chore: add update server to csp.yaml (cors)

enhane: do not expose ldap service

.env.example

@@ -59,7 +59,7 @@ TRAEFIK_SERVICES_TLS_CONFIG="tls.certresolver=letsencrypt"
 #       stores:
 #         - default
 #
-# The certificates need to copied into ./certs/, the absolute path inside the container is /certs/.
+# The certificates need to be copied into ./certs/, the absolute path inside the container is /certs/.
 # You can also use TRAEFIK_CERTS_DIR=/path/on/host to set the path to the certificates directory.
 # Enable the access log for Traefik by setting the following variable to true.
 TRAEFIK_ACCESS_LOG=

config/keycloak/opencloud-realm.dist.json

@@ -2336,7 +2336,7 @@
             "always"
           ],
           "usePasswordModifyExtendedOp": [
-            "false"
+            "true"
           ],
           "trustEmail": [
             "false"

config/opencloud/csp.yaml

@@ -8,6 +8,7 @@ directives:
     - 'wss://${COMPANION_DOMAIN|companion.opencloud.test}/'
     - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
     - 'https://${IDP_DOMAIN|keycloak.opencloud.test}/'
+    - 'https://update.opencloud.eu/'
   default-src:
     - '''none'''
   font-src:

config/opencloud/opencloud.storage.ocmproviders.json

@@ -1,46 +0,0 @@
-[
-  {
-    "name": "host.docker.internal:9200",
-    "full_name": "host.docker.internal 9200",
-    "organization": "OpenCloud",
-    "domain": "host.docker.internal:9200",
-    "homepage": "https://opencloud.eu",
-    "services": [
-      {
-        "endpoint": {
-          "type": {
-            "name": "OCM",
-            "description": "OpenCloud Open Cloud Mesh API"
-          },
-          "name": "OpenCloud - OCM API",
-          "path": "https://host.docker.internal:9200/ocm/",
-          "is_monitored": true
-        },
-        "api_version": "0.0.1",
-        "host": "host.docker.internal:9200"
-      }
-    ]
-  },
-  {
-    "name": "cloud.opencloud.test",
-    "full_name": "cloud.opencloud.test",
-    "organization": "OpenCloud",
-    "domain": "cloud.opencloud.test",
-    "homepage": "https://opencloud.eu",
-    "services": [
-      {
-        "endpoint": {
-          "type": {
-            "name": "OCM",
-            "description": "OpenCloud Open Cloud Mesh API"
-          },
-          "name": "OpenCloud - OCM API",
-          "path": "https://cloud.opencloud.test/ocm/",
-          "is_monitored": true
-        },
-        "api_version": "0.0.1",
-        "host": "cloud.opencloud.test"
-      }
-    ]
-  }
-]

config/opencloud/web.yaml

@@ -1,14 +0,0 @@
-# OpenCloud web configuration
-web:
-  config:
-    apps:
-    - files
-    - search
-    - text-editor
-    - pdf-viewer
-    - external
-    - admin-settings
-    - epub-reader
-    - preview
-    - app-store
-    - ocm

docker-compose.yml

@@ -51,25 +51,13 @@ services:
       OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS:-1}"
       OC_PASSWORD_POLICY_MIN_DIGITS: "${OC_PASSWORD_POLICY_MIN_DIGITS:-1}"
       OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS:-1}"
-
-      # OCM
-      OC_ENABLE_OCM: "true"
-      OCM_OCM_PROVIDER_AUTHORIZER_PROVIDERS_FILE: "/etc/opencloud/ocmproviders.json"
-      OCM_OCM_INVITE_MANAGER_INSECURE: "true"
-      OCM_OCM_SHARE_PROVIDER_INSECURE: "true"
-      OCM_OCM_STORAGE_PROVIDER_INSECURE: "true"
-      GRAPH_INCLUDE_OCM_SHAREES: "true"
-
     volumes:
       - ./config/opencloud/csp.yaml:/etc/opencloud/csp.yaml
       - ./config/opencloud/banned-password-list.txt:/etc/opencloud/banned-password-list.txt
-      - ./config/opencloud/opencloud.storage.ocmproviders.json:/etc/opencloud/ocmproviders.json
-      - ./config/opencloud/web.yaml:/etc/opencloud/web.yaml
       # configure the .env file to use own paths instead of docker internal volumes
       - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud
       - ${OC_DATA_DIR:-opencloud-data}:/var/lib/opencloud
       - ${OC_APPS_DIR:-./config/opencloud/apps}:/var/lib/opencloud/web/assets/apps
-
     logging:
       driver: ${LOG_DRIVER:-local}
     restart: always

idm/external-idp.yml

@@ -44,7 +44,7 @@ services:
       # The openCloud users need to be able to edit their account in the externa IdP
       WEB_OPTION_ACCOUNT_EDIT_LINK_HREF: ${IDP_ACCOUNT_URL}
   ldap-server:
-    image: bitnami/openldap:2.6
+    image: bitnamilegacy/openldap:2.6
     networks:
       opencloud-net:
     entrypoint: [ "/bin/sh", "/opt/bitnami/scripts/openldap/docker-entrypoint-override.sh", "/opt/bitnami/scripts/openldap/run.sh" ]
@@ -57,9 +57,6 @@ services:
       LDAP_TLS_KEY_FILE: /opt/bitnami/openldap/share/openldap.key
       LDAP_ROOT: "dc=opencloud,dc=eu"
       LDAP_ADMIN_PASSWORD: ${LDAP_BIND_PASSWORD:-admin}
-    ports:
-      - "127.0.0.1:389:1389"
-      - "127.0.0.1:636:1636"
     volumes:
       # Only use the base ldif file to create the base structure
       - ./config/ldap/ldif/10_base.ldif:/ldifs/10_base.ldif

idm/ldap-keycloak.yml

@@ -51,9 +51,6 @@ services:
       LDAP_TLS_KEY_FILE: /opt/bitnami/openldap/share/openldap.key
       LDAP_ROOT: "dc=opencloud,dc=eu"
       LDAP_ADMIN_PASSWORD: ${LDAP_BIND_PASSWORD:-admin}
-    ports:
-      - "127.0.0.1:389:1389"
-      - "127.0.0.1:636:1636"
     volumes:
       - ./config/ldap/ldif/10_base.ldif:/ldifs/10_base.ldif
       - ./config/ldap/ldif/20_admin.ldif:/ldifs/20_admin.ldif
@@ -65,7 +62,7 @@ services:
     restart: always
 
   postgres:
-    image: postgres:alpine
+    image: postgres:17-alpine
     networks:
       opencloud-net:
     volumes:

testing/external-keycloak.yml

@@ -1,7 +1,7 @@
 ---
 services:
   postgres:
-    image: postgres:alpine
+    image: postgres:17-alpine
     networks:
       opencloud-net:
     volumes: