# OpenCloud (Nextcloud) Deployment

OpenCloud is a Nextcloud-based cloud collaboration platform deployed at https://opencloud.basicstack.de

## Components

- **Nextcloud 29**: Main application (Apache-based)
- **PostgreSQL 16**: Database backend
- **Redis 7**: Caching layer

## Authentication

- **Pocket ID OIDC Integration**
  - Client ID: `2f3c0cea-697f-4dbc-9573-6f6e8adfd4b0`
  - Authorized Group: `opencloud_admins`
  - Users: andreas.leinen@basicstack.de

## Storage

- Database: 10Gi encrypted hcloud volume
- Nextcloud Data: 50Gi encrypted hcloud volume

## SMTP Configuration

- Server: mail.basicstack.de:465 (SSL)
- Account: opencloud@basicstack.de
- Credentials stored in `opencloud-smtp-secret` (SealedSecret)

## Backups

Daily backup configured to Hetzner S3 bucket at 2 AM using restic.

**Note**: Backup secret `opencloud-backup-secret` needs to be created with S3 credentials:
- `access-key`: S3 access key
- `secret-key`: S3 secret key  
- `restic-password`: Restic repository encryption password

## Deployment Files

- `opencloud-deployment.yaml`: Main application stack (namespace, PVCs, services, ingress)
- `opencloud-db-sealed.yaml`: Database credentials
- `opencloud-admin-sealed.yaml`: Nextcloud admin credentials
- `opencloud-oidc-sealed.yaml`: Pocket ID OIDC credentials
- `opencloud-smtp-sealed.yaml`: SMTP credentials
- `opencloud-backup.yaml`: Daily backup CronJob (requires S3 credentials)

## Post-Deployment Configuration

After deploying, configure OIDC in Nextcloud:

1. Install the "OpenID Connect user backend" app
2. Configure the provider:
   - Identifier: `PocketID`
   - Client ID: (from sealed secret)
   - Client Secret: (from sealed secret)
   - Discovery URL: `https://auth.basicstack.de/.well-known/openid-configuration`

## Deployment Commands

```bash
# Apply all manifests
kubectl apply -f opencloud-deployment.yaml
kubectl apply -f opencloud-db-sealed.yaml
kubectl apply -f opencloud-admin-sealed.yaml
kubectl apply -f opencloud-oidc-sealed.yaml
kubectl apply -f opencloud-smtp-sealed.yaml

# Optional: Apply backup (requires S3 secret first)
# kubectl apply -f opencloud-backup.yaml
```

## DNS

- A record: `opencloud.basicstack.de` → `178.105.17.239`
- TLS certificate managed by cert-manager (Let's Encrypt)