From ea64bd8c8956dd2ac05048b4dab2c0fd038e3171 Mon Sep 17 00:00:00 2001 From: Astra Logical Date: Thu, 11 Jun 2026 19:11:46 -0400 Subject: [PATCH] Nextcloud --- services/nextcloud/nextcloud-deployment.yaml | 84 +++++++++++++++++++ .../nextcloud/nextcloud-external-secrets.yaml | 34 ++++++++ services/nextcloud/nextcloud-postgres.yaml | 42 ++++++++++ services/nextcloud/nextcloud-service.yaml | 68 +++++++++++++++ services/syncthing/syncthing-deployment.yaml | 62 -------------- services/syncthing/syncthing-ingress.yaml | 19 ----- services/syncthing/syncthing-service.yaml | 29 ------- 7 files changed, 228 insertions(+), 110 deletions(-) create mode 100644 services/nextcloud/nextcloud-deployment.yaml create mode 100644 services/nextcloud/nextcloud-external-secrets.yaml create mode 100644 services/nextcloud/nextcloud-postgres.yaml create mode 100644 services/nextcloud/nextcloud-service.yaml delete mode 100644 services/syncthing/syncthing-deployment.yaml delete mode 100644 services/syncthing/syncthing-ingress.yaml delete mode 100644 services/syncthing/syncthing-service.yaml diff --git a/services/nextcloud/nextcloud-deployment.yaml b/services/nextcloud/nextcloud-deployment.yaml new file mode 100644 index 0000000..5b181fa --- /dev/null +++ b/services/nextcloud/nextcloud-deployment.yaml @@ -0,0 +1,84 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nextcloud-app + namespace: nextcloud +spec: + replicas: 1 + selector: + matchLabels: + app: nextcloud-app + template: + metadata: + labels: + app: nextcloud-app + spec: + containers: + - name: nextcloud + image: nextcloud:apache + envFrom: + - secretRef: + name: nextcloud-secrets + env: + - name: POSTGRES_HOST + value: nextcloud-db + - name: OVERWRITEPROTOCOL + value: "https" + - name: TRUSTED_PROXIES + value: "10.42.0.0/16 10.43.0.0/16" + - name: NEXTCLOUD_TRUSTED_DOMAINS + value: "cloud.mynest.love" + volumeMounts: + - name: nextcloud-core-data + mountPath: /var/www/html + - name: nextcloud-user-data + mountPath: /var/www/html/data + volumes: + - name: nextcloud-core-data + persistentVolumeClaim: + claimName: nextcloud-app-pvc + - name: nextcloud-user-data + persistentVolumeClaim: + claimName: nextcloud-media-nfs-pvc +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: nextcloud-app-pvc + namespace: nextcloud +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 100Gi +--- +apiVersion: v1 +kind: PersistentVolume +metadata: + name: nextcloud-media-nfs-pv +spec: + capacity: + storage: 1Ti + volumeMode: Filesystem + accessModes: + - ReadWriteMany + persistentVolumeReclaimPolicy: Retain + storageClassName: robin-nfs + nfs: + server: robin.home.nest + path: /nextcloud +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: nextcloud-media-nfs-pvc + namespace: nextcloud +spec: + accessModes: + - ReadWriteMany + storageClassName: robin-nfs + resources: + requests: + storage: 1Ti diff --git a/services/nextcloud/nextcloud-external-secrets.yaml b/services/nextcloud/nextcloud-external-secrets.yaml new file mode 100644 index 0000000..722b18e --- /dev/null +++ b/services/nextcloud/nextcloud-external-secrets.yaml @@ -0,0 +1,34 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: nextcloud-secrets + namespace: nextcloud +spec: + refreshInterval: "1h" + secretStoreRef: + name: vault-external-secrets-store + kind: ClusterSecretStore + target: + name: nextcloud-secrets + creationPolicy: Owner + data: + - secretKey: POSTGRES_DB + remoteRef: + key: nextcloud/postgres + property: db-name + - secretKey: POSTGRES_USER + remoteRef: + key: nextcloud/postgres + property: db-user + - secretKey: POSTGRES_PASSWORD + remoteRef: + key: nextcloud/postgres + property: db-password + - secretKey: NEXTCLOUD_ADMIN_USER + remoteRef: + key: nextcloud + property: user + - secretKey: NEXTCLOUD_ADMIN_PASSWORD + remoteRef: + key: nextcloud + property: password diff --git a/services/nextcloud/nextcloud-postgres.yaml b/services/nextcloud/nextcloud-postgres.yaml new file mode 100644 index 0000000..6006a2c --- /dev/null +++ b/services/nextcloud/nextcloud-postgres.yaml @@ -0,0 +1,42 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nextcloud-db + namespace: nextcloud +spec: + replicas: 1 + selector: + matchLabels: + app: nextcloud-db + template: + metadata: + labels: + app: nextcloud-db + spec: + containers: + - name: postgres + image: postgres:15-alpine + envFrom: + - secretRef: + name: nextcloud-secrets + volumeMounts: + - name: db-data + mountPath: /var/lib/postgresql/data + subPath: postgres-data + volumes: + - name: db-data + persistentVolumeClaim: + claimName: nextcloud-db-pvc +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: nextcloud-db-pvc + namespace: nextcloud +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 20Gi diff --git a/services/nextcloud/nextcloud-service.yaml b/services/nextcloud/nextcloud-service.yaml new file mode 100644 index 0000000..77176a4 --- /dev/null +++ b/services/nextcloud/nextcloud-service.yaml @@ -0,0 +1,68 @@ +apiVersion: v1 +kind: Service +metadata: + name: nextcloud-app + namespace: nextcloud +spec: + selector: + app: nextcloud-app + ports: + - port: 80 + targetPort: 80 +--- +apiVersion: v1 +kind: Service +metadata: + name: nextcloud-db + namespace: nextcloud +spec: + selector: + app: nextcloud-db + ports: + - port: 5432 +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: nextcloud-redirect + namespace: nextcloud +spec: + redirectRegex: + regex: "^https://(.*)/.well-known/(card|cal)dav" + replacement: "https://${1}/remote.php/dav/" +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: nextcloud-hsts + namespace: nextcloud +spec: + headers: + stsSeconds: 15552000 + stsIncludeSubdomains: true + stsPreload: true +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: nextcloud-ingress + namespace: nextcloud + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" + traefik.ingress.kubernetes.io/router.middlewares: nextcloud-nextcloud-redirect@kubernetescrd, nextcloud-nextcloud-hsts@kubernetescrd +spec: + tls: + - hosts: + - cloud.mynest.love + secretName: nextcloud-tls + rules: + - host: cloud.mynest.love + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: nextcloud-app + port: + number: 80 diff --git a/services/syncthing/syncthing-deployment.yaml b/services/syncthing/syncthing-deployment.yaml deleted file mode 100644 index bf6fcd2..0000000 --- a/services/syncthing/syncthing-deployment.yaml +++ /dev/null @@ -1,62 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - annotations: - kompose.cmd: kompose convert -f compose-syncthing.yaml - kompose.version: 1.38.0 (HEAD) - labels: - io.kompose.service: syncthing - name: syncthing -spec: - replicas: 1 - selector: - matchLabels: - io.kompose.service: syncthing - strategy: - type: Recreate - template: - metadata: - annotations: - kompose.cmd: kompose convert -f compose-syncthing.yaml - kompose.version: 1.38.0 (HEAD) - labels: - io.kompose.service: syncthing - spec: - containers: - - env: - - name: PGID - value: "1000" - - name: PUID - value: "1000" - - name: TZ - value: Etc/UTC - image: lscr.io/linuxserver/syncthing:latest - name: syncthing - ports: - - containerPort: 8384 - protocol: TCP - name: web-ui - - containerPort: 22000 - protocol: TCP - name: listen-tcp - - containerPort: 22000 - protocol: UDP - name: listen-udp - - containerPort: 21027 - protocol: UDP - name: discovery - volumeMounts: - - mountPath: /config - name: syncthing-config - - mountPath: /data1 - name: syncthing-data - restartPolicy: Always - volumes: - - name: syncthing-config - nfs: - server: birdfeeder2.home.nest - path: /k3s/syncthing - - name: syncthing-data - nfs: - server: robin.home.nest - path: /mnt/raid/syncthing diff --git a/services/syncthing/syncthing-ingress.yaml b/services/syncthing/syncthing-ingress.yaml deleted file mode 100644 index fbd4364..0000000 --- a/services/syncthing/syncthing-ingress.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: syncthing-ingress - namespace: default - annotations: - traefik.ingress.kubernetes.io/router.entrypoints: web -spec: - rules: - - host: sync.k3s.home.nest - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: syncthing - port: - name: http-web diff --git a/services/syncthing/syncthing-service.yaml b/services/syncthing/syncthing-service.yaml deleted file mode 100644 index 4cb92a2..0000000 --- a/services/syncthing/syncthing-service.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - annotations: - kompose.cmd: kompose convert -f compose-syncthing.yaml - kompose.version: 1.38.0 (HEAD) - labels: - io.kompose.service: syncthing - name: syncthing -spec: - type: ClusterIP - ports: - - name: http-web - port: 80 - targetPort: web-ui - - name: tcp-listen - port: 81 - protocol: TCP - targetPort: listen-tcp - - name: udp-listen - port: 81 - protocol: UDP - targetPort: listen-udp - - name: discovery - port: 83 - protocol: UDP - targetPort: discovery - selector: - io.kompose.service: syncthing