Revert "fix(opencloud): remove external LDAP config, use IDM for user storage"

This reverts commit 5adc38c4d8.

apps/opencloud/opencloud-configmap.yaml

@@ -6,9 +6,22 @@ metadata:
   namespace: opencloud
 data:
   opencloud.yaml: |
-    # OpenCloud Configuration - Pocket ID OIDC auth, IDM for internal user storage
+    # OpenCloud Minimal Configuration
+    # Only non-default settings - environment variables override these
 
-    # Proxy service - OIDC via Pocket ID
+    # Graph service - external OpenLDAP configuration
+    graph:
+      identity:
+        ldap:
+          uri: ldap://openldap.opencloud.svc.cluster.local:389
+          base_dn: dc=basicstack,dc=de
+          bind_dn: cn=admin,dc=basicstack,dc=de
+          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
+          user_base_dn: ou=users,dc=basicstack,dc=de
+          group_base_dn: ou=groups,dc=basicstack,dc=de
+          insecure: true
+
+    # Proxy service - OIDC configuration (already in env vars, kept for reference)
     proxy:
       oidc:
         issuer: https://auth.basicstack.de
@@ -17,7 +30,33 @@ data:
         user_oidc_claim: preferred_username
       enable_basic_auth: false
 
-    # IDM service user passwords (required when /etc/opencloud is read-only - init cannot write here)
+    # Users service - external LDAP
+    users:
+      drivers:
+        ldap:
+          uri: ldap://openldap.opencloud.svc.cluster.local:389
+          base_dn: dc=basicstack,dc=de
+          bind_dn: cn=admin,dc=basicstack,dc=de
+          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
+          user_base_dn: ou=users,dc=basicstack,dc=de
+          user_filter: (objectClass=inetOrgPerson)
+          user_object_class: inetOrgPerson
+          insecure: true
+
+    # Groups service - external LDAP
+    groups:
+      drivers:
+        ldap:
+          uri: ldap://openldap.opencloud.svc.cluster.local:389
+          base_dn: dc=basicstack,dc=de
+          bind_dn: cn=admin,dc=basicstack,dc=de
+          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
+          group_base_dn: ou=groups,dc=basicstack,dc=de
+          group_filter: (objectClass=groupOfNames)
+          group_object_class: groupOfNames
+          insecure: true
+
+    # IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
     idm:
       service_user_passwords:
         admin_password: ${OC_IDM_ADMIN_PASSWORD}