deploy folder restructured, preparing for flux, removed ghost pvc nextcloud-data, simplification of pvc names

This commit is contained in:
Márcio Fernandes
2026-07-14 10:19:05 +00:00
parent 6438530fba
commit 3e8e2a4987
41 changed files with 316 additions and 426 deletions
+10 -2
View File
@@ -4,10 +4,18 @@
"version": "2.0.0",
"tasks": [
{
"label": "Apply Infra",
"label": "Kustomize - Build - Selected File",
"type": "shell",
"command": "./ops-scripts/apply-infra.sh",
"command": "bash -c '[[ \"$(basename ${file})\" == \"kustomization.yaml\" ]] && kubectl kustomize ${fileDirname} || echo \"❌ invalid kustomization.yaml\"'",
"problemMatcher": [],
"group": "build"
},
{
"label": "Kustomize - Build & Deploy - Selected File",
"type": "shell",
"command": "bash -c '[[ \"$(basename ${file})\" == \"kustomization.yaml\" ]] && kubectl kustomize ${fileDirname} | kubectl apply -f - || echo \"❌ invalid kustomization.yaml\"'",
"problemMatcher": [],
"group": "build"
},
{
"label": "Apply App",
+2 -43
View File
@@ -19,8 +19,6 @@ Using [NextCloud](https://nextcloud.com/)
- [Mimetype migrations available](#mimetype-migrations-available)
- [delete file locks](#delete-file-locks)
- [Setup and Deploy](#setup-and-deploy)
- [App](#app)
- [Infra](#infra)
- [internal logs](#internal-logs)
- [Database](#database)
@@ -147,47 +145,8 @@ su -s /bin/bash www-data -c "php occ maintenance:repair --include-expensive"
## Setup and Deploy
### App
**Security context:**
This script is intended to be executed only by lowprivilege deployment identities, such as the **continuousdeploy** ServiceAccount or an application maintainer with equivalent permissions.
Can be executed in VS Code using the “Apply App” task.
```bash
#!/bin/bash
./ops-scripts/apply-app.sh
```
**Responsibilities:**
- Database deployment
- Persistent Volume Claims (storage.limbosolutions.com)
- Nextcloud Helm chart deployment
- Backup job deployment
**Requirements:**
- [infra](#infra)
### Infra
**Security context:**
This script requires elevated clusterlevel permissions and must be executed only by platform maintainers, not by the continuousdeploy identity.
Can be executed in VS Code using the “Apply Infra” task.
```bash
./ops-scripts/apply-infra.sh
```
**Responsibilities:**
- Ingress controller deployment
- Persistent storage provisioning (storage.limbosolutions.com)
- services accounts:
- Continuous deploy - Deployment RBAC (ServiceAccount + Role + RoleBinding)
- All kustomizations can be executed using vscode task `Kustomize - Build & Deploy - Selected File`.
- Helm charts can be deployed using vscode task `Apply App`.
## internal logs
@@ -1,3 +0,0 @@
NEXTCLOUD_HOST=????
NEXTCLOUD_USERNAME=????
NEXTCLOUD_PASSWORD=???
