nextcloud add redis helm release to fluxcd

.gitignore

@@ -3,5 +3,4 @@
 **tmp**
 **.cache**
 **.local.**
-**.private.**
 **.dec.**

.sops.yaml

@@ -1,7 +1,7 @@
 creation_rules:
 
   # encrypt secrets files
-  - path_regex: \.local\.dec\.yaml$
+  - path_regex: \.private\.dec\.yaml$
     encrypted_regex: '^(.*)$'
     age: 
       - age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g

README.md

@@ -162,6 +162,8 @@ sops -e ./deploy/whiteboard/whiteboard-secrets.dec.yaml > ./deploy/whiteboard/wh
 sops -e ./deploy/onlyoffice/onlyoffice-secrets.dec.yaml > ./deploy/onlyoffice/onlyoffice-secrets.yaml
 sops -e ./deploy/backups/backup-secrets.dec.yaml > ./deploy/backups/backup-secrets.yaml
 sops -e ./deploy/nextcloud/mariadb-secrets.dec.yaml > ./deploy/nextcloud/mariadb-secrets.yaml
+sops -e ./deploy/nextcloud/redis-helm-values.private.dec.yaml > ./deploy/nextcloud/redis-helm-values.private.yaml
+sops -e ./deploy/nextcloud/nextcloud-helm-values.private.dec.yaml > ./deploy/nextcloud/nextcloud-helm-values.private.yaml
 ```
 
 ## internal logs

deploy/nextcloud/bitnami-helm-repo.yaml

@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: bitnami
+spec:
+  interval: 40h
+  url: https://charts.bitnami.com/bitnami

deploy/nextcloud/kustomization.yaml

@@ -9,3 +9,12 @@ resources:
   - ./ingress-web.yaml
   - ./network-policies.yaml
 
+secretGenerator:
+  - name: redis-helm-values
+    files:
+      - values.yaml=redis-helm-values.yaml
+      - values.private.yaml=redis-helm-values.private.yaml
+
+generatorOptions:
+  disableNameSuffixHash: true
+

deploy/nextcloud/nextcloud-helm-values.private.yaml

@@ -0,0 +1,24 @@
+# externalDatabase values bust be equal to mariadb deployment
+externalDatabase:
+    user: ENC[AES256_GCM,data:HqXnYBKQHzIR,iv:NKiS4Vfbvy389/Zdgm4H+paOaCcc12BySuh3NosrMO8=,tag:h5lihZ+BLv2b0+G1EQSLjg==,type:str]
+    password: ENC[AES256_GCM,data:qscZw69Pz+drb8UX,iv:KY747UHpYeh5bgod8Z5Qk4bB8nRvg3Kw+VqVnfoOv7Q=,tag:phANHEL1ZkkRINK12NYdzA==,type:str]
+    database: ENC[AES256_GCM,data:/XD+NHLMJ/XN,iv:IPByRyRkp8CeI7HrUAGqItsRn5A6V5TZHGKdpsOjqxg=,tag:tILpwXkYcwMGCZ8vGcAglQ==,type:str]
+nextcloud:
+    host: ENC[AES256_GCM,data:Y374tScMzTsVld1aBnF/mJIcWR/F0OX1,iv:M/cz/UiG7/PZaSEtfsFuGfL1s1x+4MC/wj63KsTDrO0=,tag:vDl10JgJ13Cbjc5CrSQ6fQ==,type:str]
+    username: ENC[AES256_GCM,data:ZTMVaUQ=,iv:rY3amAhSfp8gmYxt8Wr8gYApY3zVq9+6mNr8SBMvoJU=,tag:gr5ww/ClJvu9VzrGHo+/6g==,type:str]
