Add strict transport security header for nextcloud

test/nextcloud/1.5.0/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

test/nextcloud/1.5.0/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: common
+  repository: file://../../../library/common/2112.0.0
+  version: 2112.0.0
+digest: sha256:47115d9b91afe42c8537dcf0fd8224f2f7d1c775f9ff860efa68a6b57d17d1c0
+generated: "2021-12-06T21:28:23.230939+05:00"

test/nextcloud/1.5.0/Chart.yaml

@@ -0,0 +1,22 @@
+apiVersion: v2
+appVersion: 23.0.3
+dependencies:
+- name: common
+  repository: file://../../../library/common/2112.0.0
+  version: 2112.0.0
+description: A file sharing server that puts the control and security of your own
+  data back into your hands.
+home: https://nextcloud.com/
+icon: https://cdn.rawgit.com/docker-library/docs/defa5ffc7123177acd60ddef6e16bddf694cc35f/nextcloud/logo.svg
+keywords:
+- nextcloud
+- storage
+- http
+- web
+- php
+name: nextcloud
+sources:
+- https://github.com/nextcloud/docker
+- https://github.com/nextcloud/helm
+upstream_version: 2.3.2
+version: 1.5.0

test/nextcloud/1.5.0/README.md

@@ -0,0 +1,11 @@
+# nextcloud
+
+[nextcloud](https://nextcloud.com/) is a file sharing server that puts the control and security of your own data back into your hands.
+
+## Introduction
+
+This chart bootstraps an [nextcloud](https://hub.docker.com/_/nextcloud/) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Configuration
+
+Please refer to questions.yaml for a detailed overview on supported configurable values.

test/nextcloud/1.5.0/app-readme.md

@@ -0,0 +1,3 @@
+# nextcloud
+
+[nextcloud](https://nextcloud.com/) is a file sharing server that puts the control and security of your own data back into your hands.

test/nextcloud/1.5.0/ix_values.yaml

@@ -0,0 +1,10 @@
+image:
+  pullPolicy: IfNotPresent
+  repository: nextcloud
+  tag: 23.0.3
+nginx:
+  image:
+    pullPolicy: IfNotPresent
+    repository: nginx
+    tag: 1.21.3
+useServiceNameForHost: false

test/nextcloud/1.5.0/migrations/migrate_from_1.1.0

@@ -0,0 +1,26 @@
+#!/usr/bin/python3
+import json
+import os
+import sys
+
+
+def migrate(values):
+    values.update({
+        'appVolumeMounts': {
+            'nextcloud-data': {
+                'hostPathEnabled': values['nextcloudDataHostPathEnabled'],
+                **({'hostPath': values['nextcloudHostPath']} if values.get('nextcloudHostPath') else {})
+            },
+        },
+        'updateStrategy': values.get('nextcloud').get('strategy', 'Recreate'),
+    })
+    return values
+
+
+if __name__ == '__main__':
+    if len(sys.argv) != 2:
+        exit(1)
+
+    if os.path.exists(sys.argv[1]):
+        with open(sys.argv[1], 'r') as f:
+            print(json.dumps(migrate(json.loads(f.read()))))

