Updated deployment manifest with all 50+ environment variables mapping
to sealed secrets, including service-specific overrides for each OpenCloud
microservice.
## Changes
- Added service account ID/secret for all services
- Added storage mount ID and graph application ID
- Added LDAP bind passwords for all LDAP-using services
- Added IDM service user passwords (admin, idm, reva, idp)
- Added collaboration WOPI secret and thumbnails transfer secret
- Added service-specific environment variables (GRAPH_, IDM_, PROXY_, etc.)
## Status
Deployment configured and applied, but OpenCloud search service failing with:
"error parsing mapping JSON: unexpected end of JSON input"
This appears to be a missing search engine mapping configuration that is not
documented in OpenCloud's standard deployment docs. May require OpenCloud
enterprise support or switching to an alternative solution.
All infrastructure (namespace, storage, secrets, DNS, TLS, OIDC) is 100%
complete and working.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Created namespace, PVC, secrets, and ingress for OpenCloud
- Pods crash-looping due to JWT configuration requirement
- OpenCloud requires init-generated config files, not just env vars
- Official Helm charts archived, production charts require subscription
- Pocket ID client and group ready for use
- DNS configured for opencloud.basicstack.de
Deployment incomplete - awaiting guidance on whether to:
1. Deep-dive into OpenCloud config file structure
2. Use archived community Helm charts (unstable)
3. Switch to alternative like Nextcloud/ownCloud
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Created opencloud namespace with Nextcloud 29, PostgreSQL 16, and Redis 7
- Configured Pocket ID OIDC integration with opencloud_admins group
- Added andreas.leinen@basicstack.de to opencloud_admins group
- Used encrypted hcloud volumes for persistent storage (50Gi data, 10Gi database)
- Configured SMTP with mail.basicstack.de for email notifications
- Set up DNS A record for opencloud.basicstack.de
- Deployed with TLS certificate from Let's Encrypt
- Created backup CronJob configuration (requires S3 credentials to activate)
All credentials stored as SealedSecrets for security.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Added Stakater Reloader to automatically restart Stalwart pods when
TLS certificates are renewed by cert-manager. This ensures seamless
certificate rotation without manual intervention.
Changes:
- Deploy Stakater Reloader in infrastructure/networking/
- Add Reloader annotation to Stalwart StatefulSet to watch stalwart-tls secret
- Document certificate renewal process and troubleshooting
The certificate is managed by cert-manager with Let's Encrypt and will
automatically renew 30 days before expiration (renewal date: 2026-08-20).
Reloader detects secret updates and triggers a rolling restart of the
Stalwart StatefulSet to load the new certificate.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Removed stalwart-config ConfigMap (config.toml not used in v0.16.11)
- All configuration is done via Stalwart API and stored in RocksDB
- Added TLS certificate mount from stalwart-tls secret
- Using stalwartlabs/stalwart:v0.16.11
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Fixed init container to set ownership to 2000:2000
- Stalwart container runs as user 2000 by default
- Resolves permission denied error during web UI setup
Refs: DEV-206
Co-Authored-By: Paperclip <noreply@paperclip.ing>