+    password: ENC[AES256_GCM,data:xTapugoUGlwYCznXIJo=,iv:CfzwABLMqvbvne9mo0Se0x8aaGVIdOeF+rqwsLi3ze0=,tag:PO5Q+Bn7JSxMYhJhMUIIXw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUalM4azhBNWIvcURLd0ZU
+            aFhjMVR1cnpCYmtTK2ZOTStKd3phREpXaDJVCnBuaVBCaVU0S1A1S2pBNE5RSjJP
+            dGxNbnM3K0pQaWpqd2F0anMxSTFqM00KLS0tIFpOSFBPRk1SdzJOUkpzbkttSU9Q
+            ZytPMHZtQnhwTnlLelpoSlByZGhTSGcKA/NnalXsjCib9dbOzc5Ra+PUqOCTpnRD
+            kodxY9x70UqujQRkgNE1QSWCPxjsIwEQDNjQcxU0SqEvy8E+n+1Jcw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g
+    encrypted_regex: ^(.*)$
+    lastmodified: "2026-07-16T20:46:54Z"
+    mac: ENC[AES256_GCM,data:Zj8OupdsjRTNj+DOGnjj11LyDrwKRjAWbjuYoiJZYaIeKuv9+xHuoY8PPRdkaw7oyxn66vFkHOGN3r3YjS8OvfVpGaw3D60mWteXRiwKTw/VrfjRHRY8oqHBiAPk0wWux9UAde4ziSBvemU/g4YESiNUOF9fKqkhpZgeH/3qiKs=,iv:X9z+K3KgyrekX9UneiLB9PUOcfRfonl2f608FfeXeyM=,tag:kHcdi4BKpXlUOtl9idL/FQ==,type:str]
+    version: 3.13.1

deploy/nextcloud/redis-helm-release.yaml

@@ -0,0 +1,23 @@
+
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+spec:
+  releaseName: nextcloud-redis
+  interval: 1m
+  chart:
+    spec:
+      chart: bitnami/redis
+      version: '25.3'
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+      interval: 24h
+  valuesFrom:
+    - kind: Secret
+      name: redis-helm-values
+      valuesKey: values.yaml
+    - kind: Secret
+      name: redis-helm-values
+      valuesKey: values.private.yaml

deploy/nextcloud/redis-helm-values.private.yaml

@@ -0,0 +1,17 @@
+auth:
+    password: ENC[AES256_GCM,data:D4Rs5S4M1Ol56z7NFpQ=,iv:nreW9uom+AFuIuU/6N+9xEZAkwHVrpCR1svbABPNNw0=,tag:wmKe+mTq558JMcf4EGKciQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHOW5nS09vcmNPRDNPN0da
+            QWdwRjFwd3hGM0Z4dU0rNEhyQXNkK1FyRjJJCmQ5d2hPTjJES21DZmIwaDIvTmhJ
+            eHBnYkRCWUUvcnZQVTJrQ3c2TzhkRzgKLS0tIDNPQVZzdmtHNXl3dlNvaWxwaVBx
+            b1E5elBLeU5TZGNMK00wSlhSTlRmRlEK4/i2IHGlTO55dp2JL5JBa5byJHEcCjo3
+            GGxapO12SpjjCm8FQrxqNWlsMBOcaHkIMEJ5uJXLvjZAnDWEUJz6qA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g
+    encrypted_regex: ^(.*)$
+    lastmodified: "2026-07-16T20:45:48Z"
+    mac: ENC[AES256_GCM,data:mwAlWr9EmP5VCnDO+2iGAjwNm9gcMcIJfL8ajZKlzKjBzrT22anjk+b7JeeQVkUOGyUBZ5iaG1Hg8kpT2pcFgOScQd0AkZoYeGhArkfCCEnmBgs63iWYdTnHayeA76x+67LQc2vBP9eINJbF2ROBuCpzL6b09SD7mWRIDOuWQa4=,iv:a8IYJWfePJ3qZLOYT0l0tw3xifgkOSql/gtLnj1l82Y=,tag:XnQGc3RVDN8O9+9rPw4n4A==,type:str]
+    version: 3.13.1