nextcloud_argocd_appset.yaml

---
# webapp is deployed 2nd because we need secrets and persistent volumes up 1st
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: nextcloud-appset
  namespace: argocd
spec:
  goTemplate: true
  # generator allows us to source specific values from an external k8s secret
  generators:
    - plugin:
        configMapRef:
          name: secret-var-plugin-generator
        input:
          parameters:
            secret_vars:
              - global_cluster_issuer
              - global_time_zone
              - nextcloud_collabora_hostname
              - nextcloud_default_phone_region
              - nextcloud_hostname
              - nextcloud_mail_domain
              - nextcloud_mail_from_address
              - nextcloud_s3_region
              - nextcloud_toleration_key
              - nextcloud_toleration_operator
              - nextcloud_toleration_value
              - nextcloud_toleration_effect
              - nextcloud_affinity_key
              - nextcloud_affinity_value
  template:
    metadata:
      name: nextcloud-app
      annotations:
        argocd.argoproj.io/sync-wave: "3"

    spec:
      # project in Argo CD
      project: nextcloud

      # which k8s cluster this goes to (this assumes the local cluster)
      destination:
        server: https://kubernetes.default.svc
        namespace: nextcloud

      # the sync policy for this Argo CD Application
      syncPolicy:
        syncOptions:
          - ApplyOutOfSyncOnly=true
        automated:
          prune: true
          selfHeal: true

      source:
        repoURL: 'https://nextcloud.github.io/helm'
        chart: nextcloud
        targetRevision: 8.3.0
        helm:
          # release name for this helm chart release. If this is not set,
          # Argo CD will use the name of the Application as the release name
          releaseName: nextcloud
          # all values to pass into the helm chart
          valuesObject:
            image:
              # this is a custom nextcloud image with ffmpeg on it
              # it's otherwise exact the same as nextcloud:fpm-alpine
              repository: jessebot/nextcloud
              tag: 31.0.7-fpm-alpine
              pullPolicy: IfNotPresent

            podLabels:
              deploymentName: nextcloud

            tolerations:
              - key: '{{ .nextcloud_toleration_key }}'
                operator: '{{ .nextcloud_toleration_operator }}'
                value: '{{ .nextcloud_toleration_value }}'
                effect: '{{ .nextcloud_toleration_effect }}'

            affinity:
              nodeAffinity:
                requiredDuringSchedulingIgnoredDuringExecution:
                  nodeSelectorTerms:
                    - matchExpressions:
                      - key: '{{ .nextcloud_affinity_key }}'
                        operator: In
                        values:
                          - '{{ .nextcloud_affinity_value }}'
            ingress:
              enabled: true
              className: nginx
              annotations:
                cert-manager.io/cluster-issuer: '{{ .global_cluster_issuer }}'
                nginx.ingress.kubernetes.io/proxy-body-size: 10G
                nginx.ingress.kubernetes.io/enable-cors: "false"
                nginx.ingress.kubernetes.io/server-snippet: |-
                  server_tokens off;
                  proxy_hide_header X-Powered-By;

                  rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
                  rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
                  rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
                  rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
                  location = /.well-known/carddav {
                    return 301 $scheme://$host/remote.php/dav;
                  }
                  location = /.well-known/caldav {
                    return 301 $scheme://$host/remote.php/dav;
                  }
                  location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
                    deny all;
                  }
                  location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
                    deny all;
                  }
              tls:
                - secretName: nextcloud-tls
                  hosts:
                    - '{{ .nextcloud_hostname }}'

            nextcloud:
              host: '{{ .nextcloud_hostname }}'
              existingSecret:
                enabled: true
                secretName: nextcloud-admin-credentials
                usernameKey: username
                passwordKey: password
                tokenKey: serverInfoToken
                smtpUsernameKey: smtpUsername
                smtpPasswordKey: smtpPassword
                smtpHostKey: smtpHost

