# values/nextcloud.values.yaml
#
# For chart: nextcloud/nextcloud
# Repo:     https://nextcloud.github.io/helm/
#
# Optimized for large file uploads over 1Gbps link

replicaCount: 1

nextcloud:
   host: nextcloud.kube.huskypup.net
   username: ""
   password: ""

   # PHP configuration for large uploads
   # Use /var/www/tmp (on Ceph PVC) instead of /tmp (on root overlay)
   phpConfigs:
      upload.ini: |
        upload_tmp_dir = /var/www/tmp
        sys_temp_dir = /var/www/tmp

   # Environment variables for PHP
   extraEnv:
     - name: TMPDIR
       value: /var/www/tmp
     - name: PHP_MEMORY_LIMIT
       value: "2G"
     - name: PHP_UPLOAD_LIMIT
       value: "10G"

   configs:
      oidc.config.php: |-
        <?php
        $CONFIG = array (
          'oidc_login_provider_url' => 'https://auth.kube.huskypup.net/application/o/nextcloud/',
          'oidc_login_client_id' => 'HmTGnUfhCvjFFbUUAne7JLrucNC2X675JicPbEnQ',
          'oidc_login_client_secret' => 'qTUf4NYjzUuAqfNV5D7SFPuuhJJwVltU6U3LAuJVy7dddJWeJSv2B4wKaRxbbHqpIiSfYPDaKujhEysKbOWUnf4n9OHPKJ0bu1I2EzkYtChO1Gq4gUv5EHPTzQlMBPnl',
          'oidc_login_button_text' => 'Log in with Authentik',
          'oidc_login_auto_redirect' => false,
          'oidc_login_hide_password_form' => false,
          'oidc_login_verify_ssl' => false,
          'user_oidc' => array(
            'httpclient.allowselfsigned' => true,
          ),
        );
      proxy.config.php: |-
        <?php
        $CONFIG = array (
          'trusted_proxies' => array(
            0 => '10.0.0.0/8',
            1 => '172.16.0.0/12',
          ),
          'overwriteprotocol' => 'https',
          'overwrite.cli.url' => 'https://nextcloud.kube.huskypup.net',
          'allow_local_remote_servers' => true,
        );
      # Use Ceph-backed temp directory for large uploads
      temp.config.php: |-
        <?php
        $CONFIG = array (
          'tempdirectory' => '/var/www/tmp',
        );

   existingSecret:
      enabled: true
      secretName: nextcloud-admin-secret
      usernameKey: username
      passwordKey: password

   # Ingress disabled - Istio VirtualService handles routing
   ingress:
     enabled: false

externalDatabase:
   enabled: true
   # Moved from MariaDB to CNPG-backed Postgres (apps/nextcloud/manifests/cnpg-cluster.yaml)
   # for backup/DR consistency with the rest of the stack (n8n, Authentik, GitLab
   # all use CNPG's native barmanObjectStore backup - MariaDB needed a bespoke
   # mysqldump job instead). pg-nextcloud-rw is CNPG's generated read-write
   # Service name for the "pg-nextcloud" Cluster.
   #
   # IMPORTANT: switching type here does NOT migrate existing data. Nextcloud
   # requires an explicit `occ db:convert-type pgsql ...` run before cutover if
   # there's real data in the old MariaDB instance. usernameKey/passwordKey below
   # match CNPG's generated app-secret keys (confirmed against the existing,
   # already-working infrastructure/authentik/values.yaml pg-authentik-app usage).
   type: postgresql
   host: pg-nextcloud-rw
   port: 5432
   user: nextcloud
   database: nextcloud
   existingSecret:
      enabled: true
      secretName: pg-nextcloud-app
      passwordKey: password
      usernameKey: username  # matches CNPG's generated app-secret key, confirmed against infrastructure/authentik/values.yaml's existing pg-authentik-app usage

persistence:
   enabled: true
   storageClass: rook-ceph-block
   accessMode: ReadWriteOnce
   size: 200Gi

resources:
   requests:
     cpu: 50m
     memory: 512Mi
   limits:
     cpu: 1000m
     memory: 2Gi

redis:
   # Was disabled; now points at the standalone Redis CR (redis-operator) in
   # apps/nextcloud/manifests/redis-cr.yaml instead of the chart's bundled
   # subchart - fixes Nextcloud's file-locking/caching as a side benefit of
   # this migration. Verify these key names against `helm show values
   # nextcloud/nextcloud` for the deployed chart version before applying.
   enabled: true
   host: redis-nextcloud
   port: 6379
   existingSecret: redis-nextcloud-secret
   existingSecretPasswordKey: password

metrics:
   enabled: false