basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Add OpenCloud v7.2.0 deployment to Kubernetes cluster

Browse source 
Deployed OpenCloud file-sharing platform at opencloud.basicstack.de with:
- Namespace: opencloud
- Encrypted hcloud volumes (100Gi PVC)
- Pocket ID OIDC integration (opencloud_admins group)
- SMTP notifications via opencloud@basicstack.de
- All credentials stored as SealedSecrets
- Search service excluded due to v7.2.0 bug (GitHub #1740)

Configuration follows official docker-compose pattern:
- Image: opencloudeu/opencloud-rolling:7.2.0
- Command: opencloud init || true; opencloud server
- External IDP mode with auto-provisioning
- OC_EXCLUDE_RUN_SERVICES: search

Files:
- opencloud-deployment.yaml: Main deployment with OIDC, SMTP config
- opencloud-configmap.yaml: OpenCloud config (search disabled)
- tika-deployment.yaml: Apache Tika for future search enablement

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-07-04 20:33:12 +00:00
parent e86f36cced
commit 182c270b4c
3 changed files with 115 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
apps/opencloud/opencloud-configmap.yaml
View file

@ -112,13 +112,22 @@ data:
webdav_allow_insecure: true
cs3_allow_insecure: true
# Search service
search:
events:
tls_insecure: true
service_account:
service_account_id: ${OC_SERVICE_ACCOUNT_ID}
service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
# Search service - DISABLED due to crashes in v7.2.0
# See: https://github.com/opencloud-eu/opencloud/issues/1740
# search:
# engine:
# type: bleve
# bleve:
# data_path: /var/lib/opencloud/search
# extractor:
# type: tika
# tika:
# tika_url: http://tika:9998
# events:
# tls_insecure: true
# service_account:
# service_account_id: ${OC_SERVICE_ACCOUNT_ID}
# service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
# Audit service
audit:

64
apps/opencloud/opencloud-deployment.yaml
View file

@ -56,7 +56,7 @@ spec:
runAsNonRoot: true
initContainers:
- name: init-dirs
image: quay.io/opencloudeu/opencloud:7.2.0
image: opencloudeu/opencloud-rolling:7.2.0
command:
- sh
- -c
@ -71,20 +71,29 @@ spec:
runAsNonRoot: true
containers:
- name: opencloud
image: quay.io/opencloudeu/opencloud:7.2.0
image: opencloudeu/opencloud-rolling:7.2.0
command:
- /usr/bin/opencloud
- server
- /bin/sh
- -c
- "opencloud init || true; opencloud server"
env:
# Basic configuration
- name: OPENCLOUD_URL
- name: OC_URL
value: "https://opencloud.basicstack.de"
- name: OPENCLOUD_LOG_LEVEL
value: "debug"
- name: OPENCLOUD_LOG_PRETTY
- name: OC_LOG_LEVEL
value: "info"
- name: OC_LOG_PRETTY
value: "false"
- name: OPENCLOUD_LOG_COLOR
- name: OC_LOG_COLOR
value: "false"
- name: OC_INSECURE
value: "false"
- name: PROXY_TLS
value: "false"
# Exclude broken search service (GitHub issue #1740)
- name: OC_EXCLUDE_RUN_SERVICES
value: "search"
# Data paths
- name: OPENCLOUD_BASE_DATA_PATH
@ -129,25 +138,26 @@ spec:
name: opencloud-config-secrets
key: admin-user-id
# OIDC Configuration
- name: PROXY_OIDC_ISSUER
# OIDC Configuration (External IDP - Pocket ID)
- name: OC_OIDC_ISSUER
value: "https://auth.basicstack.de"
- name: PROXY_OIDC_INSECURE
value: "false"
- name: PROXY_USER_OIDC_CLAIM
value: "preferred_username"
- name: PROXY_USER_CS3_CLAIM
value: "username"
- name: PROXY_OIDC_CLIENT_ID
- name: OC_OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: opencloud-oidc-secret
key: oidc-client-id
- name: PROXY_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: opencloud-oidc-secret
key: oidc-client-secret
- name: PROXY_OIDC_REWRITE_WELLKNOWN
value: "true"
- name: PROXY_USER_OIDC_CLAIM
value: "preferred_username"
- name: PROXY_USER_CS3_CLAIM
value: "username"
- name: PROXY_AUTOPROVISION_ACCOUNTS
value: "true"
- name: PROXY_ROLE_ASSIGNMENT_DRIVER
value: "oidc"
- name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM
value: "groups"
# SMTP Configuration
- name: NOTIFICATIONS_SMTP_HOST
@ -373,17 +383,21 @@ spec:
name: opencloud-config-secrets
key: thumbnails-transfer-secret
# Demo users disabled (use OIDC only)
# Demo users disabled (use external OIDC)
- name: IDM_CREATE_DEMO_USERS
value: "false"
- name: PROXY_ENABLE_BASIC_AUTH
value: "false"
# Admin user from OIDC
# Admin user and role assignment (external IDP mode)
- name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
value: "false"
- name: GRAPH_USERNAME_MATCH
value: "none"
- name: OC_ADMIN_USER_ID
value: ""
- name: SETTINGS_SETUP_DEFAULT_ASSIGNMENTS
value: "false"
ports:
- containerPort: 9200

60
apps/opencloud/tika-deployment.yaml Normal file
View file

@ -0,0 +1,60 @@
---
# Apache Tika Service for OpenCloud full-text search
apiVersion: v1
kind: Service
metadata:
name: tika
namespace: opencloud
spec:
type: ClusterIP
selector:
app: tika
ports:
- name: http
port: 9998
targetPort: 9998
protocol: TCP
---
# Apache Tika Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
name: tika
namespace: opencloud
spec:
replicas: 1
selector:
matchLabels:
app: tika
template:
metadata:
labels:
app: tika
spec:
containers:
- name: tika
image: apache/tika:latest
ports:
- containerPort: 9998
name: http
resources:
requests:
memory: "256Mi"
cpu: "100m"
limits:
memory: "1Gi"
cpu: "500m"
livenessProbe:
httpGet:
path: /tika
port: 9998
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
readinessProbe:
httpGet:
path: /tika
port: 9998
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 5