Remove incorrect Nextcloud deployment - preparing for OpenCloud

This commit is contained in:
CTO Agent 2026-07-04 18:36:45 +00:00
parent 0e3f27610e
commit 4af26bf2da
7 changed files with 0 additions and 522 deletions

View file

@ -1,75 +0,0 @@
# OpenCloud (Nextcloud) Deployment
OpenCloud is a Nextcloud-based cloud collaboration platform deployed at https://opencloud.basicstack.de
## Components
- **Nextcloud 29**: Main application (Apache-based)
- **PostgreSQL 16**: Database backend
- **Redis 7**: Caching layer
## Authentication
- **Pocket ID OIDC Integration**
- Client ID: `2f3c0cea-697f-4dbc-9573-6f6e8adfd4b0`
- Authorized Group: `opencloud_admins`
- Users: andreas.leinen@basicstack.de
## Storage
- Database: 10Gi encrypted hcloud volume
- Nextcloud Data: 50Gi encrypted hcloud volume
## SMTP Configuration
- Server: mail.basicstack.de:465 (SSL)
- Account: opencloud@basicstack.de
- Credentials stored in `opencloud-smtp-secret` (SealedSecret)
## Backups
Daily backup configured to Hetzner S3 bucket at 2 AM using restic.
**Note**: Backup secret `opencloud-backup-secret` needs to be created with S3 credentials:
- `access-key`: S3 access key
- `secret-key`: S3 secret key
- `restic-password`: Restic repository encryption password
## Deployment Files
- `opencloud-deployment.yaml`: Main application stack (namespace, PVCs, services, ingress)
- `opencloud-db-sealed.yaml`: Database credentials
- `opencloud-admin-sealed.yaml`: Nextcloud admin credentials
- `opencloud-oidc-sealed.yaml`: Pocket ID OIDC credentials
- `opencloud-smtp-sealed.yaml`: SMTP credentials
- `opencloud-backup.yaml`: Daily backup CronJob (requires S3 credentials)
## Post-Deployment Configuration
After deploying, configure OIDC in Nextcloud:
1. Install the "OpenID Connect user backend" app
2. Configure the provider:
- Identifier: `PocketID`
- Client ID: (from sealed secret)
- Client Secret: (from sealed secret)
- Discovery URL: `https://auth.basicstack.de/.well-known/openid-configuration`
## Deployment Commands
```bash
# Apply all manifests
kubectl apply -f opencloud-deployment.yaml
kubectl apply -f opencloud-db-sealed.yaml
kubectl apply -f opencloud-admin-sealed.yaml
kubectl apply -f opencloud-oidc-sealed.yaml
kubectl apply -f opencloud-smtp-sealed.yaml
# Optional: Apply backup (requires S3 secret first)
# kubectl apply -f opencloud-backup.yaml
```
## DNS
- A record: `opencloud.basicstack.de``178.105.17.239`
- TLS certificate managed by cert-manager (Let's Encrypt)

View file

@ -1,15 +0,0 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: opencloud-admin-secret
namespace: opencloud
spec:
encryptedData:
admin-password: AgBECVBRaCUBpLgzkpEfe3uyuonRihbtu+oJviI0EPAyKjnc02mzWf+r6oc5Q09sZZ9Ap71/CC384I9aVlQJqwyLW03RCkuDNsluUCkIVSBTp1yqss8iTMSVQx8POSUE3QEptOUHq3W30Nen4a58eTlAuhQcMnuOY3yPyb0DpTp9R0TRNSvnEEWw5hhhSN4o8nTsIlWVA1LSmV+6goLbiRNKstcUUWTdaaSSRRf5ciaWDxk3jsa206tbYC/rAfbLlKhr3raf2TD98t6us1RAgd9O/ulosnfyhVAOv9KlC4jTHENAw7TwvZgsKwEpfpaOAq2GA8NTamsVYEkApv5GVUNOGVYgg/7maarLfgutSa9x+yNv4UmJTscclnCzykt9ZyW2UpkuxgRei//pMA7GQhUzPZGPmMpXwZZp6WpKiVHnkNsUZCx3kv8CVdC6Mox/wz7G0HLJRuKytwECnBXPunIxCheOlA/azJVB5oclR0s+axS6JuoLqZkNd1u1gwecFc6SAo8Xu3SCcww5IPPtvOQ9PkY3ZHiRCO29lfldsNblTL6/5jrFbkEqhu0VMk9oLPuJvpGuZPT8VfV6KMyTsZmzcptZi1SSCXkDpTsBMnymnjDi9O2R0RM1KfNfDfULcUgw1Y0m/ixrLd89wkr1b4R8WC8EK1CXCKlq5J8B0v7wmDH81NCf5LYJMyL8Sv0L9kdvniLhKkiYEyhGRx1oRlRdn6Kxkw6SXXGutEKntPOHoiM8U98VsF22AziYag==
template:
metadata:
creationTimestamp: null
name: opencloud-admin-secret
namespace: opencloud
---

View file

@ -1,92 +0,0 @@
---
# OpenCloud Backup CronJob
# Backs up Nextcloud data and database daily to Hetzner S3 bucket
apiVersion: batch/v1
kind: CronJob
metadata:
name: opencloud-backup
namespace: opencloud
spec:
# Run daily at 2 AM
schedule: "0 2 * * *"
successfulJobsHistoryLimit: 3
failedJobsHistoryLimit: 3
concurrencyPolicy: Forbid
jobTemplate:
spec:
template:
spec:
restartPolicy: OnFailure
containers:
- name: backup
image: ghcr.io/restic/restic:latest
env:
- name: RESTIC_REPOSITORY
value: "s3:https://fsn1.your-objectstorage.com/basicstack-backups/opencloud"
- name: RESTIC_PASSWORD
valueFrom:
secretKeyRef:
name: opencloud-backup-secret
key: restic-password
- name: AWS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: opencloud-backup-secret
key: access-key
- name: AWS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: opencloud-backup-secret
key: secret-key
- name: BACKUP_DATE
value: "$(date +%Y%m%d-%H%M%S)"
command:
- /bin/sh
- -c
- |
set -e
# Initialize repository if it doesn't exist
restic snapshots || restic init
# Backup PostgreSQL database
echo "Backing up PostgreSQL database..."
pg_dump -h postgres -U nextcloud nextcloud > /tmp/nextcloud-db-backup.sql
# Backup Nextcloud data
echo "Backing up Nextcloud data..."
restic backup /var/www/html /tmp/nextcloud-db-backup.sql \
--tag opencloud \
--tag daily \
--host opencloud.basicstack.de
# Clean up old backups (keep last 30 days, 12 months, 5 years)
echo "Pruning old backups..."
restic forget \
--keep-daily 30 \
--keep-monthly 12 \
--keep-yearly 5 \
--prune
# Check repository integrity (once a week)
if [ $(date +%u) -eq 1 ]; then
echo "Running weekly repository check..."
restic check
fi
echo "Backup completed successfully"
volumeMounts:
- name: nextcloud-data
mountPath: /var/www/html
readOnly: true
- name: pg-password
mountPath: /run/secrets/pg-password
subPath: postgres-password
readOnly: true
volumes:
- name: nextcloud-data
persistentVolumeClaim:
claimName: nextcloud-data
- name: pg-password
secret:
secretName: opencloud-db-secret

View file

@ -1,15 +0,0 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: opencloud-db-secret
namespace: opencloud
spec:
encryptedData:
postgres-password: AgBTY8O/dND2D5WnvbDVFkoDJrnOIgODa/ifRXIWii3cnKauzqKDHsyjjGgNE+GmimexdCjX6EwBLcwXkHv4ZHAFRLBOweSe8L8gEqn9g3dakQbilfQQ6D46t9fok+sBeIHItDe06MZuW/GNlF4gxyGVLD/NSRq/0q1cTo3xXOrDDpZ32mkBoPazdjIjDauWiVePuBAU11+PRxY3rVZDydDLDfygoHZyqQcQpoc4pirZBuEAzW5fyTayd5w6JC3EHM+PaX0GEwVB0q49t9iXbCqaI+fP1lJ3+EIyyJysIT5FTW/65lUMiIpoG1Fdn7IVQDHkyetnN8GGjwUvOADqFgkSohfaty+g7vAraRB1TljbXqiyMSWGlSwSJBVcbZtb2wMi639f3inmnjvoGi4b6ty/gkzn011CplfCVjDlRNH+mHargU/uj8LK0wY3WxGHNgBONgiexfrFmOJPC6z8wS/GuDliu4F47HceiJYNm400SNDy9llF7CxZ/rh/JYYnt0AnOrlFKOEq7yHkkw7rmbSsiBCgfUpD3f9jSt6ZOvqaRYrNAwe00LwSg1w9aIcLelyoG4lfOdbfH+zOrVr1pkTicfCoCFzTkFss5PhFNDC/AU5L4/defeWPXykXGB5cvoyoHCxonxgL/LzykJejVKS4mEcoq89NdQSG5Cr+6/70MgbUcymZGZQA/V4s5H3I8R6HIdM9+SJ8MkoL+eV0SFYlr1Uifhl8aBp310rP/fTr9Wnru1uc3omdreFy8Q==
template:
metadata:
creationTimestamp: null
name: opencloud-db-secret
namespace: opencloud
---

View file

@ -1,293 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: opencloud
---
# PostgreSQL Database for Nextcloud
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: postgres-data
namespace: opencloud
spec:
accessModes:
- ReadWriteOnce
storageClassName: hcloud-volumes-encrypted
resources:
requests:
storage: 10Gi
---
apiVersion: v1
kind: Service
metadata:
name: postgres
namespace: opencloud
spec:
type: ClusterIP
selector:
app: postgres
ports:
- port: 5432
targetPort: 5432
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: postgres
namespace: opencloud
spec:
serviceName: postgres
replicas: 1
selector:
matchLabels:
app: postgres
template:
metadata:
labels:
app: postgres
spec:
containers:
- name: postgres
image: postgres:16-alpine
env:
- name: POSTGRES_DB
value: nextcloud
- name: POSTGRES_USER
value: nextcloud
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: opencloud-db-secret
key: postgres-password
ports:
- containerPort: 5432
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
subPath: pgdata
resources:
requests:
memory: "256Mi"
cpu: "100m"
limits:
memory: "512Mi"
cpu: "500m"
volumes:
- name: postgres-data
persistentVolumeClaim:
claimName: postgres-data
---
# Redis Cache
apiVersion: v1
kind: Service
metadata:
name: redis
namespace: opencloud
spec:
type: ClusterIP
selector:
app: redis
ports:
- port: 6379
targetPort: 6379
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: redis
namespace: opencloud
spec:
replicas: 1
selector:
matchLabels:
app: redis
template:
metadata:
labels:
app: redis
spec:
containers:
- name: redis
image: redis:7-alpine
ports:
- containerPort: 6379
resources:
requests:
memory: "128Mi"
cpu: "50m"
limits:
memory: "256Mi"
cpu: "200m"
---
# Nextcloud Data PVC
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nextcloud-data
namespace: opencloud
spec:
accessModes:
- ReadWriteOnce
storageClassName: hcloud-volumes-encrypted
resources:
requests:
storage: 50Gi
---
# Nextcloud Application
apiVersion: v1
kind: Service
metadata:
name: nextcloud
namespace: opencloud
spec:
type: ClusterIP
selector:
app: nextcloud
ports:
- port: 80
targetPort: 80
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: nextcloud
namespace: opencloud
spec:
serviceName: nextcloud
replicas: 1
selector:
matchLabels:
app: nextcloud
template:
metadata:
labels:
app: nextcloud
spec:
initContainers:
- name: fix-permissions
image: busybox:latest
command: ["sh", "-c", "chown -R 33:33 /var/www/html && chmod -R 755 /var/www/html"]
volumeMounts:
- name: nextcloud-data
mountPath: /var/www/html
containers:
- name: nextcloud
image: nextcloud:29-apache
env:
# Database configuration
- name: POSTGRES_HOST
value: postgres
- name: POSTGRES_DB
value: nextcloud
- name: POSTGRES_USER
value: nextcloud
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: opencloud-db-secret
key: postgres-password
# Redis configuration
- name: REDIS_HOST
value: redis
# Nextcloud configuration
- name: NEXTCLOUD_ADMIN_USER
value: admin
- name: NEXTCLOUD_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: opencloud-admin-secret
key: admin-password
- name: NEXTCLOUD_TRUSTED_DOMAINS
value: "opencloud.basicstack.de"
- name: OVERWRITEPROTOCOL
value: "https"
- name: OVERWRITEHOST
value: "opencloud.basicstack.de"
- name: OVERWRITECLIURL
value: "https://opencloud.basicstack.de"
# SMTP configuration
- name: SMTP_HOST
value: "mail.basicstack.de"
- name: SMTP_SECURE
value: "ssl"
- name: SMTP_PORT
value: "465"
- name: SMTP_AUTHTYPE
value: "LOGIN"
- name: SMTP_NAME
valueFrom:
secretKeyRef:
name: opencloud-smtp-secret
key: smtp-username
- name: SMTP_PASSWORD
valueFrom:
secretKeyRef:
name: opencloud-smtp-secret
key: smtp-password
- name: MAIL_FROM_ADDRESS
value: "opencloud"
- name: MAIL_DOMAIN
value: "basicstack.de"
ports:
- containerPort: 80
volumeMounts:
- name: nextcloud-data
mountPath: /var/www/html
resources:
requests:
memory: "512Mi"
cpu: "200m"
limits:
memory: "2Gi"
cpu: "1000m"
livenessProbe:
httpGet:
path: /status.php
port: 80
httpHeaders:
- name: Host
value: opencloud.basicstack.de
initialDelaySeconds: 60
periodSeconds: 30
timeoutSeconds: 5
readinessProbe:
httpGet:
path: /status.php
port: 80
httpHeaders:
- name: Host
value: opencloud.basicstack.de
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 5
volumes:
- name: nextcloud-data
persistentVolumeClaim:
claimName: nextcloud-data
---
# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: opencloud
namespace: opencloud
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
ingressClassName: traefik
tls:
- hosts:
- opencloud.basicstack.de
secretName: opencloud-tls
rules:
- host: opencloud.basicstack.de
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: nextcloud
port:
number: 80

