diff --git a/apps/opencloud/README.md b/apps/opencloud/README.md
new file mode 100644
index 0000000..7d68903
--- /dev/null
+++ b/apps/opencloud/README.md
@@ -0,0 +1,53 @@
+# OpenCloud Deployment - INCOMPLETE
+
+**Status:** Blocked - Configuration complexity issues
+
+## Overview
+
+Attempted deployment of OpenCloud (github.com/opencloud-eu/opencloud) v7.2.0, a modern Go-based file sharing platform.
+
+## What's Deployed
+
+- ✓ Namespace: `opencloud`
+- ✓ PVC: 100Gi encrypted hcloud volume (bound)
+- ✓ Sealed Secrets: OIDC, SMTP, JWT credentials
+- ✓ Ingress: opencloud.basicstack.de with TLS
+- ✓ Service and Deployment manifests
+- ✗ Pods: Crash-looping due to configuration issues
+
+## Configuration Challenge
+
+OpenCloud requires proper initialization with `opencloud init` to generate configuration files. Environment variable configuration alone is insufficient for the JWT secret and other core settings.
+
+Error: `The jwt_secret has not been set properly in your config for opencloud`
+
+## Official Helm Charts Status
+
+The official Helm charts repository (github.com/opencloud-eu/helm) has been **archived** due to:
+- "High amount of AI generated contributions and poor maintenance"
+- Production-ready charts now require a business subscription from OpenCloud GmbH
+
+Community charts are marked as:
+- Version 0.x.x (unstable)
+- Not officially supported
+- "Use at your own risk"
+
+## Pocket ID Integration (Ready)
+
+- Client ID: `2f3c0cea-697f-4dbc-9573-6f6e8adfd4b0`
+- Group: `opencloud_admins`
+- User: andreas.leinen@basicstack.de
+
+## Alternative Options
+
+1. **Nextcloud** - Previously deployed successfully with full OIDC integration
+2. **ownCloud** - Similar features, better documentation
+3. **FileBrowser** - Simpler alternative
+4. **OpenCloud Enterprise** - Contact sales@opencloud.eu for production Helm charts
+
+## Files
+
+- `opencloud-deployment.yaml` - Kubernetes manifests (incomplete)
+- `opencloud-oidc-sealed.yaml` - OIDC credentials
+- `opencloud-smtp-sealed.yaml` - SMTP credentials  
+- `opencloud-jwt-sealed.yaml` - JWT secret
diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
new file mode 100644
index 0000000..a7d24f2
--- /dev/null
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -0,0 +1,239 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: opencloud
+---
+# OpenCloud Data Storage
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: opencloud-data
+  namespace: opencloud
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: hcloud-volumes-encrypted
+  resources:
+    requests:
+      storage: 100Gi
+---
+# OpenCloud Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: opencloud
+  namespace: opencloud
+spec:
+  type: ClusterIP
+  selector:
+    app: opencloud
+  ports:
+    - name: http
+      port: 9200
+      targetPort: 9200
+      protocol: TCP
+---
+# OpenCloud Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: opencloud
+  namespace: opencloud
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: opencloud
+  template:
+    metadata:
+      labels:
+        app: opencloud
+    spec:
+      securityContext:
+        fsGroup: 1000
+        runAsUser: 1000
+        runAsNonRoot: true
+      initContainers:
+      - name: init-config
+        image: quay.io/opencloudeu/opencloud:7.2.0
+        command:
