stack.basicstack.de/apps/opencloud/opencloud-deployment.yaml

---
apiVersion: v1
kind: Namespace
metadata:
  name: opencloud
---
# OpenCloud Data Storage
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: opencloud-data
  namespace: opencloud
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: hcloud-volumes-encrypted
  resources:
    requests:
      storage: 100Gi
---
# OpenCloud Service
apiVersion: v1
kind: Service
metadata:
  name: opencloud
  namespace: opencloud
spec:
  type: ClusterIP
  selector:
    app: opencloud
  ports:
    - name: http
      port: 9200
      targetPort: 9200
      protocol: TCP
---
# OpenCloud Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opencloud
  namespace: opencloud
spec:
  replicas: 0
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: opencloud
  template:
    metadata:
      labels:
        app: opencloud
      annotations:
        # Skip Kopia fs-backup of the 100 GiB opencloud object-store PVC — this
        # blob store is out of scope for the DEV-573 data schedules; the
        # exclusion is a safety net so an accidental defaultVolumesToFsBackup
        # run never streams it into the Kopia repo.
        backup.velero.io/backup-volumes-excludes: opencloud-data
    spec:
      securityContext:
        fsGroup: 1000
        runAsUser: 1000
        runAsNonRoot: true
      initContainers:
      - name: init-dirs
        image: opencloudeu/opencloud-rolling:7.4.0
        command:
          - sh
          - -c
          - |
            mkdir -p /var/lib/opencloud/data
        volumeMounts:
        - name: opencloud-data
          mountPath: /var/lib/opencloud
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
          runAsNonRoot: true
      containers:
      - name: opencloud
        image: opencloudeu/opencloud-rolling:7.4.0
        command:
          - /bin/sh
          - -c
          - "yes | opencloud init --insecure=true --force-overwrite 2>&1 | head -50 || true; opencloud server"
        env:
        # Basic configuration
        - name: OC_URL
          value: "https://opencloud.basicstack.de"
        - name: OC_LOG_LEVEL
          #value: "info"
          value: "trace"
        # Auth services trace logging
        - name: AUTH_SERVICE_LOG_LEVEL
          value: "trace"
        - name: AUTH_APP_LOG_LEVEL
          value: "trace"
        - name: AUTH_MACHINE_LOG_LEVEL
          value: "trace"
        - name: OC_LOG_PRETTY
          value: "false"
        - name: OC_LOG_COLOR
          value: "false"
        - name: OC_INSECURE
          value: "false"
        - name: PROXY_TLS
          value: "false"

        # Exclude: search (broken), idp (using Pocket ID), auth-basic (OIDC-only)
        # IDM is now enabled to use built-in user/group storage instead of external OpenLDAP
        - name: OC_EXCLUDE_RUN_SERVICES
          value: "search,idp,auth-basic"

        # Data paths
        - name: OPENCLOUD_BASE_DATA_PATH
          value: "/var/lib/opencloud"
        - name: OPENCLOUD_CONFIG_DIR
          value: "/etc/opencloud"

        # Core secrets (token manager and auth-service JWT)
        - name: OC_TOKEN_MANAGER_JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-jwt-secret
              key: jwt-secret
        - name: OC_JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-jwt-secret
              key: jwt-secret
        - name: OC_MACHINE_AUTH_API_KEY
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: machine-auth-api-key
        - name: OC_SYSTEM_USER_API_KEY
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: system-user-api-key
        - name: OC_TRANSFER_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: transfer-secret
        - name: OC_URL_SIGNING_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: url-signing-secret
        - name: OC_SYSTEM_USER_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: system-user-id
        - name: OC_ADMIN_USER_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: admin-user-id

        # External OIDC Configuration (Pocket ID)
        - name: OC_OIDC_ISSUER
          value: "https://auth.basicstack.de"
        - name: OC_OIDC_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-oidc-secret
              key: oidc-client-id
        # No OC_OIDC_CLIENT_SECRET - OpenCloud web frontend is a public SPA using PKCE
        - name: OC_OIDC_CLIENT_SCOPES
          value: "openid profile email groups"

        # Proxy service OIDC configuration
        - name: PROXY_CSP_CONFIG_FILE_LOCATION
          value: "/etc/opencloud/csp.yaml"
        - name: PROXY_OIDC_ISSUER
          value: "https://auth.basicstack.de"
        - name: PROXY_OIDC_REWRITE_WELLKNOWN
          value: "true"
        - name: PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD
          value: "none"
        - name: PROXY_USER_OIDC_CLAIM
          value: "preferred_username"
        - name: PROXY_USER_CS3_CLAIM
          value: "username"
        - name: PROXY_ENABLE_BASIC_AUTH
          value: "false"
        
        # Role assignment — default gives all auto-provisioned OIDC users the standard user role
        # (oidc driver required opencloud_role claim from Pocket ID which wasn't sent)
        - name: PROXY_ROLE_ASSIGNMENT_DRIVER
          value: "default"

        # User auto-provisioning
        - name: PROXY_AUTOPROVISION_ACCOUNTS
          value: "true"
        - name: PROXY_AUTOPROVISION_CLAIM_USERNAME
          value: "preferred_username"
        - name: PROXY_AUTOPROVISION_CLAIM_EMAIL
          value: "email"
        - name: PROXY_AUTOPROVISION_CLAIM_DISPLAYNAME
          value: "name"
        - name: PROXY_AUTOPROVISION_CLAIM_GROUPS
          value: "groups"

