docker-compose.yml

---
networks:
  opencloud-net:

services:
  opencloud:
    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-latest}
    networks:
      opencloud-net:
    ports:
      - "9200:9200"
    entrypoint:
      - /bin/sh
    command: ["-c", "opencloud init || true; opencloud server"]
    environment:
      OC_ADD_RUN_SERVICES: ${START_ADDITIONAL_SERVICES}
      OC_URL: https://${OC_DOMAIN:-cloud.opencloud.test}
      OC_LOG_LEVEL: ${LOG_LEVEL:-info}
      OC_LOG_COLOR: "${LOG_PRETTY:-false}"
      OC_LOG_PRETTY: "${LOG_PRETTY:-false}"
      # do not use SSL between Traefik and OpenCloud
      PROXY_TLS: "false"
      # make the REVA gateway accessible to the app drivers
      GATEWAY_GRPC_ADDR: 0.0.0.0:9142
      # INSECURE: needed if OpenCloud / Traefik is using self generated certificates
      OC_INSECURE: "${INSECURE:-false}"
      # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
      PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
      STORAGE_USERS_POSIX_WATCH_FS: true
      # admin user password
      IDM_ADMIN_PASSWORD: "${ADMIN_PASSWORD:-admin}" # this overrides the admin password from the configuration file
      # demo users
      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
      # email server (if configured)
      NOTIFICATIONS_SMTP_HOST: "${SMTP_HOST}"
      NOTIFICATIONS_SMTP_PORT: "${SMTP_PORT}"
      NOTIFICATIONS_SMTP_SENDER: "${SMTP_SENDER:-OpenCloud notifications <notifications@${OC_DOMAIN:-cloud.opencloud.test}>}"
      NOTIFICATIONS_SMTP_USERNAME: "${SMTP_USERNAME}"
      NOTIFICATIONS_SMTP_PASSWORD: "${SMTP_PASSWORD}"
      NOTIFICATIONS_SMTP_INSECURE: "${SMTP_INSECURE}"
      NOTIFICATIONS_SMTP_AUTHENTICATION: "${SMTP_AUTHENTICATION}"
      NOTIFICATIONS_SMTP_ENCRYPTION: "${SMTP_TRANSPORT_ENCRYPTION:-none}"
      FRONTEND_ARCHIVER_MAX_SIZE: "10000000000"
      # make the registry available to the app provider containers
      MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233
      NATS_NATS_HOST: 0.0.0.0
      NATS_NATS_PORT: 9233
      # these three vars are needed to the csp config file to include the web office apps and the importer
      COLLABORA_DOMAIN: ${COLLABORA_DOMAIN:-collabora.opencloud.test}
      COMPANION_DOMAIN: ${COMPANION_DOMAIN:-companion.opencloud.test}
      # enable to allow using the banned passwords list
      OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
      ##### THESE VARIABLES ARE IMPORTANT TO GET AUTHENTIK WORKING!!! ########
      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml 
      PROXY_USER_OIDC_CLAIM: "preferred_username"
      PROXY_USER_CS3_CLAIM: "username"
      PROXY_AUTOPROVISION_ACCOUNTS: "true"
      PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"
      PROXY_ACCESS_TOKEN_VERIFY_METHOD: "none"
      PROXY_OIDC_REWRITE_WELLKNOWN: "true"
      PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM: "groups"
      PROXY_AUTOPROVISION_CLAIM_USERNAME: "preferred_username"
      OC_OIDC_ISSUER: "https://authentik.example.tld/application/o/opencloud/"
      WEB_OIDC_CLIENT_ID: OpenCloudDesktop
      OC_ADMIN_USER_ID: "" # passed actual empty string, this isn't a stand-in for something else I passed
      OC_EXCLUDE_RUN_SERVICES: idp
      WEB_OIDC_SCOPE: "openid profile email"
      GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
      GRAPH_USERNAME_MATCH: "none"
      SETTINGS_SETUP_DEFAULT_ASSIGNMENTS: "false"
      OC_LDAP_URI: ldaps://ldap-server:1636
      OC_LDAP_SERVER_WRITE_ENABLED: "true"
      FRONTEND_READONLY_USER_ATTRIBUTES: "user.onPremisesSamAccountName,user.displayName,user.mail,user.passwordProfile,user.memberOf"
      OC_LDAP_INSECURE: "true"
      OC_LDAP_BIND_DN: "cn=admin,dc=opencloud,dc=eu"
      OC_LDAP_BIND_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin}
      OC_LDAP_USER_BASE_DN: "ou=users,dc=opencloud,dc=eu"
      OC_LDAP_DISABLE_USER_MECHANISM: "none"
      OC_LDAP_GROUP_BASE_DN: "ou=groups,dc=opencloud,dc=eu"
      ####### END AUTHENTIK-IMPORTANT VARIABLE BLOCK ##########


    volumes:
      - ./config/opencloud/app-registry.yaml:/etc/opencloud/app-registry.yaml
      - ./config/opencloud/csp.yaml:/etc/opencloud/csp.yaml
      - ./config/opencloud/banned-password-list.txt:/etc/opencloud/banned-password-list.txt
      # configure the .env file to use own paths instead of docker internal volumes
      - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud
      - ${OC_DATA_DIR:-opencloud-data}:/var/lib/opencloud
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always


# This is important for Authentik (Assuming you don't already have an LDAP server configured in Authentik or elsewhere)
# If you do have an LDAP server, you'll need to figure out "Shared Directory" mode using different settings
# and the opencloud documentation. This is configured specifically for Authentik and autoprovisioning mode.
  ldap-server:  
    image: bitnami/openldap:2.6
    networks:
      opencloud-net:
    entrypoint: ["/bin/sh", "/opt/bitnami/scripts/openldap/docker-entrypoint-override.sh", "/opt/bitnami/scripts/openldap/run.sh" ]
    environment:
      BITNAMI_DEBUG: true
      LDAP_TLS_VERIFY_CLIENT: never
      LDAP_ENABLE_TLS: "yes"
      LDAP_TLS_CA_FILE: /opt/bitnami/openldap/share/openldap.crt
      LDAP_TLS_CERT_FILE: /opt/bitnami/openldap/share/openldap.crt
      LDAP_TLS_KEY_FILE: /opt/bitnami/openldap/share/openldap.key
      LDAP_ROOT: "dc=opencloud,dc=eu"
      LDAP_ADMIN_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin}
    ports:
      - "389:1389"
      - "636:1636"
    volumes:
      # Use an empty named volume to overwrite the inherited values
      - empty-dir:/ldifs
      # Only use the base ldif file to create the base structure
      - ./config/ldap/ldif/10_base.ldif:/ldifs/10_base.ldif
      # Use the custom schema from opencloud because we are in full control of the ldap server
      - ./shared/config/ldap/schemas/10_opencloud_schema.ldif:/schemas/10_opencloud_schema.ldif
      - ./config/ldap/docker-entrypoint-override.sh:/opt/bitnami/scripts/openldap/docker-entrypoint-override.sh
      - ldap-certs:/opt/bitnami/openldap/share
      - ldap-data:/bitnami/openldap
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always

volumes:
  ldap-certs:
  ldap-data:
  empty-dir: