add cert-manager configuration

README.md

@@ -1,2 +1,20 @@
 # nextcloud-kustom
 
+**WARNING - test branch, does not respect the target strategy for a production environment**
+
+1. Create cluster
+
+```kind create cluster --config requires/cluster/cluster.yaml```
+
+2. Install operators and openldap(dev)
+
+```kubectl apply -k requires/```
+
+3. Define IP poll address
+
+```kubectl apply -k base/cluster/lb```
+
+4. Install nextcloud
+
+```kubectl apply -k overlays/dev```
+

base/cluster/lb/advertise.yaml

@@ -0,0 +1,9 @@
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: l2-ip-pool-ad
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+  - main-pool
+

base/cluster/lb/ipaddresspoool.yaml

@@ -0,0 +1,8 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: main-pool
+  namespace: metallb-system
+spec:
+  addresses:
+  - 172.18.10.100-172.18.10.200

base/cluster/lb/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: metallb-system
+
+resources:
+- ipaddresspoool.yaml
+- advertise.yaml

base/components/cnpg-database/configurations/cnpg-config.yaml

@@ -0,0 +1,8 @@
+---
+nameReference:
+- kind: Secret
+  fieldSpecs:
+  - path: spec/superuserSecret/name
+    kind: Cluster
+  - path: spec/bootstrap/initdb/secret/name
+    kind: Cluster

base/components/cnpg-database/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+namespace: nextcloud
+
+configurations:
+- ./configurations/cnpg-config.yaml
+
+resources:
+- ./resources/nextcloud-cnpg.yaml
+

base/components/cnpg-database/resources/nextcloud-cnpg.yaml

@@ -0,0 +1,14 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: nextcloud-postgres
+  namespace: nextcloud
+spec:
+  instances: 1
+  primaryUpdateStrategy: unsupervised
+  bootstrap:
+    initdb:
+      database: nextcloud
+      owner: nextcloud
+  storage:
+    size: 5Gi

base/components/one-redis/ConfigMap-redis.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm-redis-config
+data:
+  redis-config: |
+    maxmemory 2mb
+    maxmemory-policy allkeys-lru    

base/components/one-redis/deployment.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: redis
+  name: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - command:
+        - redis-server
+        - /redis-master/redis.conf
+        image: redis:alpine
+        name: redis
+        ports:
+        - containerPort: 6379
+        volumeMounts:
+        - mountPath: /redis-master-data
+          name: data
+        - mountPath: /redis-master
+          name: config
+      restartPolicy: Always
+      volumes:
+      - name: data
+        emptyDir: {}
+      - name: config
+        configMap:
+          name: cm-redis-config
+          items:
+          - key: redis-config
+            path: redis.conf

base/components/one-redis/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+namespace: nextcloud
+
+resources:
+- deployment.yaml
+- redis-service.yaml
+- ConfigMap-redis.yaml

base/components/one-redis/readme.md

@@ -0,0 +1,5 @@
+# README
+
+Pour configurer facilement et rapidement le redis passer par le fichier ConfigMap-redis.yaml !!!
+
+- cf https://kubernetes.io/docs/tutorials/configuration/configure-redis-using-configmap/

base/components/one-redis/redis-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  labels:
+    app: redis
+spec:
+  ports:
+    - port: 6379
+  selector:
+    app: redis

base/kustomization.yaml

@@ -0,0 +1,39 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: nextcloud
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+# référence à l'exemple cadoles. 
+# cela force la mise à jours des secret en questions liés aux ressources ayant le labels "tenant" lorsque modifié
+configurations:
+#- https://forge.cadoles.com/CadolesKube/c-kustom/raw/branch/develop/base/minio/configurations/tenants.minio.min.io.yaml
+# => importé en locale pour pouvoir faire un kustomize build
+- ./resources/nextcloud/resources/files/minio/configurations/tenants.minio.min.io.yaml
+
+resources:
+- ./resources/nextcloud
+
+
+components:
+- ./components/cnpg-database
+- ./components/one-redis
+
+# MOUNT-TRY-multi-instance
+## A SUPPRIMER EN CAS DE REDEPLOYEMENT nextcloud doit s'intaller une FOIS, ne décommenté qu'après la première installation
+#configMapGenerator:
+#- name: nextcloud-config
+#  files:
+#  - ./config.php
+##  behavior: merge      # dans le cas ou le configmap existerait déjà et que la donnée est différente.
+#  options:
+#    disableNameSuffixHash: true  
+## Aller aussi dans deployment.yaml pour commenter les lignes suivantes, et supprimer le fichier config.php
+#        - name: nextcloud-config-volume     # monte le fichier de configuration dans 
+#          mountPath: /var/www/html/config   # les instances supplémentaire
+#          readOnly: true                    # via le configmap ConfigMaps-php.yaml
+
+#      - name: nextcloud-config-volume       # permet de monter le fichier de configuration dans 
+#        configMap:                          # les instances supplémentaires
+#          name: nextcloud-config            # via le configmap ConfigMaps-php.yaml

base/resources/nextcloud/kustomization.yaml

@@ -0,0 +1,63 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# namespace: nextcloud
+
+generatorOptions:
+  disableNameSuffixHash: true # suppression des suffixe en hash en bout de nom
+
+resources:
+- ./resources/deployment.yaml
+# - ./resources/namespace.yaml
+- ./resources/nextcloud-tenant.yaml
+- ./resources/nextcloud-service.yaml
+- ./resources/pvc.yaml
+- ./resources/job.yaml
+- ./resources/ConfigMap.yaml
+- ./resources/nextcloud-rolebinding.yaml
+- ./resources/nextcloud-role.yaml
+- ./resources/nextcloud-serviceaccount.yaml
+- ./resources/ingress.yaml
+- ./resources/ConfigMap-ldap-script.yaml
+
+#- ./resources/secret.yaml
+
+
+configMapGenerator:
+- name: nextcloud-parameters
+  files:
+  - ./resources/files/parameters.yaml
+- name: nextcloud-env
+  literals:
+  - MINIO_SERVICE_NAME=$(MINIO_SERVICE_HOST):$(MINIO_SERVICE_PORT) # pas nécessaire je pense
+  - MINIO_SERVICE_HOST=minio
+  - MINIO_SERVICE_PORT=443
+
+secretGenerator:
+# Voir https://github.com/minio/operator/issues/856
+- name: nextcloud-minio-user
+  literals:
+  - CONSOLE_ACCESS_KEY=minio_root
+  - CONSOLE_SECRET_KEY=MinioRootNotSoSecret
+  options:
+    disableNameSuffixHash: true
+# Voir https://github.com/minio/operator/issues/856
+- name: nextcloud-minio-configuration
+  files:
+  - ./resources/files/minio/config.env  # A modifier si modification mot de passe et user CONSOLE [ACCESS-SECRET]
+  options:
+    disableNameSuffixHash: true
+- name: nextcloud-smtp
+  literals:
+    - smtp-username=user
+    - smtp-password=password
+  options:
+    disableNameSuffixHash: true
+
+vars: # génération d'information pour wait-for-bootstrap du pod nextcloud
+- name: MINIO_BOOTSTRAP_JOB_NAME
+  objref:
+    name: create-minio-bucket
+    kind: Job
+    apiVersion: batch/v1
+  fieldref:
+    fieldpath: metadata.name

base/resources/nextcloud/resources/ConfigMap-ldap-script.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: script-config-ldap
+data:
+  poststart-ldap.sh: |
+    #!/bin/sh
+
+    NEXTCLOUD_READY=0
+    MAX_RETRIES=30
+    RETRY_INTERVAL=10
+
+    touch /etc/script/validator.txt
+    # Vérifiez si LDAP est déjà activé
+    # if ! su -s /bin/sh -c "/var/www/html/occ app:list --output=json" www-data | jq -e '.enabled | has("user_ldap")'; then
+        # Activez le module LDAP si ce n'est pas déjà fait
+    #    su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data
+    #fi
+    for i in $(seq 1 $MAX_RETRIES); do
+      if curl -fsS "http://localhost/status.php" > /dev/null; then
+        NEXTCLOUD_READY=1
+        break
+      else
+        echo "En attente de Nextcloud (tentative $i/$MAX_RETRIES)..." >> /etc/script/validator.txt
+        sleep $RETRY_INTERVAL
+      fi
+    done
+
+    if [ $NEXTCLOUD_READY -eq 0 ]; then
+      echo "Nextcloud n'est pas prêt après $MAX_RETRIES tentatives. Abandon de l'initialisation LDAP." >> /etc/script/validator.txt
+      exit 1
+    fi    
+
+    su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data
+
+    # Configurez LDAP (configuration minimale)
+    su -s /bin/sh -c "/var/www/html/occ config:app:set user_ldap ldapHost --value='ldap.example.com'" www-data
+    su -s /bin/sh -c "/var/www/html/occ config:app:set user_ldap ldapBase --value='dc=example,dc=com'" www-data
+    su -s /bin/sh -c "/var/www/html/occ config:app:set user_ldap ldapAgentName --value='cn=admin,dc=example,dc=com'" www-data
+    su -s /bin/sh -c "/var/www/html/occ config:app:set user_ldap ldapAgentPassword --value='your_password'" www-data
+    
+    # Lancez le processus principal de Nextcloud normalement ça ne marche pas ça ! donc plutot poststart.
+    #exec /entrypoint.sh "$@"
+
+# su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data 
+# est fonctionnel dans le pods nextcloud ! 

base/resources/nextcloud/resources/ConfigMap.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: update-config
+data:
+  custom-script.sh: |
+    #!/bin/sh
+
+    HOSTS_FILE="/etc/hosts"
+
+    # Ajoutez l'entrée au fichier hosts
+    MINIO_SERVICE_IP="${MINIO_SERVICE_HOST}"
+    MINIO_NAME="${MINIO_SERVICE_NAME}"
+    echo "$MINIO_SERVICE_IP" minio >> $HOSTS_FILE

base/resources/nextcloud/resources/deployment.yaml

@@ -0,0 +1,231 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: nextcloud
+    component: app
+  name: app
+spec:
+#  serviceName: nextcloud
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nextcloud
+      component: app
+  template:
+    metadata:
+      labels:
+        app: nextcloud
+        component: app
+    spec:
+      containers:
+      - image: reg.cadoles.com/proxy_cache/library/nextcloud:27.0.2-apache
+        imagePullPolicy: Always
+        name: app
+        ports:
+        - containerPort: 80
+        lifecycle:
+          postStart:
+            exec:
+              command: ["/bin/sh", "-c", "cp /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /usr/local/share/ca-certificates/ks.crt && update-ca-certificates && /etc/script/poststart-ldap.sh && touch /etc/script/try01.txt"]
+#        envFrom:
+#        - configMapRef:
+#            name: nextcloud-env
+        env:
+        - name: POSTGRES_DB
+          value: nextcloud
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-postgres-app
+              key: username
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-postgres-app
+              key: password
+        - name: POSTGRES_HOST
+          value: $(NEXTCLOUD_POSTGRES_RW_SERVICE_HOST) #value: nextcloud-postgres-rw.nextcloud.svc.cluster.local
+        - name: NEXTCLOUD_ADMIN_USER
+          value: admin
+        - name: NEXTCLOUD_ADMIN_PASSWORD  # 5
+          value: cadoles
+        - name: NEXTCLOUD_TRUSTED_DOMAINS
+          value: "*.cadoles.fr"
+        - name: NEXTCLOUD_INIT_LOCK
+          value: "true"
+        - name: PHP_MEMORY_LIMIT
+          value: 512M
+        - name: PHP_UPLOAD_LIMIT
+          value: 4G
+        - name: POD_INDEX
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: REDIS_HOST
+          value: redis # équivaut à redis.nextcloud.svc.cluster.local
+#          value: $(RFS_NEXTCLOUD_REDIS_SERVICE_HOST) => For redis-operator
+        - name: REDIS_HOST_PORT
+          value: "6379"
+        ######################
+        # Partie minio S3
+        - name: OBJECTSTORE_S3_HOST
+          value: minio:$(MINIO_SERVICE_PORT)
+#          value: $(MINIO_SERVICE_NAME):$(MINIO_SERVICE_PORT)
+        - name: OBJECTSTORE_S3_BUCKET
+          value: nextcloud-minio
+        - name: OBJECTSTORE_S3_KEY  # 15
+          value: minio_root
+        - name: OBJECTSTORE_S3_SECRET
+          value: MinioRootNotSoSecret
+        - name: OBJECTSTORE_S3_USEPATH_STYLE
+          value: "true"
+        - name: OBJECTSTORE_S3_SSL  # 18
+          value: "true"
+        ##################################
+# Mise en place SMTP
+        - name: MAIL_FROM_ADDRESS
+          value: "user"
+        - name: MAIL_DOMAIN
+          value: "domain.com"
+        - name: SMTP_HOST
+          value: "domain.com"
+        - name: SMTP_SECURE
+          value: "ssl"
+        - name: SMTP_PORT
+          value: "465"
+        - name: SMTP_AUTHTYPE
+          value: "LOGIN"
+        - name: SMTP_NAME
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-smtp
+              key: smtp-username
+        - name: SMTP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-smtp
+              key: smtp-password
+
+        - name: NEXTCLOUD_DATA_DIR
+          value: "/var/www/html/data"
+        livenessProbe:    # vérifie si c'est planté ou non
+          httpGet:
+            path: /status.php
+            port: 80    # en reférence à ingress.yaml ? 
+            httpHeaders:
+            - name: Host
+              value: nxt.cadoles.fr   # valeurs égale à celle dans ingress.yaml
+          initialDelaySeconds: 50
+          periodSeconds: 15
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        readinessProbe:   # vérifie si c'est ok pour envoyer des requête ou non
+          httpGet:
+            path: /status.php
+            port: 80    # en référence à ingress.yaml ? 
+            httpHeaders:
+            - name: Host
+              value: nxt.cadoles.fr   # valeurs égale à celle dans ingress.yaml
+          initialDelaySeconds: 50
+          periodSeconds: 15
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+
+        volumeMounts:
+        - mountPath: /var/www/
+          name: nextcloud-main-volume
+        - mountPath: /var/www/html
+          name: nextcloud-html-volume
+        - mountPath: /var/www/html/data
+          name: nextcloud-data-volume
+        - mountPath: /var/www/html/config
+          name: nextcloud-config-volume
+        - mountPath: /var/www/html/custom_apps
+          name: nextcloud-custom-volume
+        - mountPath: /var/www/tmp
+          name: nextcloud-tmp-volume
+        - mountPath: /var/www/html/themes
+          name: nextcloud-themes-volume
+
+# ICI montage pour les script !
+        - mountPath: /etc/script/poststart-ldap.sh
+          name: script-config-ldap
+          subPath: poststart-ldap.sh
+        - mountPath: /etc/script/custom-script.sh
+          name: update-config-script
+          subPath: custom-script.sh
+        - mountPath: /etc/minio-ccerts
+          name: minio-certs
+          readOnly: true
+
+          # MOUNT-TRY-multi-instance
+#        - name: nextcloud-config-volume     # monte le fichier de configuration dans 
+#          mountPath: /var/www/html/config   # les instances supplémentaire
+#          readOnly: false                    # via le configmap ConfigMaps-php.yaml
+
+      restartPolicy: Always
+      serviceAccountName: nextcloud-sa # declare user for initcontainer
+
+      # trois volumes pour les script
+      volumes:
+      - name: minio-certs
+        secret:
+          secretName: nextcloud-minio-tls # montage des certificat de minio
+      - name: update-config-script
+        configMap:
+          name: update-config
+          defaultMode: 0744
+      - name: script-config-ldap
+        configMap:
+          name: script-config-ldap
+          defaultMode: 0744
+
+# MOUNT-TRY-multi-instance
+#      - name: nextcloud-config-volume       # permet de monter le fichier de configuration dans 
+#        configMap:                          # les instances supplémentaires
+#          name: nextcloud-config            # via le configmap ConfigMaps-php.yaml
+
+      - name: nextcloud-main-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-main-pvc
+      - name: nextcloud-html-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-html-pvc
+      - name: nextcloud-data-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-data-pvc
+      - name: nextcloud-config-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-config-pvc
+      - name: nextcloud-custom-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-custom-pvc
+      - name: nextcloud-tmp-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-tmp-pvc
+      - name: nextcloud-themes-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-themes-pvc
+
+      initContainers: # cf README.md part ##YAML explain / ### PODS WAIT
+      - name: wait-for-bootstrap
+        image: reg.cadoles.com/proxy_cache/groundnuty/k8s-wait-for:v1.3
+        args:
+        - job
+        - $(MINIO_BOOTSTRAP_JOB_NAME)
+
+
+#####################################################
+#     For REDIS-OPERATOR USE THIS TO SET PORT
+#####################################################
+#        - name: REDIS_HOST_PORT
+#          value: $(RFS_NEXTCLOUD_REDIS_SERVICE_PORT)
+#        - name: REDIS_HOST_PASSWORD
+#          valueFrom:
+#            secretKeyRef:
+#              name: redis-secret
+#              key: password
+#####################################################

base/resources/nextcloud/resources/files/minio/config.env

@@ -0,0 +1,4 @@
+export MINIO_ROOT_USER="minio_root"
+export MINIO_ROOT_PASSWORD="MinioRootNotSoSecret"
+export MINIO_STORAGE_CLASS_STANDARD="EC:2"
+export MINIO_BROWSER="on"

base/resources/nextcloud/resources/files/minio/configurations/tenants.minio.min.io.yaml

@@ -0,0 +1,14 @@
+---
+nameReference:
+- kind: Secret
+  fieldSpecs:
+  - path: spec/credsSecret/name
+    kind: Tenant
+- kind: Secret
+  fieldSpecs:
+  - path: spec/configuration/name
+    kind: Tenant
+- kind: Secret
+  fieldSpecs:
+  - path: spec/users/name
+    kind: Tenant

base/resources/nextcloud/resources/files/parameters.yaml

@@ -0,0 +1,8 @@
+  #API minio
+  minio_url: 'http://%env(string:MINIO_SERVICE_NAME)%:9000'
+  minio_key: '%env(string:MINIO_KEY)%'
+  minio_secret: '%env(string:MINIO_SECRET)%'
+  minio_bucket: 'nextcloud'
+  minio_root: ''
+  minio_path_style: true
+  minio_secure: false

base/resources/nextcloud/resources/ingress.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nextcloud
+
+  annotations:
+#    kustomize.config.k8s.io/needs: configmap/nextcloud-envi
+    nginx.ingress.kubernetes.io/proxy-body-size: "138m"
+    nginx.ingress.kubernetes.io/enable-cors: "true"                   #cf 01
+    nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For" #cf 01
+#    nginx.ingress.kubernetes.io/client_max_body_size: "100m"
+
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: nxt.cadoles.fr
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: nextcloud
+            port:
+              number: 80
+
+# cf 01 => https://artifacthub.io/packages/helm/nextcloud/nextcloud

base/resources/nextcloud/resources/job.yaml

@@ -0,0 +1,63 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: create-minio-bucket
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: wait-for-minio
+        image: busybox
+        envFrom:
+        - configMapRef:
+            name: nextcloud-env
+        command: ["sh", "-c"]
+        args:
+        - |
+          echo "attente du service minio..."
+          cnt=0
+          tout=300
+          while [ 1 ]
+          do
+            http_code=$(wget --server-response https://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT}/minio/health/live 2>&1 | awk '/^  HTTP/{print $2}')
+            if [ "${http_code}" != "200" ]; then
+              echo "waiting for https://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT}"
+              sleep 1
+            else
+              exit 0
+            fi
+
+            cnt=$((cnt+1))
+            if [ "${cnt}" -ge "${tout}" ]; then
+              exit 3
+            fi
+          done
+# Encore nécessaire ? 
+      containers:
+      - name: create-bucket
+        image: minio/mc
+        envFrom:
+        - configMapRef:
+            name: nextcloud-env
+        env:
+        - name: CONSOLE_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-minio-user
+              key: CONSOLE_ACCESS_KEY
+        - name: CONSOLE_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-minio-user
+              key: CONSOLE_SECRET_KEY
+        command: ["sh", "-c"]
+        args:
+        - |
+          echo "création de l'alias my-minio"
+          mc alias set --insecure my-minio http://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT} ${CONSOLE_ACCESS_KEY} ${CONSOLE_SECRET_KEY}
+          echo "création du bucket..."
+          mc mb --insecure my-minio/nextcloud-minio
+          echo "Bucket créé. normalement"
+      restartPolicy: OnFailure
+# Est-ce que je mettrais pas mon ldap ici ? => ConfigMap-ldap-script.yaml ? 
+

base/resources/nextcloud/resources/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: nextcloud

base/resources/nextcloud/resources/nextcloud-role.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: status-reader
+rules:
+- apiGroups:
+  - batch
+  - v1
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - ""
+  - v1
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - patch
+
+# Declaration d'un role nommé status-reader et attribution de droit 
+
+#- apiGroups:
+#  - ""
+#  - v1
+#  resources:
+#  - services
+#  verbs:
+#  - get
+#  - list
+#- apiGroups:
+#  - ""
+#  - v1
+#  resources:
+#  - pods
+#  verbs:
+#  - get
+#  - list

base/resources/nextcloud/resources/nextcloud-rolebinding.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: status-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: status-reader
+subjects:
+- kind: ServiceAccount
+  name: nextcloud-sa
+
+# Sert à lier le role status-reader (nextcloud-role.yaml) et l'utilisateur nextcloud-sa (nextcloud-serviceaccount.yaml)

base/resources/nextcloud/resources/nextcloud-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud
+  labels:
+    app: nextcloud
+    component: app
+spec:
+  ports:
+  - port: 80
+  selector:
+    app: nextcloud
+    component: app
+

base/resources/nextcloud/resources/nextcloud-serviceaccount.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nextcloud-sa
+
+# déclaration d'un user nextcloud-sa

base/resources/nextcloud/resources/nextcloud-tenant.yaml

@@ -0,0 +1,33 @@
+apiVersion: minio.min.io/v2
+kind: Tenant
+metadata:
+  name: nextcloud-minio
+spec:
+  certConfig:
+    dnsNames:
+    - "minio"
+  pools:
+  - servers: 2
+    name: pool-0
+    volumesPerServer: 2
+    volumeClaimTemplate:
+      metadata:
+        name: nextcloud-minio-data # juste son nom dans le cluster
+      spec:
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Gi
+            #        env:
+            #          - name: MINIO_CONSOLE_TLS_ENABLE
+            #            value: "off"
+    containerSecurityContext:
+      runAsUser: 1000 # droit d'accès user
+      runAsGroup: 1000 # droit d'accès group
+      runAsNonRoot: true # accès sans être root
+  configuration:
+    name: nextcloud-minio-configuration # cf resources/nextcloud/resources/kustomization.yaml
+  users:
+  - name: nextcloud-minio-user # cf resources/nextcloud/resources/kustomization.yaml
+

base/resources/nextcloud/resources/nodeport-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-nodeport  # nom du service
+  labels:
+#    app: nextcloud
+#    component: app
+spec:
+  type: NodePort
+  ports:
+    - port: 80
+      targetPort: 80  # port du pods
+      nodePort: 30080 # port de la machine locale detenant les noeuds
+  selector:
+    app: nextcloud
+    component: app

base/resources/nextcloud/resources/pvc.yaml

@@ -0,0 +1,83 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-main-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-html-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-data-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 20Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-config-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-custom-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-tmp-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-themes-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 2Gi

overlays/dev/cluster/lb/advertise.yaml

@@ -0,0 +1,9 @@
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: l2-ip-pool-ad
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+  - main-pool
+

overlays/dev/cluster/lb/ipaddresspoool.yaml

@@ -0,0 +1,8 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: main-pool
+  namespace: metallb-system
+spec:
+  addresses:
+  - 172.18.10.100-172.18.10.200

overlays/dev/cluster/lb/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: metallb-system
+
+resources:
+- ipaddresspoool.yaml
+- advertise.yaml

overlays/dev/output.yaml

@@ -0,0 +1,627 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nextcloud-dev
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nextcloud-sa
+  namespace: nextcloud-dev
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: status-reader
+  namespace: nextcloud-dev
+rules:
+- apiGroups:
+  - batch
+  - v1
+  resources:
+  - jobs
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - ""
+  - v1
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: status-reader
+  namespace: nextcloud-dev
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: status-reader
+subjects:
+- kind: ServiceAccount
+  name: nextcloud-sa
+  namespace: nextcloud-dev
+---
+apiVersion: v1
+data:
+  redis-config: |
+    maxmemory 4mb
+    maxmemory-policy volatile-lru
+    appendonly yes
+kind: ConfigMap
+metadata:
+  name: cm-redis-config
+  namespace: nextcloud-dev
+---
+apiVersion: v1
+data:
+  NEXTCLOUD_HOST: nxt.serveur.fr
+kind: ConfigMap
+metadata:
+  name: host-config
+  namespace: nextcloud-dev
+---
+apiVersion: v1
+data:
+  MINIO_SERVICE_HOST: minio
+  MINIO_SERVICE_NAME: $(MINIO_SERVICE_HOST):$(MINIO_SERVICE_PORT)
+  MINIO_SERVICE_PORT: "443"
+kind: ConfigMap
+metadata:
+  name: nextcloud-env
+  namespace: nextcloud-dev
+---
+apiVersion: v1
+data:
+  parameters.yaml: |2-
+      #API minio
+      minio_url: 'http://%env(string:MINIO_SERVICE_NAME)%:9000'
+      minio_key: '%env(string:MINIO_KEY)%'
+      minio_secret: '%env(string:MINIO_SECRET)%'
+      minio_bucket: 'nextcloud'
+      minio_root: ''
+      minio_path_style: true
+      minio_secure: false
+kind: ConfigMap
+metadata:
+  name: nextcloud-parameters
+  namespace: nextcloud-dev
+---
+apiVersion: v1
+data:
+  poststart-ldap.sh: |
+    #!/bin/sh
+
+    # Vérifiez si LDAP est déjà activé
+    if ! su -s /bin/sh -c "/var/www/html/occ app:list --output=json" www-data | jq -e '.enabled | has("user_ldap")'; then
+        # Activez le module LDAP si ce n'est pas déjà fait
+        su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data
+        echo 'activation de ldap'
+    fi
+
+    # Configurez LDAP (configuration minimale)
+    su -s /bin/sh -c "/var/www/html/occ config:app:set user_ldap ldapHost --value='ldap.example.com'" www-data
+    su -s /bin/sh -c "/var/www/html/occ config:app:set user_ldap ldapBase --value='dc=example,dc=com'" www-data
+    su -s /bin/sh -c "/var/www/html/occ config:app:set user_ldap ldapAgentName --value='cn=admin,dc=example,dc=com'" www-data
+    su -s /bin/sh -c "/var/www/html/occ config:app:set user_ldap ldapAgentPassword --value='your_password'" www-data
+
+    echo 'ldap configured'
+
+    # Lancez le processus principal de Nextcloud normalement ça ne marche pas ça ! donc plutot poststart.
+    #exec /entrypoint.sh "$@"
+kind: ConfigMap
+metadata:
+  name: script-config-ldap
+  namespace: nextcloud-dev
+---
+apiVersion: v1
+data:
+  custom-script.sh: |-
+    #!/bin/sh
+
+    HOSTS_FILE="/etc/hosts"
+
+    # Ajoutez l'entrée au fichier hosts
+    MINIO_SERVICE_IP="${MINIO_SERVICE_HOST}"
+    MINIO_NAME="${MINIO_SERVICE_NAME}"
+    echo "$MINIO_SERVICE_IP" minio >> $HOSTS_FILE
+kind: ConfigMap
+metadata:
+  name: update-config
+  namespace: nextcloud-dev
+---
+apiVersion: v1
+data:
+  config.env: |
+    ZXhwb3J0IE1JTklPX1JPT1RfVVNFUj0ibWluaW9fcm9vdCIKZXhwb3J0IE1JTklPX1JPT1
+    RfUEFTU1dPUkQ9Ik1pbmlvUm9vdE5vdFNvU2VjcmV0IgpleHBvcnQgTUlOSU9fU1RPUkFH
+    RV9DTEFTU19TVEFOREFSRD0iRUM6MiIKZXhwb3J0IE1JTklPX0JST1dTRVI9Im9uIg==
+kind: Secret
+metadata:
+  name: nextcloud-minio-configuration
+  namespace: nextcloud-dev
+type: Opaque
+---
+apiVersion: v1
+data:
+  CONSOLE_ACCESS_KEY: bWluaW9fcm9vdA==
+  CONSOLE_SECRET_KEY: TWluaW9Sb290Tm90U29TZWNyZXQ=
+kind: Secret
+metadata:
+  name: nextcloud-minio-user
+  namespace: nextcloud-dev
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: nextcloud
+    component: app
+  name: nextcloud
+  namespace: nextcloud-dev
+spec:
+  ports:
+  - port: 80
+  selector:
+    app: nextcloud
+    component: app
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: redis
+  name: redis
+  namespace: nextcloud-dev
+spec:
+  ports:
+  - port: 6379
+  selector:
+    app: redis
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-config-pvc
+  namespace: nextcloud-dev
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-custom-pvc
+  namespace: nextcloud-dev
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-data-pvc
+  namespace: nextcloud-dev
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-html-pvc
+  namespace: nextcloud-dev
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-main-pvc
+  namespace: nextcloud-dev
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-themes-pvc
+  namespace: nextcloud-dev
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-tmp-pvc
+  namespace: nextcloud-dev
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  volumeMode: Filesystem
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: nextcloud
+    component: app
+  name: app
+  namespace: nextcloud-dev
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nextcloud
+      component: app
+  template:
+    metadata:
+      labels:
+        app: nextcloud
+        component: app
+    spec:
+      containers:
+      - env:
+        - name: POSTGRES_DB
+          value: nextcloud
+        - name: POSTGRES_USER
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: nextcloud-postgres-app
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: nextcloud-postgres-app
+        - name: POSTGRES_HOST
+          value: $(NEXTCLOUD_POSTGRES_RW_SERVICE_HOST)
+        - name: NEXTCLOUD_ADMIN_USER
+          value: admincadoles
+        - name: NEXTCLOUD_ADMIN_PASSWORD
+          value: CadolesNotSecret
+        - name: NEXTCLOUD_TRUSTED_DOMAINS
+          value: '*.cadoles.fr'
+        - name: NEXTCLOUD_INIT_LOCK
+          value: 512M
+        - name: PHP_MEMORY_LIMIT
+          value: 4G
+        - name: PHP_UPLOAD_LIMIT
+          value: 4G
+        - name: POD_INDEX
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: REDIS_HOST
+          value: redis
+        - name: REDIS_HOST_PORT
+          value: "6379"
+        - name: OBJECTSTORE_S3_HOST
+          value: minio:$(MINIO_SERVICE_PORT)
+        - name: OBJECTSTORE_S3_BUCKET
+          value: nextcloud-minio
+        - name: OBJECTSTORE_S3_KEY
+          value: minio_root
+        - name: OBJECTSTORE_S3_SECRET
+          value: MinioRootNotSoSecret
+        - name: OBJECTSTORE_S3_USEPATH_STYLE
+          value: "true"
+        - name: OBJECTSTORE_S3_SSL
+          value: "true"
+        - name: NEXTCLOUD_DATA_DIR
+          value: /var/www/html/data
+        image: reg.cadoles.com/proxy_cache/library/nextcloud:26.0.1-apache
+        imagePullPolicy: Always
+        lifecycle:
+          postStart:
+            exec:
+              command:
+              - /bin/sh
+              - -c
+              - cp /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /usr/local/share/ca-certificates/ks.crt
+                && update-ca-certificates
+              - /etc/script/poststart-ldap.sh
+        livenessProbe:
+          failureThreshold: 5
+          httpGet:
+            httpHeaders:
+            - name: Host
+              value: nxt.cadoles.fr
+            path: /status.php
+            port: 80
+          initialDelaySeconds: 50
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: app
+        ports:
+        - containerPort: 80
+        readinessProbe:
+          failureThreshold: 5
+          httpGet:
+            httpHeaders:
+            - name: Host
+              value: nxt.cadoles.fr
+            path: /status.php
+            port: 80
+          initialDelaySeconds: 50
+          periodSeconds: 15
+          successThreshold: 1
+          timeoutSeconds: 5
+        volumeMounts:
+        - mountPath: /var/www/
+          name: nextcloud-main-volume
+        - mountPath: /var/www/html
+          name: nextcloud-html-volume
+        - mountPath: /var/www/html/data
+          name: nextcloud-data-volume
+        - mountPath: /var/www/html/config
+          name: nextcloud-config-volume
+        - mountPath: /var/www/html/custom_apps
+          name: nextcloud-custom-volume
+        - mountPath: /var/www/tmp
+          name: nextcloud-tmp-volume
+        - mountPath: /var/www/html/themes
+          name: nextcloud-themes-volume
+        - mountPath: /etc/script/poststart-ldap.sh
+          name: script-config-ldap
+          subPath: poststart-ldap.sh
+        - mountPath: /etc/script/custom-script.sh
+          name: update-config-script
+          subPath: custom-script.sh
+        - mountPath: /etc/minio-ccerts
+          name: minio-certs
+          readOnly: true
+      initContainers:
+      - args:
+        - job
+        - create-minio-bucket
+        image: reg.cadoles.com/proxy_cache/groundnuty/k8s-wait-for:v1.3
+        name: wait-for-bootstrap
+      restartPolicy: Always
+      serviceAccountName: nextcloud-sa
+      volumes:
+      - name: minio-certs
+        secret:
+          secretName: nextcloud-minio-tls
+      - configMap:
+          defaultMode: 484
+          name: update-config
+        name: update-config-script
+      - configMap:
+          defaultMode: 484
+          name: script-config-ldap
+        name: script-config-ldap
+      - name: nextcloud-main-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-main-pvc
+      - name: nextcloud-html-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-html-pvc
+      - name: nextcloud-data-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-data-pvc
+      - name: nextcloud-config-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-config-pvc
+      - name: nextcloud-custom-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-custom-pvc
+      - name: nextcloud-tmp-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-tmp-pvc
+      - name: nextcloud-themes-volume
+        persistentVolumeClaim:
+          claimName: nextcloud-themes-pvc
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: redis
+  name: redis
+  namespace: nextcloud-dev
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - command:
+        - redis-server
+        - /redis-master/redis.conf
+        image: redis:alpine
+        name: redis
+        ports:
+        - containerPort: 6379
+        volumeMounts:
+        - mountPath: /redis-master-data
+          name: data
+        - mountPath: /redis-master
+          name: config
+      restartPolicy: Always
+      volumes:
+      - emptyDir: {}
+        name: data
+      - configMap:
+          items:
+          - key: redis-config
+            path: redis.conf
+          name: cm-redis-config
+        name: config
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: create-minio-bucket
+  namespace: nextcloud-dev
+spec:
+  template:
+    spec:
+      containers:
+      - args:
+        - |
+          echo "création de l'alias my-minio"
+          mc alias set --insecure my-minio http://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT} ${CONSOLE_ACCESS_KEY} ${CONSOLE_SECRET_KEY}
+          echo "création du bucket..."
+          mc mb --insecure my-minio/nextcloud-minio
+          echo "Bucket créé. normalement"
+        command:
+        - sh
+        - -c
+        env:
+        - name: CONSOLE_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              key: CONSOLE_ACCESS_KEY
+              name: nextcloud-minio-user
+        - name: CONSOLE_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              key: CONSOLE_SECRET_KEY
+              name: nextcloud-minio-user
+        envFrom:
+        - configMapRef:
+            name: nextcloud-env
+        image: minio/mc
+        name: create-bucket
+      initContainers:
+      - args:
+        - |
+          echo "attente du service minio..."
+          cnt=0
+          tout=300
+          while [ 1 ]
+          do
+            http_code=$(wget --server-response https://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT}/minio/health/live 2>&1 | awk '/^  HTTP/{print $2}')
+            if [ "${http_code}" != "200" ]; then
+              echo "waiting for https://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT}"
+              sleep 1
+            else
+              exit 0
+            fi
+
+            cnt=$((cnt+1))
+            if [ "${cnt}" -ge "${tout}" ]; then
+              exit 3
+            fi
+          done
+        command:
+        - sh
+        - -c
+        envFrom:
+        - configMapRef:
+            name: nextcloud-env
+        image: busybox
+        name: wait-for-minio
+      restartPolicy: OnFailure
+---
+apiVersion: minio.min.io/v2
+kind: Tenant
+metadata:
+  name: nextcloud-minio
+  namespace: nextcloud-dev
+spec:
+  certConfig:
+    dnsNames:
+    - minio
+  configuration:
+    name: nextcloud-minio-configuration
+  pools:
+  - containerSecurityContext:
+      runAsGroup: 1000
+      runAsNonRoot: true
+      runAsUser: 1000
+    name: pool-0
+    servers: 2
+    volumeClaimTemplate:
+      metadata:
+        name: nextcloud-minio-data
+      spec:
+        accessModes:
+        - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Gi
+    volumesPerServer: 2
+  users:
+  - name: nextcloud-minio-user
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/cors-allow-headers: X-Forwarded-For
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: 138m
+  name: nextcloud
+  namespace: nextcloud-dev
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: nxt.cadoles.fr
+    http:
+      paths:
+      - backend:
+          service:
+            name: nextcloud
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: nextcloud-postgres
+  namespace: nextcloud-dev
+spec:
+  bootstrap:
+    initdb:
+      database: nextcloud
+      owner: nextcloud
+  instances: 1
+  primaryUpdateStrategy: unsupervised
+  storage:
+    size: 5Gi

overlays/dev/patches/ConfigMap-ldap-script.yaml

@@ -0,0 +1,76 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: script-config-ldap
+data:
+  poststart-ldap.sh: |
+    #!/bin/sh
+
+    NEXTCLOUD_READY=0
+    MAX_RETRIES=30
+    RETRY_INTERVAL=10
+
+    touch /etc/script/validator.txt
+    # Vérifiez si LDAP est déjà activé
+    # if ! su -s /bin/sh -c "/var/www/html/occ app:list --output=json" www-data | jq -e '.enabled | has("user_ldap")'; then
+        # Activez le module LDAP si ce n'est pas déjà fait
+    #    su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data
+    #fi
+    for i in $(seq 1 $MAX_RETRIES); do
+      if curl -fsS "http://localhost/status.php" > /dev/null; then
+        NEXTCLOUD_READY=1
+        break
+      else
+        echo "En attente de Nextcloud (tentative $i/$MAX_RETRIES)..." >> /etc/script/validator.txt
+        sleep $RETRY_INTERVAL
+      fi
+    done
+
+    if [ $NEXTCLOUD_READY -eq 0 ]; then
+      echo "Nextcloud n'est pas prêt après $MAX_RETRIES tentatives. Abandon de l'initialisation LDAP." >> /etc/script/validator.txt
+      exit 1
+    fi 
+
+    su -s /bin/sh -c "/var/www/html/occ app:install user_ldap" www-data
+    su -s /bin/sh -c "/var/www/html/occ app:update user_ldap" www-data
+    su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:create-empty-config" www-data
+
+    ## test if backend ldap is activated and create empty config if not
+    #
+    #touch /tmp/nxt-ldap.txt
+    #su -s /bin/sh -c "/var/www/html/occ ldap:show-config s01 > /tmp/nextcloud-ldap.txt" www-data
+    #if grep -q "Invalid configID" /tmp/nextcloud-ldap.txt; then
+    #  sudo -u www-data php /var/www/html/nextcloud/occ ldap:create-empty-config -q
+    #fi
+
+    # Configurez LDAP (configuration minimale)
+
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldap_host '${NEXTCLOUD_LDAP_HOST}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldap_base '${NEXTCLOUD_LDAP_BASE}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldap_dn '${NEXTCLOUD_LDAP_DN}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldap_agent_password '${NEXTCLOUD_LDAP_PASSWD}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapBaseGroups '${NEXTCLOUD_LDAP_BASE_GROUPS}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapBaseUsers '${NEXTCLOUD_LDAP_BASE_USERS}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapConfigurationActive '${NEXTCLOUD_LDAP_ACTIVE_CONF}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapExperiencedAdmin '${NEXTCLOUD_LDAP_ADMIN_EXP}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapExpertUUIDUserAttr '${NEXTCLOUD_LDAP_EXP_UUID}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapLoginFilter '${NEXTCLOUD_LDAP_LOGIN_FILTER}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapPort '${NEXTCLOUD_LDAP_PORT}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapUserFilter '${NEXTCLOUD_LDAP_USR_FILTR}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapUserFilterObjectclass '${NEXTCLOUD_LDAP_OBJ_FILTR}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapEmailAttribute '${NEXTCLOUD_LDAP_MAIL_ATTR}'" www-data
+    su -s /bin/sh -c "/var/www/html/occ ldap:set-config s01 ldapUserDisplayName '${NEXTCLOUD_LDAP_USER_DISP}'" www-data
+
+    #sudo -u www-data php /var/www/html/nextcloud/occ ldap:set-config s01 ldapGroupFilter "${ldapGroupFilter}"
+    #sudo -u www-data php /var/www/html/nextcloud/occ ldap:set-config s01 ldapGroupFilterObjectclass "${ldapGroupFilterObjectclass}"
+    #sudo -u www-data php /var/www/html/nextcloud/occ ldap:set-config s01 ldapGroupMemberAssocAttr "${ldapGroupMemberAssocAttr}"
+
+    
+    # Lancez le processus principal de Nextcloud normalement ça ne marche pas ça ! donc plutot poststart.
+    #exec /entrypoint.sh "$@"
+
+    # su -s /bin/sh -c "/var/www/html/occ app:enable user_ldap" www-data 
+    # est fonctionnel dans le pods nextcloud ! 
+
+    #liste config : su -s /bin/sh -c "/var/www/html/occ config:list" www-data

overlays/dev/patches/ConfigMaps.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: update-config
+data:
+  custom-script.sh: |
+    #!/bin/sh
+
+    HOSTS_FILE="/etc/hosts"
+
+    # Ajoutez l'entrée au fichier hosts
+    MINIO_SERVICE_IP="${MINIO_SERVICE_HOST}"
+    MINIO_NAME="${MINIO_SERVICE_NAME}"
+    echo "$MINIO_SERVICE_IP" minio >> $HOSTS_FILE

overlays/dev/patches/ingress-nextcloud.yaml

@@ -0,0 +1,36 @@
+#- op: replace
+#  path: /metadata/annotations/nginx.ingress.kubernetes.io~1proxy-body-size
+#  value: "1G"
+#- op: replace
+#  path: /metadata/annotations/nginx.ingress.kubernetes.io~1enable-cors
+#  value: "true"
+#- op: replace
+#  path: /metadata/annotations/nginx.ingress.kubernetes.io~1cors-allow-headers
+#  value: "X-Forwarded-For"
+
+# En cas de besoin
+#- op: add
+#  path: /metadata/annotations/nginx.ingress.kubernetes.io~1client_max_body_size
+#  value: "100m"
+
+#- op: replace
+#  path: /spec/rules/0/host
+#  value: nxt.cadoles.fr
+#- op: replace
+#  path: /spec/rules/0/http/paths/0/path
+#  value: /
+#- op: replace
+#  path: /spec/rules/0/http/paths/0/pathType
+#  value: Prefix
+#- op: replace
+#  path: /spec/rules/0/http/paths/0/backend/service/name
+#  value: nextcloud
+#- op: replace
+#  path: /spec/rules/0/http/paths/0/backend/service/port/number
+#  value: 80
+
+
+
+# logiquement path = 
+#  path: /metadata/annotations/nginx.ingress.kubernetes.io/proxy-body-size
+# sauf que ... json voila, "/" est à remplacer par ~1

overlays/dev/patches/job.yaml

@@ -0,0 +1,65 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: create-minio-bucket
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: wait-for-minio
+        image: reg.cadoles.com/proxy_cache/library/debian:bookworm
+        envFrom:
+        - configMapRef:
+            name: nextcloud-env
+        command: ["sh", "-c"]
+        args:
+        - |
+          echo "attente du service minio..."
+          cnt=0
+          tout=300
+          apt update && apt install --yes --force-yes wget openssl 
+          cp /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /usr/local/share/ca-certificates/ks.crt && update-ca-certificates
+          while [ 1 ]
+          do
+            http_code=$(wget --server-response https://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT}/minio/health/live 2>&1 | awk '/^  HTTP/{print $2}')
+            if [ "${http_code}" != "200" ]; then
+              echo "waiting for https://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT}"
+              sleep 1
+            else
+              exit 0
+            fi
+
+            cnt=$((cnt+1))
+            if [ "${cnt}" -ge "${tout}" ]; then
+              exit 3
+            fi
+          done
+# Encore nécessaire ? 
+      containers:
+      - name: create-bucket
+        image: minio/mc
+        envFrom:
+        - configMapRef:
+            name: nextcloud-env
+        env:
+        - name: CONSOLE_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-minio-user
+              key: CONSOLE_ACCESS_KEY
+        - name: CONSOLE_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: nextcloud-minio-user
+              key: CONSOLE_SECRET_KEY
+        command: ["sh", "-c"]
+        args:
+        - |
+          echo "création de l'alias my-minio"
+          mc alias set --insecure my-minio http://${MINIO_SERVICE_HOST}:${MINIO_SERVICE_PORT} ${CONSOLE_ACCESS_KEY} ${CONSOLE_SECRET_KEY}
+          echo "création du bucket..."
+          mc mb --insecure my-minio/nextcloud-minio
+          echo "Bucket créé. normalement"
+      restartPolicy: OnFailure
+
+

overlays/dev/patches/nextcloud-S3.yaml

@@ -0,0 +1,24 @@
+- op: replace
+  path: /spec/template/spec/containers/0/env/13/value #OBJECTSTORE_S3_HOST
+  value: minio:$(MINIO_SERVICE_PORT)
+- op: replace
+  path: /spec/template/spec/containers/0/env/14/value #OBJECTSTORE_S3_BUCKET
+  value: nextcloud-minio
+- op: replace
+  path: /spec/template/spec/containers/0/env/15/value #OBJECTSTORE_S3_KEY
+  valueFrom:
+    secretKeyRef:
+      name: nextcloud-minio-user  # kustomize racine
+      key: CONSOLE_ACCESS_KEY
+- op: replace
+  path: /spec/template/spec/containers/0/env/16/value #OBJECTSTORE_S3_SECRET
+  valueFrom:
+    secretKeyRef:
+      name: nextcloud-minio-user  # kustomize racine
+      key: CONSOLE_SECRET_KEY
+- op: replace
+  path: /spec/template/spec/containers/0/env/17/value #OBJECTSTORE_S3_USEPATH_STYLE
+  value: "true"
+- op: replace
+  path: /spec/template/spec/containers/0/env/18/value #OBJECTSTORE_S3_SSL
+  value: "true"

overlays/dev/patches/nextcloud-ldap.yaml

@@ -0,0 +1,75 @@
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_HOST
+    value: openldap.openldap
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_BASE
+    value: dc=example,dc=org
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_DN
+    value: cn=admin,dc=example,dc=org
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_PASSWD
+    value: "adminpassword"
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_BASE_GROUPS
+    value: dc=example,dc=org
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_BASE_USERS
+    value: ou=users,dc=example,dc=org
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_ACTIVE_CONF
+    value: "1"
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_ADMIN_EXP
+    value: "0"
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_EXP_UUID
+    value: cn
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_LOGIN_FILTER
+    value: (&(objectClass=posixAccount)(cn=%uid))
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_PORT
+    value: "1389"
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_USR_FILTR
+    value: (|(objectclass=posixAccount))
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_OBJ_FILTR
+    value: posixAccount
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_MAIL_ATTR
+    value: mail
+- op: add
+  path: "/spec/template/spec/containers/0/env/-"
+  value:
+    name: NEXTCLOUD_LDAP_USER_DISP
+    value: cn

overlays/dev/patches/nextcloud-patch.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          env:
+            - name: NEXTCLOUD_ADMIN_USER
+              value: admincadoles
+            - name: NEXTCLOUD_ADMIN_PASSWORD
+              value: cadoles
+            - name: PHP_MEMORY_LIMIT
+              value: 512M
+            - name: PHP_UPLOAD_LIMIT
+              value: 4G
+            - name: REDIS_HOST
+              value: redis
+            - name: REDIS_HOST_PORT
+              value: "6379"
+            - name: NEXTCLOUD_DATA_DIR
+              value: "/var/www/html/data"
+            - name: NEXTCLOUD_TRUSTED_DOMAINS
+              value: "*.cadoles.fr"

overlays/dev/patches/nextcloud-postgres.yaml

@@ -0,0 +1,34 @@
+# USER POSTGRES
+# UNIQUEMENT Si vous ne passez pas par l'operateur.
+#- op: replace
+#  path: /spec/template/spec/containers/env/0/value #POSTGRES_DB
+#  value: username
+#- op: replace
+#  path: /spec/template/spec/containers/env/1/value #POSTGRES_USER
+#  value: username
+#- op: replace
+#  path: /spec/template/spec/containers/env/2/value #POSTGRES_PASSWORD
+#  value: password
+
+# CONF POSTGRES
+- op: replace
+  path: /spec/template/spec/containers/0/env/3/value #POSTGRES_HOST
+  value: $(NEXTCLOUD_POSTGRES_RW_SERVICE_HOST)
+- op: replace
+  path: /spec/template/spec/containers/0/env/0/value #POSTGRES_DB
+  value: nextcloud
+
+
+#Name:         nextcloud-postgres-app
+#Namespace:    nextcloud
+#Labels:       cnpg.io/cluster=nextcloud-postgres
+#              cnpg.io/reload=true
+#Annotations:  cnpg.io/operatorVersion: 1.18.1
+#
+#Type:  kubernetes.io/basic-auth
+#
+#Data
+#====
+#password:  64 bytes
+#pgpass:    112 bytes
+#username:  9 bytes

overlays/dev/patches/nextcloud-probe.yaml

@@ -0,0 +1,47 @@
+# livenessProbe
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/httpGet/httpHeaders/0/value
+  value: nxt.cadoles.fr
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/httpGet/port
+  value: 80
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/initialDelaySeconds
+  value: 50
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/periodSeconds
+  value: 10
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/timeoutSeconds
+  value: 5
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/successThreshold
+  value: 1
+- op: replace
+  path: /spec/template/spec/containers/0/livenessProbe/failureThreshold
+  value: 6
+
+
+# readinessProbe
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/httpGet/httpHeaders/0/value
+  value: nxt.cadoles.fr
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/httpGet/port
+  value: 80
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/initialDelaySeconds
+  value: 50
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/periodSeconds
+  value: 10
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/timeoutSeconds
+  value: 5
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/successThreshold
+  value: 1
+- op: replace
+  path: /spec/template/spec/containers/0/readinessProbe/failureThreshold
+  value: 6
+

overlays/dev/patches/nextcloud-smtp.yaml

@@ -0,0 +1,26 @@
+- op: replace
+  path: /spec/template/spec/containers/0/env/19/value #MAIL_FROM_ADDRESS
+  value: "usercadoles"
+- op: replace
+  path: /spec/template/spec/containers/0/env/20/value #MAIL_DOMAIN
+  value: "cadoles.com"
+- op: replace
+  path: /spec/template/spec/containers/0/env/21/value #SMTP_HOST
+  value: "groupware.cadoles.com"
+- op: replace
+  path: /spec/template/spec/containers/0/env/22/value #SMTP_SECURE
+  value: "ssl"
+- op: replace
+  path: /spec/template/spec/containers/0/env/23/value #SMTP_PORT
+  value: "587"
+- op: replace
+  path: /spec/template/spec/containers/0/env/24/value #SMTP_AUTHTYPE
+  value: "LOGIN"
+
+# THEORIQUEMENT LA MODIFICATION du secret generator lié dans kustomize suffit.
+#- op: replace
+#  path: /spec/template/spec/containers/0/env/25/value #SMTP_NAME
+#  value: 
+#- op: replace
+#  path: /spec/template/spec/containers/0/env/26/value #SMTP_PASSWORD
+#  value: 

