Update docs

docs/_static/env-vars/frontend.yaml

@@ -161,6 +161,6 @@ password_policy:
   min_digits: 1
   min_special_characters: 1
   banned_passwords_list: ""
-configurable_notifications: false
+configurable_notifications: true
 groupware:
   enabled: false

docs/_static/env-vars/frontend_configvars.md

@@ -1,5 +1,5 @@
 
-2026-09-01-12-00-11
+2026-09-05-00-44-26
 
 ## Deprecation Notice
 
@@ -132,5 +132,5 @@
 |`OC_PASSWORD_POLICY_MIN_DIGITS`<br/>`FRONTEND_PASSWORD_POLICY_MIN_DIGITS`| 1.0.0 |int|`Define the minimum number of digits. Defaults to 1 if not set.`|`"1"`|
 |`OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS`<br/>`FRONTEND_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS`| 1.0.0 |int|`Define the minimum number of characters from the special characters list to be present. Defaults to 1 if not set.`|`"1"`|
 |`OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST`<br/>`FRONTEND_PASSWORD_POLICY_BANNED_PASSWORDS_LIST`| 1.0.0 |string|`Path to the 'banned passwords list' file. This only impacts public link password validation. See the documentation for more details.`|`""`|
-|`FRONTEND_CONFIGURABLE_NOTIFICATIONS`| 1.0.0 |bool|`Allow configuring notifications via web client.`|`"false"`|
+|`FRONTEND_CONFIGURABLE_NOTIFICATIONS`| 1.0.0 |bool|`Allow configuring notifications via web client.`|`"true"`|
 |`FRONTEND_GROUPWARE_ENABLED`| 3.7.0 |bool|`Enable groupware features. Defaults to false.`|`"false"`|

docs/_static/env-vars/graph.yaml

@@ -21,6 +21,7 @@ debug:
   pprof: false
   zpages: false
 http:
+  disabled: false
   addr: 127.0.0.1:9120
   root: /graph
   tls:
@@ -48,6 +49,8 @@ http:
     - Purge
     - Restore
     allow_credentials: true
+  metrics:
+    disabled: true
 api:
   group_members_patch_limit: 20
   graph_username_match: default
@@ -119,8 +122,13 @@ identity:
       school_number_attribute: ""
       school_id_attribute: ""
       school_termination_min_grace_days: 0
+    metrics:
+      disabled: true
+  metrics:
+    disabled: true
 include_ocm_sharees: false
 events:
+  disabled_consumer: false
   endpoint: 127.0.0.1:9233
   cluster: opencloud-cluster
   tls_insecure: false

