Publish portable nextcloud-notify-push chart

.gitea/workflows/chart.yml

@@ -0,0 +1,71 @@
+name: Validate, publish and promote nextcloud-notify-push chart
+on:
+  push:
+  pull_request:
+jobs:
+  chart:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: azure/setup-helm@v4
+        with:
+          version: v4.3.0
+      - name: Validate chart
+        run: |
+          python3 -m venv "${RUNNER_TEMP}/chart-test"
+          "${RUNNER_TEMP}/chart-test/bin/pip" install PyYAML
+          PATH="${RUNNER_TEMP}/chart-test/bin:${PATH}" bash chart/test.sh
+      - name: Select immutable chart version
+        if: gitea.ref == 'refs/heads/main'
+        run: printf 'CHART_VERSION=%s\n' "$(./scripts/chart-version.sh)" >> "${GITHUB_ENV}"
+      - name: Publish chart
+        if: gitea.ref == 'refs/heads/main'
+        env:
+          PACKAGE_USERNAME: ${{ secrets.PACKAGE_USERNAME }}
+          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "${PACKAGE_USERNAME}" && test -n "${PACKAGE_TOKEN}"
+          mkdir -p .chart-packages
+          helm package chart/nextcloud-notify-push --destination .chart-packages --version "${CHART_VERSION}"
+          curl --fail --silent --show-error --user "${PACKAGE_USERNAME}:${PACKAGE_TOKEN}" \
+            --request POST --upload-file ".chart-packages/nextcloud-notify-push-${CHART_VERSION}.tgz" \
+            https://code.brunner.ninja/api/packages/feedc0de/helm/api/charts
+      - name: Check current main
+        id: current-main
+        if: gitea.ref == 'refs/heads/main'
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          git fetch --no-tags origin main
+          if test "$(git rev-parse FETCH_HEAD)" = "${COMMIT_SHA}"; then
+            echo 'promote=true' >> "${GITEA_OUTPUT}"
+          else
+            echo 'promote=false' >> "${GITEA_OUTPUT}"
+          fi
+      - uses: actions/checkout@v4
+        if: steps.current-main.outputs.promote == 'true'
+        with:
+          repository: feedc0de/homelab-gitops
+          ref: main
+          token: ${{ secrets.GITOPS_TOKEN }}
+          path: homelab-gitops
+      - name: Promote chart
+        if: steps.current-main.outputs.promote == 'true'
+        working-directory: homelab-gitops
+        run: |
+          set -euo pipefail
+          ./scripts/update-chart-version.sh nextcloud-notify-push "${CHART_VERSION}"
+          git config user.name feedc0de
+          git config user.email feedc0de@users.noreply.code.brunner.ninja
+          git add bootstrap/nextcloud-notify-push.yaml
+          if git diff --cached --quiet; then exit 0; fi
+          git commit -m "Deploy nextcloud-notify-push chart ${CHART_VERSION}"
+          for attempt in 1 2 3; do
+            git push origin HEAD:main && exit 0
+            test "${attempt}" = 3 && exit 1
+            git fetch origin main
+            git rebase origin/main
+          done

.gitignore

@@ -0,0 +1 @@
+.chart-packages/

README.md

@@ -0,0 +1,26 @@
+# Nextcloud notify-push integration
+
+This repository maintains a portable Helm chart for the Nextcloud notify-push integration integration.
+It is used with the upstream Nextcloud Helm release. The application image is
+`ghcr.io/nextcloud-releases/aio-notify-push:20260825_084538`; the chart selects that tested tag through
+`Chart.yaml.appVersion`, while GitOps selects only the chart version.
+
+The Nextcloud chart must already run the notify-push sidecar. This chart exposes that sidecar through a Service, optional Ingress, and optional ServiceMonitor; it does not run a second copy.
+
+```sh
+helm repo add brunner.ninja https://brunner.ninja/charts
+helm repo update brunner.ninja
+VALUES_FILE=values.yaml ./install.sh
+```
+
+The chart and its templates own the Kubernetes workload contract; set hostnames,
+Ingress annotations, resources, and Secret names through values. The live
+[homelab configuration](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/nextcloud)
+is an example, not a portable default. Run `bash chart/test.sh` before
+publishing.
+
+The Git tag follows the actual upstream release `20260825_084538`. Its first chart
+package is `20260825.0.0-r084538`; later chart-only commits append the commit count
+and Git hash. CI publishes the package to the indexed
+`https://brunner.ninja/charts` repository and promotes only this chart's
+Argo CD targetRevision.

