basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/opencloud
History
CTO Agent acfb8618c7 Remove external OIDC configuration for internal auth 
Removed all Pocket ID OIDC environment variables. OpenCloud now uses
its internal IDP for authentication instead of external OIDC provider.

The frontend config.json now correctly points to the internal IDP:
- Authority: https://opencloud.basicstack.de (was: auth.basicstack.de)
- Client ID: web (internal IDP client)

This fixes the login redirect issue where users were being sent to
the login page but couldn't see the login form.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-07-04 21:05:59 +00:00
..
backup-cronjob.yaml Add OpenCloud backup configuration to Hetzner Object Storage 2026-07-04 20:43:40 +00:00
BACKUP.md Add OpenCloud backup configuration to Hetzner Object Storage 2026-07-04 20:43:40 +00:00
DEPLOYMENT_STATUS.md Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
IMPLEMENTATION_STATUS.md Add OpenCloud deployment (partial implementation) 2026-07-04 19:35:08 +00:00
init-job.yaml Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
opencloud-config-sealed.yaml Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
opencloud-config-secrets-complete.yaml Complete OpenCloud configuration initialization 2026-07-04 19:41:22 +00:00
opencloud-configmap.yaml Add OpenCloud v7.2.0 deployment to Kubernetes cluster 2026-07-04 20:33:12 +00:00
opencloud-deployment.yaml Remove external OIDC configuration for internal auth 2026-07-04 21:05:59 +00:00
opencloud-jwt-sealed.yaml OpenCloud deployment attempt - blocked on configuration complexity 2026-07-04 18:59:33 +00:00
opencloud-oidc-sealed.yaml OpenCloud deployment attempt - blocked on configuration complexity 2026-07-04 18:59:33 +00:00
opencloud-smtp-sealed.yaml OpenCloud deployment attempt - blocked on configuration complexity 2026-07-04 18:59:33 +00:00
README.md Add OpenCloud deployment (partial implementation) 2026-07-04 19:35:08 +00:00
seal-config-secrets.sh Add OpenCloud deployment (partial implementation) 2026-07-04 19:35:08 +00:00
tika-deployment.yaml Add OpenCloud v7.2.0 deployment to Kubernetes cluster 2026-07-04 20:33:12 +00:00

README.md

OpenCloud Deployment

Status: In Progress - Configuration Initialization Needed

Overview

Deployment of OpenCloud v7.2.0, a modern Go-based file sharing platform, configured with Pocket ID OIDC authentication.

Configuration Approach

OpenCloud uses a cloud-native configuration system (12-Factor App principles):

  1. Base configuration in /etc/opencloud/opencloud.yaml (from ConfigMap)
  2. Secrets injected via environment variables (highest precedence)
  3. All sensitive credentials stored as SealedSecrets

Reference: https://docs.opencloud.eu/docs/next/dev/server/configuration/config-system/

Deployed Components

  • ✓ Namespace: opencloud
  • ✓ PVC: 100Gi encrypted hcloud volume
  • ✓ ConfigMap: Base opencloud.yaml configuration
  • ✓ SealedSecrets: OIDC, SMTP, JWT, and config secrets
  • ✓ Ingress: opencloud.basicstack.de with TLS
  • ✓ Service and Deployment manifests

Pocket ID Integration

Files

  • opencloud-deployment.yaml - Main Kubernetes deployment
  • opencloud-configmap.yaml - Base configuration file
  • opencloud-config-sealed.yaml - ⚠️ NEEDS SEALING - Core secrets (machine auth, transfer secret, etc.)
  • opencloud-oidc-sealed.yaml - OIDC credentials (sealed)
  • opencloud-smtp-sealed.yaml - SMTP credentials (sealed)
  • opencloud-jwt-sealed.yaml - JWT token secret (sealed)
  • seal-config-secrets.sh - Helper script to seal config secrets

Next Steps

  1. Seal the config secrets:

    cd apps/opencloud
bash seal-config-secrets.sh

  2. Apply all manifests:

    kubectl apply -f opencloud-configmap.yaml
kubectl apply -f opencloud-config-sealed.yaml  # After sealing!
kubectl apply -f opencloud-oidc-sealed.yaml
kubectl apply -f opencloud-smtp-sealed.yaml
kubectl apply -f opencloud-jwt-sealed.yaml
kubectl apply -f opencloud-deployment.yaml

  3. Verify deployment:

    kubectl get pods -n opencloud
kubectl logs -n opencloud deployment/opencloud

  4. Test login:

TODO

  • Seal opencloud-config-secrets
  • Configure daily backup to Hetzner bucket
  • Test OIDC authentication
  • Test file upload/download
  • Test SMTP notifications