overlays/dev/patches/nextcloud-variables.yaml

@@ -0,0 +1,34 @@
+# USER MDP NEXTCLOUD
+- op: replace
+  path: /spec/template/spec/containers/0/env/4/value #NEXTCLOUD_ADMIN_USER
+  value: admincadoles
+- op: replace
+  path: /spec/template/spec/containers/0/env/5/value #NEXTCLOUD_ADMIN_PASSWORD
+  value: CadolesNotSecret
+
+# CONF NEXTCLOUD PHP
+
+- op: replace
+  path: /spec/template/spec/containers/0/env/8/value  #PHP_MEMORY_LIMIT
+  value: 512M
+- op: replace
+  path: /spec/template/spec/containers/0/env/9/value #PHP_UPLOAD_LIMIT
+  value: 4G
+
+# CONF NEXTCLOUD REDIS
+
+- op: replace
+  path: /spec/template/spec/containers/0/env/11/value #REDIS_HOST
+  value: redis
+- op: replace
+  path: /spec/template/spec/containers/0/env/12/value #REDIS_HOST_PORT
+  value: "6379"
+
+# CONF NEXTCLOUD
+
+#- op: replace
+#  path: /spec/template/spec/containers/0/env/27/value #NEXTCLOUD_DATA_DIR
+#  value: "/var/www/html/data"
+- op: replace
+  path: /spec/template/spec/containers/0/env/6/value #NEXTCLOUD_TRUSTED_DOMAINS
+  value: "*.cadoles.fr"

overlays/dev/patches/nginx-ingress.yaml

@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nextcloud
+
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "5m"
+    nginx.ingress.kubernetes.io/enable-cors: "true"                   
+    nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For" 
+    cert-manager.io/issuer: cadoles-selfsigned-ca
+
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - nxt.cadoles.fr
+    secretName: cadoles-selfsigned-ca
+  rules:
+  - host: nxt.cadoles.fr
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: nextcloud
+            port:
+              number: 80
+

overlays/dev/patches/redis-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cm-redis-config
+data:
+  redis-config: |
+    maxmemory 4mb
+    maxmemory-policy volatile-lru
+    appendonly yes

overlays/dev/patches/tenant-conf.yaml

@@ -0,0 +1,21 @@
+- op: replace
+  path: /spec/certConfig/dnsNames
+  value: ["minio"]
+- op: replace
+  path: /spec/pools/0/servers
+  value: 2
+- op: replace
+  path: /spec/pools/0/volumesPerServer
+  value: 3
+- op: replace
+  path: /spec/pools/0/volumeClaimTemplate/spec/resources/requests/storage
+  value: 3Gi
+- op: replace
+  path: /spec/pools/0/containerSecurityContext/runAsUser
+  value: 1000
+- op: replace
+  path: /spec/pools/0/containerSecurityContext/runAsGroup
+  value: 1000
+- op: replace
+  path: /spec/pools/0/containerSecurityContext/runAsNonRoot
+  value: true

overlays/dev/resources/cert-manager/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ./resources/cluster-issuer.yaml
+- ./resources/ca.yaml
+- ./resources/issuer.yaml

overlays/dev/resources/cert-manager/resources/ca.yaml

@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: cadoles-selfsigned-ca
+#  namespace: cert-manager
+#  namespace: ingress-nginx
+
+spec:
+  isCA: true
+  commonName: cadoles-selfsigned-ca
+#  secretName: root-secret
+  secretName: cadoles-selfsigned-ca
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: cadoles-selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

overlays/dev/resources/cert-manager/resources/cluster-issuer.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cadoles-selfsigned-issuer
+spec:
+  selfSigned: {}

overlays/dev/resources/cert-manager/resources/issuer.yaml

@@ -0,0 +1,9 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: cadoles-ca-issuer
+#  namespace: cert-manager
+#  namespace: ingress-nginx
+spec:
+  ca:
+    secretName: cadoles-selfsigned-ca

overlays/dev/resources/files/minio/config.env

@@ -0,0 +1,4 @@
+export MINIO_ROOT_USER="cadoles"
+export MINIO_ROOT_PASSWORD="cadoles;21"
+export MINIO_STORAGE_CLASS_STANDARD="EC:2"
+export MINIO_BROWSER="on"

overlays/dev/resources/host-config.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: host-config
+data:
+  NEXTCLOUD_HOST: nxt.serveur.fr

overlays/dev/resources/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nextcloud-dev

overlays/dev/resources/ssl.yaml

@@ -0,0 +1,40 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: nextcloud
+spec:
+  # Secret names are always required.
+  #secretName: nextcloud-tls
+  secretName: cadoles-selfsigned-ca
+
+
+  duration: 2160h # 90d
+  renewBefore: 360h # 15d
+  subject:
+    organizations:
+    - cadoles
+  # The use of the common name field has been deprecated since 2000 and is
+  # discouraged from being used.
+  commonName: cadoles.fr
+  isCA: false
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS1
+    size: 2048
+  usages:
+  - server auth
+  - client auth
+  # At least one of a DNS Name, URI, or IP address is required.
+  dnsNames:
+  - nextcloud
+  - nextcloud.cadoles.fr
+  - nxt.cadoles.fr
+  # Issuer references are always required.
+  issuerRef:
+    name: cadoles-ca-issuer
+    # We can reference ClusterIssuers by changing the kind here.
+    # The default value is Issuer (i.e. a locally namespaced Issuer)
+    kind: Issuer
+    # This is optional since cert-manager will default to this value however
+    # if you are using an external issuer, change this to that issuer group.
+    group: cert-manager.io

requires/README.md

@@ -0,0 +1,12 @@
+# README
+
+Permet d'installer les opérateurs nécessaire à l'utilisation de nextcloud.
+
+Simplement lancer le ```kustomization.yaml``` pour appliquer les **quatre** opérateurs
+
+- cloudnative-pg (base de donnée postgresql)
+- nginx (ingress)
+- minio (pour le stockage S3)
+- mteallb (load-balancer, point d'entrée unique)
+
+le dossier ```cluster/``` contient simplement un fichier ```cluster.yaml``` pour lancer un cluster avec 3 worker et un control-plane.

requires/cluster/cluster.yaml

@@ -0,0 +1,8 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+name: ctest
+nodes:
+- role: control-plane
+- role: worker
+- role: worker
+- role: worker

requires/cluster/nginx/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.4.0/deploy/static/provider/cloud/deploy.yaml

requires/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+
+#- https://raw.githubusercontent.com/ory/k8s/v0.30.0/helm/charts/hydra-maester/crds/crd-oauth2clients.yaml
+- https://forge.cadoles.com/CadolesKube/c-kustom//base/metallb?ref=develop
+- https://forge.cadoles.com/CadolesKube/c-kustom//base/nginx?ref=develop
+- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
+#- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop # Nextcloud ne fonctionne pas avec la couche sentinelle
+- https://forge.cadoles.com/CadolesKube/c-kustom//base/minio?ref=develop
+- https://forge.cadoles.com/vfebvre/openldap-kustom?ref=develop
+#- ./lb => déplacé dans dev/ car propre à l'environnement cible