+          - sh
+          - -c
+          - |
+            mkdir -p /var/lib/opencloud/config
+            mkdir -p /var/lib/opencloud/data
+            cd /var/lib/opencloud
+            /usr/bin/opencloud init --insecure true || true
+        env:
+        - name: OPENCLOUD_BASE_DATA_PATH
+          value: "/var/lib/opencloud"
+        - name: OPENCLOUD_CONFIG_DIR
+          value: "/var/lib/opencloud/config"
+        - name: OPENCLOUD_JWT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-jwt-secret
+              key: jwt-secret
+        volumeMounts:
+        - name: opencloud-data
+          mountPath: /var/lib/opencloud
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          runAsNonRoot: true
+      containers:
+      - name: opencloud
+        image: quay.io/opencloudeu/opencloud:7.2.0
+        env:
+        # Basic configuration
+        - name: OPENCLOUD_URL
+          value: "https://opencloud.basicstack.de"
+        - name: OPENCLOUD_LOG_LEVEL
+          value: "info"
+        - name: OPENCLOUD_LOG_PRETTY
+          value: "false"
+        - name: OPENCLOUD_LOG_COLOR
+          value: "false"
+
+        # Data paths
+        - name: OPENCLOUD_BASE_DATA_PATH
+          value: "/var/lib/opencloud"
+        - name: OPENCLOUD_CONFIG_DIR
+          value: "/var/lib/opencloud/config"
+
+        # JWT Secret for token signing
+        - name: OPENCLOUD_JWT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-jwt-secret
+              key: jwt-secret
+        - name: PROXY_JWT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-jwt-secret
+              key: jwt-secret
+
+        # OIDC Configuration
+        - name: PROXY_OIDC_ISSUER
+          value: "https://auth.basicstack.de"
+        - name: OPENCLOUD_OIDC_ISSUER
+          value: "https://auth.basicstack.de"
+        - name: PROXY_OIDC_INSECURE
+          value: "false"
+        - name: OPENCLOUD_OIDC_INSECURE
+          value: "false"
+        - name: PROXY_USER_OIDC_CLAIM
+          value: "preferred_username"
+        - name: PROXY_USER_CS3_CLAIM
+          value: "username"
+
+        # OIDC Client Credentials
+        - name: PROXY_OIDC_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-oidc-secret
+              key: oidc-client-id
+        - name: PROXY_OIDC_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-oidc-secret
+              key: oidc-client-secret
+
+        # SMTP Configuration
+        - name: NOTIFICATIONS_SMTP_HOST
+          value: "mail.basicstack.de"
+        - name: NOTIFICATIONS_SMTP_PORT
+          value: "465"
+        - name: NOTIFICATIONS_SMTP_SENDER
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-smtp-secret
+              key: smtp-username
+        - name: NOTIFICATIONS_SMTP_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-smtp-secret
+              key: smtp-username
+        - name: NOTIFICATIONS_SMTP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-smtp-secret
+              key: smtp-password
+        - name: NOTIFICATIONS_SMTP_INSECURE
+          value: "false"
+        - name: NOTIFICATIONS_SMTP_AUTHENTICATION
+          value: "login"
+        - name: NOTIFICATIONS_SMTP_ENCRYPTION
+          value: "ssl"
+
+        # Demo users disabled (use OIDC only)
+        - name: IDM_CREATE_DEMO_USERS
+          value: "false"