View file

@ -1,16 +0,0 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: opencloud-oidc-secret
namespace: opencloud
spec:
encryptedData:
oidc-client-id: AgA1vTo4YvLSQFusBvjHCJoGZHzTAhgB3X3dXy3A0dUd602Pc3piHmMh3kKbwrkgFwyW1Jy7YrVPSQPd6SeCcjZLD3JhOc5JcAtJUV6x66MBbONU7eaOLhJaXxAJJUD31DEXgBsXaIh67BE00T2XMZ6iVPE8bNICUSD31GiQffmVizVoCuWy3rdeLvaXuiF4EXf8B9sKb2y1y8v57xMc5Tpf6NMzusH/FUt6PScP7qq8IKtlUFSBlNeAJ+YhibMAudBmEg3luNwDt9mgGY0H3HO2Q4/K9ebOCTr+x1SqvkY7dFaN8zQtFUEkXOrwBQaWkgn6KaC0jHMhAshiAshD4kMk+irQxa4sov+e9pccNJrOQ9FC4oXlsUeKMZGuQjKEGXeOFT8/dCIm7kgPUCsGXa7j4Xu6jPU7m8MjPowu5aVUs+ALKmWRcnAXdkYH666SfPxHKafkReuuV+rC9EijGoMEw2SAv40qPCsDniJRFnqjk57v/4hNMe/BXcyWyvONYZW6pfrAE12BDgFVbHt0ZPqAqfIkscyMoqf6tE7KvV4vtHocc6DakXx3ClJ14GQYDs+et/gKy8LSm/GGoHw1567i/SZ4u7Yp/laqxW9o/96r9+8nbmHok0L6zdGniL/EybwvOmM3TioEYukFBuAAj5z0AcJBKbgkeDaKkIuEVe/aJPeKybhr22DOMPFxjpGl1/tR2mOKbl3rYsp+FFUnGxQabWHx5Ej+nvNwngAQP5eBmXoi4Uc=
oidc-client-secret: AgAygioGBgSeRB6EGhd8SerXBRH6bh/nOru0CXOLkoMOvNoFbLUIlXxQOWCd3DZjD0crL6A46IBdRzUlAxOCdPyXkdYyeI2xLzsDwx4PziHfgA1iuh5d3nrxzQSSTgvGVpQ17Bmbgt3BD4t27Ze4E2VFZjo+UEQ6WX2HfiaV2dOylMc2m8GVeUnzbN054bE/7f9IdxXNFxfzRZqtMvOUZhkbCb5dpVLBUFPtdOvRYjif0wyUL0HvHLKuR3Y6yk/6dnEBn9lgU9To5oBiozWxD+iOc6Rq1Tm2Uklqj5tpavgvZULY6QgxkE0A+mimFLWJjq8XUVouxt1+N3HbJRAdAq7h4cmBlJ03hefNqOqOwpSaiGFOfy8Z9W136RfQytNhz1rsf9fBQSLygu2CaZtepq/ymHYOfqoEnux4oTB2vtWnklJJ0gis+nxFLeEHiAj6selNyskNAv/48dXBRxpJlGDT5JJQbShbUH55lWb8gWPjDdZ072eQ6F3XpOZH3Zyxe92H95deuv0ljxDyFEa/xjg5MK5IV9k82LvUGJXoX/u0qBs4+ndbhXaheKLdfEpcw4TeljhjBykgZ4V+b1K44GiS84U289jbIn03yVCdNPzXSvj4W4H3J364lppufuLeotRu60Su0IHihlKrnk8dRnAnLxDwMJaVAsWfjlQ7HS4NmOQQNjh1uWp999DQPHJFFfajbkV4u5gD8SylxUn4+ES8vzMRiE4dKobDoTuDUAWPzA==
template:
metadata:
creationTimestamp: null
name: opencloud-oidc-secret
namespace: opencloud
---

