creation de nextcloud-kustom

2023-08-30 11:35:31 +02:00
parent d3e895d0f3
commit 17b00068c4
53 changed files with 2034 additions and 0 deletions
--- a/overlays/dev/patches/ConfigMap-ldap-script.yaml
+++ b/overlays/dev/patches/ConfigMap-ldap-script.yaml
@ -0,0 +1,76 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: script-config-ldap
+data:
+  poststart-ldap.sh: |
+    #!/bin/sh
+
+    NEXTCLOUD_READY=0
+    MAX_RETRIES=30
+    RETRY_INTERVAL=10
+
+    touch /etc/script/validator.txt
+    # Vérifiez si LDAP est déjà activé
+    # if ! su -s /bin/sh -c "/var/www/html/occ app:list --output=json" www-data | jq -e '.enabled | has("user_ldap")'; then
+        # Activez le module LDAP si ce n'est pas déjà fait
+    #    su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data
+    #fi
+    for i in $(seq 1 $MAX_RETRIES); do
+      if curl -fsS "http://localhost/status.php" > /dev/null; then
+        NEXTCLOUD_READY=1
+        break
+      else
+        echo "En attente de Nextcloud (tentative $i/$MAX_RETRIES)..." >> /etc/script/validator.txt
+        sleep $RETRY_INTERVAL
+      fi
+    done
+
+    if [ $NEXTCLOUD_READY -eq 0 ]; then
+      echo "Nextcloud n'est pas prêt après $MAX_RETRIES tentatives. Abandon de l'initialisation LDAP." >> /etc/script/validator.txt
+      exit 1
+    fi 
+
+    su -s /bin/sh -c "/var/www/html/occ app:install user_ldap" www-data
+    su -s /bin/sh -c "/var/www/html/occ app:update user_ldap" www-data
+    su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:create-empty-config" www-data
+
+    ## test if backend ldap is activated and create empty config if not
+    #
+    #touch /tmp/nxt-ldap.txt
+    #su -s /bin/sh -c "/var/www/html/occ ldap:show-config s01 > /tmp/nextcloud-ldap.txt" www-data
+    #if grep -q "Invalid configID" /tmp/nextcloud-ldap.txt; then
+    #  sudo -u www-data php /var/www/html/nextcloud/occ ldap:create-empty-config -q
+    #fi
+
+    # Configurez LDAP (configuration minimale)
+
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldap_host '${NEXTCLOUD_LDAP_HOST}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldap_base '${NEXTCLOUD_LDAP_BASE}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldap_dn '${NEXTCLOUD_LDAP_DN}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldap_agent_password '${NEXTCLOUD_LDAP_PASSWD}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapBaseGroups '${NEXTCLOUD_LDAP_BASE_GROUPS}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapBaseUsers '${NEXTCLOUD_LDAP_BASE_USERS}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapConfigurationActive '${NEXTCLOUD_LDAP_ACTIVE_CONF}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapExperiencedAdmin '${NEXTCLOUD_LDAP_ADMIN_EXP}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapExpertUUIDUserAttr '${NEXTCLOUD_LDAP_EXP_UUID}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapLoginFilter '${NEXTCLOUD_LDAP_LOGIN_FILTER}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapPort '${NEXTCLOUD_LDAP_PORT}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapUserFilter '${NEXTCLOUD_LDAP_USR_FILTR}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapUserFilterObjectclass '${NEXTCLOUD_LDAP_OBJ_FILTR}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapEmailAttribute '${NEXTCLOUD_LDAP_MAIL_ATTR}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapUserDisplayName '${NEXTCLOUD_LDAP_USER_DISP}'" www-data
+
+    #sudo -u www-data php /var/www/html/nextcloud/occ ldap:set-config s01 ldapGroupFilter "${ldapGroupFilter}"
+    #sudo -u www-data php /var/www/html/nextcloud/occ ldap:set-config s01 ldapGroupFilterObjectclass "${ldapGroupFilterObjectclass}"
+    #sudo -u www-data php /var/www/html/nextcloud/occ ldap:set-config s01 ldapGroupMemberAssocAttr "${ldapGroupMemberAssocAttr}"
+
+    
+    # Lancez le processus principal de Nextcloud normalement ça ne marche pas ça ! donc plutot poststart.
+    #exec /entrypoint.sh "$@"
+
+    # su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data 
+    # est fonctionnel dans le pods nextcloud ! 