docs/_static/env-vars/graph_configvars.md

@@ -18,6 +18,7 @@
 |`GRAPH_DEBUG_TOKEN`| 1.0.0 |string|`Token to secure the metrics endpoint.`|`""`|
 |`GRAPH_DEBUG_PPROF`| 1.0.0 |bool|`Enables pprof, which can be used for profiling.`|`"false"`|
 |`GRAPH_DEBUG_ZPAGES`| 1.0.0 |bool|`Enables zpages, which can be used for collecting and viewing in-memory traces.`|`"false"`|
+|`GRAPH_HTTP_DISABLE`| %NEXT% |bool|`Disables the HTTP service. Set this to true if the service should only consume events.`|`"false"`|
 |`GRAPH_HTTP_ADDR`| 1.0.0 |string|`The bind address of the HTTP service.`|`"127.0.0.1:9120"`|
 |`GRAPH_HTTP_ROOT`| 1.0.0 |string|`Subdirectory that serves as the root for this HTTP service.`|`"/graph"`|
 |`OC_HTTP_TLS_ENABLED`| 1.0.0 |bool|`Activates TLS for the http based services using the server certifcate and key configured via OC_HTTP_TLS_CERTIFICATE and OC_HTTP_TLS_KEY. If OC_HTTP_TLS_CERTIFICATE is not set a temporary server certificate is generated - to be used with PROXY_INSECURE_BACKEND=true.`|`"false"`|
@@ -28,6 +29,7 @@
 |`OC_CORS_ALLOW_METHODS`<br/>`GRAPH_CORS_ALLOW_METHODS`| 1.0.0 |[]string|`A list of allowed CORS methods. See following chapter for more details: *Access-Control-Request-Method* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method. See the Environment Variable Types description for more details.`|`"[GET POST PUT PATCH DELETE OPTIONS]"`|
 |`OC_CORS_ALLOW_HEADERS`<br/>`GRAPH_CORS_ALLOW_HEADERS`| 1.0.0 |[]string|`A list of allowed CORS headers. See following chapter for more details: *Access-Control-Request-Headers* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers. See the Environment Variable Types description for more details.`|`"[Authorization Origin Content-Type Accept X-Requested-With X-Request-Id Purge Restore]"`|
 |`OC_CORS_ALLOW_CREDENTIALS`<br/>`GRAPH_CORS_ALLOW_CREDENTIALS`| 1.0.0 |bool|`Allow credentials for CORS.See following chapter for more details: *Access-Control-Allow-Credentials* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials.`|`"true"`|
+|`GRAPH_HTTP_METRICS_DISABLE`| %NEXT% |bool|`Disables the metrics for the HTTP service.`|`"true"`|
 |`GRAPH_GROUP_MEMBERS_PATCH_LIMIT`| 1.0.0 |int|`The amount of group members allowed to be added with a single patch request.`|`"20"`|
 |`GRAPH_USERNAME_MATCH`| 1.0.0 |string|`Apply restrictions to usernames. Supported values are 'default' and 'none'. When set to 'default', user names must not start with a number and are restricted to ASCII characters. When set to 'none', no restrictions are applied. The default value is 'default'.`|`"default"`|
 |`GRAPH_ASSIGN_DEFAULT_USER_ROLE`| 1.0.0 |bool|`Whether to assign newly created users the default role 'User'. Set this to 'false' if you want to assign roles manually, or if the role assignment should happen at first login. Set this to 'true' (the default) to assign the role 'User' when creating a new user.`|`"true"`|
@@ -89,7 +91,10 @@
 |`GRAPH_LDAP_SCHOOL_NUMBER_ATTRIBUTE`| 1.0.0 |string|`LDAP Attribute to use for the number of a school.`|`""`|
 |`GRAPH_LDAP_SCHOOL_ID_ATTRIBUTE`| 1.0.0 |string|`LDAP Attribute to use as the unique id for schools. This should be a stable globally unique ID like a UUID.`|`""`|
 |`GRAPH_LDAP_SCHOOL_TERMINATION_MIN_GRACE_DAYS`| 1.0.0 |int|`When setting a 'terminationDate' for a school, require the date to be at least this number of days in the future.`|`"0"`|
+|`GRAPH_LDAP_METRICS_DISABLE`| %NEXT% |bool|`Disables the metrics for outbound LDAP operations.`|`"true"`|
+|`GRAPH_IDENTITY_BACKEND_METRICS_DISABLE`| %NEXT% |bool|`Disables the metrics for inbound identity backend operations.`|`"true"`|
 |`OC_ENABLE_OCM`<br/>`GRAPH_INCLUDE_OCM_SHAREES`| 1.0.0 |bool|`Include OCM sharees when listing users.`|`"false"`|
+|`GRAPH_EVENTS_DISABLE_CONSUMER`| %NEXT% |bool|`Disables consuming events. Set this to true if the service should only handle HTTP requests.`|`"false"`|
 |`OC_EVENTS_ENDPOINT`<br/>`GRAPH_EVENTS_ENDPOINT`| 1.0.0 |string|`The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Set to a empty string to disable emitting events.`|`"127.0.0.1:9233"`|
 |`OC_EVENTS_CLUSTER`<br/>`GRAPH_EVENTS_CLUSTER`| 1.0.0 |string|`The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture.`|`"opencloud-cluster"`|
 |`OC_INSECURE`<br/>`OC_EVENTS_TLS_INSECURE`<br/>`GRAPH_EVENTS_TLS_INSECURE`| 1.0.0 |bool|`Whether to verify the server TLS certificates.`|`"false"`|

