From 91c7cb5f946128ab7fed274506e9b61a16b23f5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A1rcio=20Fernandes?= Date: Thu, 16 Jul 2026 20:55:41 +0000 Subject: [PATCH] nextcloud add redis helm release to fluxcd --- .gitignore | 1 - .sops.yaml | 2 +- README.md | 2 ++ deploy/nextcloud/bitnami-helm-repo.yaml | 7 ++++++ deploy/nextcloud/kustomization.yaml | 9 +++++++ .../nextcloud-helm-values.private.yaml | 24 +++++++++++++++++++ deploy/nextcloud/redis-helm-release.yaml | 23 ++++++++++++++++++ .../nextcloud/redis-helm-values.private.yaml | 17 +++++++++++++ 8 files changed, 83 insertions(+), 2 deletions(-) create mode 100644 deploy/nextcloud/bitnami-helm-repo.yaml create mode 100644 deploy/nextcloud/nextcloud-helm-values.private.yaml create mode 100644 deploy/nextcloud/redis-helm-release.yaml create mode 100644 deploy/nextcloud/redis-helm-values.private.yaml diff --git a/.gitignore b/.gitignore index 5813bf1..d3f9fe0 100644 --- a/.gitignore +++ b/.gitignore @@ -3,5 +3,4 @@ **tmp** **.cache** **.local.** -**.private.** **.dec.** diff --git a/.sops.yaml b/.sops.yaml index fde2173..00c3378 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,7 +1,7 @@ creation_rules: # encrypt secrets files - - path_regex: \.local\.dec\.yaml$ + - path_regex: \.private\.dec\.yaml$ encrypted_regex: '^(.*)$' age: - age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g diff --git a/README.md b/README.md index 1ed1f5c..d4283b3 100644 --- a/README.md +++ b/README.md @@ -162,6 +162,8 @@ sops -e ./deploy/whiteboard/whiteboard-secrets.dec.yaml > ./deploy/whiteboard/wh sops -e ./deploy/onlyoffice/onlyoffice-secrets.dec.yaml > ./deploy/onlyoffice/onlyoffice-secrets.yaml sops -e ./deploy/backups/backup-secrets.dec.yaml > ./deploy/backups/backup-secrets.yaml sops -e ./deploy/nextcloud/mariadb-secrets.dec.yaml > ./deploy/nextcloud/mariadb-secrets.yaml +sops -e ./deploy/nextcloud/redis-helm-values.private.dec.yaml > ./deploy/nextcloud/redis-helm-values.private.yaml +sops -e ./deploy/nextcloud/nextcloud-helm-values.private.dec.yaml > ./deploy/nextcloud/nextcloud-helm-values.private.yaml ``` ## internal logs diff --git a/deploy/nextcloud/bitnami-helm-repo.yaml b/deploy/nextcloud/bitnami-helm-repo.yaml new file mode 100644 index 0000000..304ace5 --- /dev/null +++ b/deploy/nextcloud/bitnami-helm-repo.yaml @@ -0,0 +1,7 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: bitnami +spec: + interval: 40h + url: https://charts.bitnami.com/bitnami \ No newline at end of file diff --git a/deploy/nextcloud/kustomization.yaml b/deploy/nextcloud/kustomization.yaml index d80105c..590599c 100644 --- a/deploy/nextcloud/kustomization.yaml +++ b/deploy/nextcloud/kustomization.yaml @@ -9,3 +9,12 @@ resources: - ./ingress-web.yaml - ./network-policies.yaml +secretGenerator: + - name: redis-helm-values + files: + - values.yaml=redis-helm-values.yaml + - values.private.yaml=redis-helm-values.private.yaml + +generatorOptions: + disableNameSuffixHash: true + diff --git a/deploy/nextcloud/nextcloud-helm-values.private.yaml b/deploy/nextcloud/nextcloud-helm-values.private.yaml new file mode 100644 index 0000000..8a41ebd --- /dev/null +++ b/deploy/nextcloud/nextcloud-helm-values.private.yaml @@ -0,0 +1,24 @@ +# externalDatabase values bust be equal to mariadb deployment +externalDatabase: + user: ENC[AES256_GCM,data:HqXnYBKQHzIR,iv:NKiS4Vfbvy389/Zdgm4H+paOaCcc12BySuh3NosrMO8=,tag:h5lihZ+BLv2b0+G1EQSLjg==,type:str] + password: ENC[AES256_GCM,data:qscZw69Pz+drb8UX,iv:KY747UHpYeh5bgod8Z5Qk4bB8nRvg3Kw+VqVnfoOv7Q=,tag:phANHEL1ZkkRINK12NYdzA==,type:str] + database: ENC[AES256_GCM,data:/XD+NHLMJ/XN,iv:IPByRyRkp8CeI7HrUAGqItsRn5A6V5TZHGKdpsOjqxg=,tag:tILpwXkYcwMGCZ8vGcAglQ==,type:str] +nextcloud: + host: ENC[AES256_GCM,data:Y374tScMzTsVld1aBnF/mJIcWR/F0OX1,iv:M/cz/UiG7/PZaSEtfsFuGfL1s1x+4MC/wj63KsTDrO0=,tag:vDl10JgJ13Cbjc5CrSQ6fQ==,type:str] + username: ENC[AES256_GCM,data:ZTMVaUQ=,iv:rY3amAhSfp8gmYxt8Wr8gYApY3zVq9+6mNr8SBMvoJU=,tag:gr5ww/ClJvu9VzrGHo+/6g==,type:str] + password: ENC[AES256_GCM,data:xTapugoUGlwYCznXIJo=,iv:CfzwABLMqvbvne9mo0Se0x8aaGVIdOeF+rqwsLi3ze0=,tag:PO5Q+Bn7JSxMYhJhMUIIXw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUalM4azhBNWIvcURLd0ZU + aFhjMVR1cnpCYmtTK2ZOTStKd3phREpXaDJVCnBuaVBCaVU0S1A1S2pBNE5RSjJP + dGxNbnM3K0pQaWpqd2F0anMxSTFqM00KLS0tIFpOSFBPRk1SdzJOUkpzbkttSU9Q + ZytPMHZtQnhwTnlLelpoSlByZGhTSGcKA/NnalXsjCib9dbOzc5Ra+PUqOCTpnRD + kodxY9x70UqujQRkgNE1QSWCPxjsIwEQDNjQcxU0SqEvy8E+n+1Jcw== + -----END AGE ENCRYPTED FILE----- + recipient: age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g + encrypted_regex: ^(.*)$ + lastmodified: "2026-07-16T20:46:54Z" + mac: ENC[AES256_GCM,data:Zj8OupdsjRTNj+DOGnjj11LyDrwKRjAWbjuYoiJZYaIeKuv9+xHuoY8PPRdkaw7oyxn66vFkHOGN3r3YjS8OvfVpGaw3D60mWteXRiwKTw/VrfjRHRY8oqHBiAPk0wWux9UAde4ziSBvemU/g4YESiNUOF9fKqkhpZgeH/3qiKs=,iv:X9z+K3KgyrekX9UneiLB9PUOcfRfonl2f608FfeXeyM=,tag:kHcdi4BKpXlUOtl9idL/FQ==,type:str] + version: 3.13.1 diff --git a/deploy/nextcloud/redis-helm-release.yaml b/deploy/nextcloud/redis-helm-release.yaml new file mode 100644 index 0000000..c66aee1 --- /dev/null +++ b/deploy/nextcloud/redis-helm-release.yaml @@ -0,0 +1,23 @@ + +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: redis +spec: + releaseName: nextcloud-redis + interval: 1m + chart: + spec: + chart: bitnami/redis + version: '25.3' + sourceRef: + kind: HelmRepository + name: bitnami + interval: 24h + valuesFrom: + - kind: Secret + name: redis-helm-values + valuesKey: values.yaml + - kind: Secret + name: redis-helm-values + valuesKey: values.private.yaml \ No newline at end of file diff --git a/deploy/nextcloud/redis-helm-values.private.yaml b/deploy/nextcloud/redis-helm-values.private.yaml new file mode 100644 index 0000000..2f789fc --- /dev/null +++ b/deploy/nextcloud/redis-helm-values.private.yaml @@ -0,0 +1,17 @@ +auth: + password: ENC[AES256_GCM,data:D4Rs5S4M1Ol56z7NFpQ=,iv:nreW9uom+AFuIuU/6N+9xEZAkwHVrpCR1svbABPNNw0=,tag:wmKe+mTq558JMcf4EGKciQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHOW5nS09vcmNPRDNPN0da + QWdwRjFwd3hGM0Z4dU0rNEhyQXNkK1FyRjJJCmQ5d2hPTjJES21DZmIwaDIvTmhJ + eHBnYkRCWUUvcnZQVTJrQ3c2TzhkRzgKLS0tIDNPQVZzdmtHNXl3dlNvaWxwaVBx + b1E5elBLeU5TZGNMK00wSlhSTlRmRlEK4/i2IHGlTO55dp2JL5JBa5byJHEcCjo3 + GGxapO12SpjjCm8FQrxqNWlsMBOcaHkIMEJ5uJXLvjZAnDWEUJz6qA== + -----END AGE ENCRYPTED FILE----- + recipient: age17efn4arj07weaak2qmsgh53qvmfhpeun4xxanakd9q7xwqxyvcpsw0zn5g + encrypted_regex: ^(.*)$ + lastmodified: "2026-07-16T20:45:48Z" + mac: ENC[AES256_GCM,data:mwAlWr9EmP5VCnDO+2iGAjwNm9gcMcIJfL8ajZKlzKjBzrT22anjk+b7JeeQVkUOGyUBZ5iaG1Hg8kpT2pcFgOScQd0AkZoYeGhArkfCCEnmBgs63iWYdTnHayeA76x+67LQc2vBP9eINJbF2ROBuCpzL6b09SD7mWRIDOuWQa4=,iv:a8IYJWfePJ3qZLOYT0l0tw3xifgkOSql/gtLnj1l82Y=,tag:XnQGc3RVDN8O9+9rPw4n4A==,type:str] + version: 3.13.1