test/nextcloud/1.5.0/questions.yaml

@@ -0,0 +1,247 @@
+groups:
+  - name: "Container Images"
+    description: "Image to be used for container"
+  - name: "Nextcloud Configuration"
+    description: "Configuration details for Nextcloud workload"
+  - name: "Storage"
+    description: "Configure Storage for Nextcloud"
+  - name: "Container Configuration"
+    description: "Configure nextcloud container parameters"
+  - name: "Postgresql Configuration"
+    description: "Configure Postgresql for nextcloud"
+  - name: "Scaling/Upgrade Policy"
+    description: "Configure how pods are replaced when configuration is upgraded"
+  - name: "Advanced DNS Settings"
+    description: "Configure DNS settings"
+
+portals:
+  web_portal:
+    protocols:
+      - "$kubernetes-resource_configmap_nginx-configuration_protocol"
+    host:
+      - "$variable-nextcloud.host"
+    ports:
+      - "$variable-service.nodePort"
+
+questions:
+
+  - variable: dnsConfig
+    label: "DNS Configuration"
+    group: "Advanced DNS Settings"
+    schema:
+      type: dict
+      attrs:
+        - variable: options
+          label: "DNS Options"
+          schema:
+            type: list
+            items:
+              - variable: optionsEntry
+                label: "Option Entry Configuration"
+                schema:
+                  type: dict
+                  attrs:
+                    - variable: name
+                      label: "Option Name"
+                      schema:
+                        type: string
+                        required: true
+                    - variable: value
+                      label: "Option Value"
+                      schema:
+                        type: string
+                        required: true
+
+  - variable: certificate
+    description: "Configure Certificate for Nextcloud"
+    label: "Certificate Configuration"
+    group: "Nextcloud Configuration"
+    schema:
+      type: int
+      $ref:
+        - "definitions/certificate"
+
+  - variable: nextcloud
+    description: "Nextcloud configuration details"
+    label: "Nextcloud Configuration"
+    group: "Nextcloud Configuration"
+    schema:
+      type: dict
+      required: true
+      additional_attrs: true
+      attrs:
+        - variable: host
+          description: "Nextcloud host to create application URLs"
+          label: "Nextcloud host"
+          schema:
+            type: string
+            $ref:
+              - "definitions/nodeIP"
+        - variable: username
+          label: "Username"
+          description: "Name of the Nextcloud admin user"
+          schema:
+            type: string
+            default: "admin"
+            required: true
+        - variable: password
+          label: "Password"
+          description: "Password for the Nextcloud admin user"
+          schema:
+            type: string
+            private: true
+            default: "changeme"
+            required: true
+        - variable: datadir
+          label: "Nextcloud data directory"
+          description: "Configures the data directory where nextcloud stores all files from the users"
+          schema:
+            type: path
+            default: "/var/www/html/data"
+            required: true
+
+  # Update strategy
+  - variable: updateStrategy
+    description: "Upgrade Policy"
+    label: "Update Strategy"
+    group: "Scaling/Upgrade Policy"
+    schema:
+      type: string
+      default: "Recreate"
+      enum:
+        - value: "RollingUpdate"
+          description: "Create new pods and then kill old ones"
+        - value: "Recreate"
+          description: "Kill existing pods before creating new ones"
+
+  - variable: service
+    description: "Nextcloud Service Configuration"
+    label: "Nextcloud Service Configuration"
+    group: "Nextcloud Configuration"
+    schema:
+      type: dict
+      required: true
+      attrs:
+        - variable: nodePort
+          label: "Node Port to use for Nextcloud"
+          schema:
+            type: int
+            min: 9000
+            max: 65535
+            default: 9001
+            required: true
+
+  - variable: appVolumeMounts
+    label: "Nextcloud Storage"
+    group: "Storage"
+    schema:
+      type: dict
+      attrs:
+        - variable: nextcloud-data
+          label: "Nextcloud Data Volume"
+          schema:
+            type: dict
+            attrs:
+              - variable: datasetName
+                label: "Nextcloud Data Volume Name"
+                schema:
+                  type: string
+                  hidden: true
+                  $ref:
+                    - "normalize/ixVolume"
+                  show_if: [["hostPathEnabled", "=", false]]
+                  default: "ix-nextcloud_data"
+                  editable: false
+              - variable: mountPath
+                label: "Nextcloud Data Mount Path"
+                description: "Path where the volume will be mounted inside the pod"
+                schema:
+                  type: path
+                  hidden: true
+                  editable: false
+                  default: "/var/www"
+              - variable: hostPathEnabled
+                label: "Enable Host Path for Nextcloud Data Volume"
+                schema:
+                  type: boolean
+                  default: false
+                  show_subquestions_if: true
+                  subquestions:
+                    - variable: hostPath
+                      label: "Host Path for Nextcloud Data Volume"
+                      schema:
+                        type: hostpath
+                        required: true
+
+  - variable: extraAppVolumeMounts
+    label: "Nextcloud Extra Host Path Volumes"
+    group: "Storage"
+    schema:
+      type: list
+      items:
+        - variable: extraAppVolume
+          label: "Nextcloud Host Path Volume"
+          description: "Add an extra host path volume for nextcloud application"
+          schema:
+            type: dict
+            attrs:
+              - variable: mountPath
+                label: "Mount Path in Pod"
+                description: "Path where the volume will be mounted inside the pod"
+                schema:
+                  type: path
+                  required: true
+              - variable: hostPath
+                label: "Host Path"
+                description: "Host path"
+                schema:
+                  type: hostpath
+                  required: true
+
+  - variable: postgresAppVolumeMounts
+    label: "Postgres Storage"
+    group: "Storage"
+    schema:
+      type: dict
+      hidden: true
+      attrs:
+        - variable: postgres-data
+          label: "Postgres Data Volume"
+          schema:
+            type: dict
+            attrs:
+              - variable: datasetName
+                label: "Postgres Data Volume Name"
+                schema:
+                  type: string
+                  $ref:
+                    - "normalize/ixVolume"
+                  default: "ix-postgres_data"
+                  editable: false
+              - variable: mountPath
+                label: "Postgresql Data Mount Path"
+                description: "Path where the volume will be mounted inside the pod"
+                schema:
+                  type: path
+                  editable: false
+                  default: "/var/lib/postgresql/data"
+        - variable: postgres-backup
+          label: "Postgres Backup Volume"
+          schema:
+            type: dict
+            attrs:
+              - variable: datasetName
+                label: "Postgres Backup Volume Name"
+                schema:
+                  type: string
+                  $ref:
+                    - "normalize/ixVolume"
+                  default: "ix-postgres_backups"
+                  editable: false
+              - variable: mountPath
+                label: "Postgresql Backup Mount Path"
+                description: "Path where the volume will be mounted inside the pod"
+                schema:
+                  type: path
+                  editable: false
+                  default: "/postgres_backups"