+
+    #liste config : su -s /bin/sh -c "/var/www/html/occ config:list" www-data
--- a/overlays/dev/patches/ConfigMaps.yaml
+++ b/overlays/dev/patches/ConfigMaps.yaml
@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: update-config
+data:
+  custom-script.sh: |
+    #!/bin/sh
+
+    HOSTS_FILE="/etc/hosts"
+
+    # Ajoutez l'entrée au fichier hosts
+    MINIO_SERVICE_IP="${MINIO_SERVICE_HOST}"
+    MINIO_NAME="${MINIO_SERVICE_NAME}"
+    echo "$MINIO_SERVICE_IP" minio >> $HOSTS_FILE
--- a/overlays/dev/patches/ingress-nextcloud.yaml
+++ b/overlays/dev/patches/ingress-nextcloud.yaml
@ -0,0 +1,36 @@
+- op: replace
+  path: /metadata/annotations/nginx.ingress.kubernetes.io~1proxy-body-size
+  value: "1G"
+- op: replace
+  path: /metadata/annotations/nginx.ingress.kubernetes.io~1enable-cors
+  value: "true"
+- op: replace
+  path: /metadata/annotations/nginx.ingress.kubernetes.io~1cors-allow-headers
+  value: "X-Forwarded-For"
+
+# En cas de besoin
+#- op: add
+#  path: /metadata/annotations/nginx.ingress.kubernetes.io~1client_max_body_size
+#  value: "100m"
+
+- op: replace
+  path: /spec/rules/0/host
+  value: nxt.cadoles.fr
+- op: replace
+  path: /spec/rules/0/http/paths/0/path
+  value: /
+- op: replace
+  path: /spec/rules/0/http/paths/0/pathType
+  value: Prefix
+- op: replace
+  path: /spec/rules/0/http/paths/0/backend/service/name
+  value: nextcloud
+- op: replace
+  path: /spec/rules/0/http/paths/0/backend/service/port/number
+  value: 80
+
+
+
+# logiquement path = 
+#  path: /metadata/annotations/nginx.ingress.kubernetes.io/proxy-body-size
+# sauf que ... json voila, "/" est à remplacer par ~1
--- a/overlays/dev/patches/job.yaml
+++ b/overlays/dev/patches/job.yaml
@ -0,0 +1,65 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: create-minio-bucket
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: wait-for-minio
+        image: reg.cadoles.com/proxy_cache/library/debian:bookworm
+        envFrom:
+        - configMapRef:
+            name: nextcloud-env
+        command: ["sh", "-c"]
+        args:
+        - |
+          echo "attente du service minio..."
+          cnt=0
+          tout=300
+          apt update && apt install --yes --force-yes wget openssl 
+          cp /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /usr/local/share/ca-certificates/ks.crt && update-ca-certificates
+          while [ 1 ]
+          do
+            http_code=$(wget --server-response https://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT}/minio/health/live 2>&1 | awk '/^  HTTP/{print $2}')
+            if [ "${http_code}" != "200" ]; then
+              echo "waiting for https://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT}"
+              sleep 1
+            else
+              exit 0
+            fi
+
+            cnt=$((cnt+1))
+            if [ "${cnt}" -ge "${tout}" ]; then
+              exit 3
+            fi
+          done
+# Encore nécessaire ? 
+      containers:
+      - name: create-bucket
+        image: minio/mc
+        envFrom:
+        - configMapRef:
+            name: nextcloud-env
+        env:
+        - name: CONSOLE_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-minio-user
+              key: CONSOLE_ACCESS_KEY
+        - name: CONSOLE_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-minio-user
+              key: CONSOLE_SECRET_KEY
+        command: ["sh", "-c"]
+        args:
+        - |
+          echo "création de l'alias my-minio"
+          mc alias set --insecure my-minio http://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT} ${CONSOLE_ACCESS_KEY} ${CONSOLE_SECRET_KEY}
+          echo "création du bucket..."
