diff --git a/docs/customizing.rst b/docs/customizing.rst
index 92920f5958db8b7ee6bae0d59f95053bad2c5f98..b01c24c49d356af04d10c1cb9ba6c7247a997cf6 100644
--- a/docs/customizing.rst
+++ b/docs/customizing.rst
@@ -21,7 +21,7 @@ Prerequisites
`Stackspin installation instructions <installation_instructions.html>`__
Customize Stackspin applications
-==========================
+================================
Apps deployed by Stackspin are configured using helm values from templates in
``flux2/apps/<application>/release.yaml``. It is possible to override values
diff --git a/docs/testing.rst b/docs/testing.rst
index 5611b274e78d653493f6b11fdcdac7678810e787..6d98d81d77fbebf2e4897c0abaf49ee9c20ee1fa 100644
--- a/docs/testing.rst
+++ b/docs/testing.rst
@@ -15,7 +15,7 @@ During these instructions, please replace *example.org* with your own
domain name.
Stackspin installation
-----------------
+----------------------
First we’d like you to setup an Stackspin cluster by yourself,
following the :ref:`installation_overview` and :ref:`usage:Usage` documentation and make sure
diff --git a/docs/troubleshooting.rst b/docs/troubleshooting.rst
index b7b9c2870b69e39afcd2bf123e31d490c07168d8..135a989d56e07f34cfbfc0626bae24ff31465a31 100644
--- a/docs/troubleshooting.rst
+++ b/docs/troubleshooting.rst
@@ -423,7 +423,7 @@ running ``flux reconcile kustomization kube-prometheus-stack`` (replace
message).
Purge Stackspin and install from scratch
-----------------------------------
+----------------------------------------
If ever things fail beyond possible recovery, here's how to completely purge an
Stackspin installation in order to start from scratch:
diff --git a/docs/upgrading.rst b/docs/upgrading.rst
index e53f51b4f29d1970ff9f55e74f3bf178204c4cbc..ba810f1ef325c4632a658474e6484d7f8ed074c3 100644
--- a/docs/upgrading.rst
+++ b/docs/upgrading.rst
@@ -4,31 +4,105 @@ Upgrading
Upgrading to 0.8.0 (not released yet)
-------------------------------------
-When upgrading to version 0.8.0 you'll get the newest versions of several
-database helm charts that have changed significantly. Because they have, you'll
-have to manually remove the following statefulsets (note: as long as you haven't
-overwritten any of the `persistence:` variables for those charts, you can do
-this without risk. If you have, make sure to back up your PVCs).
-
-```
-kubectl delete statefulset -n oas-apps nc-mariadb nc-redis-master nc-rabbitmq nc-postgresql
-```
-
-If your Nextcloud helmrelease gets stuck in a non-ready state, you can run this
-to force re-reconciliation:
-
-```
-flux suspend helmrelease nextcloud -n oas-apps
-flux resume helmrelease nextcloud -n oas-apps
-```
-
-If aftewards your ``nc-nextcloud-xxxxxxxxxx-xxxxx`` pod is stuck in the
-``Initializing`` phase, you can delete it to make sure its replacement connects
-to the new databases:
-
-```
-kubectl delete pod -n oas-apps nc-nextcloud-xxxxxxxxxx-xxxxx
-```
+When upgrading to version 0.8.0 OpenAppStack will be renamed to its final name:
+*Stackspin*. This comes with many changes, some of which need to be applied
+manually.
+
+We have written a script to automate a lot of the preparations for the upgrade.
+However, afterwards you might need to get your hands dirty to get all your
+applications to work again. **Read this whole upgrade guide carefully, before
+you get started!**
+
+.. code:: bash
+
+ # Log into your Stackspin server
+ ssh <server>
+ # Download our upgrade script
+ wget https://open.greenhost.net/stackspin/stackspin/-/raw/main/upgrade-scripts/to-0.8.0/rename-to-stackspin.sh
+ chmod +x rename-to-stackspin.sh
+
+**This script will cause serious down time and it will not do everything for
+you**. Rather, it will prepare your cluster for the upgrade.
