud initialization - OpenCloud requires comprehensive config from 'opencloud init' - Manual environment variable configuration insufficient - Multiple interdependent service configurations needed - See IMPLEMENTATION_STATUS.md for details and next steps Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-04 19:35:08 +00:00
fix(opencloud): remove external LDAP config, use IDM for user storage Graph service was routing auto-provisioning to external OpenLDAP which lacks the OpenCloud schema (openCloudUUID: attribute type undefined). The explicit graph.identity.ldap, users.drivers.ldap, and groups.drivers.ldap sections in opencloud.yaml overrode the default IDM LDAP, causing user creation to fail. Remove all external LDAP sections so Graph/Users/Groups default to IDM's internal LDAP, which has the full OpenCloud schema. IDM is already running. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 15:37:46 +00:00
# IDM service user passwords (required when /etc/opencloud is read-only - init cannot write here)
fix(opencloud): add IDM password config to ConfigMap The /etc/opencloud mount is read-only (ConfigMap), so opencloud init cannot write the generated IDM password config. IDM fails to start with "password of service user IDM has not been set properly". Add the idm.service_user_passwords section to opencloud.yaml, referencing the OC_IDM_* env vars that are already populated from the sealed secret. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 15:29:01 +00:00
idm:
service_user_passwords:
admin_password: ${OC_IDM_ADMIN_PASSWORD}
idm_password: ${OC_IDM_IDM_PASSWORD}
reva_password: ${OC_IDM_REVA_PASSWORD}
idp_password: ${OC_IDM_IDP_PASSWORD}
OpenCloud: Use native bash substitution in config file - Removed init-config container (OpenCloud supports native bash substitution) - Mount opencloud-config ConfigMap directly to /etc/opencloud - Added gateway storage configuration with ${OC_STORAGE_MOUNT_ID|} - Updated all LDAP services to use ${OPENLDAP_ADMIN_PASSWORD|} substitution - Added auth-basic auth_providers structure Services starting successfully: - Gateway, users, sharing services running - Users service connected to external OpenLDAP - Remaining: auth-basic bind_password configuration issue Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-05 14:03:49 +00:00
# Gateway service - storage configuration
gateway:
storage_registry:
storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}
fix(opencloud): add CSP config to allow Pocket ID OIDC auth Browser was blocking fetch of https://auth.basicstack.de/.well-known/openid-configuration due to missing connect-src directive in Content-Security-Policy. Adds csp.yaml to the ConfigMap (mounted at /etc/opencloud/csp.yaml) with extended connect-src that includes auth.basicstack.de and WebSocket origins. Sets PROXY_CSP_CONFIG_FILE_LOCATION env var so the proxy service picks it up. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 15:14:26 +00:00
csp.yaml: |
directives:
connect-src:
- "'self'"
- "blob:"
- "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
- "https://update.opencloud.eu/"
- "https://opencloud.basicstack.de"
- "https://auth.basicstack.de"
- "wss://opencloud.basicstack.de"
- "wss://auth.basicstack.de"
Reference in a new issue Copy permalink