jakman85andClaude Opus 4.8
4be6752c71
Onboard nextcloud (docs/13 row 7): public, DR-critical file sync backed by an external PostgreSQL. Establishes the reusable CNPG-DB pattern for later DB-backed services. - catalog/nextcloud.yaml: ServiceDefinition (image nextcloud:31-apache :80, public, internet, data 20Gi longhorn @/var/www/html, backup daily-offcluster, auth oidc +platform-admins, ingress nextcloud.home.keithjackson.dev, dependency nextcloud-db:5432). Uses schema 1.2.0 env for the Postgres connection, break-glass admin, trusted-domain + OVERWRITE* proxy settings. - apps/nextcloud-db.yaml: CloudNativePG Cluster in a dedicated nextcloud-db namespace (modeled on keycloak-db; no default-deny, mirroring the verified keycloak posture), inheritedMetadata stamps app.kubernetes.io/name=nextcloud-db so the rendered egress CNP matches. initdb consumes a pre-provisioned owner secret. - apps/nextcloud-db-app.sops.yaml + apps/nextcloud-bootstrap-secret.sops.yaml: SOPS (age) — shared DB password mirrored across the two namespaces (Pods cannot read a Secret cross-namespace), plus the break-glass local admin. - apps/nextcloud.yaml: rendered manifests (catalog/render.py --no-image-automation). - apps/kustomization.yaml: wire in the four new resources. OIDC realm-client wiring DEFERRED (WS-APPS step-3 escape hatch): editing the reconciled realm import in platform-config risks the running Keycloak realm / whole platform-config apply, and nextcloud OIDC needs post-install occ steps with no first-class env — nextcloud comes up INSTALLED on the break-glass local admin (as Gitea did); the Keycloak client is a follow-up. Off-cluster backup awaits Velero/OQ-BKP (intent declared). Gates: render --selftest PASS; other apps byte-identical; ci l0 17/17; l1 3/3; lint clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
37 lines
2.0 KiB
YAML
37 lines
2.0 KiB
YAML
# Nextcloud PostgreSQL owner credentials (WS-APPS, Phase 6). SOPS-encrypted (age).
|
|
# type basic-auth (keys username/password) so the CNPG nextcloud-db Cluster consumes it as the
|
|
# nextcloud role via spec.bootstrap.initdb.secret. The SAME password is mirrored (out of band) into
|
|
# nextcloud-bootstrap/db-password in ns nextcloud for the app env (cross-ns Secret reads are not
|
|
# possible). Recover: infra/devcontainer/dev.sh run sops -d apps/nextcloud-db-app.sops.yaml
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: nextcloud-db-app
|
|
namespace: nextcloud-db
|
|
labels:
|
|
app.kubernetes.io/name: nextcloud-db
|
|
type: kubernetes.io/basic-auth
|
|
stringData:
|
|
username: ENC[AES256_GCM,data:fB2YI9sNjeZj,iv:o1L0XH5bMOPODdk4cFxMMTOOCQNhAPm9aI708x4FoCE=,tag:nKrVmibWaPeJTnFN84BlSQ==,type:str]
|
|
password: ENC[AES256_GCM,data:09mWJL4t7yOoYsMFsoPNib7wgPJKQ3vmQudDu4+hQwDOReZTA3pgTsRkh4E//DN5,iv:nHA+fHGV6pAh+khwaBQLHgqdSjHY7U8MCDTgFWcgzEg=,tag:1zyzN4/L9LWkBZ0kjusLhg==,type:str]
|
|
sops:
|
|
kms: []
|
|
gcp_kms: []
|
|
azure_kv: []
|
|
hc_vault: []
|
|
age:
|
|
- recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZT3B5K3BETnlyK3JSQzV1
|
|
aFc4RlZBdFBza1Y1cDR1dnJJZGdySjNEY25RCkdsYVltWGlRSlQwTnRYMnFoNHZW
|
|
OXZWOHFYRS9RbEtmVjczRUh5V0VBZ2cKLS0tICtvSlp6YkQ3S2s4bWNLMzhKeEd2
|
|
K2h1TjV2aFdxdWhHZ1RqOXhTS0g3OUEKQdlDeBcuzhkCjh3ubLp8F7cn9dsqNEni
|
|
hYv08MMmO8xR1fTUvShloWYeg3/UnnjM/jihPKzvS9wIdv4fTY2ShA==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-08-26T06:30:08Z"
|
|
mac: ENC[AES256_GCM,data:u1DrTgAtbzzIKjZwEdDYxtWSN3yFf2yCZ8u9QZZDglT7KwjNRdgckpeoNst5Qq0iGkzldKQmBeSKkOvSeMe1iFam9qKM3abcqDRbaw+cAr9XKaUgKaNKyVvaiHqNYoaWynn5GcxKfe6TrYAAxTN4kJAAk71sSzbTP0fTEO0tOKs=,iv:LiSIBo1qZ7/txIqsHEb9hnhXLZI15NOU/byLN4skL/o=,tag:oxwNBvRP77TTzwAbK8F9hA==,type:str]
|
|
pgp: []
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.9.4
|