[jackspiering]

Description

Adds OpenCloud, a self-hosted file sync and sharing platform (a fork of ownCloud Infinite Scale), as a new stack with a Tailscale sidecar. It runs the single opencloudeu/opencloud-rolling:8.1.0 container with the built-in identity provider and user directory, behind Tailscale Serve on port 9200. The root README row is added in alphabetical order.

The stack leaves out the add-ons of the upstream compose project that the issue lists (Collabora, Tika search, ClamAV, Radicale) and the mounted csp.yaml, apps.yaml, and banned password list. Those are optional upstream and can follow in later PRs.

Related Issues

• Closes Opencloud #196.

Verification

• docker compose config --quiet from services/opencloud, with dummy values for the two required variables: exit 0, no warnings.
• The stack started, Tailscale is healthy, and the service is reachable through the Tailnet. Test nodes cannot be reached from the host, so I called Serve from inside the namespace with curl --resolve to the node's Tailscale IP: / returned 200, and /.well-known/openid-configuration returned the issuer https://<SERVICE>.<tailnet>.ts.net. From inside the app container, the public URL resolved and answered, which OpenCloud needs for its own login.
• Health check: wget --spider http://127.0.0.1:9205/healthz run with docker exec returns 0, and the container reports healthy.
• Browser sign-in: a headless Chromium (Playwright), run inside the node's network namespace, opened the site, was redirected to the OpenCloud sign-in page, signed in as admin with INITIAL_ADMIN_PASSWORD, and landed on the empty Personal space of OpenCloud 8.1.0. Because the node had no Tailscale certificate (see below), this run put a throwaway self-signed TLS proxy on loopback in front of port 9200 and set OC_INSECURE=true in the test copy only. Tailscale Serve and its certificate were not part of this check.
• Main function (test copy with basic auth switched on, which the shipped stack does not enable): the admin user from INITIAL_ADMIN_PASSWORD authenticated (/graph/v1.0/me returned 200, a wrong password 401), and a file was created and read back over WebDAV. Data survives docker compose down and up -d, and the second start reports config file already exists, as the README says.
• rumdl check --config .markdownlint.yml . (0.2.78) on the whole repository, and git diff --check origin/main.

Not run:

• Final HTTPS run of the committed files. Let's Encrypt rate-limited new ACME registrations from this host after many test nodes today (429 too many new registrations), so the last run of the committed files used loopback inside the namespace. Earlier runs of the same stack passed over HTTPS through Serve.
• docker compose restart. It failed to restart the app container, because the Tailscale container is restarted at the same time and its network namespace changes. down followed by up -d works.

Impact on existing users

• None. This is a new service.

Checklist

• I have performed a self-review of my code and followed the templates structure.
• I did not commit a working auth key, password, token, or other credential.
• The service README uses the headings of the template, in the same order, and is up to date.
• I added, removed, or renamed the service in the root README.md, in alphabetical order, or this PR does not change the list of services.

Additional Context

• TS_ACCEPT_DNS=true is set (added after review). OpenCloud fetches its own Tailnet address from inside the container to check sign-ins, and Docker's DNS cannot resolve MagicDNS names. The earlier test host resolved it only because the host itself uses MagicDNS (100.100.100.100). The stack has no other container that needs Docker's DNS. Retested live with the pushed files: with TS_ACCEPT_DNS=false and Docker's DNS pointed at 9.9.9.9 (a host without MagicDNS), the node could not resolve its own name (bad address). With the committed TS_ACCEPT_DNS=true, the namespace uses the sidecar's resolver 100.100.100.100, the own name and outside names resolve, the app container fetched /.well-known/openid-configuration from its Tailnet address with a valid certificate, and a headless Chromium inside the namespace signed in as admin and landed on the Personal space of OpenCloud 8.1.0.
• The data folders must belong to user 1000 before the first start, otherwise Docker creates them as root. The README describes this under "Before you start".
• TAILNET_NAME and INITIAL_ADMIN_PASSWORD are required and empty in .env; Compose stops until they are set.
• The image tag is pinned to the exact version that the upstream compose files use, with a comment that says why.