test/nextcloud/1.5.0/requirements.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: common
+  repository: file://../../../library/common/2112.0.0
+  version: 2112.0.0
+digest: sha256:11522ab36487826700d7ad0f86f713a4bb5d35248014bcef690fe94acbc09ef6
+generated: "2021-05-10T13:07:35.423192+05:00"

test/nextcloud/1.5.0/templates/NOTES.txt

@@ -0,0 +1,3 @@
+1. Get the nextcloud URL by running:
+
+  echo http://{{ .Values.nextcloud.host }}:{{ .Values.service.nodePort }}/

test/nextcloud/1.5.0/templates/_nginx.tpl

@@ -0,0 +1,79 @@
+{{/*
+Retrieve true/false if certificate is configured
+*/}}
+{{- define "nginx.certAvailable" -}}
+{{- if .Values.certificate -}}
+{{- $values := (. | mustDeepCopy) -}}
+{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.Values.certificate) -}}
+{{- template "common.resources.cert_present" $values -}}
+{{- else -}}
+{{- false -}}
+{{- end -}}
+{{- end -}}
+
+
+{{/*
+Retrieve public key of certificate
+*/}}
+{{- define "nginx.cert.publicKey" -}}
+{{- $values := (. | mustDeepCopy) -}}
+{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.Values.certificate "publicKey" true) -}}
+{{ include "common.resources.cert" $values }}
+{{- end -}}
+
+
+{{/*
+Retrieve private key of certificate
+*/}}
+{{- define "nginx.cert.privateKey" -}}
+{{- $values := (. | mustDeepCopy) -}}
+{{- $_ := set $values "commonCertOptions" (dict "certKeyName" $values.Values.certificate) -}}
+{{ include "common.resources.cert" $values }}
+{{- end -}}
+
+
+{{/*
+Retrieve configured protocol scheme for nextcloud
+*/}}
+{{- define "nginx.scheme" -}}
+{{- if eq (include "nginx.certAvailable" .) "true" -}}
+{{- print "https" -}}
+{{- else -}}
+{{- print "http" -}}
+{{- end -}}
+{{- end -}}
+
+
+{{/*
+Retrieve nginx certificate secret name
+*/}}
+{{- define "nginx.secretName" -}}
+{{- print "nginx-secret" -}}
+{{- end -}}
+
+
+{{/*
+Formats volumeMount for tls keys and trusted certs
+*/}}
+{{- define "nginx.tlsKeysVolumeMount" -}}
+{{- if eq (include "nginx.certAvailable" .) "true" -}}
+- name: cert-secret-volume
+  mountPath: "/etc/nginx-certs"
+{{- end -}}
+{{- end -}}
+
+{{/*
+Formats volume for tls keys and trusted certs
+*/}}
+{{- define "nginx.tlsKeysVolume" -}}
+{{- if eq (include "nginx.certAvailable" .) "true" -}}
+- name: cert-secret-volume
+  secret:
+    secretName: {{ include "nginx.secretName" . }}
+    items:
+    - key: certPublicKey
+      path: public.crt
+    - key: certPrivateKey
+      path: private.key
+{{- end -}}
+{{- end -}}

