Skip to content

OpenCloud

Metadata

Field Value
Service OpenCloud
Purpose Parallel evaluation as a possible Nextcloud replacement
Criticality Tier 3 while under evaluation
Owner Homelab operator
Clusters local
Namespace opencloud
Exposure Internet through Traefik
Stateful Yes
Backup class None during evaluation
RPO / RTO No guarantee during evaluation
Last reviewed 2026-09-14

1. Service Overview

OpenCloud provides file storage, synchronization, sharing, and browser access. This instance exists to test those workflows before any decision about replacing Nextcloud. It has no dependency on Nextcloud and an OpenCloud outage does not affect the existing cloud.mutana.fr service.

Dependencies

Dependency Type Why it matters
Traefik Ingress TLS termination and public routing
local-path Storage Persistent OpenCloud configuration and file data
Embedded OpenCloud IdP Identity Admin and test-user authentication

2. Architecture Diagram

[Browser / sync client]
          |
          v
[Traefik: opencloud.mutana.fr]
          |
          v
[opencloud Service :9200]
          |
          v
[OpenCloud Deployment]
     |             |
     v             v
[config PVC]   [data PVC]

3. Deployment Specifications

Item Value
Source path opencloud/base, opencloud/overlays/local
Deployment model Kustomize plus Fleet
Namespace opencloud
Workload kind Single-replica Deployment with Recreate strategy
Chart or image version opencloudeu/opencloud:7.2.4
Config files opencloud.env, kustomization.yaml, workload manifests

Cluster mapping

Cluster Overlay path Notes
local opencloud/overlays/local Rancher management cluster

The multi-architecture image can run on amd64 or arm64. The pod is not pinned to a specific node; its dynamically provisioned RWO volumes determine placement after first scheduling.

Fleet enables Helm ownership adoption so a namespace or workload resources created through the documented direct Kustomize path can be imported into the local-opencloud release. The out-of-band Secret remains outside that release.

4. Configuration Guide

Environment variables

Variable Source Purpose Secret?
OC_URL opencloud-config Canonical public URL No
PROXY_HTTP_ADDR opencloud-config Listen on pod port 9200 No
PROXY_TLS opencloud-config Use HTTP behind Traefik No
IDM_CREATE_DEMO_USERS opencloud-config Keep public demo accounts disabled No
IDM_ADMIN_PASSWORD opencloud-secrets First-start admin bootstrap Yes

ConfigMaps

Resource Path Purpose
opencloud-config opencloud/overlays/local/opencloud.env Public URL, logging, language, password policy, and proxy settings

Secrets management

  • Secret name: opencloud-secrets.
  • Required key: IDM_ADMIN_PASSWORD.
  • Source of truth: created manually in Kubernetes and stored in the operator's password manager; Git and Fleet never manage its value.
  • Rotation: after initialization, change the admin password through OpenCloud user settings or CLI, then reconcile the operational credential record.
  • Loss: the PVC contains initialized identity state, so replacing the Secret alone does not reset an existing administrator password.

5. Access Protocols

Path URL or endpoint Audience Auth TLS terminates at
Internal http://opencloud.opencloud.svc.cluster.local:9200 Cluster workloads OpenCloud None
External https://opencloud.mutana.fr Operator and test users OpenCloud embedded IdP Traefik

Authelia is deliberately absent from the route because OpenCloud supplies its own authentication and non-browser synchronization clients need to reach it.

6. Operations and Observability

Healthy means the Deployment is available, both PVCs are Bound, the Service has an endpoint, and HTTPS reaches the OpenCloud login. Logs are available from deployment/opencloud. There is no workload-specific dashboard or alert yet. Common failures are a missing bootstrap Secret, volume permissions, an invalid canonical URL, and ingress or DNS mismatch.

7. Backup and Recovery Notes

No backup is configured during evaluation. The configuration and data PVCs must be captured together for a consistent recovery point. Do not place important data only in OpenCloud until a restore drill and backup policy are complete. See docs/runbooks/opencloud.md.

8. Release and Change Notes

  • Current deployed app version: 7.2.4 production release.
  • Current chart version: none; hand-authored Kustomize manifests.
  • Last significant change: enabled Fleet ownership adoption for resources from the initial direct Kustomize deployment on 2026-09-14.
  • Rollback: remove the OpenCloud workload and retain its PVCs, or reapply the last known-good image pin. It does not require a Nextcloud rollback.