Removed all Pocket ID OIDC environment variables. OpenCloud now uses
its internal IDP for authentication instead of external OIDC provider.
The frontend config.json now correctly points to the internal IDP:
- Authority: https://opencloud.basicstack.de (was: auth.basicstack.de)
- Client ID: web (internal IDP client)
This fixes the login redirect issue where users were being sent to
the login page but couldn't see the login form.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Enable internal IDP service (remove from OC_EXCLUDE_RUN_SERVICES)
- Enable demo users (IDM_CREATE_DEMO_USERS=true)
- Enable basic auth (PROXY_ENABLE_BASIC_AUTH=true)
- Remove opencloud init command (not needed with ConfigMap)
- Remove conflicting admin user overrides
OpenCloud now uses internal user management instead of external OIDC.
Demo users will be created on first startup (admin, einstein, marie).
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Created automated daily backup system using rclone and Kubernetes CronJob.
Features:
- Daily backups at 2 AM UTC
- 7-day retention policy
- Backs up data directory and configuration
- Uses Hetzner S3-compatible Object Storage
- Read-only access to OpenCloud volumes
Files:
- backup-cronjob.yaml: CronJob for automated backups
- BACKUP.md: Complete setup and restore documentation
Requires:
- Hetzner Object Storage bucket credentials (sealed secret)
- S3 access key/secret to be provided
Once credentials are configured, backups will run automatically.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Updated deployment manifest with all 50+ environment variables mapping
to sealed secrets, including service-specific overrides for each OpenCloud
microservice.
## Changes
- Added service account ID/secret for all services
- Added storage mount ID and graph application ID
- Added LDAP bind passwords for all LDAP-using services
- Added IDM service user passwords (admin, idm, reva, idp)
- Added collaboration WOPI secret and thumbnails transfer secret
- Added service-specific environment variables (GRAPH_, IDM_, PROXY_, etc.)
## Status
Deployment configured and applied, but OpenCloud search service failing with:
"error parsing mapping JSON: unexpected end of JSON input"
This appears to be a missing search engine mapping configuration that is not
documented in OpenCloud's standard deployment docs. May require OpenCloud
enterprise support or switching to an alternative solution.
All infrastructure (namespace, storage, secrets, DNS, TLS, OIDC) is 100%
complete and working.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Created namespace, PVC, secrets, and ingress for OpenCloud
- Pods crash-looping due to JWT configuration requirement
- OpenCloud requires init-generated config files, not just env vars
- Official Helm charts archived, production charts require subscription
- Pocket ID client and group ready for use
- DNS configured for opencloud.basicstack.de
Deployment incomplete - awaiting guidance on whether to:
1. Deep-dive into OpenCloud config file structure
2. Use archived community Helm charts (unstable)
3. Switch to alternative like Nextcloud/ownCloud
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Created opencloud namespace with Nextcloud 29, PostgreSQL 16, and Redis 7
- Configured Pocket ID OIDC integration with opencloud_admins group
- Added andreas.leinen@basicstack.de to opencloud_admins group
- Used encrypted hcloud volumes for persistent storage (50Gi data, 10Gi database)
- Configured SMTP with mail.basicstack.de for email notifications
- Set up DNS A record for opencloud.basicstack.de
- Deployed with TLS certificate from Let's Encrypt
- Created backup CronJob configuration (requires S3 credentials to activate)
All credentials stored as SealedSecrets for security.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