+          mc mb --insecure my-minio/nextcloud-minio
+          echo "Bucket créé. normalement"
+      restartPolicy: OnFailure
+
+
--- a/overlays/dev/patches/nextcloud-S3.yaml
+++ b/overlays/dev/patches/nextcloud-S3.yaml
@ -0,0 +1,24 @@
+- op: replace
+  path: /spec/template/spec/containers/0/env/13/value #OBJECTSTORE_S3_HOST
+  value: minio:$(MINIO_SERVICE_PORT)
+- op: replace
+  path: /spec/template/spec/containers/0/env/14/value #OBJECTSTORE_S3_BUCKET
+  value: nextcloud-minio
+- op: replace
+  path: /spec/template/spec/containers/0/env/15/value #OBJECTSTORE_S3_KEY
+  valueFrom:
+    secretKeyRef:
+      name: nextcloud-minio-user  # kustomize racine
+      key: CONSOLE_ACCESS_KEY
+- op: replace
+  path: /spec/template/spec/containers/0/env/16/value #OBJECTSTORE_S3_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: nextcloud-minio-user  # kustomize racine
+      key: CONSOLE_SECRET_KEY
+- op: replace
+  path: /spec/template/spec/containers/0/env/17/value #OBJECTSTORE_S3_USEPATH_STYLE
+  value: "true"
+- op: replace
+  path: /spec/template/spec/containers/0/env/18/value #OBJECTSTORE_S3_SSL
+  value: "true"
--- a/overlays/dev/patches/nextcloud-ldap.yaml
+++ b/overlays/dev/patches/nextcloud-ldap.yaml
@ -0,0 +1,75 @@
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_HOST
+    value: openldap.openldap
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_BASE
+    value: dc=example,dc=org
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_DN
+    value: cn=admin,dc=example,dc=org
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_PASSWD
+    value: "adminpassword"
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_BASE_GROUPS
+    value: dc=example,dc=org
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_BASE_USERS
+    value: ou=users,dc=example,dc=org
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_ACTIVE_CONF
+    value: "1"
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_ADMIN_EXP
+    value: "0"
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_EXP_UUID
+    value: cn
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_LOGIN_FILTER
+    value: (&(objectClass=posixAccount)(cn=%uid))
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_PORT
+    value: "1389"
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_USR_FILTR
+    value: (|(objectclass=posixAccount))
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_OBJ_FILTR
+    value: posixAccount
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_MAIL_ATTR
+    value: mail
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_USER_DISP
+    value: cn
--- a/overlays/dev/patches/nextcloud-patch.yaml
+++ b/overlays/dev/patches/nextcloud-patch.yaml
@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          env:
+            - name: NEXTCLOUD_ADMIN_USER
+              value: admincadoles
+            - name: NEXTCLOUD_ADMIN_PASSWORD
+              value: cadoles
+            - name: PHP_MEMORY_LIMIT
+              value: 512M
+            - name: PHP_UPLOAD_LIMIT
+              value: 4G
+            - name: REDIS_HOST
+              value: redis
+            - name: REDIS_HOST_PORT
+              value: "6379"
+            - name: NEXTCLOUD_DATA_DIR
+              value: "/var/www/html/data"
+            - name: NEXTCLOUD_TRUSTED_DOMAINS
+              value: "*.cadoles.fr"
--- a/overlays/dev/patches/nextcloud-postgres.yaml
+++ b/overlays/dev/patches/nextcloud-postgres.yaml
@ -0,0 +1,34 @@
+# USER POSTGRES
+# UNIQUEMENT Si vous ne passez pas par l'operateur.
+#- op: replace
+#  path: /spec/template/spec/containers/env/0/value #POSTGRES_DB
+#  value: username
+#- op: replace
+#  path: /spec/template/spec/containers/env/1/value #POSTGRES_USER
+#  value: username
+#- op: replace
+#  path: /spec/template/spec/containers/env/2/value #POSTGRES_PASSWORD
+#  value: password
+
+# CONF POSTGRES
+- op: replace
+  path: /spec/template/spec/containers/0/env/3/value #POSTGRES_HOST
+  value: $(NEXTCLOUD_POSTGRES_RW_SERVICE_HOST)
+- op: replace
+  path: /spec/template/spec/containers/0/env/0/value #POSTGRES_DB
+  value: nextcloud
+
+
+#Name:         nextcloud-postgres-app
+#Namespace:    nextcloud
+#Labels:       cnpg.io/cluster=nextcloud-postgres
+#              cnpg.io/reload=true
+#Annotations:  cnpg.io/operatorVersion: 1.18.1
+#
+#Type:  kubernetes.io/basic-auth
+#
+#Data
+#====
+#password:  64 bytes
+#pgpass:    112 bytes
+#username:  9 bytes
