Fix Nextcloud Redis config: use externalRedis, not redis (bundled subchart toggle)

redis.enabled: true was unintentionally deploying the chart's BUNDLED redis
subchart (redis-21.1.3, StatefulSet nextcloud-redis-replicas) alongside
the actual redis-operator instance - that key's schema is pure subchart
passthrough (auth/image/master/replica), it has no host field. The
host/existingSecret keys previously set there were silently ignored.
Found while investigating why nextcloud-redis-replicas-0 was
crash-looping on failed liveness probes (confirmed via : the correct key for pointing at an external Redis
is the separate externalRedis: block).

This means Nextcloud's config.php may never have been correctly pointed
at the redis-operator instance despite apps/nextcloud/manifests/redis-cr.yaml
existing and being healthy - worth confirming file-locking/caching
actually engages after this deploys.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/nextcloud/values.yaml

@@ -109,17 +109,29 @@ resources:
      cpu: 1000m
      memory: 2Gi
 
+# `redis:` is purely the chart's BUNDLED subchart dependency toggle (its
+# schema is auth/image/master/replica passthrough to the redis-21.1.3
+# subchart, verified via `helm show values nextcloud/nextcloud`) - it has
+# no `host` field, and setting enabled: true here deploys a second, unused
+# Redis (nextcloud-redis-replicas StatefulSet) alongside the real one.
+# Found 2026-08-18: that bundled StatefulSet had been crash-looping on
+# failed liveness probes the whole time, and the `host`/`existingSecret`
+# keys previously set here were silently ignored (not valid subchart
+# keys) - meaning Nextcloud's actual config.php may never have been
+# correctly pointed at the redis-operator instance at all. The correct
+# key for "use an external Redis" is the separate `externalRedis:` block
+# below.
 redis:
-   # Was disabled; now points at the standalone Redis CR (redis-operator) in
-   # apps/nextcloud/manifests/redis-cr.yaml instead of the chart's bundled
-   # subchart - fixes Nextcloud's file-locking/caching as a side benefit of
-   # this migration. Verify these key names against `helm show values
-   # nextcloud/nextcloud` for the deployed chart version before applying.
+   enabled: false
+
+externalRedis:
    enabled: true
    host: redis-nextcloud
-   port: 6379
-   existingSecret: redis-nextcloud-secret
-   existingSecretPasswordKey: password
+   port: "6379"
+   existingSecret:
+      enabled: true
+      secretName: redis-nextcloud-secret
+      passwordKey: password
 
 metrics:
    enabled: false