---
apiVersion: v1
kind: Namespace
metadata:
  name: opencloud
---
# OpenCloud Data Storage
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: opencloud-data
  namespace: opencloud
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: hcloud-volumes-encrypted
  resources:
    requests:
      storage: 100Gi
---
# OpenCloud Service
apiVersion: v1
kind: Service
metadata:
  name: opencloud
  namespace: opencloud
spec:
  type: ClusterIP
  selector:
    app: opencloud
  ports:
    - name: http
      port: 9200
      targetPort: 9200
      protocol: TCP
---
# OpenCloud Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opencloud
  namespace: opencloud
spec:
  replicas: 1
  selector:
    matchLabels:
      app: opencloud
  template:
    metadata:
      labels:
        app: opencloud
    spec:
      securityContext:
        fsGroup: 1000
        runAsUser: 1000
        runAsNonRoot: true
      initContainers:
      - name: init-config
        image: quay.io/opencloudeu/opencloud:7.2.0
        command:
          - sh
          - -c
          - |
            mkdir -p /var/lib/opencloud/config
            mkdir -p /var/lib/opencloud/data
            cd /var/lib/opencloud
            /usr/bin/opencloud init --insecure true || true
        env:
        - name: OPENCLOUD_BASE_DATA_PATH
          value: "/var/lib/opencloud"
        - name: OPENCLOUD_CONFIG_DIR
          value: "/var/lib/opencloud/config"
        - name: OPENCLOUD_JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-jwt-secret
              key: jwt-secret
        volumeMounts:
        - name: opencloud-data
          mountPath: /var/lib/opencloud
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
          runAsNonRoot: true
      containers:
      - name: opencloud
        image: quay.io/opencloudeu/opencloud:7.2.0
        env:
        # Basic configuration
        - name: OPENCLOUD_URL
          value: "https://opencloud.basicstack.de"
        - name: OPENCLOUD_LOG_LEVEL
          value: "info"
        - name: OPENCLOUD_LOG_PRETTY
          value: "false"
        - name: OPENCLOUD_LOG_COLOR
          value: "false"

        # Data paths
        - name: OPENCLOUD_BASE_DATA_PATH
          value: "/var/lib/opencloud"
        - name: OPENCLOUD_CONFIG_DIR
          value: "/var/lib/opencloud/config"

        # JWT Secret for token signing
        - name: OPENCLOUD_JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-jwt-secret
              key: jwt-secret
        - name: PROXY_JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-jwt-secret
              key: jwt-secret

        # OIDC Configuration
        - name: PROXY_OIDC_ISSUER
          value: "https://auth.basicstack.de"
        - name: OPENCLOUD_OIDC_ISSUER
          value: "https://auth.basicstack.de"
        - name: PROXY_OIDC_INSECURE
          value: "false"
        - name: OPENCLOUD_OIDC_INSECURE
          value: "false"
        - name: PROXY_USER_OIDC_CLAIM
          value: "preferred_username"
        - name: PROXY_USER_CS3_CLAIM
          value: "username"

        # OIDC Client Credentials
        - name: PROXY_OIDC_CLIENT_ID
          valueFrom:
            secretKeyRef:
              name: opencloud-oidc-secret
              key: oidc-client-id
        - name: PROXY_OIDC_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: opencloud-oidc-secret
              key: oidc-client-secret

        # SMTP Configuration
        - name: NOTIFICATIONS_SMTP_HOST
          value: "mail.basicstack.de"
        - name: NOTIFICATIONS_SMTP_PORT
          value: "465"
        - name: NOTIFICATIONS_SMTP_SENDER
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-username
        - name: NOTIFICATIONS_SMTP_USERNAME
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-username
        - name: NOTIFICATIONS_SMTP_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-password
        - name: NOTIFICATIONS_SMTP_INSECURE
          value: "false"
        - name: NOTIFICATIONS_SMTP_AUTHENTICATION
          value: "login"
        - name: NOTIFICATIONS_SMTP_ENCRYPTION
          value: "ssl"

        # Demo users disabled (use OIDC only)
        - name: IDM_CREATE_DEMO_USERS
          value: "false"
        - name: PROXY_ENABLE_BASIC_AUTH
          value: "false"

        # Admin user from OIDC
        - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
          value: "false"
        - name: GRAPH_USERNAME_MATCH
          value: "none"

        ports:
        - containerPort: 9200
          name: http
        volumeMounts:
        - name: opencloud-data
          mountPath: /var/lib/opencloud
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1000m"
        livenessProbe:
          httpGet:
            path: /status.php
            port: 9200
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 5
          failureThreshold: 5
        readinessProbe:
          httpGet:
            path: /status.php
            port: 9200
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
      volumes:
      - name: opencloud-data
        persistentVolumeClaim:
          claimName: opencloud-data
---
# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: opencloud
  namespace: opencloud
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: traefik
  tls:
  - hosts:
    - opencloud.basicstack.de
    secretName: opencloud-tls
  rules:
  - host: opencloud.basicstack.de
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: opencloud
            port:
              number: 9200