+        - name: PROXY_ENABLE_BASIC_AUTH
+          value: "false"
+
+        # Admin user from OIDC
+        - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
+          value: "false"
+        - name: GRAPH_USERNAME_MATCH
+          value: "none"
+
+        ports:
+        - containerPort: 9200
+          name: http
+        volumeMounts:
+        - name: opencloud-data
+          mountPath: /var/lib/opencloud
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "250m"
+          limits:
+            memory: "2Gi"
+            cpu: "1000m"
+        livenessProbe:
+          httpGet:
+            path: /status.php
+            port: 9200
+          initialDelaySeconds: 60
+          periodSeconds: 30
+          timeoutSeconds: 5
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /status.php
+            port: 9200
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+      volumes:
+      - name: opencloud-data
+        persistentVolumeClaim:
+          claimName: opencloud-data
+---
+# Ingress
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: opencloud
+  namespace: opencloud
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - opencloud.basicstack.de
+    secretName: opencloud-tls
+  rules:
+  - host: opencloud.basicstack.de
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: opencloud
+            port:
+              number: 9200
diff --git a/apps/opencloud/opencloud-jwt-sealed.yaml b/apps/opencloud/opencloud-jwt-sealed.yaml
new file mode 100644
index 0000000..a460fff
--- /dev/null
+++ b/apps/opencloud/opencloud-jwt-sealed.yaml
@@ -0,0 +1,15 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: opencloud-jwt-secret
+  namespace: opencloud
+spec:
+  encryptedData:
+    jwt-secret: AgB80ygsfWK+rNHpD7sbqIPCPSlvPaUUv3Y+PWTOAp560BiCDtoMfyiTUYyDokiIqhJu+x02qWhHMdf3jvOQFHFJ6QmI7NB7aE6nqksEviqj3KjdznXQ84kop19kbDh/m/e85ob7N+0+U5FMNm4wCQMmZWRY1k1i1nxJd5OmMveuRHQeTuOGxtJfJ5oLZDS4Mw/llGxstvyB6BrORu3dotd53SZ56BISloRFfV47qPtGXdCajyAMFgZzjr/Rxo0ucnzseUs5B9z4wu5jAaUCVe4iIaP7XL2zFdEGsLx0GBj/4xvBCdFybebHm4oNZrgRexbfhZ4k5kO+bgfQgfzxbg/A33LVIdh8kDThzXTBJyd52KOjnGE0n/85pyeL7SFxpO+YJQkM4O8G8+b+HZmhDvEjzxFX8eu0KtkyrvFkhPNL48Zd1XcDTGnv5oVQONWq5UdMkeo0an3KzfZ8M8LdyT6Ma1jeL5VyRzk8bmjC1F5fcGNLVJiqubNIY+N4T+lrFeTIIEnQTLKMqjQViEKPJYNF678TrARHvI1h+KnQ3mM1GWmstiac4Cvyt7QIfxVh1VBg31tupPpn8z8cFMNikw9Yu4vU2dVu7GdT5sEc6LrkEQZ9RCIXDIepzTPmTk2rTn81gsKw4V1LzY26nVz0Xy1huG/xDbsWNd4Lkt6ZOKC8LKekHsnqWNSPAyCBArtBVGKoKmGn/A/v0WURbg+m13AgtpIFYo0TIUpED82SeZRFqe0iLBKI7wIjya5VFg==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: opencloud-jwt-secret
+      namespace: opencloud
+---
diff --git a/apps/opencloud/opencloud-oidc-sealed.yaml b/apps/opencloud/opencloud-oidc-sealed.yaml
new file mode 100644
index 0000000..3df3210
--- /dev/null
+++ b/apps/opencloud/opencloud-oidc-sealed.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: opencloud-oidc-secret
+  namespace: opencloud
+spec:
+  encryptedData:
