Activity

1. v-scharf

   pinned this issue on Oct 26, 2026
2. tbsbdr commented on Oct 26, 2026

   

   tbsbdr

   on Oct 26, 2026

   Last edited by JammingBen

   Member

   More actions

   releasenotes (highlights)

   [Breaking Change notice like from rolling 7->8 ?]

   Highlights

   🌍 Guest access: share with anyone by email

   Share files and folders with people who have no account on your OpenCloud. Enter their email address in the share dialog, pick a role, done. The guest gets an email with a link and starts working right away.

   Guest access is built for external collaboration where you must know who accessed what.

   • Passwordless: no account to set up, no password to forget or reset. The guest proves who they are by receiving the email.
   • Identified: every guest access is logged with the email address. A public link cannot tell you who used it, a guest is always a known person.
   • Same roles as internal users: from viewer to editor, on files and folders.

   How it works:

   • Personal links: every link is single-use and valid for 30 minutes. A used or expired link stops working, the guest requests a new one and gets it instantly.
   • Sessions: a guest session lasts 24 hours. 15 minutes before it ends, the web client warns the guest, who renews it with a PIN sent by email.
   • Expiry: like any share, guest access can have an expiry date. After that date, no new links are issued.
   • Admin settings: session lifetime, link and PIN lifetime and rate limits for renewals are configurable.

   Sharing options compared

   	Public link	Guest access	Full account
   Best for	One-time sending or collecting files from anyone	Ongoing work with a named external partner	Daily work of your own team
   Needs password	No (optional)	No	Yes
   Authentication factor	One link for all	Personal, single-use links in the guest's inbox	Password / MFA
   Who is identified	Nobody	The guest's email address	The user, via the directory
   Expiration	None (optional)	Link 30 min, session 24 h, renewable by email	None
   Restrictions	Web only, no desktop or mobile sync	Web only, no desktop or mobile sync	None
   Personal data needed	None	Email address only	Profile data in the directory

   Why guest access and not public links
   A public link is anonymous. Anyone who holds it has access, and nobody can say who that is. A guest is a known person, identified by their email address. Sharers and admins see who has access, can revoke it and can show it in an audit.

   🔐 End-to-end encrypted vaults for folders and spaces

   You can now create vaults: a folder or a whole space where every file is encrypted. The encryption happens in your browser before the data reaches the server. File names are encrypted as well. The server never gets the key, so nobody with access to the server can read the content.

   To create one, open "New", then "Folder", turn on the switch "end to end encrypt this folder" and set a passphrase. The folder gets a lock icon. When you open it you enter the passphrase once, and the vault stays unlocked for the current browser session. The passphrase is not stored anywhere.

   Vaults are built on rclone crypt and are fully compatible with it. A folder that you encrypted locally with the rclone command line can be uploaded and opened in OpenCloud and a vault that was synced to your computer can be mounted with rclone. Your data stays readable with a free standard tool, also without OpenCloud.

   Limits, because the server cannot read the files:

   • Collabora and collaborative editing do not work inside a vault.
   • Thumbnails are not shown in the file list. Images still open in the preview app.
   • You cannot share single files out of a vault, only the vault itself.
   • Encrypted spaces have no space image and no description yet.

   There is no passphrase recovery. If you lose the passphrase, the content is lost. Store the passphrase in a password manager.

   🎨 Excalidraw: draw together on a whiteboard

   OpenCloud gets a collaborative whiteboard, shipped as a web extension.

   • Create: create a new whiteboard file from the "New" menu and open it like any other file.
   • Draw together: share the file and everyone in the session sees every stroke instantly.
   • Follow a collaborator: click their avatar to follow their cursor across the canvas.

   Syncing runs through the OpenCloud Yjs service, so no extra setup if collaborative editing already works.

   🚢 OpenCloud runs on OpenShift

   The Helm chart supports OpenShift, based on customer feedback, and the setup is documented. The chart test suite simulates an OpenShift cluster and checks its security restrictions on every run, for allowed and for rejected workloads.

   Collaboration and sharing

   📐 Apollon: UML diagrams

   Apollon is a new app for UML and modeling diagrams. It supports 13 diagram types, including class, component, activity and BPMN.

   • Create: choose "UML Diagram" from the "New" menu.
   • Edit together: diagrams sync in real time, and you see the cursors of the other people in the diagram.

   🔄 Live updates for shares

   When someone shares a folder with you, it appears in "Shared with me" right away, without a reload. Revoked shares disappear the same way. This also works for guests.

   Search

   🔍 Search: 90% less memory, 50+ stability and performance improvements

   Bleve memory usage for around 100,000 files drops from 1.1 GB to about 120 MB, thanks to a community fix. An out-of-memory Bleve used to take the whole process down. The default search engine now scales much further.

   On top of that, this release fixes more than 50 search bugs. OpenCloud ships Bleve by default and offers OpenSearch for larger installations. The two had drifted apart and returned different results for the same query. Not anymore: when you switch from Bleve to OpenSearch, you get the same results.

   • Parity test suite: over 300 test cases run every KQL query against both Bleve and OpenSearch and compare the results.
   • Parity report: checked into the search package, doubles as documentation of what the search can do.
   • Fixed: path search, upper and lower case in paths, tokenization of Chinese content.

   🔎 Search results show the match

   The matching text is now shown in the middle of the preview, so it does not scroll out of view. The details view shows why the file was found, either the matching text or the tag.

   ⭐ Filters in the favorites view

   The favorites view now filters like in the search results page. You can filter by type, for example folders or documents, and by last modified, for example last 7 days or last year.

   Performance

   🚀 Web UI loads 40% faster

   First content appears 40% sooner (1.5 s → 0.9 s on an average docker deployment), the full page 35% sooner (2.0 s → 1.3 s). The Lighthouse score goes from 85 to 96. Nothing was removed, the web UI just loads less, and later.

   • Fonts: only the weights we use, split by Unicode range. The preloaded Latin subset is 7x smaller (337.5 KB → 48.5 KB). Other scripts such as Cyrillic or Greek load on demand.
   • Translations: only the selected language is loaded, for German 12x less (419 KB → 34 KB). English needs no download.
   • Chunking: smaller JavaScript chunks that load in parallel or later.

   ⚡ Smooth scrolling in folders with 1,000+ files

   Large folders scroll smoothly now, also in Safari. Triggered by a community bug report.

   • Thumbnails: tiles requested images at around 1000x1000 px, far too large for a small tile. They now load at the size they are shown.
   • Scrolling: in a folder with 1,000 photos, tiles and previews keep up with fast scrolling. Placeholders appear for a fraction of a second instead of blocking the view.

   Branding and theming

   🎨 Desktop client theming without a new build

   Brand the desktop client with a JSON theme file. Changing the theme no longer requires building your own client.

   • Content: colors, icons and a logo.
   • Delivery: packaged with the client or loaded at runtime.
   • Custom buttons: add links, for example to an internal wiki.

   🎨 Theming through the Helm chart (subscription only)

   Ship your theme as its own Docker image in a registry of your choice, including private ones. Set a few values in the Helm values file, enable the theme and sync. New pods start with a theme sidecar that copies the assets into the OpenCloud container. After the reload the web UI is branded.

   The enterprise documentation describes how to build such an image, it takes a few minutes.

   ✉️ New email design

   Notification emails have a new look based on the OpenCloud Design System.

   • Layout: OpenCloud logo, a heading and a button that opens the shared item, space or link.
   • Dark mode: logo and colors follow the mode of mail clients that support it.
   • Guest links: the PIN is shown in a highlighted box.
   • Daily and weekly summaries: events appear as a timeline with their time and a link to each shared item or space. Times are in UTC, because OpenCloud does not know the time zone of the recipient.
   • Compatibility: the templates reach 94 percent in an HTML email client check, well above the usual result for HTML emails.

   Plain-text emails and all existing translations stay the same.

   Custom templates: the HTML email now consists of layout.html.tmpl, message.html.tmpl and digest.html.tmpl in templates/html/. Existing custom template folders that only contain email.html.tmpl keep working as before. See the notifications service README for the new template values.

   Apps

   🖼️ Redesigned App Store

   • Grid or list: switch between both views, like in the Files app.
   • Official badge: apps maintained by OpenCloud are marked, so you see at a glance which apps are supported.
   • Tags and filter: apps have tags, for example "File Actions", and you can filter by them.
   • Download button: now prominent in the app details.

   ✅ Apps show version compatibility

   Find out at a glance why an app stopped working after an update.

   • Version range: each app can declare a minimum and a maximum OpenCloud version.
   • Admin overview: the compatible range is shown next to each installed app.
   • Mismatch warning: if an app does not match your OpenCloud version, its status turns red and a short hint explains the likely cause.

   Media and preview

   📷 HEIC, HEIF and AVIF photos open in the preview app

   Photos from iPhones and modern Android phones, and HEIF from Canon and Sony cameras (.hif), now open in the built-in viewer instead of downloading. Requested in the community since 2025, contributed by Dominik Schmidt.

   • Server-rendered: the viewer shows the preview the server renders, so it works in every browser. If the server has no preview for a file, the file is offered as a download, as before.
   • Vaults: encrypted images are decoded in the browser. AVIF opens everywhere, HEIC only in browsers that can decode it (Safari). Otherwise the viewer says so instead of downloading the file.
   • File list: these formats now show the image icon.
   • Errors: a broken image shows an error instead of a blank view.

   Admins: previews for these formats need the imagor-compatible thumbnail generator with the matching OC_THUMBNAILS_* and WEBDAV_THUMBNAILS_* settings, see the docs. Images above 7680 px are refused by the server.

   📷 Motion photo support

   The web client plays motion photos: the short video almost every modern phone records around a picture, known as Live Photo on iPhone and Motion Photo on Android.

   • Tile view: a play icon in the top right marks a motion photo and doubles as play/pause control. On hover the motion photo loops.
   • Preview app: the motion photo plays once when opening, then the still image remains. A "Play motion photo" button restarts the loop.

   📖 EPUB reader: fullscreen, search and a mobile layout

   Read and search a book directly in OpenCloud without a download and without installing an app.

   • Fullscreen mode.
   • Full text search inside the book and in the table of contents. Results are highlighted and take you to the position.
   • The table of contents highlights the chapter you are reading.
   • Position slider for navigation, since an EPUB has no fixed pages.
   • On small screens the text width adapts, navigation moves to the top, and the chapter list opens as a drawer from the bottom.

   🖌️ SVG files in the preview app

   SVG files are now displayed in the preview app. Every SVG goes through a sanitizer first, so script code inside an SVG cannot run.

   Limits:

   • SVG files do not show up in the photo roll.
   • Unusual SVG files, for example with an embedded bitmap, may not render.

   ▶️ Media controls in the preview app

   The playback controls were reworked. The actions are grouped by function now and separated visually, so it is easier to see what belongs together.

   Web UI

   🏗️ Create a space in one step

   Set up a space completely in the "New space" dialog instead of adjusting it afterwards. An Options button, like in the public link dialog, reveals:

   • Customization: image or emoji, subtitle, description, header.
   • Advanced options: quota and members.

   If you don't open the options, the dialog stays as simple as before.

   🔗 Redesigned public link and file drop pages

   The pages that people outside your instance see first got a new design.

   • Password page: a clearer card with lock icon and a stronger button. Password protection is the default for public links, so this is the most visible page of the set.
   • Access denied page: same layout.
   • Secret file drop: a dotted drop area, more guidance, and a clearer success message after upload.

   ✅ Grouped batch actions and deselect

   When you select multiple files, all available actions appear in a single bar at the top of the view. A new Deselect button clears the selection in one click.

   📂 Folders first, for every sort order

   Folders stay at the top of the file list when you sort by name, size or modified date, in both directions. A new option "Folders first" lets you turn this off and sort files and folders together. It is on by default, so nothing changes unless you switch it off.

   🧭 Web UI polish

   • The background now matches the sidebar (Material Design surface color).
   • The "New" button is far more prominent.
   • A new set of custom-designed file type icons, plus icons for more file types, including .drawio, .ifc, .odg, .oform and .root.
   • Right sidebar: one look across the Files app and the admin settings.
   • Activities and versions: a calmer timeline that fits many more versions on one screen, based on community feedback.
   • Tiles: a larger click area for selecting a tile.
   • Spaces: appearance settings are grouped under "Customize" in the context menu.
   • Account pages: two-column layout.
   • Vaults: the breadcrumb shows the vault icon in every subfolder.
   • Cleaner top bar in editors and viewers: The top app bar has a new layout that shows only what you need while editing or viewing a file. Its border is gone, which makes the header lighter.
   • Smaller space header: The space header with image, name and description uses less height, so more files are visible without scrolling. You can still expand it, and long descriptions stay readable with "show more".

   Operations and administration

   📢 Announcement banner

   Admins can show a banner to all users, for example before maintenance or an upgrade. Create, preview, enable and disable it in General Settings. Changes appear for everyone immediately, no restart needed. The banner supports Markdown for links and formatting.

