809 lines
25 KiB
YAML
809 lines
25 KiB
YAML
---
|
|
kind: NetworkPolicy
|
|
apiVersion: networking.k8s.io/v1
|
|
metadata:
|
|
name: nextcloud-postgresql
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/version: 17.5.0
|
|
app.kubernetes.io/component: primary
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/component: primary
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
egress:
|
|
- {}
|
|
ingress:
|
|
- ports:
|
|
- port: 5432
|
|
---
|
|
apiVersion: policy/v1
|
|
kind: PodDisruptionBudget
|
|
metadata:
|
|
name: nextcloud-postgresql
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/version: 17.5.0
|
|
app.kubernetes.io/component: primary
|
|
spec:
|
|
maxUnavailable: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/component: primary
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: nextcloud-postgresql
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/version: 17.5.0
|
|
automountServiceAccountToken: false
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: nextcloud-config
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/name: nextcloud
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/version: "32.0.2"
|
|
data:
|
|
custom.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'overwriteprotocol' => 'https',
|
|
'overwrite.cli.url' => 'https://nextcloud.dooplex.hu',
|
|
'filelocking.enabled' => true,
|
|
'default_phone_region' => 'HU',
|
|
'allow_local_remote_servers' => true,
|
|
'trusted_proxies' => array (
|
|
'10.42.0.0/16',
|
|
'10.43.0.0/16',
|
|
'192.168.0.0/24',
|
|
),
|
|
'onlyoffice' => array (
|
|
'DocumentServerUrl' => 'https://office.dooplex.hu/',
|
|
'DocumentServerInternalUrl' => 'http://onlyoffice.office-system.svc.cluster.local/',
|
|
'StorageUrl' => 'http://nextcloud.nextcloud-system.svc.cluster.local/',
|
|
),
|
|
'forwarded_for_headers' => array (
|
|
'HTTP_X_FORWARDED_FOR',
|
|
),
|
|
'allow_embed' => true,
|
|
);
|
|
previews.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'enable_previews' => true,
|
|
'enabledPreviewProviders' => [
|
|
'OC\Preview\PNG',
|
|
'OC\Preview\JPEG',
|
|
'OC\Preview\GIF',
|
|
'OC\Preview\BMP',
|
|
'OC\Preview\XBitmap',
|
|
'OC\Preview\Movie',
|
|
'OC\Preview\MP3',
|
|
'OC\Preview\MP4',
|
|
'OC\Preview\TXT',
|
|
'OC\Preview\MarkDown',
|
|
'OC\Preview\PDF',
|
|
],
|
|
);
|
|
.htaccess: |-
|
|
# line below if for Apache 2.4
|
|
<ifModule mod_authz_core.c>
|
|
Require all denied
|
|
</ifModule>
|
|
# line below if for Apache 2.2
|
|
<ifModule !mod_authz_core.c>
|
|
deny from all
|
|
</ifModule>
|
|
# section for Apache 2.2 and 2.4
|
|
<ifModule mod_autoindex.c>
|
|
IndexIgnore *
|
|
</ifModule>
|
|
|
|
apache-pretty-urls.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'htaccess.RewriteBase' => '/',