+
+The script does the following:
+
+
+#. Install ``jq``
+#. Shut down the cluster, make a back-up of the data, and bring the cluster back
+ up
+#. Copy all relevant ``oas-*`` secrets to ``stackspin-*``
+#. Move all PersistentVolumeClaims to the ``stackspin`` and ``stackspin-apps``
+ namespaces and sets the PersistentVolumes ReclaimPolicy to "Retain" so your
+ data is not accidentally deleted.
+#. Delete all OAS ``flux`` kustomizations
+#. Delete the ``oas`` and ``oas-apps`` namespace
+#. Create the new ``stackspin`` source and kustomization
+
+.. code:: bash
+
+ # Execute the upgrade preparation script
+ ./rename-to-stackspin.sh
+
+After this, you need to manually re-install the applications by running
+``install/install-app.sh <app>`` from the Stackspin repository. See the
+application specific upgrade guides below.
+
+**After all your applications work again**, you can clean up the old secrets and
+reset the Persistent Volume ReclaimPolicy to ``Delete``
+
+.. code:: bash
+
+ wget https://open.greenhost.net/stackspin/stackspin/-/raw/main/upgrade-scripts/to-0.8.0/cleanup.sh
+ chmod +x cleanup.sh
+ ./cleanup.sh
+
+Nextcloud
+~~~~~~~~~
+
+Your SSO users will have new usernames, because the OIDC provider has been
+renamed from ``oas`` to ``stackspin``. You can choose from these options:
+
+1. Manually re-upload and re-share your files after logging into your new user
+ for the first time.
+2. It is possible to transfer files from your previous user to the new user. To
+ do so:
+
+ .. code:: bash
+
+ # Exec into the Nextcloud container
+ kubectl exec -n stackspin-apps nc-nextcloud-xxx-xxx -it -- /bin/bash
+ # Change to the www-data user
+ su www-data -s /bin/bash
+ # Repeat this command for each username
+ php occ files:transfer-ownership oas-<username> stackspin-<username>
+ # Note: the files are tranferred to a subfolder in the new user's
+ # directory
+
+Rocket.Chat
+~~~~~~~~~~~
+
+We haven't found a way to keep your old Rocket.Chat history. Because we will
+soon `replace Rocket.Chat with Zulip
+<https://open.greenhost.net/stackspin/stackspin/-/issues/997>` we have not put
+energy into providing an upgrade path. If you want to upgrade Rocket.Chat
+without data loss, this should theoretically be possible with a ``mongodb``
+backup that you can restore into a database with a different hostname.
+
+Monitoring
+~~~~~~~~~~
+
+The monitoring stack will work after the upgrade, but monitoring data from the
+previous version will not be available.
+
+Wekan
+~~~~~
+
+In our testing we didn't need to change anything for Wekan to work.
+
+WordPress
+~~~~~~~~~
+
+In our testing we didn't need to change anything for WordPress to work.
Upgrading to 0.7.0
------------------
diff --git a/docs/usage.rst b/docs/usage.rst
index 81e6f459d759a541827af5e7e7d4cb9b57701360..79e57d5a94d52497a27bdbf030e9e546c736bdd2 100644
--- a/docs/usage.rst
+++ b/docs/usage.rst
@@ -2,7 +2,7 @@ Usage
=====
Stackspin User panel
---------------
+--------------------
After all the applications are installed, the first thing to do is log into
`https://admin.stackspin.example.org <https://admin.stackspin.example.org>`__.