              # update to the latest version of nextcloud
              update: 1

              securityContext:
                runAsUser: 82
                runAsGroup: 82
                # runAsNonRoot: true

              podSecurityContext:
                fsGroup: 82

              # for sending notifications
              mail:
                enabled: true
                fromAddress: '{{ .nextcloud_mail_from_address }}'
                domain: '{{ .nextcloud_mail_domain }}'

              extraInitContainers:
                - name: change-data-dir-permissions
                  image: alpine:latest
                  command:
                    - /bin/sh
                    - -c
                    - "chmod 770 -R /var/www/html/data && chown 82:www-data -R /var/www/html"
                  volumeMounts:
                    - mountPath: /var/www/
                      name: nextcloud-main
                      subPath: root
                    - mountPath: /var/www/html
                      name: nextcloud-main
                      subPath: html
                    - mountPath: /var/www/html/data
                      name: nextcloud-main
                      subPath: data
                    - mountPath: /var/www/html/config
                      name: nextcloud-main
                      subPath: config
                  securityContext:
                    runAsUser: 0
                    runAsGroup: 0
                    runAsNonRoot: false
                    seccompProfile:
                      type: RuntimeDefault

              extraEnv:
                - name: "OVERWRITECLIURL"
                  value: 'https://{{ .nextcloud_hostname }}'

                # fix time in nextcloud container
                - name: "TZ"
                  value: '{{ .global_time_zone }}'

                # OIDC parameters
                - name: "NC_oidc_login_provider_url"
                  valueFrom:
                    secretKeyRef:
                      name: nextcloud-oidc-credentials
                      key: issuer

                - name: "NC_oidc_login_client_id"
                  valueFrom:
                    secretKeyRef:
                      name: nextcloud-oidc-credentials
                      key: client_id

                - name: "NC_oidc_login_client_secret"
                  valueFrom:
                    secretKeyRef:
                      name: nextcloud-oidc-credentials
                      key: client_secret

                - name: "PGSSLCERT"
                  value: /etc/secrets/nextcloud/tls.crt

                - name: "PGSSLKEY"
                  value: /etc/secrets/nextcloud/tls.key

                - name: "PGSSLROOTCERT"
                  value: /etc/secrets/ca/ca.crt

              extraVolumes:
                # - name: before-starting-scripts
                #   configMap:
                #     name: before-starting-scripts
                #     defaultMode: 0550

                - name: postgres-ca
                  secret:
                    secretName: nextcloud-postgres-server-ca-key-pair
                    defaultMode: 0640

                - name: postgres-client-certs
                  secret:
                    secretName: nextcloud-postgres-nextcloud-cert
                    defaultMode: 0640

              extraVolumeMounts:
                # - name: before-starting-scripts
                #   mountPath: /docker-entrypoint-hooks.d/before-starting

                - name: postgres-ca
                  mountPath: /etc/secrets/ca

                - name: postgres-client-certs
                  mountPath: /etc/secrets/nextcloud

              # defaultConfigs:
              #   redis.config.php: false

              phpConfigs:
                #  www.conf: |-
                #    [www]
                #    user = www-data
                #    group = www-data
                www.conf: |-
                  [www]
                  security.limit_extensions = .php .css .js .html
                  listen = 127.0.0.1:9000
                  pm = dynamic
                  pm.max_children = 350
                  pm.start_servers = 100
                  pm.min_spare_servers = 100
                  pm.max_spare_servers = 280

                opcache.conf: |
                  php_admin_value[memory_limit] = -1
                  php_admin_value[opcache.jit_buffer_size] = 8M
                  php_admin_value[opcache.interned_strings_buffer] = 64
                  php_admin_value[opcache.memory_consumption] = 128M
                  php_admin_value[opcache.max_accelerated_files] = 30000
                  php_admin_value[opcache.validate_timestamps] = 0
                  php_admin_value[opcache.revalidate_freq] = 60
                  php_admin_value[upload_max_filesize] = 10G
                  php_admin_value[post_max_size] = 10G

              configs:
                logging.config.php: |-
                  <?php
                  $CONFIG = array (
                    'log_type' => 'file',
                    'logfile' => '/var/www/html/nextcloud.log',
                    'loglevel' => 1,
                    'logtimezone' => '{{ .global_time_zone }}',
                    'logdateformat' => 'F d, Y H:i:s',
                    'maintenance_window_start' => 23,
                    );

                previews.config.php: |-
                  <?php
                  $CONFIG = array (
                    'enable_previews' => true,
                    'enabledPreviewProviders' => array (
                      'OC\Preview\Movie',
                      'OC\Preview\PNG',
                      'OC\Preview\SVG',
                      'OC\Preview\JPEG',
                      'OC\Preview\GIF',
                      'OC\Preview\BMP',
                      'OC\Preview\XBitmap',
                      'OC\Preview\MP3',
                      'OC\Preview\MP4',
                      'OC\Preview\TXT',
                      'OC\Preview\MarkDown',
                      'OC\Preview\PDF',
                    ),
                  );

                proxy.config.php: |-
                  <?php
                  $CONFIG = array (
                    'trusted_proxies' => array(
                      0 => '127.0.0.1',
                      1 => '10.0.0.0/8',
                      2 => '192.168.0.0/16',
                    ),
                    'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
                  );

                extra.config.php: |-
                  <?php
                  $CONFIG = array (
                    'allow_local_remote_servers' => true,
                    'default_phone_region' => '{{ .nextcloud_default_phone_region }}',
                    'default_timezone' => '{{ .global_time_zone }}',
                  );

                oidc.config.php: |-
                  <?php
                  $CONFIG = array (
                    // this disables the default login
                    'hide_login_form' => true,

                    // Some Nextcloud options that might make sense here
                    'allow_user_to_change_display_name' => true,
                    'lost_password_link' => 'disabled',

                    // Automatically redirect the login page to the provider
                    'oidc_login_auto_redirect' => false,

                    // Redirect to this page after logging out the user
                    'oidc_login_logout_url' => 'https://{{ .nextcloud_hostname }}/apps/oidc_login/oidc',

                    // If set to true the user will be redirected to the
                    // logout endpoint of the OIDC provider after logout
                    'oidc_login_end_session_redirect' => false,

                    // Login button text
                    'oidc_login_button_text' => 'Log in with ZITADEL',

                    // Hide the NextCloud password change form.
                    'oidc_login_hide_password_form' => true,

                    // Use ID Token instead of UserInfo
                    'oidc_login_use_id_token' => false,

                    // Attribute map for OIDC response.
                    'oidc_login_attributes' => array (
                        'id' => 'preferred_username',
                        'name' => 'name',
                        'mail' => 'email',
                        'login_filter' => 'groups',
                        'photoURL' => 'picture',
                        'is_admin' => 'groups_nextcloud_admins',
                    ),

                    // Allow only users in configured value(s) to access Nextcloud. In case the user
                    // is not assigned to this value (read from oidc_login_attributes) the login
                    // will not be allowed for this user.
                    'oidc_login_filter_allowed_values' => array('nextcloud_admins', 'nextcloud_users'),

                    // Set OpenID Connect scope
                    'oidc_login_scope' => 'openid profile email',

                    // Run in LDAP proxy mode
                    'oidc_login_proxy_ldap' => false,

                    // Disable creation of users new to Nextcloud from OIDC login.
                    // A user may be known to the IdP but not (yet) known to Nextcloud.
                    'oidc_login_disable_registration' => false,

                    // Fallback to direct login if login from OIDC fails
                    // Note that no error message will be displayed if enabled
                    'oidc_login_redir_fallback' => false,

                    // If you get your groups from the oidc_login_attributes, you might want
                    // to create them if they are not already existing, Default is `false`.
                    'oidc_create_groups' => false,

                    // Enable use of WebDAV via OIDC bearer token.
                    'oidc_login_webdav_enabled' => true,

                    // Enable authentication with user/password for DAV clients that do not
                    // support token authentication (e.g. DAVx⁵)
                    'oidc_login_password_authentication' => true,

                    // The time in seconds used to cache public keys from provider.
                    // The default value is 1 day.
                    'oidc_login_public_key_caching_time' => 86400,

                    // The time in seconds used to cache the OIDC well-known configuration from the provider.
                    // The default value is 1 day.
                    'oidc_login_well_known_caching_time' => 86400,

                    // If true, nextcloud will download user avatars on login.
                    // This may lead to security issues as the server does not control
                    // which URLs will be requested. Use with care.
                    'oidc_login_update_avatar' => true,

                    // Code challenge method for PKCE flow.
                    'oidc_login_code_challenge_method' => 'S256',
                    );

            nginx:
              enabled: true
              config:
                # This generates the default nginx config as per the nextcloud documentation
                default: false
                custom: |-
                  upstream php-handler {
                      server 127.0.0.1:9000;
                  }

                  server {
                      listen 80;

                      # HSTS settings
                      # WARNING: Only add the preload option once you read about
                      # the consequences in https://hstspreload.org/. This option
                      # will add the domain to a hardcoded list that is shipped
                      # in all major browsers and getting removed from this list
                      # could take several months.
                      #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;

                      # set max upload size
                      client_max_body_size 10G;
                      fastcgi_buffers 64 4K;

                      # Enable gzip but do not remove ETag headers
                      gzip on;
                      gzip_vary on;
                      gzip_comp_level 4;
                      gzip_min_length 256;
                      gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
                      gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

                      # Pagespeed is not supported by Nextcloud, so if your server is built
                      # with the `ngx_pagespeed` module, uncomment this line to disable it.
                      #pagespeed off;

                      # HTTP response headers borrowed from Nextcloud `.htaccess`
                      add_header Referrer-Policy                      "no-referrer"       always;
                      add_header X-Content-Type-Options               "nosniff"           always;
                      add_header X-Download-Options                   "noopen"            always;
                      add_header X-Frame-Options                      "SAMEORIGIN"        always;
                      add_header X-Permitted-Cross-Domain-Policies    "none"              always;
                      add_header X-Robots-Tag                         "noindex, nofollow" always;
                      add_header X-XSS-Protection                     "1; mode=block"     always;

                      # Remove X-Powered-By, which is an information leak
                      fastcgi_hide_header X-Powered-By;

                      # If the user agent is missing, empty, or contains a single hyphen
                      # return forbidden http code
                      if ($http_user_agent ~ "^-?$") {
                        return 403;
                      }

                      # set the real ip in the logs
                      set_real_ip_from 192.168.0.0/16;
                      set_real_ip_from 10.0.0.0/8;
                      real_ip_recursive on;

                      # Add .mjs as a file extension for javascript
                      # Either include it in the default mime.types list
                      # or include you can include that list explicitly and add the file extension
                      # only for Nextcloud like below:
                      include mime.types;
                      types {
                          text/javascript js mjs;
                      }

                      # Path to the root of your installation
                      root /var/www/html;

                      # Specify how to handle directories -- specifying `/index.php$request_uri`
                      # here as the fallback means that Nginx always exhibits the desired behaviour
                      # when a client requests a path that corresponds to a directory that exists
                      # on the server. In particular, if that directory contains an index.php file,
                      # that file is correctly served; if it doesn't, then the request is passed to
                      # the front-end controller. This consistent behaviour means that we don't need
                      # to specify custom rules for certain paths (e.g. images and other assets,
                      # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
                      # `try_files $uri $uri/ /index.php$request_uri`
                      # always provides the desired behaviour.
                      index index.php index.html /index.php$request_uri;

                      # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
                      location = / {
                          if ( $http_user_agent ~ ^DavClnt ) {
                              return 302 /remote.php/webdav/$is_args$args;
                          }
                      }

                      location = /robots.txt {
                          allow all;
                          log_not_found off;
                          access_log off;
                      }

                      # Make a regex exception for `/.well-known` so that clients can still
                      # access it despite the existence of the regex rule
                      # `location ~ /(\.|autotest|...)` which would otherwise handle requests
                      # for `/.well-known`.
                      location ^~ /.well-known {
                          # The following 6 rules are borrowed from `.htaccess`

                          location = /.well-known/carddav     { return 301 /remote.php/dav/; }
                          location = /.well-known/caldav      { return 301 /remote.php/dav/; }
                          # Anything else is dynamically handled by Nextcloud
                          location ^~ /.well-known            { return 301 /index.php$uri; }

                          try_files $uri $uri/ =404;
                      }

                      # Rules borrowed from `.htaccess` to hide certain paths from clients
                      location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
                      location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)              { return 404; }

                      # Ensure this block, which passes PHP files to the PHP process, is above the blocks
                      # which handle static assets (as seen below). If this block is not declared first,
                      # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
                      # to the URI, resulting in a HTTP 500 error response.
                      location ~ \.php(?:$|/) {
                          # Required for legacy support
                          rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;

                          fastcgi_split_path_info ^(.+?\.php)(/.*)$;
                          set $path_info $fastcgi_path_info;

                          try_files $fastcgi_script_name =404;

                          include fastcgi_params;
                          fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                          fastcgi_param PATH_INFO $path_info;
                          #fastcgi_param HTTPS on;

                          fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
                          fastcgi_param front_controller_active true;     # Enable pretty urls
                          fastcgi_pass php-handler;

                          fastcgi_intercept_errors on;
                          fastcgi_request_buffering off;
                      }

                      location ~ \.(?:css|js|svg|gif)$ {
                          try_files $uri /index.php$request_uri;
                          expires 6M;         # Cache-Control policy borrowed from `.htaccess`
                          access_log off;     # Optional: Don't log access to assets
                      }

                      location ~ \.woff2?$ {
                          try_files $uri /index.php$request_uri;
                          expires 7d;         # Cache-Control policy borrowed from `.htaccess`
                          access_log off;     # Optional: Don't log access to assets
                      }

                      location / {
                          try_files $uri $uri/ /index.php$request_uri;
                      }
                  }

              extraEnv:
                # fix time in nginx container
                - name: "TZ"
                  value: '{{ .global_time_zone }}'

            internalDatabase:
              enabled: false

            externalDatabase:
              enabled: true
              type: postgresql
              host: "nextcloud-postgres-rw.nextcloud.svc:5432;sslmode=verify-full;sslrootcert=/etc/secrets/ca/ca.crt;sslcert=/etc/secrets/nextcloud/tls.crt;sslkey=/etc/secrets/nextcloud/tls.key"
              database: nextcloud
              existingSecret:
                enabled: true
                secretName: nextcloud-pgsql-credentials
                usernameKey: username
                passwordKey: password

            postgresql:
              enabled: false

            redis:
              enabled: false
              replica:
                replicaCount: 3
              auth:
                enabled: true
                existingSecret: nextcloud-redis-credentials
                existingSecretPasswordKey: redis_password

            cronjob:
              enabled: true

            persistence:
              enabled: true
              existingClaim: nextcloud-files
              nextcloudData:
                enabled: false

            livenessProbe:
              enabled: false
              initialDelaySeconds: 20
              periodSeconds: 10
              timeoutSeconds: 10
              failureThreshold: 100
              successThreshold: 1

            readinessProbe:
              enabled: false
              initialDelaySeconds: 20
              periodSeconds: 10
              timeoutSeconds: 10
              failureThreshold: 100
              successThreshold: 1

            startupProbe:
              enabled: false
              initialDelaySeconds: 20
              periodSeconds: 10
              timeoutSeconds: 10
              failureThreshold: 100
              successThreshold: 1

            hpa:
              enabled: false
              cputhreshold: 60
              minPods: 1
              maxPods: 10

            metrics:
              enabled: true
              https: false
              token: "enabled"
              timeout: 10s
              podLabels:
                jobLabel: nextcloud-metrics

              service:
                annotations:
                  prometheus.io/scrape: "true"
                  prometheus.io/port: "9205"
                labels:
                  jobLabel: nextcloud-metrics

              serviceMonitor:
                enabled: true
                namespace: "nextcloud"

            rbac:
              enabled: true

            ## Collabora chart configuration
            ## for more options see https://github.com/CollaboraOnline/online/tree/master/kubernetes/helm/collabora-online
            collabora:
              enabled: true

              # please check collabora README.md first
              autoscaling:
                enabled: false

              image:
                repository: collabora/code
                pullPolicy: IfNotPresent
                tag: 25.04.5.1.1

              collabora:
                fullnameOverrride: "collabora"

                ## HTTPS nextcloud domain, if needed
                aliasgroups:
                  - host: "https://{{ .nextcloud_hostname }}:443"

                extra_params: >
                  --o:ssl.enable=false
                  --o:ssl.termination=true
                  --o:fetch_update_check=0
                  --o:num_prespawn_children=3
                  --o:remote_font_config.url=https://{{ .nextcloud_hostname }}/apps/richdocuments/settings/fonts.json

                ## Specify server_name when the hostname is not reachable directly for example behind reverse-proxy
                server_name: '{{ .nextcloud_collabora_hostname }}'

                # setup admin login credentials
                existingSecret:
                  enabled: true
                  secretName: "collabora-admin-credentials"
                  usernameKey: "username"
                  passwordKey: "password"

              # setup ingress
              ingress:
                enabled: true
                className: "nginx"
                # please check collabora values.yaml for nginx/haproxy annotations examples
                annotations:
                  cert-manager.io/cluster-issuer: '{{ .global_cluster_issuer }}'
                  nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_WOPISrc"
                  nginx.ingress.kubernetes.io/proxy-body-size: "0"
                  nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
                  nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
                  nginx.ingress.kubernetes.io/server-snippet: |
                    # block admin and metrics endpoint from outside by default
                    location /cool/getMetrics { deny all; return 403; }
                    location /cool/adminws/ { deny all; return 403; }
                    location /browser/dist/admin/admin.html { deny all; return 403; }

                hosts:
                  - host: '{{ .nextcloud_collabora_hostname }}'
                    paths:
                    - path: /
                      pathType: ImplementationSpecific
                tls:
                 - secretName: collabora-ingress-tls
                   hosts:
                     - '{{ .nextcloud_collabora_hostname }}'

              # see collabora helm README.md for recommended values
              # https://github.com/CollaboraOnline/online/tree/master/kubernetes/helm/collabora-online#deploying-collabora-online-in-kubernetes
              resources:
                limits:
                  cpu: "8"
                  memory: "8Gi"
                requests:
                  cpu: "2"
                  memory: "3Gi"