+    oidc-client-id: AgCLD/CqtD3RL+lEWbUJRcpSD8y7LYIl8XD/7Ct9PaOVNALax5xmqGCMWmz3JCrsbejlvax4uDIUn42b2MGoMo0ULauheBp857ex7rraRsTJnsG4GIhgGr9+krDkR1ptdTq5H7ocOGon0WsGbZ82U9Ub+m13WNJmBXCGFkbFOTCR1+N9/Gc5UZsSPF99mUdfnfPsRt0n7TdHwZSGtWnxfqz35aTSvt9PZrC6fysoPLV/Diiz5Y+BR0R2UJWGAQaLezB1hTe+AqSNrDnjIT1cuyfS/xEBzOQp6U0pcnZaPLo2u2LbNv+m0aN67632y7nra1LbglDKnDJpnU3O2NVvZMtVL7O5BRuIk/WdyV4e6vxhPlyWIcwkBwKwdu4xa5wyOvf3w1X0W2mOMTmtGy6tvHFK37VuAOUknY+njnpAJQAzwC/VNUXOyyUBpbc32A75rSuTsEfvekNVKjH8XLkVOnvvPIUaZnDWeQ0V3Pm1l0DMpVyJdUJz9A+xc/rltcpKj//4QS3FojAlehkhHW1m7QONAqBOXs48SfGaCb57eZKHvHRPgNLRJq7f3Zt7DoTvJTZuNYiV6xyYqSqwf5w/UfyKRq9v7y6LCQpW0U9gCFySAnqeUNrdGPLScuCnR5c6rG7u5vartQhqGH5IBdmiUNZolLazrbqOoTEwNjQGhsUi8Rqg+Lwjz0EjHeWBdAAhRL+MKerWE5VtpjeFDT7ncZEziKabTqiy0MxuWq5Z9YAG1fH0YmA=
+    oidc-client-secret: AgCk1mdblRMrL3LCAB8nZHjuMktMOvLBkHpt+kQbJ6saGUcMuOeJz3RQ0i5t/0f9CeuL7bb8CSXvw4dSn2AzHoS0lHDC2QhwhVxD/LmiR8+7akOR9EdQTqg2s/NdUEGBpOdBn3V+eADgMaUT0Ho7IOO3OfqX0N4MhefzTdzyGh5ilMUgJzlWvaifjfC+CNAR6US6BwvtQgWzb2bql7qUCe4zVjf8nt9vbufTPf9mshVWhHHRMMQapa/APUWj2kRx23uegAZwmheLhXTtqwWXx+HtqRXqNXOcjaSFZzmX7Qw08KUBj96YBlym4b09WGiHYcmT2ZG+993J1qf+k3Yo55IJlXeY0PGiaeWkMvOC02kdeGylnuBEyMHQkx/WUG8HhcrF+odeSKCnKu0JvGc1jA5Mm9Wvvz0TYxQ7JsULZQK3fAgoeNWM9wAWYyIGsyfoEpy3tyAfvX1YHDFPWqJZ1nxFZ+pUtwU1z0M5FGRf5OAjzHV/Y/hNZsDTd00uO9YHlSwfvLnu518JNXixWnz1tpQngwKh4iBAgRLpVH9ncOe9WwF413EoV/aVtIZmx7fS0YQ33Clw+C02Ql6SmMiHzkOlOHzhPglhJbia5wwsG90JVmYJLHYND2swghPX7dLug5ZYGqYG82Wzi2gvExsWsIxogpJTsEs6qivIAjz+qd5lrwMpwY6A/ClkAe6akZVCm6n3FVaEd8b32OwxwQLyZChlAXWNhEyXm+l4Ts9oEuP1sw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: opencloud-oidc-secret
+      namespace: opencloud
+---
diff --git a/apps/opencloud/opencloud-smtp-sealed.yaml b/apps/opencloud/opencloud-smtp-sealed.yaml
new file mode 100644
index 0000000..7bd86c2
--- /dev/null
+++ b/apps/opencloud/opencloud-smtp-sealed.yaml
@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: opencloud-smtp-secret
+  namespace: opencloud
+spec:
+  encryptedData:
+    smtp-password: AgA9QxDLju4SpcndkNS0gRd+WMNti5xG25Wr/N71zd84DFF6XZmBdswfQ2ziIeAFOfdJ1UCiDgym0Zu63HFhZQtzxwtd5q4PlVT3b0nEu8cl8rFbGf29MEROd8i5dIgxsa85mZrkTFrTHuyEYm9beE8+CYufvyKMkFqJ3OkAI6A2/lBoi2y3dllRpVrCDdzBia/N+yfmOhkwUhyb3ZN/gqptM/fE/NzqXyCsuRwmeABKWB/2Dc/gck4zDPE52E25uTu2VBgMlQwQqtkTh405tPozs28subu0PJsXc7/QM0arTrUCwKLYfwtsyQfzPtUAmbTpcioYCNrL+zDl1wXtk+dfD9hVopH/hTPeTG4EWlc4sVh2GMnAbgL+mG5PTB6qBnyQh3piww57ZpTGWXvFxdfP2PpDrxhlcIIlGXda2eAWCBLheWQ2iBeXDvtqhZ+8zEkR78MHOLhaTmrSnjzoWV6BMJ2lfqVc0WSwpvV+0+1xxsvvMKHJ25SSaF7EOI+GhyQvruICHkdg5jfGtJ+Fg0pYtp5r8UeqFRsk2dBB7WgywM5fbl3ki3yAiEJygFZMzvknttdG/vXLMu1vbGjSadT9Stpy7EIzrnNS0iV2tO4Qdgt54pJKfTbNaL5l753odvXTq0Murw04OUPYWKeS4mBzCZkiHqUUz8z6tjRcUTMZCWF0Mqn/AjT1nFTWfLv6pAK1Hy9QI9RitI+lqkTOogTspNZ1tPn3z6yZaD+iaPtswYdv1hNBdX9/EjU7+CTEb1/q/hcqY9G5kSH31sXLeu4=
+    smtp-username: AgCaa5fp0H0Cj2RCcIEspQcif1KYNw4SZlY60cPhWb76uUiejD4Rc8+8JDr4t79I7nrcZcaPyWOKozsqzcup9WO1wgUXh7ZS8q/LQLXHJx5onAKpy+GWM81Z0hqoC8hV87nJi11FoHri2IEjGdmU9PLJ5lTal+cXa7137yEi5fvN3o+kHQ5R2py+IRmPsKemCQFQ09VSvuMVfEkPf08VnxqLZU9WFkPkUM9Nq6uVFIsrC4KezkNHBXzIJgIvaxgM3qDpW+A8x7mp32lGZpJW2Thd+0wFJLYnhOJ1PHTrFlx+AOLi0GJL/6IiFQT6B/mIUr9nW4N+okaSI70uZvDcgTRzKfC9DGtS8725MvX3gCh/y/lk+uuWFeom3xnrwjVpv+XnpiBQjhHuVA94YsQYOroskQtZb/+Wt7eQn2Vr7QhyK8ITLuXowc4dBS9zLpjC33rVMmzZ8AyodIxKB/q7zO9TH0grHQfES+UetzB1urvYHLzKsd/ppR+deoTXXKPgMX+AFUoKTGCqsvR4G+73A9voJ4oZRm02Y441+tnDAlJWj4RXKOKxQTqQpWnY56NMkdjK4bCe2LgecMa8VWad1L+ysN75+YKHzbjIj8cYXX+rFsX59Iuj4Wr9ccS5CyZvlsXY5URZv1gl6B4WPJX6LLbshGF5d8EQ3htKyQGznysZq0lky6DXw3aTpemU/hHLY7kPIKpPjxEf0VvD3Eg4/Jw+ApnhiAqIjw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: opencloud-smtp-secret
+      namespace: opencloud
+---