|
|
);
|
|
|
|
apcu.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'memcache.local' => '\OC\Memcache\APCu',
|
|
);
|
|
|
|
apps.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'apps_paths' => array (
|
|
0 => array (
|
|
'path' => OC::$SERVERROOT.'/apps',
|
|
'url' => '/apps',
|
|
'writable' => false,
|
|
),
|
|
1 => array (
|
|
'path' => OC::$SERVERROOT.'/custom_apps',
|
|
'url' => '/custom_apps',
|
|
'writable' => true,
|
|
),
|
|
),
|
|
);
|
|
|
|
autoconfig.php: |-
|
|
<?php
|
|
|
|
$autoconfig_enabled = false;
|
|
|
|
if (getenv('SQLITE_DATABASE')) {
|
|
$AUTOCONFIG['dbtype'] = 'sqlite';
|
|
$AUTOCONFIG['dbname'] = getenv('SQLITE_DATABASE');
|
|
$autoconfig_enabled = true;
|
|
} elseif (getenv('MYSQL_DATABASE_FILE') && getenv('MYSQL_USER_FILE') && getenv('MYSQL_PASSWORD_FILE') && getenv('MYSQL_HOST')) {
|
|
$AUTOCONFIG['dbtype'] = 'mysql';
|
|
$AUTOCONFIG['dbname'] = trim(file_get_contents(getenv('MYSQL_DATABASE_FILE')));
|
|
$AUTOCONFIG['dbuser'] = trim(file_get_contents(getenv('MYSQL_USER_FILE')));
|
|
$AUTOCONFIG['dbpass'] = trim(file_get_contents(getenv('MYSQL_PASSWORD_FILE')));
|
|
$AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
|
|
$autoconfig_enabled = true;
|
|
} elseif (getenv('MYSQL_DATABASE') && getenv('MYSQL_USER') && getenv('MYSQL_PASSWORD') && getenv('MYSQL_HOST')) {
|
|
$AUTOCONFIG['dbtype'] = 'mysql';
|
|
$AUTOCONFIG['dbname'] = getenv('MYSQL_DATABASE');
|
|
$AUTOCONFIG['dbuser'] = getenv('MYSQL_USER');
|
|
$AUTOCONFIG['dbpass'] = getenv('MYSQL_PASSWORD');
|
|
$AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
|
|
$autoconfig_enabled = true;
|
|
} elseif (getenv('POSTGRES_DB_FILE') && getenv('POSTGRES_USER_FILE') && getenv('POSTGRES_PASSWORD_FILE') && getenv('POSTGRES_HOST')) {
|
|
$AUTOCONFIG['dbtype'] = 'pgsql';
|
|
$AUTOCONFIG['dbname'] = trim(file_get_contents(getenv('POSTGRES_DB_FILE')));
|
|
$AUTOCONFIG['dbuser'] = trim(file_get_contents(getenv('POSTGRES_USER_FILE')));
|
|
$AUTOCONFIG['dbpass'] = trim(file_get_contents(getenv('POSTGRES_PASSWORD_FILE')));
|
|
$AUTOCONFIG['dbhost'] = getenv('POSTGRES_HOST');
|
|
$autoconfig_enabled = true;
|
|
} elseif (getenv('POSTGRES_DB') && getenv('POSTGRES_USER') && getenv('POSTGRES_PASSWORD') && getenv('POSTGRES_HOST')) {
|
|
$AUTOCONFIG['dbtype'] = 'pgsql';
|
|
$AUTOCONFIG['dbname'] = getenv('POSTGRES_DB');
|
|
$AUTOCONFIG['dbuser'] = getenv('POSTGRES_USER');
|
|
$AUTOCONFIG['dbpass'] = getenv('POSTGRES_PASSWORD');
|
|
$AUTOCONFIG['dbhost'] = getenv('POSTGRES_HOST');
|
|
$autoconfig_enabled = true;
|
|
}
|
|
|
|
if ($autoconfig_enabled) {
|
|
$AUTOCONFIG['directory'] = getenv('NEXTCLOUD_DATA_DIR') ?: '/var/www/html/data';
|
|
}
|
|
|
|
reverse-proxy.config.php: |-
|
|
