basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/opencloud
History
CTO (Paperclip Agent) ec3e9624b3 feat(velero): schedules + PVC exclude annotations (DEV-573) 
- velero/schedules/: cluster-all @ 03:00 (30d TTL, manifests only),
  per-namespace <ns>-manifests @ 03:15+n min (30 in-scope namespaces,
  30d TTL, no fs backup), and per-namespace <ns>-data @ 03:45+n min
  for the whitelist (pocket-id, vaultwarden, vikunja, passbolt;
  14d TTL, defaultVolumesToFsBackup=true).
- All schedules exclude velero, kube-system, kube-node-lease,
  kube-public so the Kopia password Secret never lands in S3.
- apps/app-velero-schedules.yaml: sibling Argo app syncing that
  directory into namespace velero with prune+selfHeal.
- opencloud, harbor(registry+trivy): pod-template annotation
  backup.velero.io/backup-volumes-excludes as a safety net so blob-
  heavy PVCs are never fs-backed-up even under a manual defaultVolumes
  run. nextcloud/monitoring workloads are not Argo-tracked yet — they
  were patched live in the same commit but need a follow-up to source-
  control them.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-09-12 17:35:49 +00:00
..
backup-cronjob.yaml fix(opencloud): shrink backup pod requests to fit worker-3 (DEV-555) 2026-08-30 10:26:13 +00:00
BACKUP.md Add OpenCloud backup configuration to Hetzner Object Storage 2026-07-04 20:43:40 +00:00
DEPLOYMENT_STATUS.md Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
IMPLEMENTATION_STATUS.md Add OpenCloud deployment (partial implementation) 2026-07-04 19:35:08 +00:00
OIDC_FIX_SUMMARY.md Fix OpenCloud authentication - Switch to Pocket ID OIDC only 2026-07-05 08:18:34 +00:00
OIDC_TROUBLESHOOTING.md Add comprehensive OIDC troubleshooting documentation 2026-07-05 09:11:50 +00:00
opencloud-config-sealed.yaml Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
opencloud-config-secrets-complete.yaml Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
opencloud-configmap.yaml Fix IDM LDAP port from 9125 to 9236 2026-07-05 20:49:14 +00:00
opencloud-deployment.yaml feat(velero): schedules + PVC exclude annotations (DEV-573) 2026-09-12 17:35:49 +00:00
opencloud-jwt-sealed.yaml OpenCloud deployment attempt - blocked on configuration complexity 2026-07-04 18:59:33 +00:00
opencloud-oidc-sealed.yaml OpenCloud deployment attempt - blocked on configuration complexity 2026-07-04 18:59:33 +00:00
opencloud-smtp-sealed.yaml OpenCloud deployment attempt - blocked on configuration complexity 2026-07-04 18:59:33 +00:00
POCKET_ID_OIDC_SETUP.md docs: Add comprehensive Pocket ID OIDC client setup documentation 2026-07-11 12:03:44 +00:00
README.md Add OpenCloud deployment (partial implementation) 2026-07-04 19:35:08 +00:00
seal-config-secrets.sh Add OpenCloud deployment (partial implementation) 2026-07-04 19:35:08 +00:00
tika-deployment.yaml Add OpenCloud v7.2.0 deployment to Kubernetes cluster 2026-07-04 20:33:12 +00:00

README.md

OpenCloud Deployment

Status: In Progress - Configuration Initialization Needed

Overview

Deployment of OpenCloud v7.2.0, a modern Go-based file sharing platform, configured with Pocket ID OIDC authentication.

Configuration Approach

OpenCloud uses a cloud-native configuration system (12-Factor App principles):

  1. Base configuration in /etc/opencloud/opencloud.yaml (from ConfigMap)
  2. Secrets injected via environment variables (highest precedence)
  3. All sensitive credentials stored as SealedSecrets

Reference: https://docs.opencloud.eu/docs/next/dev/server/configuration/config-system/

Deployed Components

  • ✓ Namespace: opencloud
  • ✓ PVC: 100Gi encrypted hcloud volume
  • ✓ ConfigMap: Base opencloud.yaml configuration
  • ✓ SealedSecrets: OIDC, SMTP, JWT, and config secrets
  • ✓ Ingress: opencloud.basicstack.de with TLS
  • ✓ Service and Deployment manifests

Pocket ID Integration

Files

  • opencloud-deployment.yaml - Main Kubernetes deployment
  • opencloud-configmap.yaml - Base configuration file
  • opencloud-config-sealed.yaml - ⚠️ NEEDS SEALING - Core secrets (machine auth, transfer secret, etc.)
  • opencloud-oidc-sealed.yaml - OIDC credentials (sealed)
  • opencloud-smtp-sealed.yaml - SMTP credentials (sealed)
  • opencloud-jwt-sealed.yaml - JWT token secret (sealed)
  • seal-config-secrets.sh - Helper script to seal config secrets

Next Steps

  1. Seal the config secrets:

    cd apps/opencloud
bash seal-config-secrets.sh

  2. Apply all manifests:

    kubectl apply -f opencloud-configmap.yaml
kubectl apply -f opencloud-config-sealed.yaml  # After sealing!
kubectl apply -f opencloud-oidc-sealed.yaml
kubectl apply -f opencloud-smtp-sealed.yaml
kubectl apply -f opencloud-jwt-sealed.yaml
kubectl apply -f opencloud-deployment.yaml

  3. Verify deployment:

    kubectl get pods -n opencloud
kubectl logs -n opencloud deployment/opencloud

  4. Test login:

TODO

  • Seal opencloud-config-secrets
  • Configure daily backup to Hetzner bucket
  • Test OIDC authentication
  • Test file upload/download
  • Test SMTP notifications