[pull] main from nextcloud:main

.github/workflows/lint-test.yaml

@@ -27,7 +27,7 @@ jobs:
     if: needs.changes.outputs.src != 'false'
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -42,7 +42,7 @@ jobs:
           helm repo add collabora-online https://collaboraonline.github.io/online
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.7.0
+        uses: helm/chart-testing-action@v2.8.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -95,9 +95,17 @@ jobs:
             helm_args: --namespace nextcloud --skip-clean-up --helm-extra-set-args "--create-namespace --values charts/nextcloud/test-values/imaginary.yaml"
             test: true
 
+          # test the helm chart with extra manifests
+          - name: Extra Manifests Enabled
+            helm_args: --namespace nextcloud --skip-clean-up --helm-extra-set-args "--create-namespace --values charts/nextcloud/test-values/extra-manifests.yaml"
+            test: true
+          - name: Extra Manifests using a map Enabled
+            helm_args: --namespace nextcloud --skip-clean-up --helm-extra-set-args "--create-namespace --values charts/nextcloud/test-values/extra-manifests-map.yaml"
+            test: true
+
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -112,7 +120,7 @@ jobs:
           helm repo add collabora-online https://collaboraonline.github.io/online
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.7.0
+        uses: helm/chart-testing-action@v2.8.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -123,7 +131,7 @@ jobs:
           fi
 
       - name: Create kind cluster
-        uses: helm/kind-action@v1.12.0
+        uses: helm/kind-action@v1.13.0
         if: steps.list-changed.outputs.changed == 'true'
 
       - name: Install MinIO for testing S3 as Primary Storage

.github/workflows/release.yaml

@@ -19,7 +19,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Fetch history
         run: git fetch --prune --unshallow

README.md

@@ -2,6 +2,8 @@
 
 [Helm](https://helm.sh) repo for different charts related to Nextcloud which can be installed on [Kubernetes](https://kubernetes.io)
 
+⚠️⚠️⚠️ This project is maintained by community volunteers and designed for expert use. For quick and easy deployment that supports the full set of Nextcloud Hub features, use the [Nextcloud All-in-One project](https://github.com/nextcloud/all-in-one#nextcloud-all-in-one) maintained by Nextcloud GmbH.
+
 ### Add Helm repository
 
 To install the repo just run:

charts/nextcloud/Chart.lock

@@ -10,6 +10,6 @@ dependencies:
   version: 21.1.3
 - name: collabora-online
   repository: https://collaboraonline.github.io/online
-  version: 1.1.20
-digest: sha256:47979e007ed8bb4a53ec00c5e457da110573a6e067f24da505144f475b26981c
-generated: "2025-05-18T15:22:37.968306345+02:00"
+  version: 1.1.53
+digest: sha256:e9dd12da1b4620c951171a92aca12ef98e669627f0139937290087718ecd6e84
+generated: "2025-11-21T19:42:03.09934126+01:00"

charts/nextcloud/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
 name: nextcloud
-version: 8.2.0
+version: 8.8.1
 # renovate: image=docker.io/library/nextcloud
-appVersion: 32.0.0
+appVersion: 32.0.3
 description: A file sharing server that puts the control and security of your own data back into your hands.
 keywords:
   - nextcloud
@@ -40,7 +40,7 @@ dependencies:
     repository: oci://registry-1.docker.io/bitnamicharts
     condition: redis.enabled
   - name: collabora-online
-    version: 1.1.20
+    version: 1.1.53
     repository: https://collaboraonline.github.io/online
     condition: collabora.enabled
     alias: collabora

