infra/stacks/nextcloud/chart_values.yaml

nextcloud:
  host: nextcloud.viktorbarzin.me
  trustedDomains:
    - nextcloud.viktorbarzin.me
  # mail:
  #   enabled: true
  #   # the user we send email as
  #   fromAddress: nextcloud@viktorbarzin.me
  #   # the domain we send email from
  #   domain: viktorbarzin.me
  #   smtp:
  #     host: mail.viktorbarzin.me
  #     secure: starttls
  #     port: 587
  #     authtype: LOGIN
  #     name: nextcloud@viktorbarzin.me
  #     password:
  extraEnv:
    - name: TRUSTED_PROXIES
      value: "10.0.0.0/8"
    - name: PHP_MEMORY_LIMIT
      value: "512M"
    - name: PHP_UPLOAD_LIMIT
      value: "16G"
    # - name: mail_smtpdebug
    #   value: "true"
    # - name: loglevel
    #   value: "0"
  configs:
    zzz-redis.config.php: |
      <?php
      // Redis with Sentinel-based master discovery
      // Queries Sentinel to find the current master, falls back to HAProxy service
      // which health-checks Redis nodes and routes only to the master.
      $sentinels = [
        ['redis-node-0.redis-headless.redis.svc.cluster.local', 26379],
        ['redis-node-1.redis-headless.redis.svc.cluster.local', 26379],
      ];
      // Fallback: HAProxy master-only service (safe even if Sentinel is unavailable)
      $redisHost = 'redis-master.redis.svc.cluster.local';
      $redisPort = 6379;
      foreach ($sentinels as [$sHost, $sPort]) {
        try {
          $s = new Redis();
          if ($s->connect($sHost, $sPort, 0.5)) {
            $master = $s->rawCommand('SENTINEL', 'get-master-addr-by-name', 'mymaster');
            if ($master) {
              $redisHost = $master[0];
              $redisPort = (int)$master[1];
              break;
            }
          }
        } catch (\Exception $e) {}
      }
      $CONFIG = array(
        'memcache.distributed' => '\\OC\\Memcache\\Redis',
        'memcache.locking' => '\\OC\\Memcache\\Redis',
        'redis' => array(
          'host' => $redisHost,
          'port' => $redisPort,
          'password' => '',
          'timeout' => 1.5,
          'read_timeout' => 1.5,
        ),
      );
    performance.config.php: |
      <?php
      $CONFIG = array(
        'loglevel' => 2,
        'mail_smtpdebug' => false,
      );
    zzz-mysql.config.php: |
      <?php
      $CONFIG = array(
        'mysql.utf8mb4' => true,
      );
  phpConfigs:
    zzz-custom.ini: |
      max_execution_time = 300
      max_input_time = 300
      default_socket_timeout = 300
      opcache.enable_file_override = 1
      apc.shm_size = 128M
  extraVolumes:
    - name: apache-tuning
      configMap:
        name: nextcloud-apache-tuning
    - name: db-password-sync
      configMap:
        name: nextcloud-db-password-sync
        defaultMode: 0755
  extraVolumeMounts:
    - name: apache-tuning
      mountPath: /etc/apache2/mods-available/mpm_prefork.conf
      subPath: mpm_prefork.conf
    - name: db-password-sync
      mountPath: /docker-entrypoint-hooks.d/before-starting

internalDatabase:
  enabled: false

externalRedis:
  enabled: false

externalDatabase:
  enabled: true
  type: mysql
  host: ${mysql_host}
  user: nextcloud
  database: nextcloud
  existingSecret:
    secretName: nextcloud-db-creds
    usernameKey: db-username
    passwordKey: DB_PASSWORD

persistence:
  enabled: true
  existingClaim: nextcloud-data-encrypted

  accessMode: ReadWriteOnce
  size: 20Gi

startupProbe:
  enabled: true
  initialDelaySeconds: 30
  periodSeconds: 10
  timeoutSeconds: 30
  failureThreshold: 60
  successThreshold: 1

livenessProbe:
  enabled: true
  initialDelaySeconds: 30
  periodSeconds: 60
  timeoutSeconds: 30
  failureThreshold: 10
  successThreshold: 1

readinessProbe:
  enabled: true
  initialDelaySeconds: 30
  periodSeconds: 60
  timeoutSeconds: 30
  failureThreshold: 5
  successThreshold: 1

podAnnotations:
  diun.enable: "true"
  diun.include_tags: "^[0-9]+(?:.[0-9]+)?(?:.[0-9]+)?.*"
  dependency.kyverno.io/wait-for: "mysql.dbaas:3306,redis-master.redis:6379"
  secret.reloader.stakater.com/reload: "nextcloud-db-creds"

collabora:
  enabled: false # Using onlyoffice instead

resources:
  limits:
    memory: 8Gi
  requests:
    cpu: 50m
    memory: 256Mi

cronjob:
  enabled: true
  resources:
    limits:
      memory: 384Mi
    requests:
      cpu: 25m
      memory: 384Mi