chart/nextcloud-notify-push/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: nextcloud-notify-push
+description: Service, Ingress, and monitoring for the Nextcloud notify-push sidecar
+type: application
+version: 0.0.0
+appVersion: "20260825_084538"

chart/nextcloud-notify-push/templates/resources.yaml

@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app.kubernetes.io/name: nextcloud-notify-push
+    app.kubernetes.io/instance: {{ .Values.nextcloudReleaseName }}
+spec:
+  selector:
+    app.kubernetes.io/name: nextcloud
+    app.kubernetes.io/instance: {{ .Values.nextcloudReleaseName }}
+    app.kubernetes.io/component: app
+  ports:
+  - name: http
+    port: 7867
+    targetPort: notify-push
+  - name: metrics
+    port: 7868
+    targetPort: push-metrics
+---
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}
+  annotations:
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  rules:
+  - host: {{ .Values.ingress.host }}
+    http:
+      paths:
+      - path: /push
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ .Release.Name }}
+            port:
+              name: http
+{{- end }}
+---
+{{- if .Values.monitoring.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    release: {{ .Values.monitoring.releaseLabel }}
+spec:
+  namespaceSelector:
+    matchNames:
+    - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nextcloud-notify-push
+      app.kubernetes.io/instance: {{ .Values.nextcloudReleaseName }}
+  endpoints:
+  - port: metrics
+    interval: 60s
+    scrapeTimeout: 15s
+{{- end }}

chart/nextcloud-notify-push/values.yaml

@@ -0,0 +1,9 @@
+nextcloudReleaseName: nextcloud
+ingress:
+  enabled: false
+  className: ""
+  host: nextcloud.example.org
+  annotations: {}
+monitoring:
+  enabled: false
+  releaseLabel: prometheus

chart/test.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+chart_name=$(basename "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/nextcloud-notify-push" && pwd)")
+chart_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/nextcloud-notify-push" && pwd)
+helm lint "$chart_dir" --strict
+python3 - "$chart_dir" "$chart_name" <<'PY'
+import subprocess,sys,yaml
+chart,name=sys.argv[1:]
+with open(chart+'/Chart.yaml') as f: metadata=yaml.safe_load(f)
+def render(*args):
+ output=subprocess.check_output(['helm','template',name,chart,'--namespace','nextcloud',*args],text=True)
+ return {(x['kind'],x['metadata']['name']):x for x in yaml.safe_load_all(output) if x}
+default=render()
+enabled=render('--set','ingress.enabled=true','--set','monitoring.enabled=true')
+assert ('Service',name) in default
+assert ('Ingress',name) not in default
+if name!='nextcloud-clamav':
+ assert ('Ingress',name) in enabled
+if name=='nextcloud-notify-push':
+ assert ('ServiceMonitor',name) in enabled
+else:
+ assert ('Deployment',name) in default
+ images=[c['image'] for c in default['Deployment',name]['spec']['template']['spec'].get('initContainers',[])+default['Deployment',name]['spec']['template']['spec']['containers']]
+ assert all(image.endswith(':'+metadata['appVersion']) for image in images)
+if name=='nextcloud-clamav':
+ assert ('PersistentVolumeClaim',name) in default
+assert not any(kind=='Secret' for kind,_ in enabled)
+PY

install.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+chart_name=$(basename "$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)")
+namespace=${NAMESPACE:-nextcloud}
+values_file=${VALUES_FILE:-values.yaml}
+if [ ! -f "$values_file" ]; then
+  echo "Values file not found: $values_file" >&2
+  exit 1
+fi
+helm repo add brunner.ninja https://brunner.ninja/charts --force-update
+helm repo update brunner.ninja
+helm upgrade --install "$chart_name" "brunner.ninja/$chart_name" \
+  --namespace "$namespace" --create-namespace --values "$values_file" \
+  --wait --timeout 15m

scripts/chart-version.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+description=$(git -C "$repo_dir" describe --tags --long --dirty)
+case "$description" in
+  *-dirty) echo 'Refusing to package a dirty tree.' >&2; exit 1 ;;
+esac
+if [[ "$description" =~ ^(.+)-([0-9]+)-g([0-9a-f]+)$ ]]; then
+  release_tag=${BASH_REMATCH[1]}
+  count=${BASH_REMATCH[2]}
+  hash=${BASH_REMATCH[3]}
+else
+  echo "Unexpected git describe result: $description" >&2
+  exit 1
+fi
+
+case "$release_tag" in
+  v[0-9]*)
+    version=${release_tag#v}
+    ;;
+  [0-9]*_[0-9]*)
+    date=${release_tag%%_*}
+    time=${release_tag#*_}
+    version="${date}.0.0-r${time}"
+    ;;
+  *)
+    echo "Unsupported application release tag: $release_tag" >&2
+    exit 1
+    ;;
+esac
+if [ "$count" -ne 0 ]; then
+  version="$version-$count-g$hash"
+fi
+printf '%s\n' "$version"