charts/nextcloud/files/defaultConfigs/autoconfig.php.tpl

@@ -1,8 +1,10 @@
 <?php
+
 $autoconfig_enabled = false;
+
 if (getenv('SQLITE_DATABASE')) {
-    $AUTOCONFIG["dbtype"] = "sqlite";
-    $AUTOCONFIG["dbname"] = getenv('SQLITE_DATABASE');
+    $AUTOCONFIG['dbtype'] = 'sqlite';
+    $AUTOCONFIG['dbname'] = getenv('SQLITE_DATABASE');
     $autoconfig_enabled = true;
 } elseif (getenv('MYSQL_DATABASE_FILE') && getenv('MYSQL_USER_FILE') && getenv('MYSQL_PASSWORD_FILE') && getenv('MYSQL_HOST')) {
     $AUTOCONFIG['dbtype'] = 'mysql';
@@ -12,11 +14,11 @@ if (getenv('SQLITE_DATABASE')) {
     $AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
     $autoconfig_enabled = true;
 } elseif (getenv('MYSQL_DATABASE') && getenv('MYSQL_USER') && getenv('MYSQL_PASSWORD') && getenv('MYSQL_HOST')) {
-    $AUTOCONFIG["dbtype"] = "mysql";
-    $AUTOCONFIG["dbname"] = getenv('MYSQL_DATABASE');
-    $AUTOCONFIG["dbuser"] = getenv('MYSQL_USER');
-    $AUTOCONFIG["dbpass"] = getenv('MYSQL_PASSWORD');
-    $AUTOCONFIG["dbhost"] = getenv('MYSQL_HOST');
+    $AUTOCONFIG['dbtype'] = 'mysql';
+    $AUTOCONFIG['dbname'] = getenv('MYSQL_DATABASE');
+    $AUTOCONFIG['dbuser'] = getenv('MYSQL_USER');
+    $AUTOCONFIG['dbpass'] = getenv('MYSQL_PASSWORD');
+    $AUTOCONFIG['dbhost'] = getenv('MYSQL_HOST');
     $autoconfig_enabled = true;
 } elseif (getenv('POSTGRES_DB_FILE') && getenv('POSTGRES_USER_FILE') && getenv('POSTGRES_PASSWORD_FILE') && getenv('POSTGRES_HOST')) {
     $AUTOCONFIG['dbtype'] = 'pgsql';
@@ -26,13 +28,14 @@ if (getenv('SQLITE_DATABASE')) {
     $AUTOCONFIG['dbhost'] = getenv('POSTGRES_HOST');
     $autoconfig_enabled = true;
 } elseif (getenv('POSTGRES_DB') && getenv('POSTGRES_USER') && getenv('POSTGRES_PASSWORD') && getenv('POSTGRES_HOST')) {
-    $AUTOCONFIG["dbtype"] = "pgsql";
-    $AUTOCONFIG["dbname"] = getenv('POSTGRES_DB');
-    $AUTOCONFIG["dbuser"] = getenv('POSTGRES_USER');
-    $AUTOCONFIG["dbpass"] = getenv('POSTGRES_PASSWORD');
-    $AUTOCONFIG["dbhost"] = getenv('POSTGRES_HOST');
+    $AUTOCONFIG['dbtype'] = 'pgsql';
+    $AUTOCONFIG['dbname'] = getenv('POSTGRES_DB');
+    $AUTOCONFIG['dbuser'] = getenv('POSTGRES_USER');
+    $AUTOCONFIG['dbpass'] = getenv('POSTGRES_PASSWORD');
+    $AUTOCONFIG['dbhost'] = getenv('POSTGRES_HOST');
     $autoconfig_enabled = true;
 }
+
 if ($autoconfig_enabled) {
-    $AUTOCONFIG["directory"] = getenv('NEXTCLOUD_DATA_DIR') ?: "/var/www/html/data";
+    $AUTOCONFIG['directory'] = getenv('NEXTCLOUD_DATA_DIR') ?: '/var/www/html/data';
 }

charts/nextcloud/files/defaultConfigs/redis.config.php.tpl

@@ -14,4 +14,8 @@ if (getenv('REDIS_HOST')) {
   } elseif (getenv('REDIS_HOST')[0] != '/') {
     $CONFIG['redis']['port'] = 6379;
   }
+
+  if (getenv('REDIS_HOST_USER') !== false) {
+    $CONFIG['redis']['user'] = (string) getenv('REDIS_HOST_USER');
+  }
 }

charts/nextcloud/files/nginx.config.tpl

@@ -4,6 +4,16 @@ upstream php-handler {
     server 127.0.0.1:9000;
 }
 
+map $http_x_forwarded_proto $real_scheme {
+	default $scheme;
+	https https;
+}
+
+map $http_x_forwarded_port $real_port {
+	default $server_port;
+	443     443;
+}
+
 # Set the `immutable` cache control options only for assets with a cache busting `v` argument
 map $arg_v $asset_immutable {
     "" "";
@@ -87,7 +97,7 @@ server {
     # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
     location = / {
         if ( $http_user_agent ~ ^DavClnt ) {
-            return 302 /remote.php/webdav/$is_args$args;
+            return 302 $real_scheme://$host:$real_port/remote.php/webdav/$is_args$args;
         }
     }
 
@@ -104,12 +114,12 @@ server {
     location ^~ /.well-known {
         # The following 6 rules are borrowed from `.htaccess`
 
-        location = /.well-known/carddav     { return 301 /remote.php/dav/; }
-        location = /.well-known/caldav      { return 301 /remote.php/dav/; }
+        location = /.well-known/carddav     { return 301 $real_scheme://$host:$real_port/remote.php/dav/; }
+        location = /.well-known/caldav      { return 301 $real_scheme://$host:$real_port/remote.php/dav/; }
 
         # Let Nextcloud's API for `/.well-known` URIs handle all other
         # requests by passing them to the front-end controller.
-        return 301 /index.php$request_uri;
+        return 301 $real_scheme://$host:$real_port/index.php$request_uri;
     }
 
     # Rules borrowed from `.htaccess` to hide certain paths from clients
@@ -158,7 +168,7 @@ server {
 
     # Rule borrowed from `.htaccess`
     location /remote {
-        return 301 /remote.php$request_uri;
+        return 301 $real_scheme://$host:$real_port/remote.php$request_uri;
     }
 
     location / {

charts/nextcloud/templates/_helpers.tpl

@@ -43,9 +43,9 @@ Create image name that is used in the deployment
 */}}
 {{- define "nextcloud.image" -}}
 {{- if .Values.image.tag -}}
-{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
+{{- printf "%s/%s:%s" (coalesce .Values.global.image.registry .Values.image.registry) .Values.image.repository .Values.image.tag -}}
 {{- else -}}
-{{- printf "%s:%s-%s" .Values.image.repository .Chart.AppVersion .Values.image.flavor -}}
+{{- printf "%s/%s:%s-%s" (coalesce .Values.global.image.registry .Values.image.registry) .Values.image.repository .Chart.AppVersion .Values.image.flavor -}}
 {{- end -}}
 {{- end -}}
 

charts/nextcloud/templates/cronjob.yaml

@@ -6,7 +6,7 @@ kind: CronJob
 metadata:
   name: {{ template "nextcloud.fullname" $ }}-cron
   labels:
-    {{- include "nextcloud.labels"  ( dict "component" "cron" "rootContext" $ ) | nindent 4 }}
+    {{- include "nextcloud.labels"  ( dict "component" "cronjob" "rootContext" $ ) | nindent 4 }}
     {{- with .labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
@@ -22,19 +22,29 @@ spec:
   jobTemplate:
     metadata:
       labels:
-        {{- include "nextcloud.selectorLabels"  ( dict "component" "cron" "rootContext" $ ) | nindent 8 }}
+        {{- include "nextcloud.selectorLabels"  ( dict "component" "cronjob" "rootContext" $ ) | nindent 8 }}
         {{- with $.Values.podLabels }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
       backoffLimit: {{ .backoffLimit }}
+      {{- with .activeDeadlineSeconds }}
+      activeDeadlineSeconds: {{ . }}
+      {{- end }}
       template:
         metadata:
           labels:
+            {{- include "nextcloud.selectorLabels"  ( dict "component" "cronjob" "rootContext" $ ) | nindent 12 }}
             {{- with (mergeOverwrite (dict) $.Values.podLabels .podLabels) }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
         spec:
+          {{- with $.Values.image.pullSecrets }}
+          imagePullSecrets:
+            {{- range . }}
+            - name: {{ . }}
+            {{- end}}
+          {{- end }}
           restartPolicy: Never
           containers:
             - name: {{ $.Chart.Name }}-cron
@@ -56,6 +66,9 @@ spec:
           nodeSelector:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with $.Values.cronjob.cronjob.priorityClassName | default $.Values.priorityClassName }}
+          priorityClassName: {{ . }}
+          {{- end }}
           {{- with .affinity }}
           affinity:
             {{- toYaml . | nindent 12 }}
@@ -64,6 +77,10 @@ spec:
           tolerations:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with $.Values.topologySpreadConstraints }}
+          topologySpreadConstraints:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
 {{- end }}{{/* end with cronjob */}}
           volumes:
             - name: nextcloud-main

