mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby HuskyandClaude Sonnet 5
2fc7fb5b59
redis.enabled: true was unintentionally deploying the chart's BUNDLED redis subchart (redis-21.1.3, StatefulSet nextcloud-redis-replicas) alongside the actual redis-operator instance - that key's schema is pure subchart passthrough (auth/image/master/replica), it has no host field. The host/existingSecret keys previously set there were silently ignored. Found while investigating why nextcloud-redis-replicas-0 was crash-looping on failed liveness probes (confirmed via : the correct key for pointing at an external Redis is the separate externalRedis: block). This means Nextcloud's config.php may never have been correctly pointed at the redis-operator instance despite apps/nextcloud/manifests/redis-cr.yaml existing and being healthy - worth confirming file-locking/caching actually engages after this deploys. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
138 lines
4.5 KiB
YAML
138 lines
4.5 KiB
YAML
# values/nextcloud.values.yaml
|
|
#
|
|
# For chart: nextcloud/nextcloud
|
|
# Repo: https://nextcloud.github.io/helm/
|
|
#
|
|
# Optimized for large file uploads over 1Gbps link
|
|
|
|
replicaCount: 1
|
|
|
|
nextcloud:
|
|
host: nextcloud.kube.huskypup.net
|
|
username: ""
|
|
password: ""
|
|
|
|
# PHP configuration for large uploads
|
|
# Use /var/www/tmp (on Ceph PVC) instead of /tmp (on root overlay)
|
|
phpConfigs:
|
|
upload.ini: |
|
|
upload_tmp_dir = /var/www/tmp
|
|
sys_temp_dir = /var/www/tmp
|
|
|
|
# Environment variables for PHP
|
|
extraEnv:
|
|
- name: TMPDIR
|
|
value: /var/www/tmp
|
|
- name: PHP_MEMORY_LIMIT
|
|
value: "2G"
|
|
- name: PHP_UPLOAD_LIMIT
|
|
value: "10G"
|
|
|
|
configs:
|
|
oidc.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'oidc_login_provider_url' => 'https://auth.kube.huskypup.net/application/o/nextcloud/',
|
|
'oidc_login_client_id' => 'HmTGnUfhCvjFFbUUAne7JLrucNC2X675JicPbEnQ',
|
|
'oidc_login_client_secret' => 'qTUf4NYjzUuAqfNV5D7SFPuuhJJwVltU6U3LAuJVy7dddJWeJSv2B4wKaRxbbHqpIiSfYPDaKujhEysKbOWUnf4n9OHPKJ0bu1I2EzkYtChO1Gq4gUv5EHPTzQlMBPnl',
|
|
'oidc_login_button_text' => 'Log in with Authentik',
|
|
'oidc_login_auto_redirect' => false,
|
|
'oidc_login_hide_password_form' => false,
|
|
'oidc_login_verify_ssl' => false,
|
|
'user_oidc' => array(
|
|
'httpclient.allowselfsigned' => true,
|
|
),
|
|
);
|
|
proxy.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'trusted_proxies' => array(
|
|
0 => '10.0.0.0/8',
|
|
1 => '172.16.0.0/12',
|
|
),
|
|
'overwriteprotocol' => 'https',
|
|
'overwrite.cli.url' => 'https://nextcloud.kube.huskypup.net',
|
|
'allow_local_remote_servers' => true,
|
|
);
|
|
# Use Ceph-backed temp directory for large uploads
|
|
temp.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'tempdirectory' => '/var/www/tmp',
|
|
);
|
|
|
|
existingSecret:
|
|
enabled: true
|
|
secretName: nextcloud-admin-secret
|
|
usernameKey: username
|
|
passwordKey: password
|
|
|
|
# Ingress disabled - Istio VirtualService handles routing
|
|
ingress:
|
|
enabled: false
|
|
|
|
externalDatabase:
|
|
enabled: true
|
|
# Moved from MariaDB to CNPG-backed Postgres (apps/nextcloud/manifests/cnpg-cluster.yaml)
|
|
# for backup/DR consistency with the rest of the stack (n8n, Authentik, GitLab
|
|
# all use CNPG's native barmanObjectStore backup - MariaDB needed a bespoke
|
|
# mysqldump job instead). pg-nextcloud-rw is CNPG's generated read-write
|
|
# Service name for the "pg-nextcloud" Cluster.
|
|
#
|
|
# IMPORTANT: switching type here does NOT migrate existing data. Nextcloud
|
|
# requires an explicit `occ db:convert-type pgsql ...` run before cutover if
|
|
# there's real data in the old MariaDB instance. usernameKey/passwordKey below
|
|
# match CNPG's generated app-secret keys (confirmed against the existing,
|
|
# already-working infrastructure/authentik/values.yaml pg-authentik-app usage).
|
|
type: postgresql
|
|
host: pg-nextcloud-rw
|
|
port: 5432
|
|
user: nextcloud
|
|
database: nextcloud
|
|
existingSecret:
|
|
enabled: true
|
|
secretName: pg-nextcloud-app
|
|
passwordKey: password
|
|
usernameKey: username # matches CNPG's generated app-secret key, confirmed against infrastructure/authentik/values.yaml's existing pg-authentik-app usage
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: rook-ceph-block
|
|
accessMode: ReadWriteOnce
|
|
size: 200Gi
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
|
|
# `redis:` is purely the chart's BUNDLED subchart dependency toggle (its
|
|
# schema is auth/image/master/replica passthrough to the redis-21.1.3
|
|
# subchart, verified via `helm show values nextcloud/nextcloud`) - it has
|
|
# no `host` field, and setting enabled: true here deploys a second, unused
|
|
# Redis (nextcloud-redis-replicas StatefulSet) alongside the real one.
|
|
# Found 2026-08-18: that bundled StatefulSet had been crash-looping on
|
|
# failed liveness probes the whole time, and the `host`/`existingSecret`
|
|
# keys previously set here were silently ignored (not valid subchart
|
|
# keys) - meaning Nextcloud's actual config.php may never have been
|
|
# correctly pointed at the redis-operator instance at all. The correct
|
|
# key for "use an external Redis" is the separate `externalRedis:` block
|
|
# below.
|
|
redis:
|
|
enabled: false
|
|
|
|
externalRedis:
|
|
enabled: true
|
|
host: redis-nextcloud
|
|
port: "6379"
|
|
existingSecret:
|
|
enabled: true
|
|
secretName: redis-nextcloud-secret
|
|
passwordKey: password
|
|
|
|
metrics:
|
|
enabled: false
|