Minimal set of environments to run without config file

[mhymny]

In the past I have figured out some minimal configuration that I needed so I could run my instance without a config file. It has been far over a year, so I don't remember every detail. However, I have been running into some issues lately, and I think I might be missing some configuration. Is there a minimal set of environments that I need to run opencloud?
E.g.
I have been using these environment variables:

--- secrets
COLLABORATION_WOPI_SECRET
GRAPH_LDAP_BIND_PASSWORD
IDM_ADMIN_PASSWORD
IDM_IDPSVC_PASSWORD
IDM_REVASVC_PASSWORD
IDM_SVC_PASSWORD
IDP_LDAP_BIND_PASSWORD
OC_JWT_SECRET
OC_LDAP_BIND_PASSWORD
OC_MACHINE_AUTH_API_KEY
OC_SERVICE_ACCOUNT_SECRET
OC_SYSTEM_USER_API_KEY
OC_TRANSFER_SECRET
THUMBNAILS_TRANSFER_TOKEN

--- not secrets
OC_URL
OC_ASYNC_UPLOADS
PROXY_TLS
PROXY_HTTP_ADDR
PROXY_CSP_CONFIG_FILE_LOCATION
FRONTEND_CHECK_FOR_UPDATES
OC_SYSTEM_USER_ID
OC_ADMIN_USER_ID
OC_SERVICE_ACCOUNT_ID
GRAPH_APPLICATION_ID
STORAGE_USERS_MOUNT_ID
GATEWAY_STORAGE_USERS_MOUNT_ID
---- USED BELOW FOR OIDC, I GUESS THESE CAN BE OMITTED
OC_EXCLUDE_RUN_SERVICES
PROXY_ENABLE_BASIC_AUTH
OC_OIDC_ISSUER
EXTERNAL_OIDC_DOMAIN
PROXY_OIDC_REWRITE_WELLKNOWN
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD
PROXY_USER_OIDC_CLAIM
PROXY_USER_CS3_CLAIM
PROXY_AUTOPROVISION_ACCOUNTS
PROXY_AUTOPROVISION_CLAIM_USERNAME
PROXY_AUTOPROVISION_CLAIM_EMAIL
PROXY_AUTOPROVISION_CLAIM_DISPLAYNAME
PROXY_AUTOPROVISION_CLAIM_GROUPS
PROXY_ROLE_ASSIGNMENT_DRIVER
GRAPH_ASSIGN_DEFAULT_USER_ROLE
GRAPH_USERNAME_MATCH
GRAPH_LDAP_SERVER_WRITE_ENABLED
WEB_OIDC_CLIENT_ID
WEB_OIDC_SCOPE
WEB_OIDC_METADATA_URL

This makes deployment especially easy, as even with new deployments, there is nothing I have to initialize or configure. Configuring via environments is more intuitive. Now that things seem to have broken I want to restart finding out the minimal set and wanted to ask, whether anyone might know some documentation or anything that I haven't found.

[mhymny]

Out of curiosity I started to check how minimal I can go in the whole deployment:

OC_EXCLUDE_RUN_SERVICES=activitylog,antivirus,app-provider,app-registry,audit,auth-app,auth-basic,auth-bearer,auth-machine,auth-service,clientlog,collaboration,eventhistory,frontend,gateway,graph,groups,idm,idp,invitations,nats,notifications,ocm,ocs,policies,postprocessing,proxy,search,settings,sharing,sse,storage-publiclink,storage-shares,storage-system,storage-users,thumbnails,userlog,users,web,webdav,webfinger
OC_JWT_SECRET=F3Ksxh7UCV3F&!y!S%=pj+GPZ94Axx8N
OC_TRANSFER_SECRET=dDIpT.BY8FXtQnF^btpsgoGBrw*O8t9!
OC_MACHINE_AUTH_API_KEY=qiav6.#D0MmXczVd2dN^f*-7bbb*dhBT
OC_SYSTEM_USER_ID=200859ba-4f3a-4432-a636-82424d6f917b

While not really working, this got me a running container:

podman run --rm -it  -v ./data/:/var/lib/opencloud:Z,U --env-file env -p 9200:9200 opencloudeu/opencloud:7.2
{"level":"error","error":"error connecting to nats cluster opencloud-cluster: error connecting to nats at 127.0.0.1:9233 with tls enabled (false): nats: no servers available for connection","time":"2026-07-06T20:49:05Z","caller":"github.com/cenkalti/backoff@v2.2.1+incompatible/retry.go:24","message":"can't connect to nats (jetstream) server, retrying in 1.589529784s"}

[mhymny]

While not reachable it looks like this doesn't throw errors:

