feat(apps): onboard nextcloud (Phase 6) — first CNPG-DB + OIDC-target patterns

Onboard nextcloud (docs/13 row 7): public, DR-critical file sync backed by an
external PostgreSQL. Establishes the reusable CNPG-DB pattern for later DB-backed
services.

- catalog/nextcloud.yaml: ServiceDefinition (image nextcloud:31-apache :80, public,
  internet, data 20Gi longhorn @/var/www/html, backup daily-offcluster, auth oidc
  +platform-admins, ingress nextcloud.home.keithjackson.dev, dependency
  nextcloud-db:5432). Uses schema 1.2.0 env for the Postgres connection, break-glass
  admin, trusted-domain + OVERWRITE* proxy settings.
- apps/nextcloud-db.yaml: CloudNativePG Cluster in a dedicated nextcloud-db namespace
  (modeled on keycloak-db; no default-deny, mirroring the verified keycloak posture),
  inheritedMetadata stamps app.kubernetes.io/name=nextcloud-db so the rendered egress
  CNP matches. initdb consumes a pre-provisioned owner secret.
- apps/nextcloud-db-app.sops.yaml + apps/nextcloud-bootstrap-secret.sops.yaml: SOPS
  (age) — shared DB password mirrored across the two namespaces (Pods cannot read a
  Secret cross-namespace), plus the break-glass local admin.
- apps/nextcloud.yaml: rendered manifests (catalog/render.py --no-image-automation).
- apps/kustomization.yaml: wire in the four new resources.

OIDC realm-client wiring DEFERRED (WS-APPS step-3 escape hatch): editing the reconciled
realm import in platform-config risks the running Keycloak realm / whole platform-config
apply, and nextcloud OIDC needs post-install occ steps with no first-class env — nextcloud
comes up INSTALLED on the break-glass local admin (as Gitea did); the Keycloak client is a
follow-up. Off-cluster backup awaits Velero/OQ-BKP (intent declared).

Gates: render --selftest PASS; other apps byte-identical; ci l0 17/17; l1 3/3; lint clean.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/nextcloud-db.yaml

@@ -0,0 +1,74 @@
+---
+# Nextcloud's PostgreSQL — a CloudNativePG Cluster (CR of the CNPG CRDs from platform/cnpg), modeled
+# on platform/keycloak/postgres-cluster.yaml. This is the first CNPG-DB in apps/ and establishes the
+# reusable pattern for later DB-backed services (semaphore, unifi, ...).
+#
+# WHY A DEDICATED `nextcloud-db` NAMESPACE (not co-located in `nextcloud`):
+#   The app->db edge in catalog/nextcloud.yaml (`dependencies: to: nextcloud-db`) compiles to a
+#   CiliumNetworkPolicy whose egress selector pins BOTH the destination pod label
+#   (app.kubernetes.io/name=nextcloud-db) AND its namespace (k8s:io.kubernetes.pod.namespace=
+#   nextcloud-db) — cross-namespace Cilium selectors must name the namespace (catalog/render.py
+#   r_dependency_policies). So the DB MUST live in a namespace literally named `nextcloud-db` and its
+#   pods MUST carry app.kubernetes.io/name=nextcloud-db, injected below via inheritedMetadata.
+#
+# DEFAULT-DENY POSTURE — mirrors keycloak (platform/keycloak/namespace.yaml): this namespace is
+# INTENTIONALLY not homelab.keithjackson.dev/app-namespace=true, so Kyverno does NOT generate the app
+# default-deny baseline here and CNPG runs under Cilium's cluster-wide default-allow — the SAME posture
+# the verified keycloak-db uses. The nextcloud SIDE keeps its default-deny; its rendered egress-allow
+# opens ONLY nextcloud -> nextcloud-db:5432, and the DB side's default-allow accepts that reciprocal
+# ingress. No app-namespace policy (auth-mode/host-namespace/secret-provenance) is weakened.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nextcloud-db
+  labels:
+    # Match the Cilium egress selector's namespace pin; NOT an app-namespace (see header).
+    app.kubernetes.io/name: nextcloud-db
+---
+# Owner credentials for the CNPG cluster. SOPS-encrypted (age); type basic-auth so CNPG's initdb
+# consumes it as the `nextcloud` role's password instead of generating a random one — this lets the
+# SAME password be mirrored into ns nextcloud (nextcloud-bootstrap/db-password) for the app's env,
+# since a Pod cannot read a Secret in another namespace. Provided as apps/nextcloud-db-app.sops.yaml.
+#
+# CNPG Cluster (CR of postgresql.cnpg.io installed by platform/cnpg).
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: nextcloud-db
+  namespace: nextcloud-db
+spec:
+  # Single Postgres instance on 3-replica Longhorn is acceptable at home scale (ADR-0014, same as
+  # keycloak-db). The storage is already 3-way replicated by Longhorn; raise to 3 for Postgres-level
+  # HA as a future hardening.
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.4
+  # Stamp app.kubernetes.io/name=nextcloud-db onto every generated pod/service so the rendered
+  # nextcloud egress CiliumNetworkPolicy's toEndpoints selector matches the primary pod (R-NET-02).
+  inheritedMetadata:
+    labels:
+      app.kubernetes.io/name: nextcloud-db
+  storage:
+    storageClass: longhorn
+    size: 5Gi
+  bootstrap:
+    initdb:
+      database: nextcloud
+      owner: nextcloud
+      # Use the pre-provisioned owner secret (basic-auth) so its password is known + reusable by the
+      # app in the other namespace, instead of the random CNPG-generated one.
+      secret:
+        name: nextcloud-db-app
+  # Emit Postgres metrics so Prometheus scrapes DB health (R-OBS-01). The CNPG operator creates the
+  # PodMonitor at runtime (CRD present from Phase-4 monitoring).
+  monitoring:
+    enablePodMonitor: true
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      memory: 512Mi
+  # --- Off-cluster DR backup (R-STATE-03) — OPERATOR HAND-OFF (OQ-BKP, shared with Velero, Phase 4) ---
+  # When the off-cluster backup target is chosen, add a Barman object store + a ScheduledBackup here
+  # (same hand-off as keycloak-db). Until then the DB is protected by 3-replica Longhorn + (Phase-4)
+  # Velero PVC backups of the namespace; the SD declares backup.policy daily-offcluster as the intent.