charts/nextcloud/templates/deployment.yaml

@@ -281,14 +281,17 @@ spec:
       nodeSelector:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with $.Values.nextcloud.priorityClassName | default $.Values.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
       {{- if or .Values.nextcloud.extraInitContainers .Values.mariadb.enabled .Values.postgresql.enabled }}
       initContainers:
         {{- with .Values.nextcloud.extraInitContainers }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
         {{- if .Values.mariadb.enabled }}
         - name: mariadb-isalive
-          image: {{ .Values.mariadb.image.registry | default "docker.io" }}/{{ .Values.mariadb.image.repository }}:{{ .Values.mariadb.image.tag }}
+          image: {{ coalesce .Values.global.image.registry .Values.mariadb.image.registry "docker.io" }}/{{ .Values.mariadb.image.repository }}:{{ .Values.mariadb.image.tag }}
           {{- with .Values.nextcloud.mariaDbInitContainer }}
           resources:
             {{- toYaml .resources | nindent 12 }}
@@ -312,7 +315,7 @@ spec:
             - {{ printf "until mysql --host=%s-mariadb --user=${MYSQL_USER} --password=${MYSQL_PASSWORD} --execute=\"SELECT 1;\"; do echo waiting for mysql; sleep 2; done;" .Release.Name }}
         {{- else if .Values.postgresql.enabled }}
         - name: postgresql-isready
-          image: {{ .Values.postgresql.image.registry | default "docker.io"  }}/{{ .Values.postgresql.image.repository }}:{{ .Values.postgresql.image.tag }}
+          image: {{ coalesce .Values.global.image.registry .Values.postgresql.image.registry "docker.io"  }}/{{ .Values.postgresql.image.repository }}:{{ .Values.postgresql.image.tag }}
           {{- with .Values.nextcloud.postgreSqlInitContainer }}
           resources:
             {{- toYaml .resources | nindent 12 }}
@@ -341,6 +344,10 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       volumes:
         - name: nextcloud-main
           {{- if .Values.persistence.enabled }}

charts/nextcloud/templates/extra-manifests.yaml

@@ -0,0 +1,14 @@
+{{- /*
+  Renders extra manifests provided by the user in values.yaml under extraManifests.
+  extraManifests can be a map (keyed by manifest name) or a list of manifests.
+  If a map, each key is the name of the manifest.
+  If an array, each item is a manifest, which can be a string (YAML block) or a YAML object.
+*/ -}}
+{{- range $manifest := .Values.extraManifests }}
+---
+{{- if kindIs "string" $manifest }}
+{{ tpl $manifest $ }}
+{{- else }}
+{{ tpl (toYaml $manifest) $ }}
+{{- end }}
+{{- end }}

charts/nextcloud/templates/imaginary/deployment.yaml

@@ -85,4 +85,11 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.imaginary.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.imaginary.priorityClassName | default .Values.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
 {{- end }}

charts/nextcloud/templates/metrics/deployment.yaml

@@ -29,7 +29,7 @@ spec:
       {{- end }}
       containers:
         - name: metrics-exporter
-          image: "{{ .Values.metrics.image.repository }}:{{ .Values.metrics.image.tag }}"
+          image: "{{ coalesce .Values.global.image.registry .Values.metrics.image.registry  }}/{{ .Values.metrics.image.repository }}:{{ .Values.metrics.image.tag }}"
           imagePullPolicy: {{ .Values.metrics.image.pullPolicy }}
           env:
             {{- if or .Values.metrics.token .Values.nextcloud.existingSecret.tokenKey }}

charts/nextcloud/templates/metrics/prometheus-rules.yaml

@@ -42,7 +42,7 @@ spec:
         - alert: "nextcloud: outdated apps"
           expr: 'sum(nextcloud_apps_updates_available_total{ {{ $filter }} }) without(endpoint,container,pod,instance) > 0'
           labels:
-            severity: "warning"
+            severity: "info"
             {{- with .labels }}
             {{- toYaml . | nindent 12 }}
             {{- end }}

charts/nextcloud/templates/nextcloud-data-pvc.yaml

@@ -6,6 +6,9 @@ metadata:
   name: {{ template "nextcloud.fullname" . }}-nextcloud-data
   labels:
     {{- include "nextcloud.labels"  ( dict "component" "app"  "rootContext" $ ) | nindent 4 }}
+  {{- with .Values.persistence.nextcloudData.labels }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/resource-policy: keep
   {{- with .Values.persistence.nextcloudData.annotations }}

charts/nextcloud/templates/nextcloud-pvc.yaml

@@ -5,6 +5,9 @@ metadata:
   name: {{ template "nextcloud.fullname" . }}-nextcloud
   labels:
     {{- include "nextcloud.labels"  ( dict "component" "app"  "rootContext" $ ) | nindent 4 }}
+  {{- with .Values.persistence.labels }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   annotations:
     helm.sh/resource-policy: keep
   {{- with .Values.persistence.annotations }}