basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/opencloud/README.md
CTO Agent 0e3f27610e Deploy OpenCloud (Nextcloud 29) with OIDC and encrypted storage 
- Created opencloud namespace with Nextcloud 29, PostgreSQL 16, and Redis 7
- Configured Pocket ID OIDC integration with opencloud_admins group
- Added andreas.leinen@basicstack.de to opencloud_admins group
- Used encrypted hcloud volumes for persistent storage (50Gi data, 10Gi database)
- Configured SMTP with mail.basicstack.de for email notifications
- Set up DNS A record for opencloud.basicstack.de
- Deployed with TLS certificate from Let's Encrypt
- Created backup CronJob configuration (requires S3 credentials to activate)

All credentials stored as SealedSecrets for security.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-04 18:27:12 +00:00

2.2 KiB
Raw Blame History

OpenCloud (Nextcloud) Deployment

OpenCloud is a Nextcloud-based cloud collaboration platform deployed at https://opencloud.basicstack.de

Components

  • Nextcloud 29: Main application (Apache-based)
  • PostgreSQL 16: Database backend
  • Redis 7: Caching layer

Authentication

  • Pocket ID OIDC Integration

Storage

  • Database: 10Gi encrypted hcloud volume
  • Nextcloud Data: 50Gi encrypted hcloud volume

SMTP Configuration

  • Server: mail.basicstack.de:465 (SSL)
  • Account: opencloud@basicstack.de
  • Credentials stored in opencloud-smtp-secret (SealedSecret)

Backups

Daily backup configured to Hetzner S3 bucket at 2 AM using restic.

Note: Backup secret opencloud-backup-secret needs to be created with S3 credentials:

  • access-key: S3 access key
  • secret-key: S3 secret key
  • restic-password: Restic repository encryption password

Deployment Files

  • opencloud-deployment.yaml: Main application stack (namespace, PVCs, services, ingress)
  • opencloud-db-sealed.yaml: Database credentials
  • opencloud-admin-sealed.yaml: Nextcloud admin credentials
  • opencloud-oidc-sealed.yaml: Pocket ID OIDC credentials
  • opencloud-smtp-sealed.yaml: SMTP credentials
  • opencloud-backup.yaml: Daily backup CronJob (requires S3 credentials)

Post-Deployment Configuration

After deploying, configure OIDC in Nextcloud:

  1. Install the "OpenID Connect user backend" app
  2. Configure the provider:
    • Identifier: PocketID
    • Client ID: (from sealed secret)
    • Client Secret: (from sealed secret)
    • Discovery URL: https://auth.basicstack.de/.well-known/openid-configuration

Deployment Commands

# Apply all manifests
kubectl apply -f opencloud-deployment.yaml
kubectl apply -f opencloud-db-sealed.yaml
kubectl apply -f opencloud-admin-sealed.yaml
kubectl apply -f opencloud-oidc-sealed.yaml
kubectl apply -f opencloud-smtp-sealed.yaml

# Optional: Apply backup (requires S3 secret first)
# kubectl apply -f opencloud-backup.yaml

DNS

  • A record: opencloud.basicstack.de → 178.105.17.239
  • TLS certificate managed by cert-manager (Let's Encrypt)