diff --git a/flux2/apps/nextcloud/nextcloud-values-configmap.yaml b/flux2/apps/nextcloud/nextcloud-values-configmap.yaml
index 0536119c59b9563f17396efa4f5b6b2738da9b8d..f18b5c9590d773b766398ef9ab1c3283bf97f1cc 100644
--- a/flux2/apps/nextcloud/nextcloud-values-configmap.yaml
+++ b/flux2/apps/nextcloud/nextcloud-values-configmap.yaml
@@ -199,10 +199,12 @@ data:
sociallogin:
custom_oidc:
+ name: stackspin
+ title: Stackspin
authorizeUrl: "https://sso.${domain}/oauth2/auth"
tokenUrl: "https://sso.${domain}/oauth2/token"
userInfoUrl: "https://sso.${domain}/userinfo"
clientSecret: "${nextcloud_oauth_client_secret}"
groupsClaim: "stackspin_roles"
clientId: nextcloud
- title: Stackspin
+ scope: "openid profile email stackspin_roles"
diff --git a/upgrade-scripts/to-0.8.0/cleanup.sh b/upgrade-scripts/to-0.8.0/cleanup.sh
new file mode 100755
index 0000000000000000000000000000000000000000..25c5f9276e22c9005f0b6b599bc96a17a2c12b49
--- /dev/null
+++ b/upgrade-scripts/to-0.8.0/cleanup.sh
@@ -0,0 +1,16 @@
+#! /usr/bin/env bash
+
+# Clean up oas-* secrets
+kubectl delete secret -n flux-system oas-cluster-variables
+kubectl delete secret -n flux-system oas-single-sign-on-variables
+kubectl delete secret -n flux-system oas-oauth-variables
+kubectl delete secret -n flux-system oas-kube-prometheus-stack-variables
+kubectl delete secret -n flux-system oas-nextcloud-variables
+kubectl delete secret -n flux-system oas-wekan-variables
+kubectl delete secret -n flux-system oas-rocketchat-variables
+kubectl delete secret -n flux-system oas-wordpress-variables
+
+# Set retain policy for PVs back to "Delete"
+for pv in $(kubectl get pv --no-headers | awk '{print $1}'); do
+ kubectl patch pv "$pv" -p '{"spec":{"persistentVolumeReclaimPolicy":"Delete"}}'
+done
diff --git a/upgrade-scripts/to-0.8.0/rename-to-stackspin.sh b/upgrade-scripts/to-0.8.0/rename-to-stackspin.sh
new file mode 100755
index 0000000000000000000000000000000000000000..68a8b52836779fea437da44a5fa817fd9465e996
--- /dev/null
+++ b/upgrade-scripts/to-0.8.0/rename-to-stackspin.sh
@@ -0,0 +1,100 @@
+#! /usr/bin/env bash
+set -euo pipefail
+
+sudo snap install jq
+
+echo "Stopping k3s service for backup"
+/usr/local/bin/k3s-killall.sh
+echo "Backing up all PVCs to /var/lib/OpenAppStack.tar.gz"
+cd /var/lib
+tar -czf OpenAppStack.tar.gz OpenAppStack
+cd -
+echo "Starting k3s service"
+sudo systemctl start k3s
+
+echo "adding stackspin-named secrets"
+kubectl get secret -n flux-system oas-cluster-variables -o json | jq '.metadata.name="stackspin-cluster-variables"' | kubectl apply -f -
+kubectl get secret -n flux-system oas-single-sign-on-variables -o json | jq '.metadata.name="stackspin-single-sign-on-variables"' | kubectl apply -f -
+kubectl get secret -n flux-system oas-oauth-variables -o json | jq '.metadata.name="stackspin-oauth-variables"' | kubectl apply -f -
+kubectl get secret -n flux-system oas-kube-prometheus-stack-variables -o json | jq '.metadata.name="stackspin-kube-prometheus-stack-variables"' | kubectl apply -f -
+kubectl get secret -n flux-system oas-nextcloud-variables -o json | jq '.metadata.name="stackspin-nextcloud-variables"' | kubectl apply -f -
+kubectl get secret -n flux-system oas-wekan-variables -o json | jq '.metadata.name="stackspin-wekan-variables"' | kubectl apply -f -
+kubectl get secret -n flux-system oas-rocketchat-variables -o json | jq '.metadata.name="stackspin-rocketchat-variables"' | kubectl apply -f -