test/nextcloud/1.5.0/templates/_postgres.tpl

@@ -0,0 +1,49 @@
+{{/*
+Get Nextloud Postgres Database Name
+*/}}
+{{- define "postgres.DatabaseName" -}}
+{{- print "nextcloud" -}}
+{{- end -}}
+
+
+{{- define "postgres.imageName" -}}
+{{- print "postgres:13.1" -}}
+{{- end -}}
+
+
+{{/*
+Retrieve postgres backup name
+This will return a unique name based on revision and chart numbers specified.
+*/}}
+{{- define "postgres.backupName" -}}
+{{- $upgradeDict := .Values.ixChartContext.upgradeMetadata -}}
+{{- printf "postgres-backup-from-%s-to-%s-revision-%d" $upgradeDict.oldChartVersion $upgradeDict.newChartVersion (int64 $upgradeDict.preUpgradeRevision) -}}
+{{- end }}
+
+
+{{/*
+Retrieve postgres credentials for environment variables configuration
+*/}}
+{{- define "postgres.envVariableConfiguration" -}}
+{{ $envList := list }}
+{{ $envList = mustAppend $envList (dict "name" "POSTGRES_USER" "valueFromSecret" true "secretName" "db-details" "secretKey" "db-user") }}
+{{ $envList = mustAppend $envList (dict "name" "POSTGRES_PASSWORD" "valueFromSecret" true "secretName" "db-details" "secretKey" "db-password") }}
+{{ include "common.containers.environmentVariables" (dict "environmentVariables" $envList) }}
+{{- end -}}
+
+
+{{/*
+Retrieve postgres volume configuration
+*/}}
+{{- define "postgres.volumeConfiguration" -}}
+{{ include "common.storage.configureAppVolumes" (dict "appVolumeMounts" .Values.postgresAppVolumeMounts "emptyDirVolumes" .Values.emptyDirVolumes "ixVolumes" .Values.ixVolumes) | nindent 0 }}
+{{- end -}}
+
+
+{{/*
+Retrieve postgres volume mounts configuration
+*/}}
+{{- define "postgres.volumeMountsConfiguration" -}}
+{{ include "common.storage.configureAppVolumeMountsInContainer" (dict "appVolumeMounts" .Values.postgresAppVolumeMounts ) | nindent 0 }}
+{{- end -}}
+

test/nextcloud/1.5.0/templates/backup-postgres-config.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "postgres-backup-hook-config-map"
+  annotations:
+    rollme: {{ randAlphaNum 5 | quote }}
+data:
+  entrypoint.sh: |-
+    #!/bin/sh
+    cmd="/docker-entrypoint.sh postgres"
+    eval "${cmd}" & disown;
+    until pg_isready; do
+      sleep 5;
+    done;
+    pg_dump -U $POSTGRES_USER -d {{ template "postgres.DatabaseName" . }} > /postgres_backups/$BACKUP_NAME;

test/nextcloud/1.5.0/templates/backup-postgres-hook.yaml

@@ -0,0 +1,39 @@
+{{- if .Values.ixChartContext.isUpgrade -}}
+{{ $values := (. | mustDeepCopy) }}
+{{ $_ := set $values "common" (dict "nameSuffix" "postgres") }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "pre-upgrade-hook2"
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": hook-succeeded
+    rollme: {{ randAlphaNum 5 | quote }}
+spec:
+  template:
+    metadata:
+      name: "pre-upgrade-hook2"
+    spec:
+      restartPolicy: Never
+      serviceAccountName: "{{ template "common.names.serviceAccountName" . }}"
+      containers:
+      - name: {{ .Chart.Name }}-postgres-backup
+        image: {{ template "postgres.imageName" . }}
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        env: {{ include "postgres.envVariableConfiguration" $values | nindent 10 }}
+          - name: BACKUP_NAME
+            value: {{ template "postgres.backupName" . }}
+        volumeMounts: {{ include "postgres.volumeMountsConfiguration" $values | nindent 10 }}
+          - name: backup-script-configmap
+            mountPath: /bin/backup_entrypoint.sh
+            readOnly: true
+            subPath: entrypoint.sh
+        command:
+          - "/bin/backup_entrypoint.sh"
+      volumes: {{ include "postgres.volumeConfiguration" $values | nindent 8 }}
+        - name: backup-script-configmap
+          configMap:
+            defaultMode: 0700
+            name: "postgres-backup-hook-config-map"
+{{- end -}}

