basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

chore(opencloud): Remove external OpenLDAP deployment #1

Merged
Andreas.Leinen.imicros merged 2 commits from chore/remove-openldap-from-opencloud into main 2026-08-01 08:18:59 +00:00
Conversation 0 Commits 2 Files changed 8 +21 -599
forgejoadmin commented 2026-08-01 08:16:46 +00:00
Owner
Copy link

Summary

Removes the external OpenLDAP deployment from the OpenCloud configuration, as OpenCloud has been migrated to use the built-in IDM service.

Changes

  • Remove openldap-deployment.yaml and related configuration files
  • Remove openldap-admin-sealed.yaml (admin credentials)
  • Remove ldap-init-structure.ldif (initialization script)
  • Remove opencloud-ldap-schema files (schema configuration)
  • Remove OPENLDAP_DEPLOYMENT.md documentation
  • Remove OPENLDAP_ADMIN_PASSWORD environment variable from OpenCloud deployment

Rationale

OpenCloud now uses its built-in IDM service which provides an internal LDAP server on localhost:9236 with base DN o=libregraph-idm. The external OpenLDAP server (openldap.opencloud.svc.cluster.local:389 with base DN dc=basicstack,dc=de) is no longer used.

Testing

This is a cleanup PR that removes unused infrastructure. The OpenCloud deployment has already been updated to use the built-in IDM service in previous commits.

Resolves: DEV-421

## Summary Removes the external OpenLDAP deployment from the OpenCloud configuration, as OpenCloud has been migrated to use the built-in IDM service. ## Changes - Remove `openldap-deployment.yaml` and related configuration files - Remove `openldap-admin-sealed.yaml` (admin credentials) - Remove `ldap-init-structure.ldif` (initialization script) - Remove `opencloud-ldap-schema` files (schema configuration) - Remove `OPENLDAP_DEPLOYMENT.md` documentation - Remove `OPENLDAP_ADMIN_PASSWORD` environment variable from OpenCloud deployment ## Rationale OpenCloud now uses its built-in IDM service which provides an internal LDAP server on `localhost:9236` with base DN `o=libregraph-idm`. The external OpenLDAP server (`openldap.opencloud.svc.cluster.local:389` with base DN `dc=basicstack,dc=de`) is no longer used. ## Testing This is a cleanup PR that removes unused infrastructure. The OpenCloud deployment has already been updated to use the built-in IDM service in previous commits. Resolves: DEV-421
forgejoadmin added 2 commits 2026-08-01 08:16:47 +00:00 
The pod was crash-looping because Stalwart's security configuration
blocks the kubelet's IP (10.244.4.1) from accessing the HTTP health
endpoints. The kubelet's health checks were failing, causing the
startup probe to fail after 6 attempts, leading to pod restarts.

Changed all three health probes (startup, liveness, readiness) from
httpGet to exec with curl localhost. This bypasses the IP blocking
since the health check runs from inside the container using localhost,
which is not subject to Stalwart's external IP blocking rules.

This fix is non-destructive to Stalwart's configuration and state.
The pod will restart once with the new probe configuration, but no
data or configuration will be lost.

Root cause: Stalwart logs showed "Blocked IP address (security.ip-blocked)
listenerId=http, remoteIp=10.244.4.1" followed by "Shutting down Stalwart
Server (server.shutdown) causedBy=SIGTERM" in a repeating pattern.

Fixes: DEV-420

Co-Authored-By: Paperclip <noreply@paperclip.ing>
OpenCloud has been migrated to use the built-in IDM service which
provides an internal LDAP server (localhost:9236). The external
OpenLDAP deployment is no longer needed.

Changes:
- Remove openldap-deployment.yaml and related configuration files
- Remove openldap-admin-sealed.yaml (admin credentials)
- Remove ldap-init-structure.ldif (initialization script)
- Remove opencloud-ldap-schema files (schema configuration)
- Remove OPENLDAP_DEPLOYMENT.md documentation
- Remove OPENLDAP_ADMIN_PASSWORD env var from OpenCloud deployment

The OpenCloud deployment now relies solely on the built-in IDM
service for user and group storage via its internal LDAP interface.

Resolves: DEV-421

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Andreas.Leinen.imicros merged commit 8bed4f003e into main 2026-08-01 08:18:59 +00:00
Andreas.Leinen.imicros deleted branch chore/remove-openldap-from-opencloud 2026-08-01 08:19:36 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: basicstack/stack.basicstack.de#1
No description provided.
Delete branch "chore/remove-openldap-from-opencloud"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?