docs/_static/env-vars/graph_readme.md

@@ -24,6 +24,12 @@ for a detailed specification of the API implemented by the graph service.
   * [Translation Rules](#translation-rules)
 * [Default Language](#default-language)
 * [Unified Role Management](#unified-role-management)
+* [API Handlers](#api-handlers)
+* [Metrics](#metrics)
+  * [Graph User Password Change Counter Metric](#graph-user-password-change-counter-metric)
+  * [Graph Inbound HTTP Request Duration Metrics](#graph-inbound-http-request-duration-metrics)
+  * [Graph Outbound LDAP Operation Duration Metrics](#graph-outbound-ldap-operation-duration-metrics)
+  * [Graph Identity Backend API Duration Metrics](#graph-identity-backend-api-duration-metrics)
 
 ## Sequence Diagram
 
@@ -188,7 +194,7 @@ The output of this command includes the following information for each role:
 * `Condition`
 * `Allowed resource actions`
 
-**Example output (shortned)**
+**Example output (shortened)**
 
 ```bash
 +--------------------------------------+----------+--------------------------------+--------------------------------+------------------------------------------+
@@ -204,4 +210,96 @@ The output of this command includes the following information for each role:
 +--------------------------------------+----------+--------------------------------+--------------------------------+------------------------------------------+
 ```
 
+## API Handlers
+
+To specialize `graph` service instances in order to scale them independently, it is possible to disable its API handlers:
+
+* `GRAPH_HTTP_DISABLE`: when set to `true`, the service does not listen on HTTP and only consumes events (defaults to `false`)
+* `GRAPH_EVENTS_DISABLE_CONSUMER`: when set to `true`, the service does not consome events and only listens on HTTP (defaults to `false`)
+
+## Metrics
+
+Metrics are disabled by default, and must be enabled using the following environment variables:
+
+* `GRAPH_LDAP_METRICS_DISABLE`: set to `false` to enable metrics for the duration of outbound LDAP client operations (defaults to `true`)
+* `GRAPH_HTTP_METRICS_DISABLE`: set to `false` to enable metrics for the duration of inbound Graph HTTP API requests (defaults to `true`)
+* `GRAPH_IDENTITY_BACKEND_METRICS_DISABLE`: set to `false` to enable metrics for the duration of Graph identity backend operations (defaults to `true`)
+
+The `graph` service provides the following metrics:
+
+| Name | Description |
+| ---- | ----------- |
+| `opencloud_graph_build_info{version=...}` | Contains a label `version` that is set to the current version of the service, and always has a value of `1` |
+| `opencloud_graph_events_enabled` | Is set to `1` if the Events API handler is enabled, or `0` if not |
+| `opencloud_graph_http_enabled` | Is set to `1` if the HTTP API handler is enabled, or `0` if not |
+| `opencloud_graph_events{event=...,result=...}` | Counts the number of events that have been consumed, with a `event` label that contains the name of the event, and a `result` label that is set to `success` or `failure` |
+| `opencloud_graph_events_invalid` | Counts the number of invalid events that are malformed or are missing required data |
+| `opencloud_graph_events_unsupported` | Counts the numbef of consumed events that cannot be processes by this service, should always be `0` |
+| `opencloud_graph_user_password_changes{result=...,reason=...}` | Counts the number of user password change attempts, including the reason for failure when `result`=`failure` |
+| `opencloud_graph_http_request_duration_seconds{method=...,path=...,version=...,resource=...,code=...,result=...}` | Histogram that measures the duration of Graph HTTP API requests, in buckets |
+| `opencloud_graph_http_requests` | Gauge that counts the number of concurrent inbound HTTP requests to the Graph API |
+| `opencloud_graph_ldap_client_operation_duration_seconds{uri=...,write=...,operation=...,result=...}` | Histogram that measures the duration of outbound LDAP operations |
+| `opencloud_graph_ldap_client_operations{uri=...,write=...}` | Gauge that counts the number of concurrent outbound LDAP operations |
+| `opencloud_graph_identity_backend_api_duration_seconds{type=...,operation=...,result=...}` | Histogram that measures the duration of requests to the Graph identity backend, in buckets |
+
+To create some moderate load on a running `opencloud` instance, one can use the k6 script `load_test.js` as follows:
+
+```bash
+k6 run --vus=10 --duration=3m ./load_test.js
+```
+
+The following environment variables can be used to influence its behavior:
+
+ * `BASE_URL`: defaults to `https://localhost:9200`
+ * `USERNAME`: defaults to `alan`
+ * `PASSWORD`: defaults to `demo`
+
+For example, to use a different user and a different URL:
+
+```bash
+k6 run --vus=10 --duration=3m -e USERNAME=lynn -e BASE_URL=https://localhost:9201 ./load_test.js
+```
+
+It is not meant to be a feature test suite, but merely a small k6 script to generate some read-only load in order to make Grafana displays.
+
+### Graph User Password Change Counter Metric
+
+For `opencloud_graph_user_password_changes`:
+
+* `result` is either
+  * `success`: when the password was changed successfully
+  * `failure`: when the password could not be changed, the reason being tracked in the `reason` label
+* `reason` is either
+  * empty when `result` is `success`
+  * `invalid`: when parameters were invalid, such as the new password being an empty password
+  * `error`: when an error prevented the password change, such as a network failure
+  * `wrong-password`: when the password change was refused because the current password is wrong
+
+### Graph Inbound HTTP Request Duration Metrics
+
+For `opencloud_graph_http_request_duration_seconds`:
+
+* `method` is the HTTP method (`GET`, `PUT`, ...)
+* `path` is the canonical request path with placeholders (e.g. `/v1beta1/drives/{driveID}/root/children`)
+* `version` is the Graph API version (`v1beta` or `v1.0`)
+* `resource` is the top-level resource after the version (`me`, `application`, `drives`, ...)
+* `code` is the resulting HTTP status code (`200`, `404`, `500`, ...)
+* `result` is one of `success`, `client-error`, `server-error`
+
+### Graph Outbound LDAP Operation Duration Metrics
+
+For `opencloud_graph_ldap_client_operation_duration_seconds`:
+
+* `operation` is the name of the LDAP operation (`add`, `delete`, `modify`, `modify-dn`, ...)
+* `result` is either `success`, `failure`, `read-only` (when attempting a write operation on a LDAP server that is configured as read-only in OpenCloud) or `not-found`
+* `uri` contains the LDAP server URI the client is connected to
+* `write` is set to `1` if the LDAP client is allowed to perform write operations, or to `0` if it is configured to be read-only
+
+### Graph Identity Backend API Duration Metrics
+
+* `type` is the type of the identity backend that is being used (`ldap` or `cs3`)
+* `operation` is the name of the API operation (`create-user`, `get-users`, ...)
+* `result` is `success`, `failure` or `not-found`
+
+
 

docs/_static/env-vars/storage-users_configvars.md

@@ -1,5 +1,5 @@
 
-2026-09-01-12-00-11
+2026-09-05-00-44-26
 
 ## Deprecation Notice
 

docs/_static/env-vars/web_configvars.md

@@ -1,5 +1,5 @@
 
-2026-09-01-12-00-11
+2026-09-05-00-44-26
 
 ## Deprecation Notice