OC_EXCLUDE_RUN_SERVICES=activitylog,antivirus,app-provider,app-registry,audit,auth-app,auth-basic,auth-bearer,auth-machine,auth-service,clientlog,collaboration,eventhistory,frontend,graph,groups,idm,idp,invitations,notifications,ocm,ocs,policies,postprocessing,proxy,search,settings,sharing,sse,storage-publiclink,storage-shares,storage-system,storage-users,thumbnails,userlog,users,web,webdav,webfinger
OC_JWT_SECRET=F3Ksxh7UCV3F&!y!S%=pj+GPZ94Axx8N
OC_TRANSFER_SECRET=dDIpT.BY8FXtQnF^btpsgoGBrw*O8t9!
OC_MACHINE_AUTH_API_KEY=qiav6.#D0MmXczVd2dN^f*-7bbb*dhBT
OC_SYSTEM_USER_ID=200859ba-4f3a-4432-a636-82424d6f917b
GATEWAY_STORAGE_USERS_MOUNT_ID=6e61aa80-29c5-4234-8e14-aa1c8fa71029

[mhymny]

A reachable site with errors:

OC_EXCLUDE_RUN_SERVICES=activitylog,antivirus,app-provider,app-registry,audit,auth-app,auth-basic,auth-bearer,auth-machine,auth-service,clientlog,collaboration,eventhistory,frontend,graph,groups,idm,idp,invitations,notifications,ocm,ocs,policies,postprocessing,search,settings,sharing,sse,storage-publiclink,storage-shares,storage-system,storage-users,thumbnails,userlog,users,webdav,webfinger
OC_JWT_SECRET=F3Ksxh7UCV3F&!y!S%=pj+GPZ94Axx8N
OC_TRANSFER_SECRET=dDIpT.BY8FXtQnF^btpsgoGBrw*O8t9!
OC_MACHINE_AUTH_API_KEY=qiav6.#D0MmXczVd2dN^f*-7bbb*dhBT
OC_SYSTEM_USER_ID=200859ba-4f3a-4432-a636-82424d6f917b
GATEWAY_STORAGE_USERS_MOUNT_ID=6e61aa80-29c5-4234-8e14-aa1c8fa71029
OC_SERVICE_ACCOUNT_ID=e0108a5d-e2b8-4b12-ae07-14b10ec8e765
OC_SERVICE_ACCOUNT_SECRET=wUe-N!fxHo#M8M56gPwF!OiyiKa&=dYU

[mhymny]

This seems to be the smallest I could come up with, I get the login form, can't login though right now, will check tomorrow:

OC_EXCLUDE_RUN_SERVICES=activitylog,antivirus,app-provider,audit,auth-app,auth-basic,auth-machine,auth-service,clientlog,collaboration,eventhistory,graph,groups,invitations,notifications,ocm,ocs,policies,postprocessing,search,settings,sharing,sse,storage-publiclink,storage-shares,storage-system,storage-users,thumbnails,userlog,users,webdav
OC_JWT_SECRET=F3Ksxh7UCV3F&!y!S%=pj+GPZ94Axx8N
OC_TRANSFER_SECRET=dDIpT.BY8FXtQnF^btpsgoGBrw*O8t9!
OC_MACHINE_AUTH_API_KEY=qiav6.#D0MmXczVd2dN^f*-7bbb*dhBT
OC_SYSTEM_USER_ID=200859ba-4f3a-4432-a636-82424d6f917b
GATEWAY_STORAGE_USERS_MOUNT_ID=6e61aa80-29c5-4234-8e14-aa1c8fa71029
OC_SERVICE_ACCOUNT_ID=e0108a5d-e2b8-4b12-ae07-14b10ec8e765
OC_SERVICE_ACCOUNT_SECRET=wUe-N!fxHo#M8M56gPwF!OiyiKa&=dYU
IDP_LDAP_BIND_PASSWORD=1V=iJyX!#^MyxXiNHTVwhBn@B#khP%=q
IDM_SVC_PASSWORD=j1Sj=u.Hhb38kTDeSJzt414qOaRvdH%-
#IDM_ADMIN_PASSWORd=admin
IDM_IDPSVC_PASSWORD=1V=iJyX!#^MyxXiNHTVwhBn@B#khP%=q
IDM_REVASVC_PASSWORD=Zw8iPEei9zmmMRSzkZXtE*ED2%t4W6QP

[mhymny]

I can now login with admin/admin, however don't have storage yet:

