basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/opencloud/IMPLEMENTATION_STATUS.md
CTO Agent 0a0148bd78 Add OpenCloud deployment (partial implementation) 
Infrastructure and secrets complete, needs configuration initialization.

Created:
- Complete Kubernetes manifests (deployment, service, ingress, PVC)
- SealedSecrets for OIDC, SMTP, JWT, and core configuration
- Base opencloud.yaml ConfigMap with bash substitution
- Pocket ID integration (client + opencloud_admins group)
- DNS configured (opencloud.basicstack.de)

Status: Blocked on OpenCloud initialization
- OpenCloud requires comprehensive config from 'opencloud init'
- Manual environment variable configuration insufficient
- Multiple interdependent service configurations needed
- See IMPLEMENTATION_STATUS.md for details and next steps

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-04 19:35:08 +00:00

5.1 KiB
Raw Permalink Blame History

OpenCloud Implementation Status

Date: 2026-07-04
Status: Blocked - Initialization Required

What We've Built

Infrastructure (✓ Complete)

  • Namespace: opencloud
  • PersistentVolumeClaim: 100Gi encrypted hcloud volume
  • Service: ClusterIP on port 9200
  • Ingress: opencloud.basicstack.de with TLS (cert-manager)
  • DNS: A record configured

Secrets (✓ Complete)

All credentials stored as SealedSecrets:

  • opencloud-oidc-secret - Pocket ID OIDC credentials
  • opencloud-smtp-secret - SMTP credentials for notifications
  • opencloud-jwt-secret - JWT token signing secret
  • opencloud-config-secrets - Core OpenCloud secrets (machine auth, transfer secret, etc.)

Pocket ID Integration (✓ Complete)

Configuration Progress (⚠️ Partial)

We've created:

  • Base opencloud.yaml ConfigMap with bash substitution for secrets
  • Deployment with environment variable overrides
  • Proper security contexts (runAsUser: 1000, fsGroup: 1000)

The Problem

OpenCloud requires a comprehensive initialization configuration generated by opencloud init. Manual configuration via environment variables is insufficient because:

  1. Complex Service Dependencies: OpenCloud consists of multiple microservices (IDM, Storage, Gateway, OCM, Graph, Proxy, etc.) that each require:

    • Service account IDs (UUIDs)
    • Service account secrets
    • Inter-service authentication credentials

  2. Initialization Cascade: Each configuration fix reveals new required settings:

    • JWT secret → Storage mount ID → IDM password → Service account ID → OCM config → ...

  3. Documentation Gap: The official documentation describes the config system but doesn't provide complete examples of all required fields for a minimal working deployment.

Solutions Considered

1. Manual Environment Variables (Current Approach - Incomplete)

Status: Attempted but insufficient
Blocker: Too many interdependent configuration items

2. Use opencloud init in Init Container

Status: Not yet implemented
Challenge: Need to:

  • Run opencloud init to generate complete config
  • Extract the generated opencloud.yaml
  • Merge it with our security secrets (from SealedSecrets)
  • Mount the final config

Implementation Approach:

initContainers:
- name: generate-config
  image: quay.io/opencloudeu/opencloud:7.2.0
  command: ["/bin/sh", "-c"]
  args:
    - |
      # Generate base config
      opencloud init --insecure true --force-overwrite
      
      # Apply secret overrides via sed/yq
      # (JWT, machine_auth, etc. from environment)
      
      # Copy to shared volume
      cp /etc/opencloud/*.yaml /config-out/
  volumeMounts:
    - name: config-volume
      mountPath: /config-out

3. Fork Official Helm Charts

Status: Not feasible
Reason: Official charts are archived, production versions require business subscription

4. Switch to Alternative (Not Chosen)

User explicitly wants OpenCloud, not Nextcloud or ownCloud

Recommended Next Steps

  1. Complete Configuration Initialization:

    # Run opencloud init locally to generate complete config
docker run --rm \
  -v ./config:/etc/opencloud \
  quay.io/opencloudeu/opencloud:7.2.0 \
  opencloud init --insecure true

# Review generated opencloud.yaml
# Extract all required configuration keys
# Add them to our ConfigMap with bash substitution for secrets

  2. Update ConfigMap with complete configuration structure from opencloud init output

  3. Test Deployment with complete configuration

  4. Configure Backup to Hetzner bucket (once deployment is stable)

Current Errors

Latest pod error:

The service account id has not been configured for ocm. 
Make sure your /etc/opencloud config contains the proper values 
(e.g. by using 'opencloud init --diff' and applying the patch 
or setting a value manually in the config/corresponding environment variable).

Previous errors (now resolved):

  • ✓ JWT secret not set
  • ✓ Storage users mount ID not configured
  • ✓ IDM service user password not set
  • ✓ Service account ID for storage-users not configured

Files Created

  • opencloud-deployment.yaml - Main Kubernetes deployment
  • opencloud-configmap.yaml - Base configuration with bash substitution
  • opencloud-config-sealed.yaml - Core secrets (sealed)
  • opencloud-oidc-sealed.yaml - OIDC credentials (sealed)
  • opencloud-smtp-sealed.yaml - SMTP credentials (sealed)
  • opencloud-jwt-sealed.yaml - JWT secret (sealed)
  • seal-config-secrets.sh - Helper script for sealing secrets
  • README.md - Deployment documentation
  • IMPLEMENTATION_STATUS.md - This file

References