0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-11 21:26:44 +00:00

Files

T

kevinveenbirkenbach c3e003301d Merge branch 'feature/designer' into feature/store-i18n

# Conflicts:
#	roles/web-app-mattermost/templates/env.j2
#	roles/web-app-mattermost/vars/main.yml
#	roles/web-app-odoo/meta/services.yml
#	roles/web-app-odoo/tasks/01_manager_ops.yml
#	roles/web-app-opencloud/vars/main.yml

2026-10-08 02:42:35 +02:00

2.8 KiB

Raw Blame History

OpenCloud

Description

OpenCloud is a sovereign self-hosted file sync, share, and collaboration platform maintained by the Heinlein Group. It is a fork of the OpenCloud Infinite Scale codebase and is published as the opencloudeu/opencloud container image.

Overview

This role deploys OpenCloud using Docker Compose in single-binary mode and exposes it under open.cloud.{{ DOMAIN_PRIMARY }} through the central reverse proxy. It wires the deployment to the shared Keycloak realm via OIDC, sources users and groups from the central svc-db-openldap directory, and runs side by side with web-app-nextcloud so both file platforms can coexist on the same host. For identity wiring details see IAM.md and LDAP.md.

Features

Sovereign File Sync and Share: Self-host file sync, shares, and collaborative spaces under your own domain.
Single Sign-On: Users authenticate once via Keycloak and reuse the session across the platform.
Central User Directory: Users and groups are read from a shared OpenLDAP backend, so accounts stay consistent across apps.
Auto-Provisioning: New OIDC users are created on first login with username equal to the LDAP uid, and group claims drive role assignment.
OpenTalk Cross-Launch: Start a video meeting in OpenTalk from a file context without re-authenticating when web-app-opentalk is deployed alongside.
Coexists with Nextcloud: Runs in parallel with web-app-nextcloud on a distinct canonical hostname.

Developer Notes

See IAM.md for OIDC discovery and verification commands, and LDAP.md for the directory binding and schema mapping. Open follow-up items are tracked in TODO.md.

Further Resources

Persona contract opt-outs

The shared biber and administrator persona helpers are declared blocked in templates/playwright.env.j2. OpenCloud Web answers Playwright's headless Chromium user agent with a "browser not supported" splash unless forceAllowOldBrowser is seeded into localStorage before the first navigation, and its OIDC callback runs through OpenCloud's own /oidc-callback → /web-oidc-callback routes instead of the oauth2-proxy pattern the shared helper detects. Both personas' Keycloak round trip is covered by files/playwright/test-sso-login.js, which does that priming in files/playwright/_shared.js.

2.8 KiB Raw Blame History