<?php
|
|
$overwriteHost = getenv('OVERWRITEHOST');
|
|
if ($overwriteHost) {
|
|
$CONFIG['overwritehost'] = $overwriteHost;
|
|
}
|
|
|
|
$overwriteProtocol = getenv('OVERWRITEPROTOCOL');
|
|
if ($overwriteProtocol) {
|
|
$CONFIG['overwriteprotocol'] = $overwriteProtocol;
|
|
}
|
|
|
|
$overwriteCliUrl = getenv('OVERWRITECLIURL');
|
|
if ($overwriteCliUrl) {
|
|
$CONFIG['overwrite.cli.url'] = $overwriteCliUrl;
|
|
}
|
|
|
|
$overwriteWebRoot = getenv('OVERWRITEWEBROOT');
|
|
if ($overwriteWebRoot) {
|
|
$CONFIG['overwritewebroot'] = $overwriteWebRoot;
|
|
}
|
|
|
|
$overwriteCondAddr = getenv('OVERWRITECONDADDR');
|
|
if ($overwriteCondAddr) {
|
|
$CONFIG['overwritecondaddr'] = $overwriteCondAddr;
|
|
}
|
|
|
|
$trustedProxies = getenv('TRUSTED_PROXIES');
|
|
if ($trustedProxies) {
|
|
$CONFIG['trusted_proxies'] = array_filter(array_map('trim', explode(' ', $trustedProxies)));
|
|
}
|
|
|
|
$forwardedForHeaders = getenv('FORWARDED_FOR_HEADERS');
|
|
if ($forwardedForHeaders) {
|
|
$CONFIG['forwarded_for_headers'] = array_filter(array_map('trim', explode(' ', $forwardedForHeaders)));
|
|
}
|
|
|
|
upgrade-disable-web.config.php: |-
|
|
<?php
|
|
$CONFIG = array (
|
|
'upgrade.disable-web' => true,
|
|
);
|
|
trusted-domains.config.php: |-
|
|
<?php
|
|
$trustedDomains = getenv('NEXTCLOUD_TRUSTED_DOMAINS');
|
|
if ($trustedDomains) {
|
|
$CONFIG['trusted_domains'] = array_values(array_filter(array_map('trim', explode(' ', $trustedDomains))));
|
|
}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: nextcloud-phpconfig
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/name: nextcloud
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/version: "32.0.2"
|
|
data:
|
|
uploadLimit.ini: |-
|
|
upload_max_filesize = 10G
|
|
post_max_size = 10G
|
|
max_input_time = 3600
|
|
max_execution_time = 3600
|
|
memory_limit = 512M
|
|
---
|
|
kind: PersistentVolumeClaim
|
|
apiVersion: v1
|
|
metadata:
|
|
name: nextcloud-nextcloud
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/name: nextcloud
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/component: app
|
|
app.kubernetes.io/version: "32.0.2"
|
|
spec:
|
|
accessModes:
|
|
- "ReadWriteOnce"
|
|
resources:
|
|
requests:
|
|
storage: "10Gi"
|
|
storageClassName: "longhorn"
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: nextcloud-postgresql-data
|
|
namespace: "nextcloud-system"
|
|
spec:
|
|
accessModes:
|
|
- "ReadWriteOnce"
|
|
resources:
|
|
requests:
|
|
storage: "5Gi"
|
|
storageClassName: "longhorn"
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: nextcloud-postgresql-hl
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/version: 17.5.0
|
|
app.kubernetes.io/component: primary
|
|
annotations:
|
|
spec:
|
|
type: ClusterIP
|
|
clusterIP: None
|
|
# We want all pods in the StatefulSet to have their addresses published for
|
|
# the sake of the other Postgresql pods even before they're ready, since they
|
|
# have to be able to talk to each other in order to become ready.
|
|
publishNotReadyAddresses: true
|
|
ports:
|
|
- name: tcp-postgresql
|
|
port: 5432
|
|
targetPort: tcp-postgresql
|
|
selector:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/component: primary
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: nextcloud-postgresql
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/version: 17.5.0
|
|
app.kubernetes.io/component: primary
|
|
spec:
|
|
type: ClusterIP
|
|
sessionAffinity: None
|
|
ports:
|
|
- name: tcp-postgresql
|
|
port: 5432
|
|
targetPort: tcp-postgresql
|
|
nodePort: null
|
|
selector:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/component: primary
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: nextcloud
|
|
namespace: "nextcloud-system"
|
|
annotations:
|
|
external-dns.alpha.kubernetes.io/hostname: nextcloud.home
|
|
labels:
|
|
app.kubernetes.io/name: nextcloud
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/component: app
|
|
app.kubernetes.io/version: "32.0.2"
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- port: 80
|
|
protocol: TCP
|
|
name: http
|
|
selector:
|
|
app.kubernetes.io/name: nextcloud
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/component: app
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
reloader.stakater.com/auto: "true"
|
|
name: nextcloud
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/name: nextcloud
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/component: app
|
|
app.kubernetes.io/version: "32.0.2"
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: nextcloud
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/component: app
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: nextcloud
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/component: app
|
|
annotations:
|
|
nextcloud-config-hash: 06b49913be13b1f9a81745166dd75ada59e7ddd39e8f6a2c5538affe2a6d1093
|
|
php-config-hash: 5a497358af870e06b42325eee83d7c0e5466b7f6819cb49b598559d96def7428
|
|
hooks-hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
|
|
spec:
|
|
containers:
|
|
- name: nextcloud
|
|
image: docker.io/library/nextcloud:32.0.2-apache
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: SMTP_HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: smtp-credentials
|
|
key: host
|
|
- name: SMTP_PORT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: smtp-credentials
|
|
key: port
|
|
- name: SMTP_NAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: smtp-credentials
|
|
key: username
|
|
- name: SMTP_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: smtp-credentials
|
|
key: password
|
|
- name: SMTP_SECURE
|
|
value: tls
|
|
- name: SMTP_AUTHTYPE
|
|
value: LOGIN
|
|
- name: MAIL_FROM_ADDRESS
|
|
value: nextcloud
|
|
- name: MAIL_DOMAIN
|
|
value: gmail.com
|
|
- name: POSTGRES_HOST
|
|
value: nextcloud-postgresql
|
|
- name: POSTGRES_DB
|
|
value: "nextcloud"
|
|
- name: POSTGRES_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: nextcloud-db
|
|
key: db-username
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: nextcloud-db
|
|
key: db-password
|
|
- name: NEXTCLOUD_ADMIN_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: nextcloud
|
|
key: nextcloud-username
|
|
- name: NEXTCLOUD_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: nextcloud
|
|
key: nextcloud-password
|
|
- name: NEXTCLOUD_TRUSTED_DOMAINS
|
|
value: "nextcloud.home nextcloud.dooplex.hu localhost nextcloud.nextcloud-system.svc.cluster.local"
|
|
- name: OVERWRITECLIURL
|
|
value: "https://nextcloud.dooplex.hu"
|
|
- name: NEXTCLOUD_DATA_DIR
|
|
value: "/data"
|
|
resources: {}
|
|
volumeMounts:
|
|
- name: nextcloud-main
|
|
mountPath: /var/www/
|
|
subPath: root
|
|
- name: nextcloud-main
|
|
mountPath: /var/www/html
|
|
subPath: html
|
|
- name: nextcloud-main
|
|
mountPath: /var/www/html/config
|
|
subPath: config
|
|
- name: nextcloud-main