View file

@ -1,16 +0,0 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: opencloud-smtp-secret
namespace: opencloud
spec:
encryptedData:
smtp-password: AgCTH2rFxKMrdtvSJ7h3+waqKyHeua5O5ZITLQx3O1x+gikErG63nA8OA066xgcy+hlO39zbcQ0GxAZrmh2glLwHxN3/5MKEApHn8VNfJPAquWJuV9BQPX5kJq8LPhtEqsfwKWhI4ZaSGmwNYr3Wb+AEgT2kQadWdmWuxBj/fQd4KiXd7oGzVPXjk2mo+rksfiNOBWyjD37lY8RrNfbgEw/K1HQZenekFh30ST3L3Gi7CKchlJnc0t0MEttTMpT15ACQoaixeYd0kVXQxzWxv08Bo1XYd2oeNXuhkJEs8/8qt54fODyy0Wuw3wLtAdf//OoY5WMMcol4c1v8tAfHHKCNLLwP4ZKYQVnsTVhtLHk3oD9GGiIduc9skfbLuoy+IkDx/Mq6tW/uPeCRncp3OCopeTyIHzVfLMBIrJJN68nOFEma4KCl4obRTZIbQxTPlWZboUF4a9yzSCRContAMPxmSmbW8kFCJ5ZojlxYxBMIkMSL7Ecdvkjv4wUclDeININ4b6OomV6JtlnsU4hN200+jHgZC9JmPMZbYL/CzA8BemVhXrnLvxqHVyQQ5419KxFaWq0jAviRiP3i42cy2ik1C4QioiJL0FEmuQZ98ktzCUfyxeKGwz/kYXV6WzaQ+5NO9SKw0k5b223ED83nql3prPd/ZPE7HXoSch1AyIg6iJchEdtZ+d+gWDRqXkJiQaY7LBjVyorSn4rhuF0w00oaqZvUZc9vkZ5BNlnQrELE6WHSdLDHYDQ7gXo7H/IKUB7yuqefFjd/91XbD9Yqlhw=
smtp-username: AgBXNha36wVI/Tm3zI/SJ91PdDWxjh2PJXvaDeHV02h/Fk9drjSztDX3y0TrKWi/Fp1Bb6qNaPvEgrrM1LhgYvLruzaSXV+8ZClqQlLSY9C4C84Zf2bl1NBmfsezt2PEootCQgsl0kk8MwVcrsifSnXEi2c+9yy/TYi2jRveWNYINTkZmWfEqiBaSKQHorLU4tz+FluEGXrKLxKZuyX6V1kHvVNtcsxOxUW1qbC0ToXiAM9Rc1fEFyJnvqbWe6AAVCHaqWS8/dQGmgs+5A1YNtAlFcCmVZC9hHwbggb7a7WP4bPg+UtOwmPAQDkUOQ4I6s49N2jWK20tMCBJt/HwCNN3A3lFYNy5ZyrmBYT75MISpGesX7D5l5HSh9Xi7Qq9EKVlWBh1q2hsG8k2ARMzBRKDsBZMYV9Ljy12KI0aquUzr9UQl2MU2Wxvqp0GM8qmvX47eLovWhLEBxMBZedgMlM+W/4ca9iEwEipsUtS5y+tEWuI0jqDEQiyjnefOAl8pEvQ4Or2YwDD7QOXwXIHnt6mTOGtSkgNKywlwGw4w+amfmoattnkUWdY0pVbuLa4sALlm5d80KYfybRd2pBBsEfJvjno94zLe1PEM+rXOPMIL6az2Zaa96TuTkLFiBVmYIOSRaHpt+VcrlrOYpEtjTwTMiZPGPkt45cG+9eHkRdkAKltlwah65/VWQS7bjFvaTwyxx8E4EE+Joa3qM+bUOo80GaFBgAJGg==
template:
metadata:
creationTimestamp: null
name: opencloud-smtp-secret
namespace: opencloud
---