upgrade immich[ci skip]

modules/kubernetes/nextcloud/chart_values.yaml

@@ -0,0 +1,47 @@
+# ingress:
+#   enabled: true
+#   annotations:
+#     "kubernetes.io/ingress.class": "nginx"
+#   nginx.ingress.kubernetes.io/proxy-body-size: 4G
+#   #  kubernetes.io/tls-acme: "true"
+#   #  cert-manager.io/cluster-issuer: letsencrypt-prod
+#   #  # Keep this in sync with the README.md:
+#   #  nginx.ingress.kubernetes.io/server-snippet: |-
+#   #    server_tokens off;
+#   #    proxy_hide_header X-Powered-By;
+#   #    rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
+#   #    rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
+#   #    rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+#   #    rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
+#   #    location = /.well-known/carddav {
+#   #      return 301 $scheme://$host/remote.php/dav;
+#   #    }
+#   #    location = /.well-known/caldav {
+#   #      return 301 $scheme://$host/remote.php/dav;
+#   #    }
+#   #    location = /robots.txt {
+#   #      allow all;
+#   #      log_not_found off;
+#   #      access_log off;
+#   #    }
+#   #    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+#   #      deny all;
+#   #    }
+#   #    location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
+#   #      deny all;
+#   #    }
+#   tls:
+#     - secretName: "${tls_secret_name}"
+#       hosts:
+#         - nextcloud.viktorbarzin.me
+#   labels: {}
+#   path: /
+#   pathType: Prefix
+
+nextcloud:
+  host: nextcloud.viktorbarin.me
+  trustedDomains:
+    - nextcloud.viktorbarin.me
+  extraEnv:
+    - name: TRUSTED_PROXIES
+      value: "127.0.0.1,10.0.0.0/8"

modules/kubernetes/nextcloud/main.tf

@@ -0,0 +1,151 @@
+variable "tls_secret_name" {}
+
+module "tls_secret" {
+  source          = "../setup_tls_secret"
+  namespace       = "nextcloud"
+  tls_secret_name = var.tls_secret_name
+}
+
+resource "kubernetes_namespace" "nextcloud" {
+  metadata {
+    name = "nextcloud"
+    labels = {
+      "istio-injection" : "disabled"
+    }
+  }
+}
+
+resource "helm_release" "nextcloud" {
+  namespace = "nextcloud"
+  name      = "nextcloud"
+
+  repository = "https://nextcloud.github.io/helm/"
+  chart      = "nextcloud"
+  atomic     = true
+  #   version    = "0.7.0"
+
+  values = [templatefile("${path.module}/chart_values.yaml", { tls_secret_name = var.tls_secret_name })]
+}
+
+# resource "kubernetes_config_map" "config" {
+#   metadata {
+#     name      = "config"
+#     namespace = "nextcloud"
+
+#     annotations = {
+#       "reloader.stakater.com/match" = "true"
+#     }
+#   }
+
+#   data = {
+#     "conf.yml" = file("${path.module}/conf.yml")
+#   }
+# }
+
+# resource "kubernetes_deployment" "nextcloud" {
+#   metadata {
+#     name      = "nextcloud"
+#     namespace = "nextcloud"
+#     labels = {
+#       app = "nextcloud"
+#     }
+#     annotations = {
+#       "reloader.stakater.com/search" = "true"
+#     }
+#   }
+#   spec {
+#     replicas = 1
+#     selector {
+#       match_labels = {
+#         app = "nextcloud"
+#       }
+#     }
+#     template {
+#       metadata {
+#         annotations = {
+#           "diun.enable" = "true"
+#         }
+#         labels = {
+#           app = "nextcloud"
+#         }
+#       }
+#       spec {
+#         container {
+#           image = "lissy93/nextcloud:latest"
+#           name  = "nextcloud"
+
+#           port {
+#             container_port = 8080
+#           }
+#           volume_mount {
+#             name       = "config"
+#             mount_path = "/app/user-data/"
+#           }
+#         }
+#         volume {
+#           name = "config"
+#           config_map {
+#             name = "config"
+#           }
+#         }
+#       }
+#     }
+#   }
+# }
+
+# resource "kubernetes_service" "nextcloud" {
+#   metadata {
+#     name      = "nextcloud"
+#     namespace = "nextcloud"
+#     labels = {
+#       app = "nextcloud"
+#     }
+#   }
+
+#   spec {
+#     selector = {
+#       app = "nextcloud"
+#     }
+#     port {
+#       name        = "http"
+#       port        = 80
+#       target_port = 8080
+#     }
+#   }
+# }
+
+resource "kubernetes_ingress_v1" "nextcloud" {
+  metadata {
+    name      = "nextcloud-ingress"
+    namespace = "nextcloud"
+    annotations = {
+      "kubernetes.io/ingress.class" = "nginx"
+      "nginx.ingress.kubernetes.io/auth-url" : "https://oauth2.viktorbarzin.me/oauth2/auth"
+      "nginx.ingress.kubernetes.io/auth-signin" : "https://oauth2.viktorbarzin.me/oauth2/start?rd=/redirect/$http_host$escaped_request_uri"
+    }
+  }
+
+  spec {
+    tls {
+      hosts       = ["nextcloud.viktorbarzin.me"]
+      secret_name = var.tls_secret_name
+    }
+    rule {
+      host = "nextcloud.viktorbarzin.me"
+      http {
+        path {
+          path = "/"
+          backend {
+            service {
+              name = "nextcloud"
+              port {
+                number = 8080
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+