basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/opencloud/opencloud-configmap.yaml

46 lines
1.4 KiB
YAML
Raw Normal View History

Add OpenCloud deployment (partial implementation) Infrastructure and secrets complete, needs configuration initialization. Created: - Complete Kubernetes manifests (deployment, service, ingress, PVC) - SealedSecrets for OIDC, SMTP, JWT, and core configuration - Base opencloud.yaml ConfigMap with bash substitution - Pocket ID integration (client + opencloud_admins group) - DNS configured (opencloud.basicstack.de) Status: Blocked on OpenCloud initialization - OpenCloud requires comprehensive config from 'opencloud init' - Manual environment variable configuration insufficient - Multiple interdependent service configurations needed - See IMPLEMENTATION_STATUS.md for details and next steps Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-04 19:35:08 +00:00
---
apiVersion: v1
kind: ConfigMap
metadata:
name: opencloud-config
namespace: opencloud
data:
opencloud.yaml: |
Revert "fix(opencloud): remove external LDAP config, use IDM for user storage" This reverts commit 5adc38c4d8562800f1fbd8928448812f84558ea9.
2026-07-05 15:41:56 +00:00
# OpenCloud Minimal Configuration
# Only non-default settings - environment variables override these
Configure OpenCloud to use built-in IDM instead of external OpenLDAP - Enable IDM service by removing it from OC_EXCLUDE_RUN_SERVICES - Remove external LDAP configuration from configmap (graph, users, groups) - Built-in IDM will handle user/group storage internally - OIDC auto-provisioning via Pocket ID remains unchanged This allows OpenCloud to save new users using its internal IDM service. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 20:41:15 +00:00
# Using built-in IDM for user/group storage instead of external OpenLDAP
Revert "fix(opencloud): remove external LDAP config, use IDM for user storage" This reverts commit 5adc38c4d8562800f1fbd8928448812f84558ea9.
2026-07-05 15:41:56 +00:00
# Proxy service - OIDC configuration (already in env vars, kept for reference)
Add OpenCloud deployment (partial implementation) Infrastructure and secrets complete, needs configuration initialization. Created: - Complete Kubernetes manifests (deployment, service, ingress, PVC) - SealedSecrets for OIDC, SMTP, JWT, and core configuration - Base opencloud.yaml ConfigMap with bash substitution - Pocket ID integration (client + opencloud_admins group) - DNS configured (opencloud.basicstack.de) Status: Blocked on OpenCloud initialization - OpenCloud requires comprehensive config from 'opencloud init' - Manual environment variable configuration insufficient - Multiple interdependent service configurations needed - See IMPLEMENTATION_STATUS.md for details and next steps Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-04 19:35:08 +00:00
proxy:
oidc:
issuer: https://auth.basicstack.de
insecure: false
Enable OIDC auto-provisioning for OpenCloud Problem: Users still routed to /login page instead of OIDC redirect. Root cause: auto_provision_accounts was disabled in proxy OIDC config. Changes: - proxy.oidc.auto_provision_accounts: true (enable auto-provisioning) - proxy.oidc.user_oidc_claim: email (user identification claim) - proxy.oidc.role_assignment: Added OIDC role mapper for groups - proxy.enable_basic_auth: false (explicitly disable basic auth) Result: Users will be auto-created on first OIDC login with group-based roles. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 08:38:07 +00:00
auto_provision_accounts: true
Implement ConfigMap mount with init container for envsubst Added init-config container that: - Uses alpine with envsubst to expand environment variables - Reads ConfigMap template from /etc/opencloud-template - Writes expanded config to emptyDir at /etc/opencloud-processed - Main container mounts processed config at /etc/opencloud Simplified ConfigMap to only essential LDAP configuration: - Graph service LDAP (external OpenLDAP) - Users/Groups service LDAP configuration - Removed default values (env vars override anyway) - Only placeholder remains This follows OpenCloud's config precedence: 1. opencloud.yaml (base config) 2. Environment variables (highest precedence) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-05 13:39:15 +00:00
user_oidc_claim: preferred_username
enable_basic_auth: false
Add OpenCloud deployment (partial implementation) Infrastructure and secrets complete, needs configuration initialization. Created: - Complete Kubernetes manifests (deployment, service, ingress, PVC) - SealedSecrets for OIDC, SMTP, JWT, and core configuration - Base opencloud.yaml ConfigMap with bash substitution - Pocket ID integration (client + opencloud_admins group) - DNS configured (opencloud.basicstack.de) Status: Blocked on OpenCloud initialization - OpenCloud requires comprehensive config from 'opencloud init' - Manual environment variable configuration insufficient - Multiple interdependent service configurations needed - See IMPLEMENTATION_STATUS.md for details and next steps Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-04 19:35:08 +00:00
Revert "fix(opencloud): remove external LDAP config, use IDM for user storage" This reverts commit 5adc38c4d8562800f1fbd8928448812f84558ea9.
2026-07-05 15:41:56 +00:00
# IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
fix(opencloud): add IDM password config to ConfigMap The /etc/opencloud mount is read-only (ConfigMap), so opencloud init cannot write the generated IDM password config. IDM fails to start with "password of service user IDM has not been set properly". Add the idm.service_user_passwords section to opencloud.yaml, referencing the OC_IDM_* env vars that are already populated from the sealed secret. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 15:29:01 +00:00
idm:
service_user_passwords:
admin_password: ${OC_IDM_ADMIN_PASSWORD}
idm_password: ${OC_IDM_IDM_PASSWORD}
reva_password: ${OC_IDM_REVA_PASSWORD}
idp_password: ${OC_IDM_IDP_PASSWORD}
OpenCloud: Use native bash substitution in config file - Removed init-config container (OpenCloud supports native bash substitution) - Mount opencloud-config ConfigMap directly to /etc/opencloud - Added gateway storage configuration with ${OC_STORAGE_MOUNT_ID|} - Updated all LDAP services to use ${OPENLDAP_ADMIN_PASSWORD|} substitution - Added auth-basic auth_providers structure Services starting successfully: - Gateway, users, sharing services running - Users service connected to external OpenLDAP - Remaining: auth-basic bind_password configuration issue Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-05 14:03:49 +00:00
# Gateway service - storage configuration
gateway:
storage_registry:
storage_users_mount_id: ${OC_STORAGE_MOUNT_ID}
fix(opencloud): add CSP config to allow Pocket ID OIDC auth Browser was blocking fetch of https://auth.basicstack.de/.well-known/openid-configuration due to missing connect-src directive in Content-Security-Policy. Adds csp.yaml to the ConfigMap (mounted at /etc/opencloud/csp.yaml) with extended connect-src that includes auth.basicstack.de and WebSocket origins. Sets PROXY_CSP_CONFIG_FILE_LOCATION env var so the proxy service picks it up. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 15:14:26 +00:00
csp.yaml: |
directives:
connect-src:
- "'self'"
- "blob:"
- "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
- "https://update.opencloud.eu/"
- "https://opencloud.basicstack.de"
- "https://auth.basicstack.de"
- "wss://opencloud.basicstack.de"
- "wss://auth.basicstack.de"
Reference in a new issue Copy permalink