test/nextcloud/1.5.0/templates/deployment.yaml

@@ -0,0 +1,98 @@
+{{ $postgres_values := (. | mustDeepCopy) }}
+{{ $_ := set $postgres_values "common" (dict "nameSuffix" "postgres") }}
+{{ include "common.deployment.common_config" . | nindent 0 }}
+spec: {{ include "common.deployment.common_spec" . | nindent 2 }}
+  template: {{ include "common.deployment.pod.metadata" . | nindent 4 }}
+    spec:
+      initContainers:
+        - name: init-postgresdb
+          image: {{ template "postgres.imageName" . }}
+          command: ['sh', '-c', "until pg_isready -h {{ template "common.names.fullname" $postgres_values }}; do echo waiting for postgres; sleep 2; done"]
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+      containers:
+      {{ if eq (include "nginx.certAvailable" .) "true" }}
+      - name: nginx
+        {{ include "common.containers.imageConfig" .Values.nginx.image | nindent 8 }}
+        volumeMounts:
+          - name: nginx-configuration
+            mountPath: /etc/nginx/nginx.conf
+            subPath: nginx.conf
+          {{ include "nginx.tlsKeysVolumeMount" . | nindent 10 }}
+        ports:
+          - name: nginx-http
+            containerPort: 8000
+            protocol: TCP
+          - name: nginx-https
+            containerPort: 443
+            protocol: TCP
+      {{ end }}
+      - name: {{ .Chart.Name }}
+        {{ include "common.containers.imageConfig" .Values.image | nindent 8 }}
+        env: {{ include "postgres.envVariableConfiguration" $postgres_values | nindent 10 }}
+        {{ $envList := list }}
+        {{ $secretName := (include "common.names.fullname" .) }}
+        {{ $envList = mustAppend $envList (dict "name" "POSTGRES_HOST" "value" (printf "%s:5432" (include "common.names.fullname" $postgres_values))) }}
+        {{ $envList = mustAppend $envList (dict "name" "POSTGRES_DB" "value" (include "postgres.DatabaseName" .)) }}
+        {{ $envList = mustAppend $envList (dict "name" "NEXTCLOUD_DATA_DIR" "value" .Values.nextcloud.datadir) }}
+        {{ if eq (include "nginx.certAvailable" .) "true" }}
+        {{ $envList = mustAppend $envList (dict "name" "APACHE_DISABLE_REWRITE_IP" "value" "1") }}
+        {{ $envList = mustAppend $envList (dict "name" "OVERWRITEHOST" "value" (printf "%v:%v" .Values.nextcloud.host .Values.service.nodePort)) }}
+        {{ $envList = mustAppend $envList (dict "name" "OVERWRITEPROTOCOL" "value" "https") }}
+        {{ $envList = mustAppend $envList (dict "name" "TRUSTED_PROXIES" "value" "127.0.0.1") }}
+        {{ end }}
+        {{ $hostName := .Values.nextcloud.host }}
+        {{ if .Values.useServiceNameForHost }}
+        {{ $hostName = (include "common.names.fullname" .) }}
+        {{ end }}
+        {{ $envList = mustAppend $envList (dict "name" "NEXTCLOUD_TRUSTED_DOMAINS" "value" $hostName) }}
+        {{ $envList = mustAppend $envList (dict "name" "NEXTCLOUD_ADMIN_USER" "valueFromSecret" true "secretName" $secretName "secretKey" "nextcloud-username") }}
+        {{ $envList = mustAppend $envList (dict "name" "NEXTCLOUD_ADMIN_PASSWORD" "valueFromSecret" true "secretName" $secretName "secretKey" "nextcloud-password") }}
+        {{ include "common.containers.environmentVariables" (dict "environmentVariables" $envList) | nindent 10 }}
+        ports:
+        - name: http
+          containerPort: 80
+          protocol: TCP
+        volumeMounts:
+        - name: nextcloud-data
+          mountPath: /var/www/
+          subPath: "root"
+        - name: nextcloud-data
+          mountPath: /var/www/html
+          subPath: "html"
+        - name: nextcloud-data
+          mountPath: {{ .Values.nextcloud.datadir }}
+          subPath: "data"
+        - name: nextcloud-data
+          mountPath: /var/www/html/config
+          subPath: "config"
+        - name: nextcloud-data
+          mountPath: /var/www/html/custom_apps
+          subPath: "custom_apps"
+        - name: nextcloud-data
+          mountPath: /var/www/tmp
+          subPath: "tmp"
+        - name: nextcloud-data
+          mountPath: /var/www/html/themes
+          subPath: "themes"
+        {{ range $index, $hostPathConfiguration := .Values.extraAppVolumeMounts }}
+        - name: extrappvolume-{{ $index }}
+          mountPath: {{ $hostPathConfiguration.mountPath }}
+        {{ end }}
+{{ include "common.networking.dnsConfiguration" .Values | nindent 6 }}
+      volumes:
+        - name: nginx-configuration
+          configMap:
+            defaultMode: 0700
+            name: "nginx-configuration"
+{{ include "nginx.tlsKeysVolume" . | nindent 8 }}
+{{ if .Values.appVolumeMounts }}
+{{ include "common.storage.configureAppVolumes" .Values | nindent 8 }}
+{{ end }}
+      {{ range $index, $hostPathConfiguration := .Values.extraAppVolumeMounts }}
+        - name: extrappvolume-{{ $index }}
+          hostPath:
+            path: {{ $hostPathConfiguration.hostPath }}
+      {{ end }}
+      # Will mount configuration files as www-data (id: 33) for nextcloud
+      securityContext:
+        fsGroup: 33

test/nextcloud/1.5.0/templates/nginx-configmap.yaml

@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "nginx-configuration"
+data:
+  protocol: {{ include "nginx.scheme" . }}
+  nginx.conf: |-
+    events {}
+    http {
+      # redirects all http requests to https requests
+      server {
+        listen 8000 default_server;
+        listen [::]:8000 default_server;
+        return 301 https://$host$request_uri;
+      }
+
+      server {
+        server_name localhost;
+
+        listen 443 ssl http2;
+        listen [::]:433 ssl http2;
+
+        ssl_certificate '/etc/nginx-certs/public.crt';
+        ssl_certificate_key '/etc/nginx-certs/private.key';
+
+        # maximum 3GB Upload File; change to fit your needs
+        client_max_body_size 3G;
+
+        add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload" always;
+
+        location = /robots.txt {
+          allow all;
+          log_not_found off;
+          access_log off;
+        }
+
+        location = /.well-known/carddav {
+          return 301 $scheme://$host/remote.php/dav;
+        }
+
+        location = /.well-known/caldav {
+          return 301 $scheme://$host/remote.php/dav;
+        }
+
+        location / {
+          proxy_pass http://localhost;
+          proxy_http_version                 1.1;
+          proxy_cache_bypass                 $http_upgrade;
+          proxy_request_buffering            off;
+
+          # Proxy headers
+          proxy_set_header Upgrade           $http_upgrade;
+          proxy_set_header Connection        "upgrade";
+          proxy_set_header Host              $http_host;
+          proxy_set_header X-Real-IP         $remote_addr;
+          proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto https;
+          proxy_set_header X-Forwarded-Host  $host;
+          proxy_set_header X-Forwarded-Port  $server_port;
+
+          # Proxy timeouts
+          proxy_connect_timeout              60s;
+          proxy_send_timeout                 60s;
+          proxy_read_timeout                 60s;
+        }
+      }
+    }

