From 256371292a3705db2399e86160790c374891f3d8 Mon Sep 17 00:00:00 2001 From: Stavros kois Date: Fri, 12 Apr 2024 18:14:12 +0300 Subject: [PATCH] more config --- .../nextcloud/templates/_configuration.tpl | 74 +++++++++++++ .../templates/_nginx-configuration.tpl | 102 ++++++++++++++++++ .../nextcloud/templates/_persistence.tpl | 71 ++++++++++++ .../charts/nextcloud/templates/common.yaml | 2 + library/ix-dev/charts/nextcloud/values.yaml | 23 +++- 5 files changed, 271 insertions(+), 1 deletion(-) create mode 100644 library/ix-dev/charts/nextcloud/templates/_configuration.tpl create mode 100644 library/ix-dev/charts/nextcloud/templates/_nginx-configuration.tpl create mode 100644 library/ix-dev/charts/nextcloud/templates/_persistence.tpl diff --git a/library/ix-dev/charts/nextcloud/templates/_configuration.tpl b/library/ix-dev/charts/nextcloud/templates/_configuration.tpl new file mode 100644 index 0000000000..4b8f270e90 --- /dev/null +++ b/library/ix-dev/charts/nextcloud/templates/_configuration.tpl @@ -0,0 +1,74 @@ +{{- define "nextcloud.configuration" -}} + + {{- $fullname := (include "ix.v1.common.lib.chart.names.fullname" $) -}} + + {{- $dbHost := (printf "%s-postgres" $fullname) -}} + {{- $dbUser := "nextcloud" -}} + {{- $dbName := "nextcloud" -}} + {{- $dbPass := (randAlphaNum 32) -}} + + {{/* Fetch secrets from pre-migration secret */}} + {{- with (lookup "v1" "Secret" .Release.Namespace "db-details") -}} + {{- $dbUser = ((index .data "db-user") | b64dec) -}} + {{- $dbPass = ((index .data "db-password") | b64dec) -}} + {{- end -}} + + {{- with (lookup "v1" "Secret" .Release.Namespace (printf "%s-postgres-creds" $fullname)) -}} + {{- $dbUser = ((index .data "POSTGRES_USER") | b64dec) -}} + {{- $dbPass = ((index .data "POSTGRES_PASSWORD") | b64dec) -}} + {{- end -}} + + {{/* Temporary set dynamic db details on values, + so we can print them on the notes */}} + {{- $_ := set .Values "haDbPass" $dbPass -}} + {{- $_ := set .Values "haDbHost" $dbHost -}} + {{- $_ := set .Values "haDbName" $dbName -}} + {{- $_ := set .Values "haDbUser" $dbUser -}} + + {{- $dbURL := (printf "postgres://%s:%s@%s:5432/%s?sslmode=disable" $dbUser $dbPass $dbHost $dbName) -}} +secret: + postgres-creds: + enabled: true + data: + POSTGRES_USER: {{ $dbUser }} + POSTGRES_DB: {{ $dbName }} + POSTGRES_PASSWORD: {{ $dbPass }} + POSTGRES_HOST: {{ $dbHost }} + POSTGRES_URL: {{ $dbURL }} + nextcloud-creds: + enabled: true + data: + POSTGRES_HOST: {{ $dbHost }} + POSTGRES_URL: {{ $dbURL }} + NEXTCLOUD_DATA_DIR: {{ .Values.ncConfig.dataDir }} + PHP_UPLOAD_LIMIT: {{ printf "%vG" .Values.ncConfig.maxUploadLimit | default 3 }} + PHP_MEMORY_LIMIT: {{ printf "%vM" .Values.ncConfig.phpMemoryLimit | default 512 }} + {{- if .Values.ncNetwork.certificateID }} + APACHE_DISABLE_REWRITE_IP: "1" + OVERWRITEPROTOCOL: "https" + TRUSTED_PROXIES: "127.0.0.1" + {{- if and .Values.ncConfig.host .Values.ncNetwork.webPort }} + {{- if .Values.ncConfig.nginx.useDifferentAccessPort }} + OVERWRITEHOST: {{ .Values.ncConfig.host }} + {{- else }} + OVERWRITEHOST: {{ .Values.ncConfig.host }}:{{ .Values.ncNetwork.webPort }} + {{- end }} + {{- end }} + NEXTCLOUD_TRUSTED_DOMAINS: {{ .Values.ncConfig.host }} + NEXTCLOUD_ADMIN_USER: {{ .Values.ncConfig.adminUser }} + NEXTCLOUD_ADMIN_PASSWORD: {{ .Values.ncConfig.adminPassword }} + {{- if eq (include "nextcloud.is-migration" $) "true" }} + postgres-backup-creds: + enabled: true + annotations: + helm.sh/hook: "pre-upgrade" + helm.sh/hook-delete-policy: "hook-succeeded" + helm.sh/hook-weight: "1" + data: + POSTGRES_USER: {{ $dbUser }} + POSTGRES_DB: {{ $dbName }} + POSTGRES_PASSWORD: {{ $dbPass }} + POSTGRES_HOST: {{ $dbHost }}-ha + POSTGRES_URL: {{ printf "postgres://%s:%s@%s-ha:5432/%s?sslmode=disable" $dbUser $dbPass $dbHost $dbName }} + {{- end }} +{{- end -}} diff --git a/library/ix-dev/charts/nextcloud/templates/_nginx-configuration.tpl b/library/ix-dev/charts/nextcloud/templates/_nginx-configuration.tpl new file mode 100644 index 0000000000..bf963a9001 --- /dev/null +++ b/library/ix-dev/charts/nextcloud/templates/_nginx-configuration.tpl @@ -0,0 +1,102 @@ +{{- define "nginx.configuration" -}} + +{{- if .Values.ncNetwork.certificateID }} +scaleCertificate: + nextcloud-cert: + enabled: true + id: {{ .Values.ncNetwork.certificateID }} + {{- end -}} + + {{ $timeout := 60 }} + {{ $size := .Values.ncConfig.maxUploadLimit | default 3 }} + {{ $useDiffAccessPort := false }} + {{ $externalAccessPort := "" }} + {{/* Safely access key as it is conditionaly shown */}} + {{ if hasKey .Values.ncConfig "nginx" }} + {{ $useDiffAccessPort = .Values.ncConfig.nginx.useDifferentAccessPort }} + {{ $externalAccessPort = printf ":%v" .Values.ncConfig.nginx.externalAccessPort }} + {{ $timeout = .Values.ncConfig.nginx.proxyTimeouts | default 60 }} + {{ end }} + {{/* If its 443, do not append it on the rewrite at all */}} + {{ if eq $externalAccessPort ":443" }} + {{ $externalAccessPort = "" }} + {{ end }} +configmap: + nginx: + enabled: true + data: + nginx.conf: | + events {} + http { + # redirects all http requests to https requests + server { + listen 8000 default_server; + listen [::]:8000 default_server; + return 301 https://$host$request_uri; + } + + server { + server_name localhost; + + listen {{ .Values.ncNetwork.webPort }} ssl http2; + listen [::]:{{ .Values.ncNetwork.webPort }} ssl http2; + + ssl_certificate '/etc/nginx-certs/public.crt'; + ssl_certificate_key '/etc/nginx-certs/private.key'; + + # maximum 3GB Upload File; change to fit your needs + client_max_body_size {{ $size }}G; + + add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload" always; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + location = /.well-known/carddav { + {{ if $useDiffAccessPort }} + return 301 $scheme://$host{{ $externalAccessPort }}/remote.php/dav; + {{ else }} + return 301 $scheme://$host:$server_port/remote.php/dav; + {{ end }} + } + + location = /.well-known/caldav { + {{ if $useDiffAccessPort }} + return 301 $scheme://$host{{ $externalAccessPort }}/remote.php/dav; + {{ else }} + return 301 $scheme://$host:$server_port/remote.php/dav; + {{ end }} + } + + location / { + proxy_pass http://localhost; + proxy_http_version 1.1; + proxy_cache_bypass $http_upgrade; + proxy_request_buffering off; + + # Proxy headers + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-Forwarded-Host $host; + {{ if $useDiffAccessPort }} + proxy_set_header X-Forwarded-Port {{ $externalAccessPort | default "443" | trimPrefix ":" }}; + {{ else }} + proxy_set_header X-Forwarded-Port $server_port; + {{ end }} + + # Proxy timeouts + proxy_connect_timeout {{ $timeout }}s; + proxy_send_timeout {{ $timeout }}s; + proxy_read_timeout {{ $timeout }}s; + } + } + } +{{- end -}} +{{- end -}} diff --git a/library/ix-dev/charts/nextcloud/templates/_persistence.tpl b/library/ix-dev/charts/nextcloud/templates/_persistence.tpl