homelab-gitops/apps/nextcloud/values.yaml

ingress:
  enabled: true
  className: traefik
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.middlewares: nextcloud-nextcloud-security-headers@kubernetescrd
  hosts:
  - cloud.brunner.ninja
nextcloud:
  host: cloud.brunner.ninja
  trustedDomains:
  - cloud.brunner.ninja
  - nextcloud.nextcloud.svc.cluster.local
  mail:
    enabled: true
    fromAddress: cloud
    domain: brunner.ninja
    smtp:
      host: smtp-relay.gmail.com
      secure: ''
      port: 587
      authtype: NONE
      name: ''
      password: ''
  objectStore:
    s3:
      enabled: true
      host: rook-ceph-rgw-my-store.rook-ceph.svc.cluster.local
      ssl: false
      port: 80
      bucket: nextcloud
      usePathStyle: true
      storageClass: STANDARD_IA
      existingSecret: nextcloud-objectstore
      secretKeys:
        accessKey: access-key
        secretKey: secret-key
  defaultConfigs:
    imaginary.config.php: true
  phpConfigs:
    zzz-opcache-memory.ini: |-
      opcache.memory_consumption=256
      opcache.interned_strings_buffer=32
  configs:
    operations.config.php: |-
      <?php
      $CONFIG = array (
        'trusted_proxies' => array (
          '127.0.0.1',
          '::1',
          '10.0.0.0/24',
          '10.0.1.0/24',
          '10.0.2.0/24',
          '10.0.3.0/24',
          '10.0.4.0/24',
          '10.0.5.0/24',
          '10.0.6.0/24',
        ),
        'forwarded_for_headers' => array (
          'HTTP_X_FORWARDED_FOR',
        ),
        'overwrite.cli.url' => 'https://cloud.brunner.ninja',
        'default_phone_region' => 'AT',
        // Nextcloud 34 interprets this as the start of a fixed six-hour UTC window.
        // 23:00 UTC is 01:00 local time while daylight saving time is active.
        'maintenance_window_start' => 23,
        'loglevel' => 2,
      );
    previews.config.php: |-
      <?php
      $CONFIG = array (
        'enable_previews' => true,
        'enabledPreviewProviders' => array (
          'OC\Preview\Movie',
          'OC\Preview\PNG',
          'OC\Preview\JPEG',
          'OC\Preview\GIF',
          'OC\Preview\BMP',
          'OC\Preview\XBitmap',
          'OC\Preview\MP3',
          'OC\Preview\MP4',
          'OC\Preview\TXT',
          'OC\Preview\MarkDown',
          'OC\Preview\PDF'
        ),
      );
  extraSidecarContainers:
  - name: notify-push
    image: ghcr.io/nextcloud-releases/aio-notify-push:20260825_084538
    imagePullPolicy: IfNotPresent
    command:
    - /bin/sh
    - -ec
    args:
    - |-
      case "$(uname -m)" in
        x86_64) notify_arch=x86_64 ;;
        aarch64|arm64) notify_arch=aarch64 ;;
        *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
      esac
      notify_binary="/var/www/html/custom_apps/notify_push/bin/${notify_arch}/notify_push"
      until [ -x "$notify_binary" ]; do sleep 5; done
      export DATABASE_URL="postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@nextcloud-postgresql:5432/nextcloud"
      export REDIS_URL="redis://:${REDIS_PASSWORD}@nextcloud-redis-master:6379"
      exec "$notify_binary" --port 7867
    env:
    - name: POSTGRES_USER
      valueFrom:
        secretKeyRef:
          name: nextcloud-db
          key: db-username
    - name: POSTGRES_PASSWORD
      valueFrom:
        secretKeyRef:
          name: nextcloud-db
          key: db-password
    - name: REDIS_PASSWORD
      valueFrom:
        secretKeyRef:
          name: nextcloud-redis
          key: redis-password
    - name: DATABASE_PREFIX
      value: oc_
    - name: NEXTCLOUD_URL
      value: http://127.0.0.1
    - name: USER_AGENT
      value: nextcloud-notify-push-kubernetes
    - name: METRICS_PORT
      value: '7868'
    ports:
    - name: notify-push
      containerPort: 7867
    - name: push-metrics
      containerPort: 7868
    livenessProbe:
      tcpSocket:
        port: notify-push
      initialDelaySeconds: 300
      periodSeconds: 30
    resources:
      requests:
        cpu: 10m
        memory: 32Mi
      limits:
        cpu: 250m
        memory: 128Mi
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 33
      runAsGroup: 33
    volumeMounts:
    - name: nextcloud-main
      mountPath: /var/www/html/custom_apps
      subPath: custom_apps
      readOnly: true
  existingSecret:
    enabled: true
    secretName: nextcloud
    tokenKey: nextcloud-token
phpClientHttpsFix:
  enabled: true
  protocol: https
internalDatabase:
  enabled: false
externalDatabase:
  enabled: true
  type: postgresql
  user: nextcloud
  database: nextcloud
  existingSecret:
    enabled: true
    secretName: nextcloud-db
mariadb:
  enabled: false
postgresql:
  enabled: true
  global:
    postgresql:
      auth:
        username: nextcloud
        database: nextcloud
        existingSecret: nextcloud-postgresql
        secretKeys:
          adminPasswordKey: postgres-password
          userPasswordKey: password
  primary:
    persistence:
      enabled: true
      storageClass: rook-ceph-block
    resources:
      requests:
        memory: 1Gi
        cpu: 250m
      limits:
        memory: 4Gi
        cpu: 1
redis:
  enabled: true
  auth:
    enabled: true
    existingSecret: nextcloud-redis
    existingSecretPasswordKey: redis-password
  global:
    storageClass: rook-ceph-block
startupProbe:
  enabled: true
collabora:
  enabled: true
  image:
    tag: 25.04.10.3.1
  collabora:
    aliasgroups:
    - host: https://cloud.brunner.ninja:443
    extra_params: --o:ssl.enable=false --o:ssl.termination=true
    server_name: office.brunner.ninja
    username: admin
    existingSecret:
      enabled: true
      secretName: nextcloud-collabora
  ingress:
    enabled: true
    className: traefik
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
    hosts:
    - host: office.brunner.ninja
      paths:
      - path: /
        pathType: ImplementationSpecific
cronjob:
  enabled: true
persistence:
  enabled: true
  storageClass: rook-ceph-block
imaginary:
  enabled: true
metrics:
  enabled: true
  timeout: 25s
  info:
    apps: true
    update: true
prometheus:
  serviceMonitor:
    enabled: false
  rules:
    enabled: true