+kubectl get secret -n flux-system oas-wordpress-variables -o json | jq '.metadata.name="stackspin-wordpress-variables"' | kubectl apply -f -
+
+# Backs up pvcs to /tmp/$namespace/$pvc.yaml and sets their pv's to "retain"
+backup_pvc() {
+ pvc=$1
+ old_namespace=$2
+ new_namespace=$3
+
+ pv="$(kubectl get pvc -n "$old_namespace" "$pvc" --template '{{ .spec.volumeName }}')"
+ pv_path="$(kubectl get pv "$pv" --template '{{ .spec.local.path }}')"
+
+ echo "Backing up PVC '$pvc' with PV '$pv' from namespace '$old_namespace'"
+ echo "PV path: '$pv_path'"
+
+ # Make namespace backup directory
+ mkdir -p "/tmp/$old_namespace"
+
+ # back-up PVC and PV manifests
+ kubectl get pvc -n "$old_namespace" "$pvc" -o yaml >"/tmp/$old_namespace/$pvc.yaml"
+ kubectl get pv "$pv" -o yaml >"/tmp/$old_namespace/$pv.yaml"
+
+ # Set reclaimpolicy for PV
+ kubectl patch pv "$pv" -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}'
+
+ # Re-add PVC in new namespace
+ grep -v -e "uid:" -e "resourceVersion:" -e "namespace:" -e "selfLink:" "/tmp/$old_namespace/$pvc.yaml" | kubectl -n "$new_namespace" apply -f -
+
+ # Get new pvc UID
+ uid=$(kubectl get -n "$new_namespace" pvc "$pvc" --template '{{ .metadata.uid }}')
+
+ # Set new PVC UID in PV
+ kubectl patch pv "$pv" -p '{"spec":{"claimRef":{"uid":"'"$uid"'","name":null}}}'
+
+ echo "When all is fine, re-set the reclaimPolicy to Delete:"
+ echo "kubectl patch pv \"'$pv'\" -p '{\"spec\":{\"persistentVolumeReclaimPolicy\":\"Delete\"}}'"
+}
+
+# Move all PVCs to stackspin namespace
+oas_pvcs="single-sign-on-userbackend storage-loki-0 grafana alertmanager-kube-prometheus-stack-alertmanager-db-alertmanager-kube-prometheus-stack-alertmanager-0 prometheus-kube-prometheus-stack-prometheus-db-prometheus-kube-prometheus-stack-prometheus-0"
+for pvc in $oas_pvcs; do
+ backup_pvc "$pvc" oas stackspin
+done
+
+# Move all PVCs to stackspin-apps namespace
+oas_apps_pvcs="nextcloud-postgresql nextcloud-mariadb nextcloud-onlyoffice-data nextcloud-files wekan datadir-rocketchat-mongodb-0 rocketchat-rocketchat wordpress-files wordpress-mariadb"
+for pvc in $oas_apps_pvcs; do
+ backup_pvc "$pvc" oas-apps stackspin-apps
+done
+
+# Remove the old source and kustomization
+flux delete --silent kustomization openappstack
+# Remove old add-apps kustomizations
+apps="monitoring nextcloud rocketchat velero wekan wordpress"
+for app in $apps; do
+ flux delete --silent kustomization "add-$app"
+ flux delete --silent kustomization "$app"
+done
+flux delete --silent source git openappstack
+
+# Delete old namespaces
+kubectl delete ns oas
+kubectl delete ns oas-apps
+
+# Add the new source and kustomization
+flux create source git stackspin \
+ --url=https://open.greenhost.net/stackspin/stackspin \
+ --branch="main" \
+ --interval=1h
+
+flux create kustomization stackspin \
+ --source=GitRepository/stackspin \
+ --path="./flux2/cluster/base" \
+ --prune=true \
+ --interval=1h
+
+echo "All upgrades have been prepared, but Flux will have to do some work now. Check the progress of your flux kustomizations with 'flux get ks'. You can speed up the process by manually triggering flux reconciles".
+echo "Once everything seems to work, re-add your app kustomizations by re-running the install/install-\$app script"
+echo "Refer to the upgrade guide for app specific upgrades"