        # Disable demo user creation (using OIDC auto-provisioning only)
        - name: IDM_CREATE_DEMO_USERS
          value: "false"

        # Web service OIDC configuration (Public Client with PKCE)
        - name: WEB_OIDC_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-oidc-secret
              key: oidc-client-id
        # No WEB_OIDC_CLIENT_SECRET - web frontend is a public SPA using PKCE
        - name: WEB_OIDC_AUTHORITY
          value: "https://auth.basicstack.de"
        - name: WEB_OIDC_METADATA_URL
          value: "https://auth.basicstack.de/.well-known/openid-configuration"
        - name: WEB_OIDC_RESPONSE_TYPE
          value: "code"
        - name: WEB_OIDC_SCOPE
          value: "openid profile email groups"

        # SMTP Configuration
        - name: NOTIFICATIONS_SMTP_HOST
          value: "mail.basicstack.de"
        - name: NOTIFICATIONS_SMTP_PORT
          value: "465"
        - name: NOTIFICATIONS_SMTP_SENDER
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-username
        - name: NOTIFICATIONS_SMTP_USERNAME
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-username
        - name: NOTIFICATIONS_SMTP_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-password
        - name: NOTIFICATIONS_SMTP_INSECURE
          value: "false"
        - name: NOTIFICATIONS_SMTP_AUTHENTICATION
          value: "login"
        - name: NOTIFICATIONS_SMTP_ENCRYPTION
          value: "ssl"

        # Service account (shared across all services)
        - name: OC_SERVICE_ACCOUNT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-id
        - name: OC_SERVICE_ACCOUNT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-secret

        # Storage configuration
        - name: OC_STORAGE_MOUNT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: storage-mount-id
        - name: OC_GRAPH_APPLICATION_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: graph-application-id

        # LDAP bind passwords
        - name: OC_GRAPH_LDAP_BIND_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: graph-ldap-bind-password
        - name: OC_IDP_LDAP_BIND_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idp-ldap-bind-password
        - name: OC_USERS_LDAP_BIND_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: ldap-bind-password
        - name: OC_GROUPS_LDAP_BIND_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: ldap-bind-password

        # IDM service user passwords
        - name: OC_IDM_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idm-admin-password
        - name: OC_IDM_IDM_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idm-idm-password
        - name: OC_IDM_REVA_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idm-reva-password
        - name: OC_IDM_IDP_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idm-idp-password

        # Other service secrets
        - name: OC_COLLABORATION_WOPI_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: collaboration-wopi-secret
        - name: OC_THUMBNAILS_TRANSFER_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: thumbnails-transfer-secret

        # Service-specific environment variables (for direct override)
        - name: GRAPH_APPLICATION_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: graph-application-id
        - name: GRAPH_IDENTITY_LDAP_BIND_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: graph-ldap-bind-password
        - name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-id
        - name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-secret
        - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
          value: "false"
        - name: GRAPH_USERNAME_MATCH
          value: "none"
        - name: IDP_LDAP_BIND_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idp-ldap-bind-password
        - name: IDM_SERVICE_USER_PASSWORDS_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idm-admin-password
        - name: IDM_SERVICE_USER_PASSWORDS_IDM_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idm-idm-password
        - name: IDM_SERVICE_USER_PASSWORDS_REVA_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idm-reva-password
        - name: IDM_SERVICE_USER_PASSWORDS_IDP_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: idm-idp-password
        - name: COLLABORATION_WOPI_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: collaboration-wopi-secret
        - name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-id
        - name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-secret
        - name: STORAGE_USERS_MOUNT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: storage-mount-id
        - name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-id
        - name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-secret
        - name: GATEWAY_STORAGE_REGISTRY_STORAGE_USERS_MOUNT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: storage-mount-id
        - name: USERS_DRIVERS_LDAP_BIND_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: ldap-bind-password
        - name: GROUPS_DRIVERS_LDAP_BIND_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: ldap-bind-password
        - name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-id
        - name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: service-account-secret
        - name: THUMBNAILS_THUMBNAIL_TRANSFER_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-config-secrets
              key: thumbnails-transfer-secret

        ports:
        - containerPort: 9200
          name: http
        volumeMounts:
        - name: opencloud-data
          mountPath: /var/lib/opencloud
        - name: opencloud-config
          mountPath: /etc/opencloud
        resources:
          requests:
            memory: "512Mi"
            cpu: "50m"
          limits:
            memory: "2Gi"
            cpu: "1000m"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 9200
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 5
          failureThreshold: 5
        readinessProbe:
          httpGet:
            path: /healthz
            port: 9200
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
      volumes:
      - name: opencloud-data
        persistentVolumeClaim:
          claimName: opencloud-data
      - name: opencloud-config
        configMap:
          name: opencloud-config
---
# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: opencloud
  namespace: opencloud
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: traefik
  tls:
  - hosts:
    - opencloud.basicstack.de
    secretName: opencloud-tls
  rules:
  - host: opencloud.basicstack.de
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: opencloud
            port:
              number: 9200