|
|
mountPath: /var/www/html/custom_apps
|
|
subPath: custom_apps
|
|
- name: nextcloud-main
|
|
mountPath: /var/www/tmp
|
|
subPath: tmp
|
|
- name: nextcloud-main
|
|
mountPath: /var/www/html/themes
|
|
subPath: themes
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/custom.config.php
|
|
subPath: custom.config.php
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/previews.config.php
|
|
subPath: previews.config.php
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/.htaccess
|
|
subPath: .htaccess
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/apache-pretty-urls.config.php
|
|
subPath: apache-pretty-urls.config.php
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/apcu.config.php
|
|
subPath: apcu.config.php
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/apps.config.php
|
|
subPath: apps.config.php
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/autoconfig2.php
|
|
subPath: autoconfig2.php
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/reverse-proxy.config.php
|
|
subPath: reverse-proxy.config.php
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/upgrade-disable-web.config.php
|
|
subPath: upgrade-disable-web.config.php
|
|
- name: nextcloud-config
|
|
mountPath: /var/www/html/config/trusted-domains.config.php
|
|
subPath: trusted-domains.config.php
|
|
- mountPath: /data
|
|
name: data
|
|
- name: nextcloud-phpconfig
|
|
mountPath: "/usr/local/etc/php/conf.d/uploadLimit.ini"
|
|
subPath: uploadLimit.ini
|
|
ports:
|
|
- name: http
|
|
containerPort: 80
|
|
protocol: TCP
|
|
startupProbe:
|
|
httpGet:
|
|
path: /status.php
|
|
port: 80
|
|
httpHeaders:
|
|
- name: Host
|
|
value: localhost
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /status.php
|
|
port: 80
|
|
httpHeaders:
|
|
- name: Host
|
|
value: localhost
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
successThreshold: 1
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /status.php
|
|
port: 80
|
|
httpHeaders:
|
|
- name: Host
|
|
value: localhost
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
successThreshold: 1
|
|
failureThreshold: 3
|
|
initContainers:
|
|
- name: postgresql-isready
|
|
image: docker.io/bitnamilegacy/postgresql:17.5.0-debian-12-r3
|
|
resources: {}
|
|
securityContext: {}
|
|
env:
|
|
- name: POSTGRES_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: nextcloud-db
|
|
key: db-username
|
|
- name: POSTGRES_HOST
|
|
value: nextcloud-postgresql
|
|
command:
|
|
- "sh"
|
|
- "-c"
|
|
- "until pg_isready -h ${POSTGRES_HOST} -U ${POSTGRES_USER} ; do sleep 2 ; done"
|
|
volumes:
|
|
- name: nextcloud-main
|
|
persistentVolumeClaim:
|
|
claimName: nextcloud-nextcloud
|
|
- name: nextcloud-config
|
|
configMap:
|
|
name: nextcloud-config
|
|
- name: nextcloud-phpconfig
|
|
configMap:
|
|
name: nextcloud-phpconfig
|
|
- hostPath:
|
|
path: /mnt/4_hdd/data/nextcloud
|
|
type: Directory
|
|
name: data
|
|
securityContext:
|
|
# Will mount configuration files as www-data (id: 33) for nextcloud
|
|
fsGroup: 33
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: nextcloud-postgresql
|
|
namespace: "nextcloud-system"
|
|
labels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/version: 17.5.0
|
|
app.kubernetes.io/component: primary
|
|
spec:
|
|
replicas: 1
|
|
serviceName: nextcloud-postgresql-hl
|
|
updateStrategy:
|
|
rollingUpdate: {}
|
|
type: RollingUpdate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/component: primary
|
|
template:
|
|
metadata:
|
|
name: nextcloud-postgresql
|
|
labels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/version: 17.5.0
|
|
app.kubernetes.io/component: primary
|
|
spec:
|
|
serviceAccountName: nextcloud-postgresql
|
|
automountServiceAccountToken: false
|
|
affinity:
|
|
podAntiAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- podAffinityTerm:
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: postgresql
|
|
app.kubernetes.io/component: primary
|
|
topologyKey: kubernetes.io/hostname
|
|
weight: 1
|
|
securityContext:
|
|
fsGroup: 1001
|
|
fsGroupChangePolicy: Always
|
|
supplementalGroups: []
|
|
sysctls: []
|
|
