basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/opencloud
History
CTO a71c5d9a63 fix(opencloud): reduce CPU request 250m→50m to free worker-2 slot for backup CronJob (DEV-594) 
Worker-2 CPU requests were pinned at 100% (2000m/2000m), leaving no room
for the daily opencloud-backup CronJob (needs 20m). Actual opencloud CPU
usage is ~3m — reserving 250m was 80x over actual. Reduce to 50m which is
still 15x headroom. Frees 200m on worker-2.

Backup CronJob is pinned to the opencloud node by RWO PVC + hard
podAffinity. Reducing opencloud's own CPU request is the cleanest
unblock — contained to the opencloud namespace, no cross-app blast
radius.

Related: DEV-593, DEV-464, DEV-481, DEV-514, DEV-582/584 (recurring
pattern of backup CronJob squeezed off worker-2).

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-10-11 01:11:29 +00:00
..
backup-cronjob.yaml fix(opencloud): shrink backup pod requests to fit worker-3 (DEV-555) 2026-08-30 10:26:13 +00:00
BACKUP.md Add OpenCloud backup configuration to Hetzner Object Storage 2026-07-04 20:43:40 +00:00
DEPLOYMENT_STATUS.md Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
IMPLEMENTATION_STATUS.md Add OpenCloud deployment (partial implementation) 2026-07-04 19:35:08 +00:00
OIDC_FIX_SUMMARY.md Fix OpenCloud authentication - Switch to Pocket ID OIDC only 2026-07-05 08:18:34 +00:00
OIDC_TROUBLESHOOTING.md Add comprehensive OIDC troubleshooting documentation 2026-07-05 09:11:50 +00:00
opencloud-config-sealed.yaml Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
opencloud-config-secrets-complete.yaml Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
opencloud-configmap.yaml Fix IDM LDAP port from 9125 to 9236 2026-07-05 20:49:14 +00:00
opencloud-deployment.yaml fix(opencloud): reduce CPU request 250m→50m to free worker-2 slot for backup CronJob (DEV-594) 2026-10-11 01:11:29 +00:00
opencloud-jwt-sealed.yaml OpenCloud deployment attempt - blocked on configuration complexity 2026-07-04 18:59:33 +00:00
opencloud-oidc-sealed.yaml OpenCloud deployment attempt - blocked on configuration complexity 2026-07-04 18:59:33 +00:00
opencloud-smtp-sealed.yaml OpenCloud deployment attempt - blocked on configuration complexity 2026-07-04 18:59:33 +00:00
POCKET_ID_OIDC_SETUP.md docs: Add comprehensive Pocket ID OIDC client setup documentation 2026-07-11 12:03:44 +00:00
README.md Add OpenCloud deployment (partial implementation) 2026-07-04 19:35:08 +00:00
seal-config-secrets.sh Add OpenCloud deployment (partial implementation) 2026-07-04 19:35:08 +00:00
tika-deployment.yaml Add OpenCloud v7.2.0 deployment to Kubernetes cluster 2026-07-04 20:33:12 +00:00

README.md

OpenCloud Deployment

Status: In Progress - Configuration Initialization Needed

Overview

Deployment of OpenCloud v7.2.0, a modern Go-based file sharing platform, configured with Pocket ID OIDC authentication.

Configuration Approach

OpenCloud uses a cloud-native configuration system (12-Factor App principles):

  1. Base configuration in /etc/opencloud/opencloud.yaml (from ConfigMap)
  2. Secrets injected via environment variables (highest precedence)
  3. All sensitive credentials stored as SealedSecrets

Reference: https://docs.opencloud.eu/docs/next/dev/server/configuration/config-system/

Deployed Components

  • ✓ Namespace: opencloud
  • ✓ PVC: 100Gi encrypted hcloud volume
  • ✓ ConfigMap: Base opencloud.yaml configuration
  • ✓ SealedSecrets: OIDC, SMTP, JWT, and config secrets
  • ✓ Ingress: opencloud.basicstack.de with TLS
  • ✓ Service and Deployment manifests

Pocket ID Integration

Files

  • opencloud-deployment.yaml - Main Kubernetes deployment
  • opencloud-configmap.yaml - Base configuration file
  • opencloud-config-sealed.yaml - ⚠️ NEEDS SEALING - Core secrets (machine auth, transfer secret, etc.)
  • opencloud-oidc-sealed.yaml - OIDC credentials (sealed)
  • opencloud-smtp-sealed.yaml - SMTP credentials (sealed)
  • opencloud-jwt-sealed.yaml - JWT token secret (sealed)
  • seal-config-secrets.sh - Helper script to seal config secrets

Next Steps

  1. Seal the config secrets:

    cd apps/opencloud
bash seal-config-secrets.sh

  2. Apply all manifests:

    kubectl apply -f opencloud-configmap.yaml
kubectl apply -f opencloud-config-sealed.yaml  # After sealing!
kubectl apply -f opencloud-oidc-sealed.yaml
kubectl apply -f opencloud-smtp-sealed.yaml
kubectl apply -f opencloud-jwt-sealed.yaml
kubectl apply -f opencloud-deployment.yaml

  3. Verify deployment:

    kubectl get pods -n opencloud
kubectl logs -n opencloud deployment/opencloud

  4. Test login:

TODO

  • Seal opencloud-config-secrets
  • Configure daily backup to Hetzner bucket
  • Test OIDC authentication
  • Test file upload/download
  • Test SMTP notifications