test/nextcloud/1.5.0/templates/nginx-secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "nginx.secretName" . }}
+type: Opaque
+data:
+  {{ if eq (include "nginx.certAvailable" .) "true" }}
+  certPublicKey: {{ (include "nginx.cert.publicKey" .) | toString | b64enc | quote }}
+  certPrivateKey: {{ (include "nginx.cert.privateKey" .) | toString | b64enc | quote }}
+  {{ end }}

test/nextcloud/1.5.0/templates/nuke-deployments-hook.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.ixChartContext.isUpgrade -}}
+{{ $values := (. | mustDeepCopy) }}
+{{ $_ := set $values "common" (dict "nameSuffix" "postgres") }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "pre-upgrade-hook1"
+  annotations:
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "-1"
+    "helm.sh/hook-delete-policy": hook-succeeded
+    rollme: {{ randAlphaNum 5 | quote }}
+spec:
+  template:
+    metadata:
+      name: "pre-upgrade-hook1"
+    spec:
+      restartPolicy: Never
+      serviceAccountName: "{{ template "common.names.serviceAccountName" . }}"
+      containers:
+      - name: kubectl
+        image: "bitnami/kubectl:1.19"
+        command: ["kubectl", "delete" , "deployment", "{{ template "common.names.fullname" . }}", "{{ template "common.names.fullname" $values }}"]
+{{- end -}}

test/nextcloud/1.5.0/templates/postgres-deployment.yaml

@@ -0,0 +1,17 @@
+{{ $values := (. | mustDeepCopy) }}
+{{ $_ := set $values "common" (dict "nameSuffix" "postgres") }}
+{{ include "common.deployment.common_config" $values | nindent 0 }}
+spec: {{ include "common.deployment.common_spec" $values | nindent 2 }}
+  template: {{ include "common.deployment.pod.metadata" $values | nindent 4 }}
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}-postgres
+        image: {{ template "postgres.imageName" . }}
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        env: {{ include "postgres.envVariableConfiguration" $values | nindent 10 }}
+        volumeMounts: {{ include "postgres.volumeMountsConfiguration" $values | nindent 10 }}
+        ports:
+        - name: postgres-tcp
+          containerPort: 5432
+          protocol: TCP
+      volumes: {{ include "postgres.volumeConfiguration" $values | nindent 8 }}

test/nextcloud/1.5.0/templates/postgres-secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: db-details
+data:
+  db-user: postgres
+  {{- if .Release.IsInstall }}
+  db-password: {{ randAlphaNum 15 | b64enc | quote }}
+  {{ else }}
+  # `index` function is necessary because the property name contains a dash.
+  # Otherwise (...).data.db_password would have worked too.
+  db-password:  {{ index (lookup "v1" "Secret" .Release.Namespace "db-details").data "db-password" }}
+  {{ end }}

test/nextcloud/1.5.0/templates/postgres-service.yaml

@@ -0,0 +1,6 @@
+{{ $ports := list }}
+{{ $ports = mustAppend $ports (dict "name" "postgres-tcp" "port" 5432 "targetPort" 5432) }}
+{{ $values := (. | mustDeepCopy) }}
+{{ $_ := set $values "common" (dict "nameSuffix" "postgres") }}
+{{ $_1 := set $values "commonService" (dict "type" "ClusterIP" "ports" $ports ) }}
+{{ include "common.classes.service" $values }}