--- a/overlays/dev/patches/nextcloud-probe.yaml
+++ b/overlays/dev/patches/nextcloud-probe.yaml
@ -0,0 +1,47 @@
+# livenessProbe
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/httpGet/httpHeaders/0/value
+  value: nxt.cadoles.fr
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/httpGet/port
+  value: 80
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/initialDelaySeconds
+  value: 50
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/periodSeconds
+  value: 10
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/timeoutSeconds
+  value: 5
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/successThreshold
+  value: 1
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/failureThreshold
+  value: 6
+
+
+# readinessProbe
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/httpGet/httpHeaders/0/value
+  value: nxt.cadoles.fr
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/httpGet/port
+  value: 80
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/initialDelaySeconds
+  value: 50
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/periodSeconds
+  value: 10
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/timeoutSeconds
+  value: 5
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/successThreshold
+  value: 1
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/failureThreshold
+  value: 6
+
--- a/overlays/dev/patches/nextcloud-smtp.yaml
+++ b/overlays/dev/patches/nextcloud-smtp.yaml
@ -0,0 +1,26 @@
+- op: replace
+  path: /spec/template/spec/containers/0/env/19/value #MAIL_FROM_ADDRESS
+  value: "usercadoles"
+- op: replace
+  path: /spec/template/spec/containers/0/env/20/value #MAIL_DOMAIN
+  value: "cadoles.com"
+- op: replace
+  path: /spec/template/spec/containers/0/env/21/value #SMTP_HOST
+  value: "groupware.cadoles.com"
+- op: replace
+  path: /spec/template/spec/containers/0/env/22/value #SMTP_SECURE
+  value: "ssl"
+- op: replace
+  path: /spec/template/spec/containers/0/env/23/value #SMTP_PORT
+  value: "587"
+- op: replace
+  path: /spec/template/spec/containers/0/env/24/value #SMTP_AUTHTYPE
+  value: "LOGIN"
+
+# THEORIQUEMENT LA MODIFICATION du secret generator lié dans kustomize suffit.
+#- op: replace
+#  path: /spec/template/spec/containers/0/env/25/value #SMTP_NAME
+#  value: 
+#- op: replace
+#  path: /spec/template/spec/containers/0/env/26/value #SMTP_PASSWORD
+#  value: 
--- a/overlays/dev/patches/nextcloud-variables.yaml
+++ b/overlays/dev/patches/nextcloud-variables.yaml
@ -0,0 +1,34 @@
+# USER MDP NEXTCLOUD
+- op: replace
+  path: /spec/template/spec/containers/0/env/4/value #NEXTCLOUD_ADMIN_USER
+  value: admincadoles
+- op: replace
+  path: /spec/template/spec/containers/0/env/5/value #NEXTCLOUD_ADMIN_PASSWORD
+  value: CadolesNotSecret
+
+# CONF NEXTCLOUD PHP
+
+- op: replace
+  path: /spec/template/spec/containers/0/env/8/value  #PHP_MEMORY_LIMIT
+  value: 512M
+- op: replace
+  path: /spec/template/spec/containers/0/env/9/value #PHP_UPLOAD_LIMIT
+  value: 4G
+
+# CONF NEXTCLOUD REDIS
+
+- op: replace
+  path: /spec/template/spec/containers/0/env/11/value #REDIS_HOST
+  value: redis
+- op: replace
+  path: /spec/template/spec/containers/0/env/12/value #REDIS_HOST_PORT
+  value: "6379"
+
+# CONF NEXTCLOUD
+
+#- op: replace
+#  path: /spec/template/spec/containers/0/env/27/value #NEXTCLOUD_DATA_DIR
+#  value: "/var/www/html/data"
+- op: replace
+  path: /spec/template/spec/containers/0/env/6/value #NEXTCLOUD_TRUSTED_DOMAINS
+  value: "*.cadoles.fr"
--- a/overlays/dev/patches/redis-config.yaml
+++ b/overlays/dev/patches/redis-config.yaml
@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm-redis-config
+data:
+  redis-config: |
+    maxmemory 4mb
+    maxmemory-policy volatile-lru
+    appendonly yes
--- a/overlays/dev/patches/tenant-conf.yaml
+++ b/overlays/dev/patches/tenant-conf.yaml
@ -0,0 +1,21 @@
+- op: replace
+  path: /spec/certConfig/dnsNames
+  value: ["minio"]
+- op: replace
+  path: /spec/pools/0/servers
+  value: 2
+- op: replace
+  path: /spec/pools/0/volumesPerServer
+  value: 3
+- op: replace
+  path: /spec/pools/0/volumeClaimTemplate/spec/resources/requests/storage
+  value: 3Gi
+- op: replace
+  path: /spec/pools/0/containerSecurityContext/runAsUser
+  value: 1000
+- op: replace
+  path: /spec/pools/0/containerSecurityContext/runAsGroup
+  value: 1000
+- op: replace
+  path: /spec/pools/0/containerSecurityContext/runAsNonRoot
+  value: true