   📊 Prometheus metrics for the Graph API

   The Graph API now exports Prometheus metrics:

   • HTTP requests: path and status code, so error rates, requests per second and concurrent requests are visible.
   • LDAP calls: which operations run and how long they take.
   • Nodes: how many Graph API nodes serve HTTP or process events.

   Everything is exported as histograms, so p50, p95 and p99 are available in Grafana, live or over a time window. Define alerts on top, for example errors per second or requests that are too slow.

   The Helm chart ships a Grafana suite with dashboards and about 10 alerts. The new metrics close its biggest blind spot, LDAP in particular.

   🔄 Automated search index migration through Helm hooks

   When an upgrade changes the search index, the Helm chart now handles the migration. Admins run nothing by hand.

   • Pre-upgrade hook: checks whether the OpenSearch index mapping needs to change and builds the new index.
   • Pod update: the pods are rolled to the new version.
   • Post-upgrade hook: triggers the rescan and index update for all spaces.

   Limitation: while an index update runs, the instance is down.

   The same hook mechanism can automate future breaking changes in the chart.

   👥 Admin settings

   • Search users by user name and email, not only by first and last name.
   • The quota column shows used space.
   • User and group edit panels are redesigned, "Login allowed" is a toggle.
3. suse-coder commented on Oct 27, 2026

   

   suse-coder

   on Oct 27, 2026

   Last edited by suse-coder

   More actions

   "OpenCloud runs on OpenShift
   The Helm chart supports OpenShift, based on customer feedback, and the setup is documented. The chart test suite simulates an OpenShift cluster and checks its security restrictions on every run, for allowed and for rejected workloads"

   -> Maybe have that also for talos kubernetes. At the end the helm chart should be the same.
4. v-scharf commented on Nov 4, 2026

   

   v-scharf

   on Nov 4, 2026

   Last edited by v-scharf

   ContributorAuthor

   More actions

   Upgrade test: 7.2.4 → 9.0.0

   between opencloudeu/opencloud:7.2.4 and opencloudeu/opencloud-rolling:9.0.0 (our RC) posix and bleve extractor
   using https://github.com/opencloud-eu/opencloud-compose

   Baseline (7.2.4)

   • git checkout stable-7.2
   • in .env: DEMO_USERS=true, INITIAL_ADMIN_PASSWORD=admin. Add GRAPH_SPACES_DEFAULT_QUOTA=20000000000 to opencloud.yml (20 GB to test the quota config change later).
   • COMPOSE_FILE=docker-compose.yml:traefik/opencloud.yml:weboffice/collabora.yml:traefik/collabora.yml:search/tika.yml
   • OC_DOCKER_IMAGE=opencloudeu/opencloud OC_DOCKER_TAG=7.2.4 docker compose up -d

   Create data: files, folders, versions, shares, public links, favorites, tags, trash (use the demo users alan/mary/margaret).

   Upgrade to 9.0.0

   • docker compose stop
   • git checkout main
   • COMPOSE_FILE=docker-compose.yml:yjs/yjs.yml:traefik/opencloud.yml:weboffice/collabora.yml:traefik/collabora.yml:search/tika.yml

   1. Update - adding auth_guest.service_account, dropping thumbnails.thumbnail

   docker run --rm -it --user 1000:1000 --entrypoint /bin/sh -v opencloud-compose_opencloud-config:/etc/opencloud opencloudeu/opencloud-rolling:9.0.0

   opencloud init --diff --config-path /etc/opencloud --insecure true

   @@ -66,15 +66,14 @@
      drivers:
        ldap:
          bind_password: <redacted>
   +auth_guest:
   +  service_account:
   +    service_account_id: <redacted>
   +    service_account_secret: <redacted>
    ocm:
      service_account:
        service_account_id: <redacted>
        service_account_secret: <redacted>
   -thumbnails:
   -  thumbnail:
   -    transfer_secret: <redacted>
   -    webdav_allow_insecure: true
   -    cs3_allow_insecure: true
    search:
      events:
        tls_insecure: true
   
   

   cd /etc/opencloud
   patch opencloud.yaml < opencloud.config.patch
   exit
   

   • start: OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling OC_DOCKER_TAG=9.0.0 docker compose up -d

   2. Update - search reindex

   • docker compose exec opencloud opencloud search index --all-spaces --force-rescan --insecure

   3. delete old thumbnails cache

   • docker compose exec opencloud rm -rf /var/lib/opencloud/thumbnails/files

   4. space quota.

   if you used GRAPH_SPACES_DEFAULT_QUOTA -> that is deprecated. after upgrade a new project space defaults to 1 GB
   you need set new env: OC_SPACES_DEFAULT_QUOTA=

   • check that all data still exists (files, versions, shares, public links, spaces, search).

