OpenCloud
Documentation federation usage #658
Unanswered
suse-coder
asked this question in
Q&A
Replies: 4 comments 8 replies
|
Federation is currently done via OCM, you can find some information here: https://github.com/opencloud-eu/opencloud/tree/main/services/ocm. Also there is a docker compose example in the dev setup of the web client: https://github.com/opencloud-eu/web/blob/main/docker-compose.yml#L117. |
0 replies
|
Hi! |
2 replies
|
You need to use the OCM App in the Web UI. You can find it under "ScienceMesh" in the app switcher menu. Once connected, use the filter switch when sharing to search for external users: 
|
|
Many thanks! The app switcher menu is that the square with 9 dots in the top right corner where text editor and admin settings are etc? I do not have ScienceMesh there. Do I need to install that app? |
|
@JammingBen ---
services:
opencloud:
# renovate: depName=opencloudeu/opencloud-rolling
image: opencloudeu/opencloud-rolling:7.3
#image: opencloudeu/opencloud:7.2
container_name: opencloud
# changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog
# release notes: https://docs.opencloud.eu/opencloud_release_notes.html
user: root:root
ports:
- 9200:9200
networks:
- frontend
entrypoint:
- /bin/sh
# run opencloud init to initialize a configuration file with random secrets
# it will fail on subsequent runs, because the config file already exists
# therefore we ignore the error and then start the opencloud server
command: ["-c", "opencloud init || true; opencloud server"]
environment:
# collaborarive mode for the files
# this enables syncthing to modify files and have opencloud pick up
# the changes.
STORAGE_USERS_POSIX_WATCH_FS: true
STORAGE_USERS_ID_CACHE_STORE: nats-js-kv
# enable services that are not started automatically
OC_ADD_RUN_SERVICES: "collaboration,ocm,invitations,ScienceMesh"
OC_URL: "https://my.domain"
# Logs
OC_LOG_LEVEL: warn
OC_LOG_COLOR: true
OC_LOG_PRETTY: true
# do not use SSL between the reverse proxy and OpenCloud
PROXY_TLS: "false"
# INSECURE: needed if OpenCloud / reverse proxy is using self generated certificates
OC_INSECURE: "${INSECURE:-false}"
# basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
# demo users
IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
# admin password
IDM_ADMIN_PASSWORD: "${INITIAL_ADMIN_PASSWORD}"
# email server (if configured)
NOTIFICATIONS_SMTP_HOST: "${SMTP_HOST}"
NOTIFICATIONS_SMTP_PORT: "${SMTP_PORT}"
NOTIFICATIONS_SMTP_SENDER: "${SMTP_SENDER:-OpenCloud Notifications <notifications@cloud.opencloud.test>}"
NOTIFICATIONS_SMTP_USERNAME: "${SMTP_USERNAME}"
NOTIFICATIONS_SMTP_PASSWORD: "${SMTP_PASSWORD}"
NOTIFICATIONS_SMTP_INSECURE: "${SMTP_INSECURE:-false}"
NOTIFICATIONS_SMTP_AUTHENTICATION: "${SMTP_AUTHENTICATION}"
NOTIFICATIONS_SMTP_ENCRYPTION: "${SMTP_TRANSPORT_ENCRYPTION:-none}"
FRONTEND_ARCHIVER_MAX_SIZE: "10000000000"
FRONTEND_CHECK_FOR_UPDATES: "${CHECK_FOR_UPDATES:-true}"
PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
# enable to allow using the banned passwords list
OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
# control the password enforcement and policy for public shares
OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD:-true}"
OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD:-false}"
OC_PASSWORD_POLICY_DISABLED: "${OC_PASSWORD_POLICY_DISABLED:-false}"
OC_PASSWORD_POLICY_MIN_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_CHARACTERS:-8}"
OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS:-1}"
OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS:-1}"
OC_PASSWORD_POLICY_MIN_DIGITS: "${OC_PASSWORD_POLICY_MIN_DIGITS:-1}"
OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS:-1}"
# default language for services/WebUI; defaults to English, language code (ISO 639-1, e.g. de, en, fr)
OC_DEFAULT_LANGUAGE: ${DEFAULT_LANGUAGE}
# OIDC
OC_EXCLUDE_RUN_SERVICES: idp
OC_LDAP_SERVER_WRITE_ENABLED: 'true'
IDP_DOMAIN: secure.erikboberg.se
EXTERNAL_OIDC_DOMAIN: https://oidc.domain
IDP_ISSUER_URL: https://oidc.domain
OC_OIDC_ISSUER: https://oidc.domain
WEB_OIDC_CLIENT_ID: opencloud
WEB_OIDC_SCOPE: openid profile email groups
PROXY_USER_OIDC_CLAIM: preferred_username
PROXY_USER_CS3_CLAIM: username
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD: none
PROXY_OIDC_REWRITE_WELLKNOWN: true
PROXY_AUTOPROVISION_ACCOUNTS: true
PROXY_AUTOPROVISION_CLAIM_USERNAME: preferred_username
PROXY_AUTOPROVISION_CLAIM_EMAIL: email
PROXY_AUTOPROVISION_CLAIM_DISPLAYNAME: name
PROXY_AUTOPROVISION_CLAIM_GROUPS: groups
PROXY_ROLE_ASSIGNMENT_DRIVER: oidc
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM: groups
GRAPH_ASSIGN_DEFAULT_USER_ROLE: false
GRAPH_USERNAME_MATCH: none
SETTINGS_SETUP_DEFAULT_ASSIGNMENTS: 'false'
