OpenCloud
Full Docker-Compose setup with Authentik OIDC and Caddy reverse proxy #1830
Replies: 6 comments 11 replies
-
|
Huge thanks! This helped me setting up my instance. I also emphasize the fact that roles are needed, not only groups. That's what I was stuck on. |
Beta Was this translation helpful? Give feedback.
-
|
Interesting. I did in fact not have to setup any roles and only used groups. Not saying one solution is better than the other. WEB_OIDC_SCOPE: "openid profile email groups offline_access" # Offline access prevents logouts as soon as the access token expires.In role_assignment:
driver: oidc
oidc_role_mapper:
role_claim: groups # <-- This tells Authentik to look inside the groups claim that is getting pulled from above.
role_mapping:
- role_name: admin
claim_value: opencloud-admin # <-- Authentik group name
- role_name: user
claim_value: opencloud-user # <-- Authentik group name
- role_name: guest
claim_value: opencloud-guest # <-- Authentik group name
additional_policies:
# [...]Finally, in Authentik: As said above, this only works for me on the web client. If anyone has managed to get the apps working, I'd love to get some help. I hope it helps :) |
Beta Was this translation helpful? Give feedback.
-
|
@jicka Ah, weird, I'm using your config and this did not work. Maybe I've messed up somewhere else.
Only caveat, changing the token verification method seems to create another bug: #1493, even despite having |
Beta Was this translation helpful? Give feedback.
-
|
Interesting ! Then I must have made a tiny change that I forgot to document. On an unrelated note: I just updated the description above so that it works with the newest compose files from the repo (adding direct intercontainer networking, which I should have done from the start). |
Beta Was this translation helpful? Give feedback.
-
|
Big thanks to both of you, got it working in the end. I found at least two issues with my config, one was missing proxy volume mount on and the other was a missing Can also confirm that it works without the roles config described above - sorry @ni0ki that you had to go through the effort of documenting it here! I am still learning about OIDC - for the groups approach to work it seems that the Authentik user needs to belong to at least one of the groups created in Authentik. In my setup both share the same username. |
Beta Was this translation helpful? Give feedback.
-
|
Happy to know you've done it! I've edited my original answer to not mislead other people, and I'll have a look at my config. |
Beta Was this translation helpful? Give feedback.
-
|
Big Thanks of all here. It runs on Authentik 2025.10.2 |
Beta Was this translation helpful? Give feedback.
-
|
This is brilliant! Thank you all!!!! For future reference. I was getting stuck at a redirect URL. I ended up adding this to the Authentik provider.
But I was playing with Confidential vs. Public at the time. I may have been my own worse enemy there, but adding that doesn't break anything so I left it in. I am also using external Traefik instead of Caddy. Meaning my OpenCloud server is on a different VM than my Traefik server. To get Traefik working I am using: .env
Added a http:
routers:
opencloud-router:
rule: "Host(`cloud.example.com`)" # <--- change this URL
tls:
certResolver: letsencrypt # <--- change this certResolver
entryPoints:
- websecure
priority: 10
service: opencloud-lb
collabora-router:
rule: "Host(`collabora.example.com`)" # <--- change this URL
tls:
certResolver: letsencrypt # <--- change this certResolver
entryPoints:
- websecure
priority: 10
service: collabora-lb
wopiserver-router:
rule: "Host(`wopiserver.example.com`)" # <--- change this URL
tls:
certResolver: letsencrypt # <--- change this certResolver
entryPoints:
- websecure
priority: 10
service: wopiserver-lb
services:
opencloud-lb:
loadBalancer:
servers:
- url: http://<OC LAN IP>:9200 # <--- change this IP/URL
collabora-lb:
loadBalancer:
servers:
- url: http://<OC LAN IP>:9980 # <--- change this IP/URL
wopiserver-lb:
loadBalancer:
servers:
- url: http://<OC LAN IP>:9300 # <--- change this IP/URLYou can use the IP address of the OpenCloud server or an internally resolvable FQDN. In providers:
docker:
exposedByDefault: false
endpoint: 'unix:///var/run/docker.sock'
watch: true
file:
directory: /etc/traefik/
watch: trueWith a volume linking rules to a location Traefik will watch.
|
Beta Was this translation helpful? Give feedback.
