Initial commit

apps/nextcloud/manifests/envoy-route.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+spec:
+  parentRefs:
+    - name: edge
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - nextcloud.kube.huskypup.net
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: nextcloud
+          port: 8080

apps/nextcloud/manifests/external-secret.yaml

@@ -0,0 +1,26 @@
+# kubernetes/apps/nextcloud/external-secret.yaml
+# ExternalSecrets for Nextcloud - pulls OAuth credentials from Vault
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: nextcloud-oauth
+  namespace: nextcloud
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: nextcloud-oauth-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client-id
+      remoteRef:
+        key: nextcloud-oauth
+        property: client-id
+    - secretKey: client-secret
+      remoteRef:
+        key: nextcloud-oauth
+        property: client-secret

apps/nextcloud/manifests/istio-virtualservice.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+spec:
+  hosts:
+    - nextcloud.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    - timeout: 3600s
+      route:
+        - destination:
+            host: nextcloud.nextcloud.svc.cluster.local
+            port:
+              number: 8080

apps/nextcloud/manifests/mariadb-deployment.yaml

@@ -0,0 +1,92 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mariadb-nextcloud
+  namespace: nextcloud
+  labels:
+    app: mariadb-nextcloud
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mariadb-nextcloud
+  template:
+    metadata:
+      labels:
+        app: mariadb-nextcloud
+    spec:
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 999
+        fsGroup: 999
+      containers:
+      - name: mariadb
+        image: mariadb:11.4
+        securityContext:
+          runAsUser: 999
+          runAsGroup: 999
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+        args:
+          - --character-set-server=utf8mb4
+          - --collation-server=utf8mb4_unicode_ci
+          - --init-connect=SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci
+        env:
+        - name: MARIADB_ROOT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: mariadb-nextcloud
+              key: root-password
+        - name: MARIADB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: mariadb-nextcloud
+              key: password
+        - name: MARIADB_USER
+          value: nextcloud
+        - name: MARIADB_DATABASE
+          value: nextcloud
+        ports:
+        - containerPort: 3306
+        volumeMounts:
+        - name: mariadb-data
+          mountPath: /var/lib/mysql
+        - name: tmp
+          mountPath: /tmp
+        - name: run-mysqld
+          mountPath: /run/mysqld
+      volumes:
+      - name: tmp
+        emptyDir: {}
+      - name: run-mysqld
+        emptyDir: {}
+      - name: mariadb-data
+        persistentVolumeClaim:
+          claimName: mariadb-nextcloud-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mariadb-nextcloud
+  namespace: nextcloud
+spec:
+  selector:
+    app: mariadb-nextcloud
+  ports:
+  - port: 3306
+    targetPort: 3306
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mariadb-nextcloud-pvc
+  namespace: nextcloud
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block
+  resources:
+    requests:
+      storage: 10Gi

apps/nextcloud/manifests/mariadb-secrets.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: nextcloud-mariadb-password
+  namespace: nextcloud
+spec:
+  length: 32
+  digits: 5
+  symbols: 3
+  symbolCharacters: "-_$"
+  noUpper: false
+  allowRepeat: true
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: nextcloud-mariadb-secret
+  namespace: nextcloud
+spec:
+  refreshInterval: "24h"
+  target:
+    name: mariadb-nextcloud
+    creationPolicy: Owner
+    template:
+      data:
+        password: "{{ .password }}"
+        root-password: "{{ .password }}"
+        user: nextcloud
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: nextcloud-mariadb-password

apps/nextcloud/manifests/pvc.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-nextcloud
+  namespace: nextcloud
+  labels:
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: nextcloud
+    app.kubernetes.io/instance: nextcloud
+  annotations:
+    meta.helm.sh/release-name: nextcloud
+    meta.helm.sh/release-namespace: nextcloud
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: rook-ceph-block      # Rook-Ceph block storage
+  resources:
+    requests:
+      storage: 50Gi                 # whatever size you want