---
# Standalone Redis via the ot-container-kit redis-operator that's already
# deployed as infra (argocd-apps/infrastructure/redis-operator.yaml) but
# currently unused - GitLab's Redis is a hand-rolled StatefulSet instead
# (apps/gitlab/manifests/redis-cluster.yaml), not this operator. This is the
# first real consumer of it in the repo.
#
# Verified against the live CRD (redis.redis.redis.opstreelabs.in) 2026-08-17:
# apiVersion is v1beta1, not v1beta2 as originally guessed here (blocked
# ArgoCD from syncing the *entire* nextcloud Application - it validates all
# resource types up front, so one unknown apiVersion blocks everything, not
# just this resource). redisSecret also belongs nested under
# kubernetesConfig, not top-level.
apiVersion: generators.external-secrets.io/v1alpha1
kind: Password
metadata:
  name: nextcloud-redis-password
  namespace: nextcloud
spec:
  length: 32
  digits: 5
  symbols: 0
  noUpper: false
  allowRepeat: true
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: nextcloud-redis-password
  namespace: nextcloud
spec:
  refreshInterval: "0"  # generate once, don't rotate (Redis CR reads this at pod start only)
  target:
    name: redis-nextcloud-secret
    creationPolicy: Owner
    template:
      data:
        password: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: nextcloud-redis-password
---
apiVersion: redis.redis.opstreelabs.in/v1beta1
kind: Redis
metadata:
  name: redis-nextcloud
  namespace: nextcloud
spec:
  # Without this, the redis process can't write to its PVC-backed data dirs
  # (appendonlydir, node-conf) - "Permission denied", confirmed live 2026-08-17.
  # 1000 matches the opstree/redis image's default non-root "redis" user.
  podSecurityContext:
    fsGroup: 1000
    runAsUser: 1000
  kubernetesConfig:
    image: quay.io/opstree/redis:v7.0.12
    imagePullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 25m
        memory: 128Mi
      limits:
        cpu: 250m
        memory: 256Mi
    redisSecret:
      name: redis-nextcloud-secret
      key: password
  redisExporter:
    # image is required by the CRD schema even when enabled: false
    enabled: false
    image: quay.io/opstree/redis-exporter:v1.44.0
  storage:
    volumeClaimTemplate:
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: rook-ceph-block
        resources:
          requests:
            storage: 2Gi