mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby Husky
7990f1fa47
Foundation for a DR/backup path using an always-on VPS as a second ArgoCD-managed cluster, plus DB/backup standardization work that fell out of it: - vps-standby ArgoCD cluster destination + AppProject, MinIO backup receiver, VPS bootstrap script (k3s, Netbird, cert-manager) - Dual-site DNS failover watcher + home-IP DDNS CronJob, Cloudflare token moved out of git into Vault+ExternalSecret - Nextcloud migrated from ad-hoc MariaDB to CNPG + redis-operator (matches n8n/Authentik/GitLab's backup-native pattern) - Authentik's CNPG manifests moved into the actual ArgoCD-synced manifests/ path (were present but never wired into the sync path) - Vault raft-snapshot CronJob, CNPG barmanObjectStore backups (Authentik/n8n/Nextcloud), Nextcloud file-PVC restic sync - all targeting the new VPS MinIO receiver See VPS Warm-Standby plan doc for full design rationale.
126 lines
3.9 KiB
YAML
126 lines
3.9 KiB
YAML
# values/nextcloud.values.yaml
|
|
#
|
|
# For chart: nextcloud/nextcloud
|
|
# Repo: https://nextcloud.github.io/helm/
|
|
#
|
|
# Optimized for large file uploads over 1Gbps link
|
|
|
|
replicaCount: 1
|
|
|
|
nextcloud:
|
|
host: nextcloud.kube.huskypup.net
|
|
username: ""
|
|
password: ""
|
|
|
|
# PHP configuration for large uploads
|
|
# Use /var/www/tmp (on Ceph PVC) instead of /tmp (on root overlay)
|
|
phpConfigs:
|
|
upload.ini: |
|
|
upload_tmp_dir = /var/www/tmp
|
|
sys_temp_dir = /var/www/tmp
|
|
|
|
# Environment variables for PHP
|
|
extraEnv:
|
|
- name: TMPDIR
|
|
value: /var/www/tmp
|
|
- name: PHP_MEMORY_LIMIT
|
|
value: "2G"
|
|
- name: PHP_UPLOAD_LIMIT
|
|
value: "10G"
|
|
|
|
configs:
|
|
oidc.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'oidc_login_provider_url' => 'https://auth.kube.huskypup.net/application/o/nextcloud/',
|
|
'oidc_login_client_id' => '',
|
|
'oidc_login_client_secret' => '',
|
|
'oidc_login_button_text' => 'Log in with Authentik',
|
|
'oidc_login_auto_redirect' => false,
|
|
'oidc_login_hide_password_form' => false,
|
|
'oidc_login_verify_ssl' => false,
|
|
'user_oidc' => array(
|
|
'httpclient.allowselfsigned' => true,
|
|
),
|
|
);
|
|
proxy.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'trusted_proxies' => array(
|
|
0 => '10.0.0.0/8',
|
|
1 => '172.16.0.0/12',
|
|
),
|
|
'overwriteprotocol' => 'https',
|
|
'overwrite.cli.url' => 'https://nextcloud.kube.huskypup.net',
|
|
'allow_local_remote_servers' => true,
|
|
);
|
|
# Use Ceph-backed temp directory for large uploads
|
|
temp.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'tempdirectory' => '/var/www/tmp',
|
|
);
|
|
|
|
existingSecret:
|
|
enabled: true
|
|
secretName: nextcloud-admin-secret
|
|
usernameKey: username
|
|
passwordKey: password
|
|
|
|
# Ingress disabled - Istio VirtualService handles routing
|
|
ingress:
|
|
enabled: false
|
|
|
|
externalDatabase:
|
|
enabled: true
|
|
# Moved from MariaDB to CNPG-backed Postgres (apps/nextcloud/manifests/cnpg-cluster.yaml)
|
|
# for backup/DR consistency with the rest of the stack (n8n, Authentik, GitLab
|
|
# all use CNPG's native barmanObjectStore backup - MariaDB needed a bespoke
|
|
# mysqldump job instead). pg-nextcloud-rw is CNPG's generated read-write
|
|
# Service name for the "pg-nextcloud" Cluster.
|
|
#
|
|
# IMPORTANT: switching type here does NOT migrate existing data. Nextcloud
|
|
# requires an explicit `occ db:convert-type pgsql ...` run before cutover if
|
|
# there's real data in the old MariaDB instance. usernameKey/passwordKey below
|
|
# match CNPG's generated app-secret keys (confirmed against the existing,
|
|
# already-working infrastructure/authentik/values.yaml pg-authentik-app usage).
|
|
type: postgresql
|
|
host: pg-nextcloud-rw
|
|
port: 5432
|
|
user: nextcloud
|
|
database: nextcloud
|
|
existingSecret:
|
|
enabled: true
|
|
secretName: pg-nextcloud-app
|
|
passwordKey: password
|
|
usernameKey: username # matches CNPG's generated app-secret key, confirmed against infrastructure/authentik/values.yaml's existing pg-authentik-app usage
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: rook-ceph-block
|
|
accessMode: ReadWriteOnce
|
|
size: 200Gi
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
|
|
redis:
|
|
# Was disabled; now points at the standalone Redis CR (redis-operator) in
|
|
# apps/nextcloud/manifests/redis-cr.yaml instead of the chart's bundled
|
|
# subchart - fixes Nextcloud's file-locking/caching as a side benefit of
|
|
# this migration. Verify these key names against `helm show values
|
|
# nextcloud/nextcloud` for the deployed chart version before applying.
|
|
enabled: true
|
|
host: redis-nextcloud
|
|
port: 6379
|
|
existingSecret: redis-nextcloud-secret
|
|
existingSecretPasswordKey: password
|
|
|
|
metrics:
|
|
enabled: false
|