new file mode 100644 index 0000000000..eb0975aa5d --- /dev/null +++ b/library/ix-dev/charts/nextcloud/templates/_persistence.tpl @@ -0,0 +1,71 @@ +{{- define "nextcloud.persistence" -}} +persistence: + # config: + # enabled: true + # targetSelector: + # nextcloud: + # nextcloud: + # mountPath: /config + # 01-init-config: + # mountPath: /config + # media: + # enabled: true + # targetSelector: + # nextcloud: + # nextcloud: + # mountPath: /media + # default-config: + # enabled: true + # type: secret + # objectName: ha-config + # defaultMode: "0744" + # items: + # - key: configuration.default + # path: configuration.default + # - key: recorder.default + # path: recorder.default + # - key: script.sh + # path: script.sh + # targetSelector: + # nextcloud: + # 01-init-config: + # mountPath: /default/init + tmp: + enabled: true + type: emptyDir + targetSelector: + nextcloud: + nextcloud: + mountPath: /tmp + {{- range $idx, $storage := .Values.ncStorage.additionalStorages }} + {{ printf "nc-%v:" (int $idx) }} + enabled: true + {{- include "ix.v1.common.app.storageOptions" (dict "storage" $storage) | nindent 4 }} + targetSelector: + nextcloud: + nextcloud: + mountPath: {{ $storage.mountPath }} + {{- end }} + {{- if .Values.ncNetwork.certificateID }} + nginx-cert: + enabled: true + type: secret + objectName: nextcloud-cert + defaultMode: "0600" + items: + - key: tls.key + path: private.key + - key: tls.crt + path: public.crt + targetSelector: + nginx: + nginx: + mountPath: /etc/nginx-certs + readOnly: true + {{- end -}} + + {{- include "ix.v1.common.app.postgresPersistence" + (dict "pgData" .Values.ncStorage.pgData + "pgBackup" .Values.ncStorage.pgBackup + ) | nindent 2 }} +{{- end -}} diff --git a/library/ix-dev/charts/nextcloud/templates/common.yaml b/library/ix-dev/charts/nextcloud/templates/common.yaml index 12374b9430..f1848146d6 100644 --- a/library/ix-dev/charts/nextcloud/templates/common.yaml +++ b/library/ix-dev/charts/nextcloud/templates/common.yaml @@ -4,7 +4,9 @@ {{/* Merge the templates with Values */}} {{- $_ := mustMergeOverwrite .Values (include "nextcloud.workload" $ | fromYaml) -}} +{{- $_ := mustMergeOverwrite .Values (include "nextcloud.configuration" $ | fromYaml) -}} {{- $_ := mustMergeOverwrite .Values (include "nginx.workload" $ | fromYaml) -}} +{{- $_ := mustMergeOverwrite .Values (include "nginx.configuration" $ | fromYaml) -}} {{- $_ := mustMergeOverwrite .Values (include "postgres.workload" $ | fromYaml) -}} {{- $_ := mustMergeOverwrite .Values (include "nextcloud.service" $ | fromYaml) -}} {{- $_ := mustMergeOverwrite .Values (include "nextcloud.persistence" $ | fromYaml) -}} diff --git a/library/ix-dev/charts/nextcloud/values.yaml b/library/ix-dev/charts/nextcloud/values.yaml index 407ce1d85b..18054a6014 100644 --- a/library/ix-dev/charts/nextcloud/values.yaml +++ b/library/ix-dev/charts/nextcloud/values.yaml @@ -23,11 +23,32 @@ podOptions: options: [] ncConfig: - additionalEnvs: [] + adminUser: admin + adminPassword: password + host: "" + dataDir: /var/www/html commands: - ffmpeg - smbclient + maxUploadLimit: 3 + phpMemoryLimit: 512 + nginx: + proxyTimeouts: 120 + useDifferentAccessPort: false + externalAccessPort: 80 + additionalEnvs: [] ncNetwork: webPort: 9001 certificateID: + +ncStorage: + pgData: + type: ixVolume + ixVolumeConfig: + datasetName: pgData + pgBackup: + type: ixVolume + ixVolumeConfig: + datasetName: pgBackup + additionalStorages: []