OC_EXCLUDE_RUN_SERVICES=activitylog,antivirus,app-provider,audit,auth-app,auth-basic,clientlog,collaboration,eventhistory,groups,invitations,notifications,ocm,ocs,policies,postprocessing,search,sharing,sse,storage-publiclink,storage-shares,storage-users,thumbnails,userlog,webdav
OC_JWT_SECRET=F3Ksxh7UCV3F&!y!S%=pj+GPZ94Axx8N
OC_TRANSFER_SECRET=dDIpT.BY8FXtQnF^btpsgoGBrw*O8t9!
OC_MACHINE_AUTH_API_KEY=qiav6.#D0MmXczVd2dN^f*-7bbb*dhBT
OC_SYSTEM_USER_ID=200859ba-4f3a-4432-a636-82424d6f917b
OC_SYSTEM_USER_API_KEY=qZlRFiZT0meR+*X+z$%!Frw1D#kTS-QW
GATEWAY_STORAGE_USERS_MOUNT_ID=6e61aa80-29c5-4234-8e14-aa1c8fa71029
OC_SERVICE_ACCOUNT_ID=e0108a5d-e2b8-4b12-ae07-14b10ec8e765
OC_SERVICE_ACCOUNT_SECRET=wUe-N!fxHo#M8M56gPwF!OiyiKa&=dYU
IDP_LDAP_BIND_PASSWORD=1V=iJyX!#^MyxXiNHTVwhBn@B#khP%=q
IDM_SVC_PASSWORD=j1Sj=u.Hhb38kTDeSJzt414qOaRvdH%-
IDM_ADMIN_PASSWORD=admin
IDM_IDPSVC_PASSWORD=1V=iJyX!#^MyxXiNHTVwhBn@B#khP%=q
IDM_REVASVC_PASSWORD=Zw8iPEei9zmmMRSzkZXtE*ED2%t4W6QP
USERS_LDAP_BIND_PASSWORD=Zw8iPEei9zmmMRSzkZXtE*ED2%t4W6QP
GRAPH_LDAP_BIND_PASSWORD=j1Sj=u.Hhb38kTDeSJzt414qOaRvdH%-
GRAPH_APPLICATION_ID=b576d288-edf6-4c97-831f-eefb6f671109

[mhymny]

Working storage:

OC_EXCLUDE_RUN_SERVICES=activitylog,antivirus,app-provider,audit,auth-app,auth-basic,clientlog,collaboration,eventhistory,groups,invitations,notifications,ocm,ocs,policies,postprocessing,search,sharing,sse,storage-publiclink,storage-shares,thumbnails,userlog,webdav
OC_JWT_SECRET=F3Ksxh7UCV3F&!y!S%=pj+GPZ94Axx8N
OC_TRANSFER_SECRET=dDIpT.BY8FXtQnF^btpsgoGBrw*O8t9!
OC_MACHINE_AUTH_API_KEY=qiav6.#D0MmXczVd2dN^f*-7bbb*dhBT
OC_SYSTEM_USER_ID=200859ba-4f3a-4432-a636-82424d6f917b
OC_SYSTEM_USER_API_KEY=qZlRFiZT0meR+*X+z$%!Frw1D#kTS-QW
GATEWAY_STORAGE_USERS_MOUNT_ID=6e61aa80-29c5-4234-8e14-aa1c8fa71029
OC_SERVICE_ACCOUNT_ID=e0108a5d-e2b8-4b12-ae07-14b10ec8e765
OC_SERVICE_ACCOUNT_SECRET=wUe-N!fxHo#M8M56gPwF!OiyiKa&=dYU
IDP_LDAP_BIND_PASSWORD=1V=iJyX!#^MyxXiNHTVwhBn@B#khP%=q
IDM_SVC_PASSWORD=j1Sj=u.Hhb38kTDeSJzt414qOaRvdH%-
IDM_ADMIN_PASSWORD=admin
IDM_IDPSVC_PASSWORD=1V=iJyX!#^MyxXiNHTVwhBn@B#khP%=q
IDM_REVASVC_PASSWORD=Zw8iPEei9zmmMRSzkZXtE*ED2%t4W6QP
USERS_LDAP_BIND_PASSWORD=Zw8iPEei9zmmMRSzkZXtE*ED2%t4W6QP
GRAPH_LDAP_BIND_PASSWORD=j1Sj=u.Hhb38kTDeSJzt414qOaRvdH%-
GRAPH_APPLICATION_ID=b576d288-edf6-4c97-831f-eefb6f671109
STORAGE_USERS_MOUNT_ID=6e61aa80-29c5-4234-8e14-aa1c8fa71029

[mhymny]

It looks like you'd at least need these services:
app-registry,auth-bearer,auth-machine,auth-service,frontend,gateway,graph,idm,idp,nats,proxy,settings,storage-system,storage-users,users,web

This gives me a system where I can login into and upload files. With an external IDP this can probably be further skimmed down. Can someone confirm whether this is the leanest possible configuration you can get to an env-only setup. From here I think you can enable further services to smoothen the experience.