   Note:

   • Motion / live photo need Tika 4.x (the default apache/tika:latest in opencloud-compose is 2.x and extracts no facet): set TIKA_IMAGE=apache/tika:4.2.1-SNAPSHOT, recreate tika,
   • Guest links: set OC_ENABLE_GUEST_LINKS=true, configure SMTP for the notifications service, restart OpenCloud.
5. v-scharf commented on Nov 4, 2026

   

   v-scharf

   on Nov 4, 2026

   ContributorAuthor

   More actions

   Upgrade test: 7.2.4 → 9.0.0 (decomposed fs + OpenSearch)

   OpenSearch exists only from 8.0.0, so the 7.2.4 baseline runs on embedded bleve; switch to OpenSearch after the upgrade.

   Create an override for decomposed:

   storage/decomposed.yml

   ---
   services:
     opencloud:
       environment:
         STORAGE_USERS_DRIVER: decomposed

   Baseline (7.2.4, decomposed, bleve)

   • git checkout stable-7.2
   • in .env: DEMO_USERS=true, INITIAL_ADMIN_PASSWORD=admin.
   • COMPOSE_FILE=docker-compose.yml:storage/decomposed.yml:traefik/opencloud.yml:weboffice/collabora.yml:traefik/collabora.yml:search/tika.yml
   • OC_DOCKER_IMAGE=opencloudeu/opencloud OC_DOCKER_TAG=7.2.4 docker compose up -d

   Create data: files, folders, versions, shares, public links, favorites, tags, trash (demo users alan/mary/margaret).
   using qa-script

   for a in files sharing spaces admin account search; do
     echo "=== seed $a ==="
     node release-testing/upgrade/run.mjs seed "$a" 2>&1 | tail -5
   done
   

   add image files for testing thumbnail

   Upgrade to 9.0.0

   • docker compose stop
   • git checkout main
   • change in .env:
     • OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling
     • OC_DOCKER_TAG=9.0.0
     • COMPOSE_FILE=docker-compose.yml:storage/decomposed.yml:yjs/yjs.yml:traefik/opencloud.yml:weboffice/collabora.yml:traefik/collabora.yml:search/tika.yml

   Migrate the config with a temporary 9.0.0 container mounting the config volume:

   docker run --rm -it --user 1000:1000 --entrypoint /bin/sh  -v opencloud-compose_opencloud-config:/etc/opencloud opencloudeu/opencloud-rolling:9.0.0
   

   opencloud init --diff --config-path /etc/opencloud --insecure true
   

   +auth_guest:
   +  service_account:
   +    service_account_id: <redacted>
   +    service_account_secret: <redacted>
   -thumbnails:
   -  thumbnail:
   -    transfer_secret: <redacted>
   -    webdav_allow_insecure: true
   -    cs3_allow_insecure: true

   cd /etc/opencloud
   patch opencloud.yaml < opencloud.config.patch
   exit
   

   • start: OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling OC_DOCKER_TAG=9.0.0 docker compose up -d
   • delete old thumbnails cache: docker compose exec opencloud rm -rf /var/lib/opencloud/thumbnails/files
   • check all data survived (files, versions, shares, public links, spaces):

   for a in files sharing spaces admin account search; do
     node release-testing/upgrade/run.mjs verify "$a" --phase before 2>&1 | tail -3
   done
   

   Switch search to OpenSearch (after upgrade)

   • add search/opensearch.yml to COMPOSE_FILE, then docker compose up -d (starts the opensearch container, points the search service at it).
   • build the index: docker compose exec opencloud opencloud search index --all-spaces --force-rescan --insecure
   • verify global search returns the baseline files, tag search works, and matching text shows in the preview.

   Notes

   • Motion / live photo need Tika 4.x (default apache/tika:latest is 2.x, extracts no facet):
     TIKA_IMAGE=apache/tika:4.2.1-SNAPSHOT, recreate tika, reindex.
     Playback also needs blob: in media-src of config/opencloud/csp.yaml.
   • Guest links: OC_ENABLE_GUEST_LINKS=true, configure SMTP, restart.