DOCSEARCHbyAlgolia
Submit Docs

OpenCloud Documentation

repository·main·Indexed 26 days ago

https://github.com/opencloud-eu/opencloud

A Go-based server backend providing proxy and identity services. OpenCloud features a lightweight architecture using filesystem-based storage instead of traditional databases and leverages OpenID Connect for authentication. The project includes tools for multi-tenancy deployment via Docker Compose, a runtime service supervisor, a service registry supporting nats-js-kv and memory, and a suite of CLI tools for backup consistency, revision purging, and trash management.

Tokens
65.4K
Snippets
108
Records
525
Agent score
89%

What's inside OpenCloud

  1. Overview of Frontend Service Endpoints

    main

    The OpenCloud frontend service acts as a translation layer between various HTTP APIs and CS3 requests. It provides four primary functional endpoints:

    • appprovider (/app): Forwards requests to the CS3 App Registry API.
    • archiver (/archiver): Implements zip and tar downloads for file collections by initiating CS3 downloads and streaming compressed files.
    • datagateway (/data): Forwards file upload and download requests to the appropriate CS3 data provider. Routing is determined by the JWT created during the InitiateFileDownload or InitiateFileUpload requests.
    • ocs (/ocs): Implements the Open Collaboration Services API by translating it into CS3 API requests. It manages users, groups, capabilities, and file sharing. Note that /ocs/v[12].php/cloud/user/signing-key is handled by a dedicated ocs service.

  2. Overview of the OpenCloud Auth Service Family

    main

    OpenCloud provides several authentication services within the auth- service family, each designed for specific scopes of request authentication:

    • auth-app: Authenticates external 3rd party applications.
    • auth-basic: Handles basic authentication.
    • auth-bearer: Handles OIDC (OpenID Connect) authentication.
    • auth-machine: Handles inter-service authentication when a user is being impersonated.
    • auth-service: Handles inter-service authentication specifically when using service accounts.

  3. Overview of the IDM service

    main

    The IDM (Identity Management) service provides a minimal LDAP service for OpenCloud based on Libregraph idm. It serves as a central repository for user and group information and is intended for small OpenCloud installations.

    Key Characteristics:

    • Default Port: 9235
    • Protocol: LDAPS (TLS-protected connections only by default)
    • BaseDN: o=libregraph-idm
    • Write Permissions: Only the user uid=libregraph,ou=sysusers,o=libregraph-idm has LDAP write permissions. All other authenticated users have read-only access.
    • Data Storage: Uses a BoltDB file located at idm/idm.boltdb within the OpenCloud base data directory.
    • Supported Operations: A limited subset of LDAP operations: BIND, SEARCH, ADD, MODIFY, and DELETE.
    • Limitations: Does not perform schema verification (e.g., structural vs. auxiliary object classes, attribute syntax checks).

  4. Overview of the App Provider service

    main
    The app-provider service implements the CS3 App Provider API for OpenCloud. Its primary responsibility is managing and serving applications capable of opening files based on their MIME types. It acts as a coordinator between the client, the app-registry service (which tracks available applications and their supported MIME types), and the target applications to provide the appropriate interface for file interaction.

  7. Overview of the Users service

    main
    The users service provides the CS3 Users API for OpenCloud. It manages user information and authentication, implementing the CS3 identity user provider interface. This allows other services to query and manage user accounts. It specifically functions as a backend provider for the graph service when the graph service is configured in CS3 backend mode.

  9. Overview of the IDP service

    main

    The IDP (Identity Provider) service is a built-in, minimal OpenID Connect (OIDC) provider for OpenCloud based on LibreGraph Connect (lico). It is designed for smaller installations. For larger-scale deployments, it is recommended to use an external OpenID Connect Provider instead.

    By default, the service uses the OpenCloud IDM service as its LDAP backend for user authentication and lookups. You can configure alternative backends, such as an external LDAP server, using environment variables.

  10. Overview of the Invitations service

    main

    The Invitations service provides an Invitation Manager to invite external users (guests) to an organization.

    Users are categorized by type:

    • Guests: Users invited via the Invitation Manager (using the libre graph API) are assigned userType="Guest". In the CS3 API, this corresponds to USER_TYPE_GUEST.
    • Members: Users belonging to the organization are assigned userType="Member". In the CS3 API, this corresponds to USER_TYPE_PRIMARY.

  11. Overview of the Audit service

    main

    The Audit service records all system events as audit logs to enable compliance reporting and operational auditing. It tracks actions performed by both users and administrators, specifically focusing on:

    • File system operations: Creation, deletion, and movement of files, including trash bin actions and versioning.
    • User management operations: Creation and deletion of users.
    • Sharing operations: User/group sharing, link sharing, permission changes, and client-side sharing API calls.