acfb8618c7
Removed all Pocket ID OIDC environment variables. OpenCloud now uses its internal IDP for authentication instead of external OIDC provider. The frontend config.json now correctly points to the internal IDP: - Authority: https://opencloud.basicstack.de (was: auth.basicstack.de) - Client ID: web (internal IDP client) This fixes the login redirect issue where users were being sent to the login page but couldn't see the login form. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
434 lines
13 KiB
YAML
434 lines
13 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: opencloud
|
|
---
|
|
# OpenCloud Data Storage
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: opencloud-data
|
|
namespace: opencloud
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: hcloud-volumes-encrypted
|
|
resources:
|
|
requests:
|
|
storage: 100Gi
|
|
---
|
|
# OpenCloud Service
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: opencloud
|
|
namespace: opencloud
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: opencloud
|
|
ports:
|
|
- name: http
|
|
port: 9200
|
|
targetPort: 9200
|
|
protocol: TCP
|
|
---
|
|
# OpenCloud Deployment
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: opencloud
|
|
namespace: opencloud
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: opencloud
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: opencloud
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 1000
|
|
runAsUser: 1000
|
|
runAsNonRoot: true
|
|
initContainers:
|
|
- name: init-dirs
|
|
image: opencloudeu/opencloud-rolling:7.2.0
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
mkdir -p /var/lib/opencloud/data
|
|
volumeMounts:
|
|
- name: opencloud-data
|
|
mountPath: /var/lib/opencloud
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
containers:
|
|
- name: opencloud
|
|
image: opencloudeu/opencloud-rolling:7.2.0
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- "opencloud server"
|
|
env:
|
|
# Basic configuration
|
|
- name: OC_URL
|
|
value: "https://opencloud.basicstack.de"
|
|
- name: OC_LOG_LEVEL
|
|
value: "info"
|
|
- name: OC_LOG_PRETTY
|
|
value: "false"
|
|
- name: OC_LOG_COLOR
|
|
value: "false"
|
|
- name: OC_INSECURE
|
|
value: "false"
|
|
- name: PROXY_TLS
|
|
value: "false"
|
|
|
|
# Exclude broken search service only (using internal IDP)
|
|
- name: OC_EXCLUDE_RUN_SERVICES
|
|
value: "search"
|
|
|
|
# Data paths
|
|
- name: OPENCLOUD_BASE_DATA_PATH
|
|
value: "/var/lib/opencloud"
|
|
- name: OPENCLOUD_CONFIG_DIR
|
|
value: "/etc/opencloud"
|
|
|
|
# Core secrets (token manager)
|
|
- name: OC_TOKEN_MANAGER_JWT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-jwt-secret
|
|
key: jwt-secret
|
|
- name: OC_MACHINE_AUTH_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: machine-auth-api-key
|
|
- name: OC_SYSTEM_USER_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: system-user-api-key
|
|
- name: OC_TRANSFER_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: transfer-secret
|
|
- name: OC_URL_SIGNING_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: url-signing-secret
|
|
- name: OC_SYSTEM_USER_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: system-user-id
|
|
- name: OC_ADMIN_USER_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: admin-user-id
|
|
|
|
# SMTP Configuration
|
|
- name: NOTIFICATIONS_SMTP_HOST
|
|
value: "mail.basicstack.de"
|
|
- name: NOTIFICATIONS_SMTP_PORT
|
|
value: "465"
|
|
- name: NOTIFICATIONS_SMTP_SENDER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-smtp-secret
|
|
key: smtp-username
|
|
- name: NOTIFICATIONS_SMTP_USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-smtp-secret
|
|
key: smtp-username
|
|
- name: NOTIFICATIONS_SMTP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-smtp-secret
|
|
key: smtp-password
|
|
- name: NOTIFICATIONS_SMTP_INSECURE
|
|
value: "false"
|
|
- name: NOTIFICATIONS_SMTP_AUTHENTICATION
|
|
value: "login"
|
|
- name: NOTIFICATIONS_SMTP_ENCRYPTION
|
|
value: "ssl"
|
|
|
|
# Service account (shared across all services)
|
|
- name: OC_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: OC_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
|
|
# Storage configuration
|
|
- name: OC_STORAGE_MOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: storage-mount-id
|
|
- name: OC_GRAPH_APPLICATION_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: graph-application-id