-
|
Many thanks @jicka . |
Beta Was this translation helpful? Give feedback.
-
|
Hi, great post i am struggling to get it working with an admin user. Problem is that I followed authentik and opencloud instructions and it worked but whe I legged in, it create a new blank user (which is the default i believe) but I already had a local admin user which i setup when i first created the opencloud instance. So I have 2 questions if possible:
Btw I am using pangolin as reverse proxy if that helps Thanks |
Beta Was this translation helpful? Give feedback.
-
|
Hello,
The guide at the top isn't up to date with 7.2.0 and there were many little changes since I initially wrote the guide. I've updated it for a clean install below.
I think it'll be easier to ignore the initial admin account and just use your OIDC account. As far as I can tell opencloud fully supports multiple admin users, so if you have a legacy admin user that's not an issue. |
Beta Was this translation helpful? Give feedback.
-
|
After having some issues migrating to 7.x versions, and seeing that there were improvements to the OIDC System as well as Euro-Office, I rebuilt my whole install from scratch. Here is an updated guide based on a fresh install of 7.2.0. Questions and ideas for improvements are welcome ! Setup Overview
OpencloudTo setup OIDC, I've created a new services:
opencloud:
restart: unless-stopped
environment:
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD: "none" # Required for auth to work.
volumes:
- ./config/opencloud/proxy.yaml:/etc/opencloud/proxy.yaml # Required for role mapping
networks:
opencloud-net:
name: opencloud-netWithin the role_assignment:
driver: oidc
oidc_role_mapper:
role_claim: groups
role_mapping:
- role_name: admin
claim_value: opencloud-admin # <-- Authentik group name
- role_name: user
claim_value: opencloud-user # <-- Authentik group name
- role_name: guest
claim_value: opencloud-guest # <-- Authentik group name
additional_policies:
# [...]Finally, here is the full list of environment variables set in the .env file. LOG_DRIVER=
INSECURE=true
OC_LOG_LEVEL=info
COMPOSE_FILE=docker-compose.yml:weboffice/euroffice.yml:external-proxy/opencloud.yml:external-proxy/euroffice.yml:idm/external-idp.yml:idm/oidc-authentik.yml
OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling
OC_DOCKER_TAG=latest
OC_DOMAIN=cloud.example.com
DEMO_USERS=false
INITIAL_ADMIN_PASSWORD=XXXXXXXXXXXXXXXXX
CHECK_FOR_UPDATES=true
LOG_LEVEL=WARNING
LOG_PRETTY=true
OC_CONFIG_DIR=/path/to/opencloud/data/config/
OC_DATA_DIR=/path/to/opencloud/storage
OC_APPS_DIR=/path/to/opencloud/data/apps
DEFAULT_LANGUAGE=en
LDAP_CERTS_DIR=/path/to/opencloud/data/ldap_certs
LDAP_DATA_DIR=/path/to/opencloud/data/ldap_data
START_ADDITIONAL_SERVICES=""
EURO_OFFICE_DOMAIN=eurooffice.example.com
EURO_OFFICE_JWT_SECRET=YYYYYYYYYYYYYYYYYYYYYYY
EURO_OFFICE_DOCKER_IMAGE=
EURO_OFFICE_DOCKER_TAG=latest
COMPOSE_PATH_SEPARATOR=:
PROXY_ROLE_ASSIGNMENT_DRIVER=oidc
GRAPH_ASSIGN_DEFAULT_USER_ROLE=false
IDP_DOMAIN=authentik.example.com
IDP_ISSUER_URL=https://authentik.example.com/application/o/opencloud/
IDP_ACCOUNT_URL=https://authentik.example.com/if/user/
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups
OC_OIDC_CLIENT_SCOPES=
OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD=false
OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD=falseCaddyThe caddy setup is very simple. Here is the relevant portion of the caddyfile: cloud.example.com {
reverse_proxy opencloud:9200
}
eurooffice.example.com {
reverse_proxy euro-office:80
}The caddy container needs to be on the same network as the opencloud containers. The following lines are therefore added to the caddy services:
caddy:
# [...]
networks:
opencloud-net:
# [...]
opencloud-net:
name: opencloud-net
external: true
AuthentikFirst, create groups that will give access to opencloud, with a specific role:
Then create an application with provider. Here are the relevant settings:
Scopes:
Policy / Group / User Bindings: Add the three groups previously created Other providersHere are the client IDs and redirect URIs / Origins for the other clients:
iOS:
Desktop:
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks I will check it tonight, just a quick hint I believe you need to add an environtment variable on the euroffice.yml as the EURO_OFFICE_JWT_SECRET= variable is not passed to the container and it will create a random secret at boot. |
Beta Was this translation helpful? Give feedback.
-
|
ok thanks! I got it working now but only for the web, I have been trying to set it up for my ios app but I have no idea, how did you do it for other providers? even on e the authentik website sayd that you have to add some config to the proxy. I am using poangolin btw. |
Beta Was this translation helpful? Give feedback.
-
|
I cannot help with the ios app specifically, as I don't have a device to test. Here are a few ideas where you could look: Inside Authentik, you need a specific application with its specific provider for the ios app (and one for android, and one for desktop). They require specific Client IDs (Authentik generally generates the client ID automatically, but you have to overwrite that value). Also, make sure that your web provider has the client ID "web" and that all environment variables (in the .env file) relating to client IDs are commented out: # Global Client ID: You can override this by specifying a custom client ID, or leave it blank to use the OC defaults, as described in the documentation
#OC_OIDC_CLIENT_ID=
# Declares which property should be used for the oidc claim
# Example: "roles"
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups
# Defines the OIDC client scope
# Example: "openid profile email roles"
OC_OIDC_CLIENT_SCOPES=
# Client specific environment vars
#WEBFINGER_WEB_OIDC_CLIENT_ID=web
#WEBFINGER_WEB_OIDC_CLIENT_SCOPES=
#WEBFINGER_IOS_OIDC_CLIENT_ID=
#WEBFINGER_IOS_OIDC_CLIENT_SCOPES=
#WEBFINGER_ANDROID_OIDC_CLIENT_ID=
#WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES=
#WEBFINGER_DESKTOP_OIDC_CLIENT_ID=web
#WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES=I think the OpenCloud team is preparing to support per client type client IDs (which is great), and put the variables into the example .env file. But in my testing, things currently break when you set any of them. I hope this helps ! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
EDIT: See below for an updated version of this guide based on 7.2.0.
After (happily!) spending a lot of time tweaking all the environment variables, I think I have gotten to a satisfying state of things and can now start using / testing opencloud. I pulled together knowledge from many different places and wanted to put it all together if anyone else is interested.
Please let me know if this is not relevant / should be posted somewhere else.
Questions and ideas for improvements are welcome !
Setup Overview
Opencloud
To setup OIDC, I've created a new
oidc-authentik.ymlfile within theidmfolder. It expands the original compose file without having to touch it directly:Within the
config/opencloudfolder, add the Authentik domain tocsp.yamlunder connect-src:Within the
config/opencloudfolder, add the Authentik group to Opencloud role mapping toproxy.yaml(right at the top):Finally, here is the full .env file. Note that at the bottom, the OIDC values are set:
Caddy
The caddy setup is very simple. Here is the relevant portion of the caddyfile:
The caddy container needs to be on the same network as the opencloud containers. The following lines are therefore added to the caddy
compose.yml. This allows the caddyfile to reference the other containers as hosts.Authentik
First, create groups that will give access to opencloud, with a specific role:
Then create an application with provider. Here are the relevant settings:
slug: opencloud
Provider type: Oauth2 / OpenID
Client type: Public
Redirect URIs / Origins:
Scopes:
Policy / Group / User Bindings: Add the three groups previously created
Other providers
While not in use, here are the client IDs and redirect URIs / Origins for the other client types:
Android:
iOS:
Desktop:
EDIT 2025-11-22: Added caddy container to the opencloud-net network for direct intercontainer networking without the host. This is now necessary as the standard external-proxy compose files only bind the port to the container localhost. Removed limitation about apps as they now work (Thank you Ni0ki for the guidance!)
Beta Was this translation helpful? Give feedback.
All reactions