@@ -1,104 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mf-documents-limbosolutions-com
spec:
storageClassName: storage-limbosolutions-com
volumeName: mf-documents-limbosolutions-com-nextcloud
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: media-music-limbosolutions-com
spec:
storageClassName: storage-limbosolutions-com
volumeName: media-music-limbosolutions-com-nextcloud
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: media-videos-limbosolutions-com
spec:
storageClassName: storage-limbosolutions-com
volumeName: media-videos-limbosolutions-com-nextcloud
accessModes:
- ReadWriteMany
resources:
requests:
storage: 2000Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: media-gaming-limbosolutions-com
spec:
storageClassName: storage-limbosolutions-com
volumeName: media-gaming-limbosolutions-com-nextcloud
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: it-storage-limbosolutions-com
spec:
storageClassName: storage-limbosolutions-com
volumeName: it-storage-limbosolutions-com-nextcloud
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1000Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mf-gallery-limbosolutions-com
spec:
storageClassName: storage-limbosolutions-com
volumeName: mf-gallery-limbosolutions-com-nextcloud
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mf-nextcloud-limbosolutions-com
spec:
storageClassName: storage-limbosolutions-com
volumeName: mf-nextcloud-limbosolutions-com-nextcloud
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
---
@@ -90,7 +90,7 @@ spec:
- |
set -e
SCRIPT_START_TIME=$(date +%s)
proxmox-backup-client backup nextcloud-html.pxar:/data/nextcloud-html nextcloud-data.pxar:/data/nextcloud-data mariadb-data.pxar:/data/mariadb-data mariadb-export.pxar:/data/mariadb-export --include-dev /data/nextcloud-html --include-dev /data/nextcloud-data --include-dev /data/mariadb-data --include-dev /data/mariadb-export --backup-id "nextcloud-full" -ns cloud.limbosolutions.com && \
proxmox-backup-client backup nextcloud-html.pxar:/data/nextcloud-html mariadb-data.pxar:/data/mariadb-data mariadb-export.pxar:/data/mariadb-export --include-dev /data/nextcloud-html --include-dev /data/mariadb-data --include-dev /data/mariadb-export --backup-id "nextcloud-full" -ns cloud.limbosolutions.com && \
SCRIPT_DURATION=$(($(date +%s) - SCRIPT_START_TIME)) && \
echo "INFO: Finished Backup of cloud.limbosolutions.com ($((SCRIPT_DURATION / 60 / 60)):$((SCRIPT_DURATION / 60)):$((SCRIPT_DURATION % 60)))"
@@ -98,9 +98,6 @@ spec:
- name: nextcloud-html
mountPath: /data/nextcloud-html
- name: nextcloud-data
mountPath: /data/nextcloud-data
- name: db-data
mountPath: /data/mariadb-data
@@ -117,10 +114,6 @@ spec:
persistentVolumeClaim:
claimName: nextcloud-nextcloud
- name: nextcloud-data
persistentVolumeClaim:
claimName: nextcloud-nextcloud-data
- name: db-data
persistentVolumeClaim:
claimName: mariadb-data-nextcloud-mariadb-0
+14
View File
@@ -0,0 +1,14 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./backup-pbs-cronjob.yaml
secretGenerator:
- name: backup-secret
envs:
- ./.env.d/pbs.env
generatorOptions:
disableNameSuffixHash: true
namespace: cloud-limbosolutions-com
+3
View File
@@ -0,0 +1,3 @@
**
!.gitignore
!**.example
@@ -1,3 +1,4 @@
# values bust be equal to nextcloud deployment
MARIADB_USER=????
MARIADB_PASSWORD=????
MARIADB_ROOT_PASSWORD=???
@@ -1,22 +1,17 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cloud-limbosolutions-com
generatorOptions:
disableNameSuffixHash: true
secretGenerator:
- name: nextcloud-mariadb
envs:
- ./.env.d/nextcloud-mariadb.env
- name: backup-secret
envs:
- ./.env.d/pbs.env
resources:
- ./storage-limbosolutions-com/pvc.yaml
- ./storage-limbosolutions-com
- ./mariadb-deploy.yaml
- ./backups/backup-pbs-cronjob.yaml
- ./onlyoffice
- ./whiteboard
generatorOptions:
disableNameSuffixHash: true
namespace: cloud-limbosolutions-com
@@ -58,9 +58,9 @@ externalDatabase:
enabled: true
type: mysql
host: nextcloud-mariadb.cloud-limbosolutions-com.svc.cluster.local
user: "???"
password: "???"
database: "???"