WEBFINGER_WEB_OIDC_CLIENT_ID: opencloud
WEBFINGER_WEB_OIDC_CLIENT_SCOPES: openid profile email groups
# Desktop app does not work with OIDC and I want to use
# syncthing anyway...
#WEBFINGER_DESKTOP_OIDC_CLIENT_ID: OpenCloudAPP
#WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES: openid profile email groups offline_access
WEBFINGER_IOS_OIDC_CLIENT_ID: OpenCloudAPP
WEBFINGER_IOS_OIDC_CLIENT_SCOPES: openid profile email groups offline_access
# Collabora online
COLLABORA_DOMAIN: collaboraonline.my.domain
TRAEFIK_PORT_HTTPS: 443
# make collabora the secure view app
FRONTEND_APP_HANDLER_SECURE_VIEW_APP_ADDR: eu.opencloud.api.collaboration
#GRAPH_AVAILABLE_ROLES: "b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5,a8d5fe5e-96e3-418d-825b-534dbdf22b99,fb6c3e19-e378-47e5-b277-9732f9de6e21,58c63c02-1d89-4572-916a-870abc5a1b7d,2d00ce52-1fc2-4dbc-8b95-a73b73395f5a,1c996275-f1c9-4e71-abdf-a42f6495e960,312c0871-5ef7-4b3a-85b6-0e4074c64049,aa97fe03-7980-45ac-9e50-b325749fd7e6"
# collaboration service configuration; the WOPI endpoint is served by the
# opencloud proxy on the opencloud domain (/wopi and /collaboration routes),
# so no separate wopiserver domain, route or port is needed
COLLABORATION_WOPI_SRC: https://my.domain
COLLABORATION_APP_NAME: "Office"
COLLABORATION_APP_PRODUCT: "Collabora"
COLLABORATION_APP_ADDR: https://collaboraonline.my.domain
COLLABORATION_APP_ICON: https://collaboraonline.my.domain/favicon.ico
COLLABORATION_APP_INSECURE: true
COLLABORATION_CS3API_DATAGATEWAY_INSECURE: true
COLLABORATION_APP_PROOF_DISABLE: true
# fulltext search
SEARCH_EXTRACTOR_TYPE: tika
SEARCH_EXTRACTOR_TIKA_TIKA_URL: http://opencloud-tika:9998
FRONTEND_FULL_TEXT_SEARCH_ENABLED: true
# OCM
OC_ENABLE_OCM: true
GRAPH_INCLUDE_OCM_SHAREES: true
OCM_OCM_PROVIDER_AUTHORIZER_PROVIDERS_FILE: /etc/opencloud/ocmproviders.json
volumes:
# configure the .env file to use own paths instead of docker internal volumes
- ./config:/etc/opencloud
- /mnt/cloud-data:/var/lib/opencloud
logging:
driver: ${LOG_DRIVER:-local}
restart: unless-stopped
depends_on:
tika:
condition: service_healthy
# Apache tika for search indexing
tika:
image: apache/tika:latest
container_name: opencloud-tika
# Using the base variant for smaller image size and faster startup
# The base variant includes core functionality for text extraction
# Full variant is only needed for specialized OCR/image processing
# release notes: https://tika.apache.org
networks:
- frontend
restart: always
logging:
driver: ${LOG_DRIVER:-local}
healthcheck:
test:
[
"CMD",
"bash",
"-c",
"exec 3<>/dev/tcp/127.0.0.1/9998 && printf 'GET /tika HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && grep '200 OK' <&3",
]
interval: 5s
timeout: 5s
retries: 10
start_period: 5s
# Networks
networks:
frontend:
external: true
name: frontend |
5 replies
|
Ah yes, I forgot it's not enabled per default. You need to enable it via the E.g.: |
|
Thanks! It would have saved me hours yesterday… |
|
Great! A follow-up question: Can I create a space that invites users from federated instances? |
|
uha, @Svanvith I created a task here to document OCM opencloud-eu/docs#1079 please correct me if anything speaks against documenting it, I think we just forgot to document it 🤐 |
|
More errors, both me and my brother are using OIDC for authentication (Authelia and Authentic). Shared files / folders between our federated instances are not working properly. My brother cannot edit documents that are created in shared folders. I get errors like this in my console: This seems to only happen for office documents, not for text files / markdown. I also get these kinds of warnings: |
1 reply
|
@micbar do you know something about this, do WOPI apps work with OCM? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Is there a documentation how to connect two opencloud instances together for federation?
All reactions