---
apiVersion: v1
kind: Namespace
metadata:
  name: opencloud
---
# PostgreSQL Database for Nextcloud
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-data
  namespace: opencloud
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: hcloud-volumes-encrypted
  resources:
    requests:
      storage: 10Gi
---
apiVersion: v1
kind: Service
metadata:
  name: postgres
  namespace: opencloud
spec:
  type: ClusterIP
  selector:
    app: postgres
  ports:
    - port: 5432
      targetPort: 5432
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
  namespace: opencloud
spec:
  serviceName: postgres
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
      - name: postgres
        image: postgres:16-alpine
        env:
        - name: POSTGRES_DB
          value: nextcloud
        - name: POSTGRES_USER
          value: nextcloud
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-db-secret
              key: postgres-password
        ports:
        - containerPort: 5432
        volumeMounts:
        - name: postgres-data
          mountPath: /var/lib/postgresql/data
          subPath: pgdata
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"
      volumes:
      - name: postgres-data
        persistentVolumeClaim:
          claimName: postgres-data
---
# Redis Cache
apiVersion: v1
kind: Service
metadata:
  name: redis
  namespace: opencloud
spec:
  type: ClusterIP
  selector:
    app: redis
  ports:
    - port: 6379
      targetPort: 6379
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
  namespace: opencloud
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
      - name: redis
        image: redis:7-alpine
        ports:
        - containerPort: 6379
        resources:
          requests:
            memory: "128Mi"
            cpu: "50m"
          limits:
            memory: "256Mi"
            cpu: "200m"
---
# Nextcloud Data PVC
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: nextcloud-data
  namespace: opencloud
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: hcloud-volumes-encrypted
  resources:
    requests:
      storage: 50Gi
---
# Nextcloud Application
apiVersion: v1
kind: Service
metadata:
  name: nextcloud
  namespace: opencloud
spec:
  type: ClusterIP
  selector:
    app: nextcloud
  ports:
    - port: 80
      targetPort: 80
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: nextcloud
  namespace: opencloud
spec:
  serviceName: nextcloud
  replicas: 1
  selector:
    matchLabels:
      app: nextcloud
  template:
    metadata:
      labels:
        app: nextcloud
    spec:
      initContainers:
      - name: fix-permissions
        image: busybox:latest
        command: ["sh", "-c", "chown -R 33:33 /var/www/html && chmod -R 755 /var/www/html"]
        volumeMounts:
        - name: nextcloud-data
          mountPath: /var/www/html
      containers:
      - name: nextcloud
        image: nextcloud:29-apache
        env:
        # Database configuration
        - name: POSTGRES_HOST
          value: postgres
        - name: POSTGRES_DB
          value: nextcloud
        - name: POSTGRES_USER
          value: nextcloud
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-db-secret
              key: postgres-password
        # Redis configuration
        - name: REDIS_HOST
          value: redis
        # Nextcloud configuration
        - name: NEXTCLOUD_ADMIN_USER
          value: admin
        - name: NEXTCLOUD_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-admin-secret
              key: admin-password
        - name: NEXTCLOUD_TRUSTED_DOMAINS
          value: "opencloud.basicstack.de"
        - name: OVERWRITEPROTOCOL
          value: "https"
        - name: OVERWRITEHOST
          value: "opencloud.basicstack.de"
        - name: OVERWRITECLIURL
          value: "https://opencloud.basicstack.de"
        # SMTP configuration
        - name: SMTP_HOST
          value: "mail.basicstack.de"
        - name: SMTP_SECURE
          value: "ssl"
        - name: SMTP_PORT
          value: "465"
        - name: SMTP_AUTHTYPE
          value: "LOGIN"
        - name: SMTP_NAME
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-username
        - name: SMTP_PASSWORD
          valueFrom:
            secretKeyRef:
              name: opencloud-smtp-secret
              key: smtp-password
        - name: MAIL_FROM_ADDRESS
          value: "opencloud"
        - name: MAIL_DOMAIN
          value: "basicstack.de"
        ports:
        - containerPort: 80
        volumeMounts:
        - name: nextcloud-data
          mountPath: /var/www/html
        resources:
          requests:
            memory: "512Mi"
            cpu: "200m"
          limits:
            memory: "2Gi"
            cpu: "1000m"
        livenessProbe:
          httpGet:
            path: /status.php
            port: 80
            httpHeaders:
            - name: Host
              value: opencloud.basicstack.de
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            path: /status.php
            port: 80
            httpHeaders:
            - name: Host
              value: opencloud.basicstack.de
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
      volumes:
      - name: nextcloud-data
        persistentVolumeClaim:
          claimName: nextcloud-data
---
# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: opencloud
  namespace: opencloud
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: traefik
  tls:
  - hosts:
    - opencloud.basicstack.de
    secretName: opencloud-tls
  rules:
  - host: opencloud.basicstack.de
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nextcloud
            port:
              number: 80