user: "SET_BY_PRIVATE_VALUES"
password: "SET_BY_PRIVATE_VALUES"
database: "SET_BY_PRIVATE_VALUES"
port: 3306
persistence:
@@ -151,25 +151,25 @@ nextcloud:
extraVolumes:
- name: mf-documents
persistentVolumeClaim:
claimName: mf-documents-limbosolutions-com
claimName: nextcloud-mf-documents
- name: mf-photos
persistentVolumeClaim:
claimName: mf-gallery-limbosolutions-com
claimName: nextcloud-mf-gallery
- name: media-gaming
persistentVolumeClaim:
claimName: media-gaming-limbosolutions-com
claimName: nextcloud-media-gaming
- name: media-music
persistentVolumeClaim:
claimName: media-music-limbosolutions-com
claimName: nextcloud-media-music
- name: media-videos
persistentVolumeClaim:
claimName: media-videos-limbosolutions-com
claimName: nextcloud-media-videos
- name: it-storage
persistentVolumeClaim:
claimName: it-storage-limbosolutions-com
claimName: nextcloud-it-storage
- name: mf-nextcloud
persistentVolumeClaim:
claimName: mf-nextcloud-limbosolutions-com
claimName: nextcloud-mf
- name: data-folder-structure
emptyDir: {}
@@ -1,12 +1,9 @@
architecture: standalone
auth:
enabled: true
password: "SET_BY_PRIVATE_VALUES"
master:
persistence:
enabled: false
replica:
replicaCount: 0
@@ -0,0 +1,12 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cloud-limbosolutions-com
resources:
- nextcloud-mf-documents.yaml
- nextcloud-mf-gallery.yaml
- nextcloud-mf.yaml
- nextcloud-media-gaming.yaml
- nextcloud-media-music.yaml
- nextcloud-media-videos.yaml
- nextcloud-it-storage.yaml
@@ -0,0 +1,33 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: nextcloud-it-storage
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 1000Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: nextcloud-it-storage
volumeAttributes:
collection: storage
path: /buckets/storage
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud-it-storage
spec:
storageClassName: storage-limbosolutions-com
volumeName: nextcloud-it-storage
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1000Gi
@@ -0,0 +1,37 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: nextcloud-media-gaming
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: nextcloud-media-gaming
volumeAttributes:
collection: media.gaming
path: /buckets/media.gaming
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud-media-gaming
spec:
storageClassName: storage-limbosolutions-com
volumeName: nextcloud-media-gaming
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
@@ -0,0 +1,37 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: nextcloud-media-music
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: nextcloud-media-music
volumeAttributes:
collection: media.music
path: /buckets/media.music
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud-media-music
spec:
storageClassName: storage-limbosolutions-com
volumeName: nextcloud-media-music
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
@@ -0,0 +1,34 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: nextcloud-media-videos
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 2000Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: nextcloud-media-videos
volumeAttributes:
collection: media.videos
path: /buckets/media.videos
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud-media-videos
spec:
storageClassName: storage-limbosolutions-com
volumeName: nextcloud-media-videos
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
@@ -0,0 +1,35 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: nextcloud-mf-documents
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: nextcloud-mf-documents
volumeAttributes:
collection: mf.documents
path: /buckets/mf.documents
volumeServerAccess: filerProxy
diskType: "ssd"
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud-mf-documents
spec:
storageClassName: storage-limbosolutions-com
volumeName: nextcloud-mf-documents
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
@@ -0,0 +1,33 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: nextcloud-mf-gallery
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: nextcloud-mf-gallery
volumeAttributes:
collection: mf.gallery
path: /buckets/mf.gallery
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud-mf-gallery
spec:
storageClassName: storage-limbosolutions-com
volumeName: nextcloud-mf-gallery
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
@@ -0,0 +1,33 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: nextcloud-mf
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: nextcloud-mf
volumeAttributes:
collection: mf.ssd.nexcloud
path: /buckets/mf.ssd.nexcloud
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud-mf
spec:
storageClassName: storage-limbosolutions-com
volumeName: nextcloud-mf
accessModes:
- ReadWriteMany
resources:
requests:
storage: 64Gi
-50
View File
@@ -1,50 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: continuous-deploy
rules:
- apiGroups: [""]
resources: ["pods", "services", "secrets", "configmaps", "persistentvolumeclaims"]
verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
- apiGroups: ["apps"]
resources: ["deployments", "statefulsets"]
verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
- apiGroups: ["batch"]
resources: ["cronjobs", "jobs"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: continuous-deploy
---
apiVersion: v1
kind: Secret
metadata:
name: continuous-deploy
annotations:
kubernetes.io/service-account.name: continuous-deploy
type: kubernetes.io/service-account-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: continuous-deploy
subjects:
- kind: ServiceAccount
name: continuous-deploy
roleRef:
kind: Role
name: continuous-deploy
apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,8 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cloud-limbosolutions-com
resources:
- ./ingress-web-public.yaml
- ./ingress-web.yaml
@@ -1,156 +0,0 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: mf-documents-limbosolutions-com-nextcloud
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: mf-documents-limbosolutions-com-nextcloud
volumeAttributes:
collection: mf.documents
path: /buckets/mf.documents
volumeServerAccess: filerProxy
diskType: "ssd"
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: media-music-limbosolutions-com-nextcloud
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: media-music-limbosolutions-com-nextcloud
volumeAttributes:
collection: media.music
path: /buckets/media.music
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: media-videos-limbosolutions-com-nextcloud
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 2000Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: media-videos-limbosolutions-com-nextcloud
volumeAttributes:
collection: media.videos
path: /buckets/media.videos
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: media-gaming-limbosolutions-com-nextcloud
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: media-gaming-limbosolutions-com-nextcloud
volumeAttributes:
collection: media.gaming
path: /buckets/media.gaming
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: it-storage-limbosolutions-com-nextcloud
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 1000Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: it-storage-limbosolutions-com-nextcloud
volumeAttributes:
collection: storage
path: /buckets/storage
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: mf-gallery-limbosolutions-com-nextcloud
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: mf-gallery-limbosolutions-com-nextcloud
volumeAttributes:
collection: mf.gallery
path: /buckets/mf.gallery
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: mf-nextcloud-limbosolutions-com-nextcloud
spec:
storageClassName: storage-limbosolutions-com
accessModes:
- ReadWriteMany
capacity:
storage: 64Gi
csi:
driver: storage-limbosolutions-com-csi-driver
volumeHandle: mf-nextcloud-limbosolutions-com-nextcloud
volumeAttributes:
collection: mf.ssd.nexcloud
path: /buckets/mf.ssd.nexcloud
volumeServerAccess: filerProxy
persistentVolumeReclaimPolicy: Retain
volumeMode: Filesystem
---
+4 -28
View File
@@ -1,42 +1,18 @@
#!/bin/bash
set -e
echo "Executing nextcloud app deploy."
kubectl kustomize deploy/app | kubectl apply -f -
load_env_file() {
local file="$1"
if [ -f "$file" ]; then
echo "Loading environment variables from: $file"
set -a
. "$file"
set +a
else
echo "Skipping missing env file: $file"
fi
}
helm repo add nextcloud https://nextcloud.github.io/helm/ --force-update
load_env_file "deploy/app/.env.d/nextcloud-mariadb.env"
load_env_file "deploy/app/.env.d/nextcloud-secrets.env"
load_env_file "deploy/app/.env.d/redis.env"
helm upgrade --install nextcloud nextcloud/nextcloud --version "9.0" \
--values ./deploy/app/nextcloud-helm-values.yaml \
--set externalDatabase.user=${MARIADB_USER:?Missing MARIADB_USER} \
--set externalDatabase.password=${MARIADB_PASSWORD:?Missing MARIADB_PASSWORD} \
--set externalDatabase.database=${MARIADB_DATABASE:?Missing MARIADB_DATABASE} \
--set nextcloud.host=${NEXTCLOUD_HOST:?Missing NEXTCLOUD_HOST} \
--set nextcloud.username=${NEXTCLOUD_USERNAME:?Missing NEXTCLOUD_USERNAME} \
--set nextcloud.password=${NEXTCLOUD_PASSWORD:?Missing NEXTCLOUD_PASSWORD} \
--values ./deploy/apps/nextcloud/nextcloud-helm-values.yaml \
--values ./deploy/apps/nextcloud/nextcloud-helm-values.private.yaml \
--namespace cloud-limbosolutions-com
helm repo add bitnami https://charts.bitnami.com/bitnami --force-update
helm upgrade --install nextcloud-redis bitnami/redis --version "25.3" \
--values ./deploy/app/redis-helm-values.yaml \
--set auth.password="${REDIS_PASSWORD:?Missing REDIS_PASSWORD}" \
--values ./deploy/apps/nextcloud/redis-helm-values.yaml \
--values ./deploy/apps/nextcloud/redis-helm-values.private.yaml \
--namespace cloud-limbosolutions-com
-5
View File
@@ -1,5 +0,0 @@
#!/bin/bash
set -e
echo "Executing infra deploy."
kubectl create namespace cloud-limbosolutions-com || true
kubectl kustomize deploy/infra | kubectl -n cloud-limbosolutions-com apply -f -