Skip to content

Commit 3be3cf2

Browse files
layertwolayertwo
committed
feat: add ocis
1 parent c895679 commit 3be3cf2

File tree

7 files changed

+212
-0
lines changed

7 files changed

+212
-0
lines changed

‎clusters/home/apps/cloud/ocis/app/ingressroute.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
apiVersion: traefik.io/v1alpha1
3+
kind: IngressRoute
4+
metadata:
5+
name: ocis
6+
namespace: owncloud
7+
annotations:
8+
external-dns.alpha.kubernetes.io/enabled: "true"
9+
external-dns.alpha.kubernetes.io/hostname: "oc.layertwo.dev"
10+
external-dns.alpha.kubernetes.io/target: "proxy-external.layertwo.dev"
11+
cert-manager.io/cluster-issuer: letsencrypt-prod-dns
12+
kubernetes.io/ingress.class: external
13+
spec:
14+
entryPoints:
15+
- websecure
16+
routes:
17+
- match: Host(`oc.layertwo.dev`)
18+
kind: Rule
19+
services:
20+
- name: ocis
21+
port: 9200
22+
middlewares:
23+
- name: secure-headers
24+
namespace: traefik-external

‎clusters/home/apps/cloud/ocis/app/kustomization.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
resources:
5+
- release.yml
6+
- ingressroute.yml
7+
- secrets-ocis.sops.yml

‎clusters/home/apps/cloud/ocis/app/release.yml‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
---
2+
apiVersion: helm.toolkit.fluxcd.io/v2
3+
kind: HelmRelease
4+
metadata:
5+
name: ocis
6+
namespace: owncloud
7+
spec:
8+
interval: 30m
9+
chart:
10+
spec:
11+
chart: charts/ocis
12+
version: 0.7.0
13+
sourceRef:
14+
kind: GitRepository
15+
name: ocis
16+
namespace: flux-system
17+
interval: 12h
18+
install:
19+
remediation:
20+
retries: 3
21+
upgrade:
22+
cleanupOnFail: true
23+
remediation:
24+
retries: 3
25+
values:
26+
# oCIS configuration
27+
externalDomain: oc.layertwo.dev
28+
29+
features:
30+
externalUserManagement:
31+
enabled: true
32+
oidc:
33+
issuerURI: &oidc_isser https://authentik.layertwo.dev/application/o/owncloud/
34+
webClientID: owncloud
35+
userIDClaim: preferred_username
36+
userIDClaimAttributeMapping: username
37+
38+
# Image configuration
39+
image:
40+
repository: owncloud/ocis
41+
tag: 5.0.0
42+
pullPolicy: IfNotPresent
43+
44+
# Ingress configuration (disabled - using Traefik IngressRoute)
45+
ingress:
46+
enabled: false
47+
48+
# Service configuration
49+
services:
50+
proxy:
51+
service:
52+
type: ClusterIP
53+
port: 9200
54+
55+
# Environment variables
56+
env:
57+
OCIS_INSECURE: "false"
58+
OCIS_LOG_LEVEL: "info"
59+
OCIS_LOG_COLOR: "false"
60+
OCIS_LOG_PRETTY: "false"
61+
62+
# Admin user configuration
63+
OCIS_ADMIN_USER_ID: "admin"
64+
IDM_ADMIN_PASSWORD:
65+
valueFrom:
66+
secretKeyRef:
67+
name: ocis-secrets
68+
key: admin-password
69+
70+
# JWT secret
71+
OCIS_JWT_SECRET:
72+
valueFrom:
73+
secretKeyRef:
74+
name: ocis-secrets
75+
key: jwt-secret
76+
77+
# Transfer secret
78+
OCIS_TRANSFER_SECRET:
79+
valueFrom:
80+
secretKeyRef:
81+
name: ocis-secrets
82+
key: transfer-secret
83+
84+
# Machine auth API key
85+
OCIS_MACHINE_AUTH_API_KEY:
86+
valueFrom:
87+
secretKeyRef:
88+
name: ocis-secrets
89+
key: machine-auth-api-key
90+
91+
# OIDC Configuration
92+
PROXY_OIDC_ISSUER: *oidc_isser
93+
WEB_OIDC_CLIENT_ID: "owncloud"
94+
WEB_OIDC_CLIENT_SECRET:
95+
valueFrom:
96+
secretKeyRef:
97+
name: ocis-secrets
98+
key: oidc-client-secret
99+
PROXY_OIDC_INSECURE: "false"
100+
OCIS_OIDC_ISSUER: *oidc_isser
101+
102+
# User management
103+
PROXY_USER_OIDC_CLAIM: "preferred_username"
104+
PROXY_USER_CS3_CLAIM: "username"
105+
106+
# Auto provision users from OIDC
107+
PROXY_AUTOPROVISION_ACCOUNTS: "true"
108+
PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"
109+
110+
# Persistence
111+
persistence:
112+
enabled: true
113+
storageClassName: truenas-iscsi
114+
size: 100Gi
115+
116+
# Resources
117+
resources:
118+
requests:
119+
cpu: 500m
120+
memory: 1Gi
121+
limits:
122+
cpu: 2000m
123+
memory: 4Gi
124+
125+
# Security context
126+
securityContext:
127+
runAsUser: 1000
128+
runAsGroup: 1000
129+
fsGroup: 1000

‎clusters/home/apps/cloud/ocis/app/secrets-ocis.sops.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: ocis-secrets
6+
namespace: owncloud
7+
type: Opaque
8+
stringData:
9+
# IMPORTANT: Replace these with actual secure values and encrypt with SOPS
10+
# Run: sops -e -i clusters/home/apps/owncloud/app/secrets-ocis.sops.yml
11+
12+
# Admin password for the default admin user
13+
admin-password: changeme-admin-password
14+
15+
# JWT secret for token signing (generate with: openssl rand -base64 32)
16+
jwt-secret: changeme-jwt-secret-generate-random-32-bytes
17+
18+
# Transfer secret for file transfers (generate with: openssl rand -base64 32)
19+
transfer-secret: changeme-transfer-secret-generate-random-32-bytes
20+
21+
# Machine auth API key (generate with: openssl rand -base64 32)
22+
machine-auth-api-key: changeme-machine-auth-api-key-generate-random-32-bytes
23+
24+
# OIDC client secret from Authentik
25+
oidc-client-secret: changeme-get-from-authentik-provider

‎clusters/home/apps/cloud/ocis/kustomization.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1beta1
3+
kind: Kustomization
4+
resources:
5+
- namespace.yml
6+
- app

‎clusters/home/apps/cloud/ocis/namespace.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: owncloud

‎clusters/home/charts/git/ocis.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
apiVersion: source.toolkit.fluxcd.io/v1
3+
kind: GitRepository
4+
metadata:
5+
name: ocis
6+
namespace: flux-system
7+
spec:
8+
interval: 30m
9+
url: https://github.com/owncloud/ocis-charts.git
10+
ref:
11+
branch: main
12+
ignore: |-
13+
# exclude all
14+
/*
15+
# include charts directory
16+
!/charts/

0 commit comments

Comments
 (0)