mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
08b8209455
Nextcloud: PHP's postgres driver tries to look up a client cert at $HOME/.postgresql/postgresql.crt (HOME=/root in this image) for verify-ca/verify-full sslmodes - 'Permission denied' there aborts the connection entirely with a confusing 'password authentication failed' secondary error. Confirmed live: psql with the identical credentials connects fine (uses sslmode=prefer, no cert lookup). PGSSLMODE=disable sidesteps it - this is an intra-cluster connection, not worth TLS here. n8n: chart's default liveness/readiness probe timing is tighter than n8n needs to actually finish starting - kubelet was killing the container (exitCode 143/SIGTERM) before it ever bound :5678, in an endless crashloop. Copied home's more generous probe timing.
104 lines
2.8 KiB
YAML
104 lines
2.8 KiB
YAML
# Nextcloud warm standby on the VPS - Phase 2. Same discipline as the
|
|
# other vps-standby apps: CNPG replica cluster (manifests/cnpg-cluster.yaml)
|
|
# keeps the DB warm, manifests/pvc-restore-cronjob.yaml keeps file content
|
|
# warm, and the app runs continuously too (replicaCount: 1, reachable at
|
|
# nextcloud.vps.huskypup.net - see manifests/ingress.yaml) so replicated
|
|
# files/users are browsable at all times - uploads/changes will error
|
|
# against the read-only DB until a deliberate manual promotion.
|
|
#
|
|
# No Redis here - the home instance uses the redis-operator
|
|
# (infrastructure/vps-standby has no redis-operator deployed, out of
|
|
# scope for a standby that isn't actually serving writable traffic).
|
|
# Nextcloud runs fine without Redis (falls back to DB-based locking,
|
|
# just slower) - add a real Redis at promotion time if desired.
|
|
replicaCount: 1
|
|
|
|
nextcloud:
|
|
host: nextcloud.vps.huskypup.net
|
|
username: ""
|
|
password: ""
|
|
|
|
phpConfigs:
|
|
upload.ini: |
|
|
upload_tmp_dir = /var/www/tmp
|
|
sys_temp_dir = /var/www/tmp
|
|
|
|
extraEnv:
|
|
- name: TMPDIR
|
|
value: /var/www/tmp
|
|
- name: PHP_MEMORY_LIMIT
|
|
value: "2G"
|
|
- name: PHP_UPLOAD_LIMIT
|
|
value: "10G"
|
|
# libpq (via PHP's pgsql/pdo_pgsql) defaults HOME=/root in this image
|
|
# but tries to look up a client cert at $HOME/.postgresql/postgresql.crt
|
|
# for higher sslmodes - "Permission denied" there aborts the whole
|
|
# connection outright (confirmed live: psql itself connects fine with
|
|
# the same creds, only PHP's driver hits this). CNPG's in-cluster
|
|
# Postgres connection doesn't need client-cert verification here.
|
|
- name: PGSSLMODE
|
|
value: "disable"
|
|
|
|
configs:
|
|
proxy.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'trusted_proxies' => array(
|
|
0 => '10.0.0.0/8',
|
|
1 => '172.16.0.0/12',
|
|
),
|
|
'overwriteprotocol' => 'https',
|
|
'overwrite.cli.url' => 'https://nextcloud.vps.huskypup.net',
|
|
'allow_local_remote_servers' => true,
|
|
);
|
|
temp.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'tempdirectory' => '/var/www/tmp',
|
|
);
|
|
|
|
existingSecret:
|
|
enabled: true
|
|
secretName: nextcloud-admin-secret
|
|
usernameKey: username
|
|
passwordKey: password
|
|
|
|
ingress:
|
|
enabled: false
|
|
|
|
externalDatabase:
|
|
enabled: true
|
|
type: postgresql
|
|
host: pg-nextcloud-rw
|
|
port: 5432
|
|
user: nextcloud
|
|
database: nextcloud
|
|
existingSecret:
|
|
enabled: true
|
|
secretName: pg-nextcloud-app
|
|
passwordKey: password
|
|
usernameKey: username
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: local-path
|
|
accessMode: ReadWriteOnce
|
|
size: 30Gi
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
redis:
|
|
enabled: false
|
|
|
|
externalRedis:
|
|
enabled: false
|
|
|
|
metrics:
|
|
enabled: false
|