Initial commit

apps/nextcloud/manifests/envoy-route.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+spec:
+  parentRefs:
+    - name: edge
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - nextcloud.kube.huskypup.net
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: nextcloud
+          port: 8080

apps/nextcloud/manifests/external-secret.yaml

@@ -0,0 +1,26 @@
+# kubernetes/apps/nextcloud/external-secret.yaml
+# ExternalSecrets for Nextcloud - pulls OAuth credentials from Vault
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: nextcloud-oauth
+  namespace: nextcloud
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: nextcloud-oauth-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client-id
+      remoteRef:
+        key: nextcloud-oauth
+        property: client-id
+    - secretKey: client-secret
+      remoteRef:
+        key: nextcloud-oauth
+        property: client-secret

apps/nextcloud/manifests/istio-virtualservice.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+spec:
+  hosts:
+    - nextcloud.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    - timeout: 3600s
+      route:
+        - destination:
+            host: nextcloud.nextcloud.svc.cluster.local
+            port:
+              number: 8080

apps/nextcloud/manifests/mariadb-deployment.yaml

@@ -0,0 +1,92 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mariadb-nextcloud
+  namespace: nextcloud
+  labels:
+    app: mariadb-nextcloud
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mariadb-nextcloud
+  template:
+    metadata:
+      labels:
+        app: mariadb-nextcloud
+    spec:
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 999
+        fsGroup: 999
+      containers:
+      - name: mariadb
+        image: mariadb:11.4
+        securityContext:
+          runAsUser: 999
+          runAsGroup: 999
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+        args:
+          - --character-set-server=utf8mb4
+          - --collation-server=utf8mb4_unicode_ci
+          - --init-connect=SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci
+        env:
+        - name: MARIADB_ROOT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: mariadb-nextcloud
+              key: root-password
+        - name: MARIADB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: mariadb-nextcloud
+              key: password
+        - name: MARIADB_USER
+          value: nextcloud
+        - name: MARIADB_DATABASE
+          value: nextcloud
+        ports:
+        - containerPort: 3306
+        volumeMounts:
+        - name: mariadb-data
+          mountPath: /var/lib/mysql
+        - name: tmp
+          mountPath: /tmp
+        - name: run-mysqld
+          mountPath: /run/mysqld
+      volumes:
+      - name: tmp
+        emptyDir: {}
+      - name: run-mysqld
+        emptyDir: {}
+      - name: mariadb-data
+        persistentVolumeClaim:
+          claimName: mariadb-nextcloud-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mariadb-nextcloud
+  namespace: nextcloud
+spec:
+  selector:
+    app: mariadb-nextcloud
+  ports:
+  - port: 3306
+    targetPort: 3306
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mariadb-nextcloud-pvc
+  namespace: nextcloud
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 10Gi

apps/nextcloud/manifests/mariadb-secrets.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: nextcloud-mariadb-password
+  namespace: nextcloud
+spec:
+  length: 32
+  digits: 5
+  symbols: 3
+  symbolCharacters: "-_$"
+  noUpper: false
+  allowRepeat: true
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: nextcloud-mariadb-secret
+  namespace: nextcloud
+spec:
+  refreshInterval: "24h"
+  target:
+    name: mariadb-nextcloud
+    creationPolicy: Owner
+    template:
+      data:
+        password: "{{ .password }}"
+        root-password: "{{ .password }}"
+        user: nextcloud
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: nextcloud-mariadb-password

apps/nextcloud/manifests/pvc.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-nextcloud
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: nextcloud
+    app.kubernetes.io/instance: nextcloud
+  annotations:
+    meta.helm.sh/release-name: nextcloud
+    meta.helm.sh/release-namespace: nextcloud
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block      # Rook-Ceph block storage
+  resources:
+    requests:
+      storage: 50Gi                 # whatever size you want

apps/nextcloud/values.yaml

@@ -0,0 +1,111 @@
+# values/nextcloud.values.yaml
+#
+# For chart: nextcloud/nextcloud
+# Repo:     https://nextcloud.github.io/helm/
+#
+# Optimized for large file uploads over 1Gbps link
+
+replicaCount: 1
+
+nextcloud:
+   host: nextcloud.kube.huskypup.net
+   username: ""
+   password: ""
+
+   # PHP configuration for large uploads
+   # Use /var/www/tmp (on Ceph PVC) instead of /tmp (on root overlay)
+   phpConfigs:
+      upload.ini: |
+        upload_tmp_dir = /var/www/tmp
+        sys_temp_dir = /var/www/tmp
+
+   # Environment variables for PHP
+   extraEnv:
+     - name: TMPDIR
+       value: /var/www/tmp
+     - name: PHP_MEMORY_LIMIT
+       value: "2G"
+     - name: PHP_UPLOAD_LIMIT
+       value: "10G"
+
+   configs:
+      oidc.config.php: |-
+        <?php
+        $CONFIG = array (
+          'oidc_login_provider_url' => 'https://auth.kube.huskypup.net/application/o/nextcloud/',
+          'oidc_login_client_id' => '',
+          'oidc_login_client_secret' => '',
+          'oidc_login_button_text' => 'Log in with Authentik',
+          'oidc_login_auto_redirect' => false,
+          'oidc_login_hide_password_form' => false,
+          'oidc_login_verify_ssl' => false,
+          'user_oidc' => array(
+            'httpclient.allowselfsigned' => true,
+          ),
+        );
+      proxy.config.php: |-
+        <?php
+        $CONFIG = array (
+          'trusted_proxies' => array(
+            0 => '10.0.0.0/8',
+            1 => '172.16.0.0/12',
+          ),
+          'overwriteprotocol' => 'https',
+          'overwrite.cli.url' => 'https://nextcloud.kube.huskypup.net',
+          'allow_local_remote_servers' => true,
+        );
+      # Use Ceph-backed temp directory for large uploads
+      temp.config.php: |-
+        <?php
+        $CONFIG = array (
+          'tempdirectory' => '/var/www/tmp',
+        );
+
+   existingSecret:
+      enabled: true
+      secretName: nextcloud-admin-secret
+      usernameKey: username
+      passwordKey: password
+
+   # Ingress disabled - Istio VirtualService handles routing
+   ingress:
+     enabled: false
+
+externalDatabase:
+   enabled: true
+   type: mysql
+   host: mariadb-nextcloud
+   port: 3306
+   user: nextcloud
+   database: nextcloud
+   existingSecret:
+      enabled: true
+      secretName: mariadb-nextcloud
+      passwordKey: password
+      usernameKey: user
+
+persistence:
+   enabled: true
+   storageClass: rook-ceph-block
+   accessMode: ReadWriteOnce
+   size: 50Gi
+
+securityContext:
+   allowPrivilegeEscalation: false
+   capabilities:
+     drop:
+       - ALL
+
+resources:
+   requests:
+     cpu: 50m
+     memory: 512Mi
+   limits:
+     cpu: 1000m
+     memory: 2Gi
+
+redis:
+   enabled: false
+
+metrics:
+   enabled: false