Stage independent Nextcloud companion chart Applications

apps/nextcloud/README.md

@@ -25,7 +25,7 @@ backups.
 
 Automated pruning is disabled because this release owns data-bearing PVCs and
 an object-store user. Nextcloud's local install script must not be run against
-an Argo-owned resource. Separate companion Deployments for whiteboard, Talk
-HPB, and ClamAV and the notify-push Service/Ingress are being migrated as
-their own deployment contracts; do not delete them merely because they are
-absent from the upstream Nextcloud chart.
+an Argo-owned resource. Whiteboard, Talk HPB, ClamAV, and the notify-push
+Service/Ingress use four separately published companion charts and Argo
+Applications. Their manifests are absent from the upstream chart and are not
+duplicated here.

apps/nextcloud/clamav-values.yaml

@@ -0,0 +1,18 @@
+persistence:
+  storageClass: rook-ceph-block
+  size: 2Gi
+timezone: Europe/Vienna
+initResources:
+  requests:
+    cpu: 50m
+    memory: 128Mi
+  limits:
+    cpu: 1
+    memory: 512Mi
+resources:
+  requests:
+    cpu: 100m
+    memory: 1Gi
+  limits:
+    cpu: 2
+    memory: 3Gi

apps/nextcloud/notify-push-values.yaml

@@ -0,0 +1,11 @@
+ingress:
+  enabled: true
+  className: traefik
+  host: cloud.brunner.ninja
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: nextcloud-strip-push-prefix@kubernetescrd,nextcloud-nextcloud-security-headers@kubernetescrd
+    traefik.ingress.kubernetes.io/router.priority: "100"
+monitoring:
+  enabled: true
+  releaseLabel: prometheus

apps/nextcloud/talk-hpb-values.yaml

@@ -0,0 +1,18 @@
+nextcloudHost: cloud.brunner.ninja
+integrationSecret:
+  name: nextcloud-integrations
+timezone: Europe/Vienna
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 2
+    memory: 2Gi
+ingress:
+  enabled: true
+  className: traefik
+  host: signaling.brunner.ninja
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: nextcloud-nextcloud-security-headers@kubernetescrd

apps/nextcloud/whiteboard-values.yaml

@@ -0,0 +1,18 @@
+nextcloudUrl: https://cloud.brunner.ninja
+jwtSecret:
+  name: nextcloud-integrations
+  key: whiteboard-jwt
+resources:
+  requests:
+    cpu: 50m
+    memory: 128Mi
+  limits:
+    cpu: 1
+    memory: 1Gi
+ingress:
+  enabled: true
+  className: traefik
+  host: whiteboard.brunner.ninja
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: nextcloud-nextcloud-security-headers@kubernetescrd

bootstrap/nextcloud-clamav.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nextcloud-clamav
+  namespace: argocd
+spec:
+  project: nextcloud
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: nextcloud-clamav
+    targetRevision: 20260825.0.0-r084538
+    helm:
+      releaseName: nextcloud-clamav
+      valueFiles:
+      - $values/apps/nextcloud/clamav-values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: nextcloud
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true

bootstrap/nextcloud-notify-push.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nextcloud-notify-push
+  namespace: argocd
+spec:
+  project: nextcloud
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: nextcloud-notify-push
+    targetRevision: 20260825.0.0-r084538
+    helm:
+      releaseName: nextcloud-notify-push
+      valueFiles:
+      - $values/apps/nextcloud/notify-push-values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: nextcloud
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true

bootstrap/nextcloud-project.yaml

@@ -9,6 +9,7 @@ spec:
   description: Nextcloud and its existing Rook object-store user
   sourceRepos:
   - https://nextcloud.github.io/helm/
+  - https://brunner.ninja/charts
   - https://code.brunner.ninja/feedc0de/homelab-gitops.git
   destinations:
   - namespace: nextcloud

bootstrap/nextcloud-talk-hpb.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nextcloud-talk-hpb
+  namespace: argocd
+spec:
+  project: nextcloud
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: nextcloud-talk-hpb
+    targetRevision: 20260825.0.0-r084538
+    helm:
+      releaseName: nextcloud-talk-hpb
+      valueFiles:
+      - $values/apps/nextcloud/talk-hpb-values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: nextcloud
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true

bootstrap/nextcloud-whiteboard.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nextcloud-whiteboard
+  namespace: argocd
+spec:
+  project: nextcloud
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: nextcloud-whiteboard
+    targetRevision: 2.0.0
+    helm:
+      releaseName: nextcloud-whiteboard
+      valueFiles:
+      - $values/apps/nextcloud/whiteboard-values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: nextcloud
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true