test/nextcloud/1.5.0/templates/secrets.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "common.names.fullname" . }}
+  labels: {{ include "common.labels" . | nindent 4 }}
+type: Opaque
+data:
+  nextcloud-username: {{ .Values.nextcloud.username | b64enc | quote }}
+  {{ if .Values.nextcloud.password }}
+  nextcloud-password: {{ .Values.nextcloud.password | b64enc | quote }}
+  {{ else }}
+  nextcloud-password: {{ randAlphaNum 10 | b64enc | quote }}
+  {{ end }}

test/nextcloud/1.5.0/templates/service.yaml

@@ -0,0 +1,10 @@
+{{ $svc := .Values.service }}
+{{ $ports := list }}
+{{ if eq (include "nginx.certAvailable" .) "true" }}
+{{ $ports = mustAppend $ports (dict "name" "nginx-https" "targetPort" 443 "port" 443 "nodePort" $svc.nodePort) }}
+{{ else }}
+{{ $ports = mustAppend $ports (dict "name" "http" "port" 80 "nodePort" $svc.nodePort) }}
+{{ end }}
+{{ $params := . }}
+{{ $_ := set $params "commonService" (dict "type" "NodePort" "ports" $ports ) }}
+{{ include "common.classes.service" $params }}

test/nextcloud/1.5.0/templates/serviceaccount.yaml

@@ -0,0 +1,35 @@
+{{ include "common.serviceaccount" . | nindent 0 }}
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "{{ .Release.Name }}-service-account-role-binding"
+subjects:
+- kind: ServiceAccount
+  name: "{{ template "common.names.serviceAccountName" . }}"
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: "{{ .Release.Name }}-service-account-role"
+  apiGroup: rbac.authorization.k8s.io
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: "{{ .Release.Name }}-service-account-role"
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups:
+    - ""
+    - "apps"
+    resources:
+      - pods
+      - deployments
+    verbs:
+      - delete
+      - get
+      - list

test/nextcloud/1.5.0/templates/tests/deployment-check.yaml

@@ -0,0 +1,21 @@
+{{- $serviceName := (include "common.names.fullname" .) -}}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ .Release.Name }}-nextcloud-test"
+  labels:
+    app: {{ .Release.Name }}
+    release: {{ .Release.Name }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+    containers:
+      - name: test-curl
+        image: alpine/curl
+        imagePullPolicy: "IfNotPresent"
+        command:
+          - /bin/sh
+          - -ec
+          - |
+            curl --connect-timeout 5 --max-time 10 --retry 5 --retry-delay 15 --retry-max-time 90 --retry-all-errors -ksf http://{{ $serviceName }}/login
+    restartPolicy: Never

test/nextcloud/1.5.0/test_values.yaml

@@ -0,0 +1,41 @@
+appVolumeMounts:
+  nextcloud-data:
+    emptyDir: true
+    mountPath: /var/www
+dnsConfig:
+  options: []
+emptyDirVolumes: true
+environmentVariables: []
+image:
+  pullPolicy: IfNotPresent
+  repository: nextcloud
+  tag: 23.0.3
+ixChartContext: {}
+nextcloud:
+  datadir: /var/www/html/data
+  host: nextcloud.kube.home
+  password: changeme
+  username: admin
+nginx:
+  image:
+    pullPolicy: IfNotPresent
+    repository: nginx
+    tag: 1.21.3
+postgresAppVolumeMounts:
+  postgres-backup:
+    emptyDir: true
+    mountPath: /postgres_backups
+  postgres-data:
+    emptyDir: true
+    mountPath: /var/lib/postgresql/data
+postgresql:
+  backupVolume:
+    datasetName: ix-postgres_backups
+    mountPath: /postgres_backups
+  dataVolume:
+    datasetName: ix-postgres_data
+    mountPath: /var/lib/postgresql/data
+service:
+  nodePort: 31000
+updateStrategy: Recreate
+useServiceNameForHost: true