hostNetwork: false
|
|
hostIPC: false
|
|
containers:
|
|
- name: postgresql
|
|
image: docker.io/bitnamilegacy/postgresql:17.5.0-debian-12-r3
|
|
imagePullPolicy: "IfNotPresent"
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
privileged: false
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1001
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
seLinuxOptions: {}
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
env:
|
|
- name: BITNAMI_DEBUG
|
|
value: "false"
|
|
- name: POSTGRESQL_PORT_NUMBER
|
|
value: "5432"
|
|
- name: POSTGRESQL_VOLUME_DIR
|
|
value: "/bitnami/postgresql"
|
|
- name: PGDATA
|
|
value: "/bitnami/postgresql/data"
|
|
# Authentication
|
|
- name: POSTGRES_USER
|
|
value: "nextcloud"
|
|
- name: POSTGRES_PASSWORD_FILE
|
|
value: /opt/bitnami/postgresql/secrets/password
|
|
- name: POSTGRES_POSTGRES_PASSWORD_FILE
|
|
value: /opt/bitnami/postgresql/secrets/postgres-password
|
|
- name: POSTGRES_DATABASE
|
|
value: "nextcloud"
|
|
# LDAP
|
|
- name: POSTGRESQL_ENABLE_LDAP
|
|
value: "no"
|
|
# TLS
|
|
- name: POSTGRESQL_ENABLE_TLS
|
|
value: "no"
|
|
# Audit
|
|
- name: POSTGRESQL_LOG_HOSTNAME
|
|
value: "false"
|
|
- name: POSTGRESQL_LOG_CONNECTIONS
|
|
value: "false"
|
|
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
|
value: "false"
|
|
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
|
value: "off"
|
|
# Others
|
|
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
|
value: "error"
|
|
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
|
value: "pgaudit"
|
|
ports:
|
|
- name: tcp-postgresql
|
|
containerPort: 5432
|
|
livenessProbe:
|
|
failureThreshold: 6
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- exec pg_isready -U "nextcloud" -d "dbname=nextcloud" -h 127.0.0.1 -p 5432
|
|
readinessProbe:
|
|
failureThreshold: 6
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- -e
|
|
- |
|
|
exec pg_isready -U "nextcloud" -d "dbname=nextcloud" -h 127.0.0.1 -p 5432
|
|
resources:
|
|
limits:
|
|
cpu: 150m
|
|
ephemeral-storage: 2Gi
|
|
memory: 192Mi
|
|
requests:
|
|
cpu: 100m
|
|
ephemeral-storage: 50Mi
|
|
memory: 128Mi
|
|
volumeMounts:
|
|
- name: empty-dir
|
|
mountPath: /tmp
|
|
subPath: tmp-dir
|
|
- name: empty-dir
|
|
mountPath: /opt/bitnami/postgresql/conf
|
|
subPath: app-conf-dir
|
|
- name: empty-dir
|
|
mountPath: /opt/bitnami/postgresql/tmp
|
|
subPath: app-tmp-dir
|
|
- name: postgresql-password
|
|
mountPath: /opt/bitnami/postgresql/secrets/
|
|
- name: dshm
|
|
mountPath: /dev/shm
|
|
- name: data
|
|
mountPath: /bitnami/postgresql
|
|
volumes:
|
|
- name: empty-dir
|
|
emptyDir: {}
|
|
- name: postgresql-password
|
|
secret:
|
|
secretName: nextcloud-postgresql
|
|
- name: dshm
|
|
emptyDir:
|
|
medium: Memory
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: nextcloud-postgresql-data # NOW PERSISTENT
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
external-dns.alpha.kubernetes.io/hostname: nextcloud.home,dooplex.hu
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
proxy_hide_header Content-Security-Policy;
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https:; media-src 'self'; frame-ancestors 'self' https://home.dooplex.hu https://orsi.dooplex.hu https://kisfenyo.dooplex.hu;" always;
|
|
set $geo_allowed 0;
|
|
if ($remote_addr ~ "^192\.168\.") { set $geo_allowed 1; }
|
|
if ($remote_addr ~ "^10\.") { set $geo_allowed 1; }
|
|
if ($geoip2_country_code = "HU") { set $geo_allowed 1; }
|
|
if ($geo_allowed = 0) {
|
|
return 403 "Access restricted to Hungary";
|
|
}
|
|
name: nextcloud
|
|
namespace: nextcloud-system
|
|
spec:
|
|
ingressClassName: nginx-internal
|
|
rules:
|
|
- host: nextcloud.dooplex.hu
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: nextcloud
|
|
port:
|
|
number: 80
|
|
path: /
|
|
pathType: Prefix
|
|
- host: nextcloud.home
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: nextcloud
|
|
port:
|
|
number: 80
|
|
path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- hosts:
|
|
- nextcloud.dooplex.hu
|
|
secretName: nextcloud-tls
|
|
status:
|
|
loadBalancer:
|
|
ingress:
|
|
- ip: 192.168.0.192
|
|
---
|