Merge fix/nextcloud-oidc-reach: allow_local_remote_servers for private-IP IdP + platform-admins→admin (#2,#5)

catalog/nextcloud.yaml

@@ -102,6 +102,15 @@ lifecycle:
             [ "$i" -ge 300 ] && { echo "[nextcloud-oidc] occ not ready (installed/maintenance) after wait; skipping" >&2; exit 0; }
             sleep 2
           done
+          # Let Nextcloud's OWN server-side HTTP client reach the private-network IdP. The Keycloak
+          # FQDN resolves (split-horizon) to the PRIVATE Cilium gateway VIP (RFC1918), and Nextcloud's
+          # SSRF guard otherwise REFUSES that request — OCP\Http\Client\LocalServerException "violates
+          # local access rules" — during user_oidc's discovery/JWKS/token fetch AT LOGIN, surfacing to
+          # the user as "Could not reach the provider". (The (b) curl check below uses system libcurl,
+          # NOT this guard, so it passes while the browser login still failed.) Idempotent; re-applied
+          # every start so it survives pod rolls / PVC rebuilds. Confirmed root cause 2026-08-27.
+          OCC config:system:set allow_local_remote_servers --value=true --type=boolean >/dev/null 2>&1 \
+            || echo "[nextcloud-oidc] WARN: failed to set allow_local_remote_servers" >&2
           if [ -z "${NEXTCLOUD_OIDC_CLIENT_SECRET:-}" ]; then
             echo "[nextcloud-oidc] client secret unset; skipping OIDC (break-glass admin only)"
             exit 0
@@ -148,6 +157,23 @@ lifecycle:
           else
             nextcloud_oidc_fail "user_oidc:provider ran but the provider did not persist after retries"
           fi
+          # (d) Promote Keycloak 'platform-admins' members to Nextcloud admins (#5). user_oidc 8.11 has
+          #     NO native group->admin mapping (occ user_oidc:provider offers group PROVISIONING and a
+          #     login WHITELIST only), so mirror the provisioned 'platform-admins' membership into the
+          #     built-in 'admin' group (the sole source of admin rights in Nextcloud). Idempotent every
+          #     start: occ group:adduser is a no-op for an existing member. A user is promotable only
+          #     AFTER their first OIDC login provisions them into the group, so a brand-new admin gains
+          #     rights on their next login + the following pod start (or run `occ group:adduser admin
+          #     <uid>` once). The LOCAL break-glass admin is unaffected (docs/15). The group name is
+          #     passed to php as argv (never interpolated) so group:list JSON parses robustly.
+          ADMIN_SRC_GROUP=platform-admins
+          admin_members=$(su -s /bin/sh www-data -c "php /var/www/html/occ group:list --output=json" 2>/dev/null \
+            | php -r '$d=json_decode(stream_get_contents(STDIN),true);$g=$argv[1];if(is_array($d)&&!empty($d[$g])&&is_array($d[$g])){foreach($d[$g] as $u){echo $u,"\n";}}' -- "$ADMIN_SRC_GROUP" 2>/dev/null)
+          for uid in $admin_members; do
+            if OCC group:adduser admin "$uid" >/dev/null 2>&1; then
+              echo "[nextcloud-oidc] ensured '$uid' is a Nextcloud admin (member of $ADMIN_SRC_GROUP)"
+            fi
+          done
 exposure: public                # edge port-forward + public DNS (docs/09; R-DNS/R-NET)
 egress: internet                # normal WAN egress (docs/03; R-NET-05) — app store, integrity checks
 storage:
@@ -172,8 +198,14 @@ auth:
   # import.yaml + live kcadm) is registered as a user_oidc login provider ("keycloak") by the postStart
   # hook (occ user_oidc:provider), using the client secret mirrored into nextcloud-bootstrap
   # (oidc-client-secret; same value SOPS-held in keycloak-realm-clients). The `groups` claim drives
-  # user_oidc group provisioning (R-IDP-06). Nextcloud KEEPS its LOCAL admin as the break-glass path so
-  # an IdP outage never locks the operator out (docs/15 "Availability caveat"). No secret is embedded here.
+  # user_oidc group provisioning (R-IDP-06). Members of `platform-admins` are ELEVATED to Nextcloud
+  # admins by the postStart hook step (d) — user_oidc 8.11 has no native group->admin mapping, so the
+  # provisioned membership is mirrored into the built-in `admin` group idempotently on every start; a
+  # user is promoted after their first login provisions them + the next pod start. Nextcloud KEEPS its
+  # LOCAL admin as the break-glass path so an IdP outage never locks the operator out (docs/15
+  # "Availability caveat"). Reachability to the IdP at login requires allow_local_remote_servers=true
+  # (set by the hook): the Keycloak FQDN resolves to the private gateway VIP, which Nextcloud's SSRF
+  # guard blocks by default ("Could not reach the provider"). No secret is embedded here.
 update:
   channel: stable               # R-UPD-01
   range: ">=31.0.0 <32.0.0"     # stay on the 31.x stable line