Phase 2: deploy n8n and Nextcloud warm standbys on the VPS

Same CNPG replica-cluster pattern as Authentik (continuous WAL replay from home via VPS MinIO, app at 0 replicas until manual promotion - see infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml for the full rationale). n8n: N8N_ENCRYPTION_KEY copied byte-identical from home (kubectl, not git) - decrypts stored credentials in the replicated DB, same reasoning as Vault's unseal key / root token copies. Nextcloud: adds infrastructure/vps-standby/nextcloud/manifests/ pvc-restore-cronjob.yaml, the read side of home's existing nextcloud-pvc-sync restic backup - restores the latest snapshot from VPS MinIO into this standby's PVC daily at 04:00 (2h after home's 02:00 backup). No Redis on the VPS side (no redis-operator deployed there, out of scope for a standby that isn't serving traffic - Nextcloud degrades gracefully to DB-based locking without it).
2026-08-20 23:16:49 +00:00 · 2026-08-17 22:31:41 -05:00
parent 1a657ad0a4
commit 85c916285e
7 changed files with 479 additions and 0 deletions
@@ -0,0 +1,94 @@
+# Nextcloud warm standby on the VPS - Phase 2. Same discipline as the
+# other vps-standby apps: CNPG replica cluster (manifests/cnpg-cluster.yaml)
+# keeps the DB warm, manifests/pvc-restore-cronjob.yaml keeps file content
+# warm, but the app itself stays at replicaCount: 0 until a deliberate
+# manual promotion.
+#
+# No Redis here - the home instance uses the redis-operator
+# (infrastructure/vps-standby has no redis-operator deployed, out of
+# scope for a standby that isn't actually serving traffic). Nextcloud
+# runs fine without Redis (falls back to DB-based locking, just slower) -
+# acceptable for an emergency-promotion scenario; add a real Redis at
+# promotion time if desired.
+replicaCount: 0
+
+nextcloud:
+   host: nextcloud.kube.huskypup.net
+   username: ""
+   password: ""
+
+   phpConfigs:
+      upload.ini: |
+        upload_tmp_dir = /var/www/tmp
+        sys_temp_dir = /var/www/tmp
+
+   extraEnv:
+     - name: TMPDIR
+       value: /var/www/tmp
+     - name: PHP_MEMORY_LIMIT
+       value: "2G"
+     - name: PHP_UPLOAD_LIMIT
+       value: "10G"
+
+   configs:
+      proxy.config.php: |-
+        <?php
+        $CONFIG = array (
+          'trusted_proxies' => array(
+            0 => '10.0.0.0/8',
+            1 => '172.16.0.0/12',
+          ),
+          'overwriteprotocol' => 'https',
+          'overwrite.cli.url' => 'https://nextcloud.kube.huskypup.net',
+          'allow_local_remote_servers' => true,
+        );
+      temp.config.php: |-
+        <?php
+        $CONFIG = array (
+          'tempdirectory' => '/var/www/tmp',
+        );
+
+   existingSecret:
+      enabled: true
+      secretName: nextcloud-admin-secret
+      usernameKey: username
+      passwordKey: password
+
+   ingress:
+     enabled: false
+
+externalDatabase:
+   enabled: true
+   type: postgresql
+   host: pg-nextcloud-rw
+   port: 5432
+   user: nextcloud
+   database: nextcloud
+   existingSecret:
+      enabled: true
+      secretName: pg-nextcloud-app
+      passwordKey: password
+      usernameKey: username
+
+persistence:
+   enabled: true
+   storageClass: local-path
+   accessMode: ReadWriteOnce
+   size: 30Gi
+
+resources:
+   requests:
+     cpu: 50m
+     memory: 256Mi
+   limits:
+     cpu: 500m
+     memory: 1Gi
+
+redis:
+   enabled: false
+
+externalRedis:
+   enabled: false
+
+metrics:
+   enabled: false