|
|
|
|
# LDAP bind passwords
|
|
- name: OC_GRAPH_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: graph-ldap-bind-password
|
|
- name: OC_IDP_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idp-ldap-bind-password
|
|
- name: OC_AUTH_BASIC_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: OC_USERS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: OC_GROUPS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
|
|
# IDM service user passwords
|
|
- name: OC_IDM_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-admin-password
|
|
- name: OC_IDM_IDM_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-idm-password
|
|
- name: OC_IDM_REVA_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-reva-password
|
|
- name: OC_IDM_IDP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-idp-password
|
|
|
|
# Other service secrets
|
|
- name: OC_COLLABORATION_WOPI_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: collaboration-wopi-secret
|
|
- name: OC_THUMBNAILS_TRANSFER_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: thumbnails-transfer-secret
|
|
|
|
# Service-specific environment variables (for direct override)
|
|
- name: GRAPH_APPLICATION_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: graph-application-id
|
|
- name: GRAPH_IDENTITY_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: graph-ldap-bind-password
|
|
- name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: GRAPH_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
- name: IDP_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idp-ldap-bind-password
|
|
- name: IDM_SERVICE_USER_PASSWORDS_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-admin-password
|
|
- name: IDM_SERVICE_USER_PASSWORDS_IDM_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-idm-password
|
|
- name: IDM_SERVICE_USER_PASSWORDS_REVA_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-reva-password
|
|
- name: IDM_SERVICE_USER_PASSWORDS_IDP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: idm-idp-password
|
|
- name: COLLABORATION_WOPI_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: collaboration-wopi-secret
|
|
- name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: PROXY_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
- name: STORAGE_USERS_MOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: storage-mount-id
|
|
- name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: STORAGE_USERS_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
- name: GATEWAY_STORAGE_REGISTRY_STORAGE_USERS_MOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: storage-mount-id
|
|
- name: AUTH_BASIC_AUTH_PROVIDERS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: USERS_DRIVERS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: GROUPS_DRIVERS_LDAP_BIND_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: ldap-bind-password
|
|
- name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-id
|
|
- name: OCM_SERVICE_ACCOUNT_SERVICE_ACCOUNT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: service-account-secret
|
|
- name: THUMBNAILS_THUMBNAIL_TRANSFER_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: opencloud-config-secrets
|
|
key: thumbnails-transfer-secret
|
|
|
|
# Enable internal authentication
|
|
- name: IDM_CREATE_DEMO_USERS
|
|
value: "true"
|
|
- name: PROXY_ENABLE_BASIC_AUTH
|
|
value: "true"
|
|
|
|
ports:
|
|
- containerPort: 9200
|
|
name: http
|
|
volumeMounts:
|
|
- name: opencloud-data
|
|
mountPath: /var/lib/opencloud
|
|
- name: opencloud-config
|
|
mountPath: /etc/opencloud
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "250m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "1000m"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 9200
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 9200
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
volumes:
|
|
- name: opencloud-data
|
|
persistentVolumeClaim:
|
|
claimName: opencloud-data
|
|
- name: opencloud-config
|
|
configMap:
|
|
name: opencloud-config
|
|
---
|
|
# Ingress
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: opencloud
|
|
namespace: opencloud
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- opencloud.basicstack.de
|
|
secretName: opencloud-tls
|
|
rules:
|
|
- host: opencloud.basicstack.de
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: opencloud
|
|
port:
|
|
number: 9200
|