a13labs.infra/terraform/modules/apps/nextcloud/main.tf

resource "kubernetes_namespace" "nextcloud" {
  metadata {
    annotations = {
      name = "nextcloud"
    }

    labels = {
      name = "nextcloud"
    }

    name = "nextcloud"
  }
}

resource "kubernetes_manifest" "internal_cert" {
  count = var.tls_enabled ? 1 : 0
  manifest = {
    apiVersion = "cert-manager.io/v1"
    kind       = "Certificate"
    metadata = {
      name      = "internal-cert"
      namespace = kubernetes_namespace.nextcloud.metadata[0].name
    }
    spec = {
      secretName = "internal-cert"
      issuerRef = {
        name = var.issuer
        kind = "ClusterIssuer"
      }
      commonName = var.fqdn
      dnsNames   = [var.fqdn]
    }
  }
}

resource "kubernetes_config_map" "apache_confs" {
  metadata {
    name      = "nextcloud-apache-confs"
    namespace = kubernetes_namespace.nextcloud.metadata[0].name
  }
  data = local.apache_confs
}

resource "kubernetes_config_map" "apache_mods_load" {
  metadata {
    name      = "nextcloud-apache-mods-load"
    namespace = kubernetes_namespace.nextcloud.metadata[0].name
  }
  data = local.apache_mods_load
}

resource "kubernetes_config_map" "apache_mods_conf" {
  metadata {
    name      = "nextcloud-apache-mods-enabled"
    namespace = kubernetes_namespace.nextcloud.metadata[0].name
  }
  data = local.apache_mods_conf
}

resource "kubernetes_config_map" "apache_sites" {
  metadata {
    name      = "nextcloud-apache-sites"
    namespace = kubernetes_namespace.nextcloud.metadata[0].name
  }
  data = local.apache_sites
}

resource "kubernetes_service_account" "nextcloud_service_account" {

  metadata {
    name      = "nextcloud-app-sa"
    namespace = kubernetes_namespace.nextcloud.metadata[0].name
  }

  automount_service_account_token = false
}


resource "kubernetes_deployment" "nextcloud_apache" {

  depends_on = [
    kubernetes_deployment.nextcloud_redis
  ]

  metadata {
    name      = "nextcloud-app"
    namespace = kubernetes_namespace.nextcloud.metadata[0].name
  }
  spec {
    selector {
      match_labels = {
        app = "nextcloud"
      }
    }
    strategy {
      type = "Recreate"
    }
    template {
      metadata {
        labels = {
          app = "nextcloud"
        }
        annotations = {
          "checksum/apache_confs"     = local.apache_confs_checksum
          "checksum/apache_sites"     = local.apache_sites_checksum
          "checksum/apache_mods_load" = local.apache_mods_load_checksum
          "checksum/apache_mods_conf" = local.apache_mods_conf_checksum
        }
      }
      spec {
        service_account_name = kubernetes_service_account.nextcloud_service_account.metadata[0].name

        container {
          name              = "nextcloud"
          image             = "nextcloud:${var.tag}"
          image_pull_policy = "Always"

          resources {
            requests = {
              memory = "200Mi"
            }
          }

          readiness_probe {
            http_get {
              port = "http"
              path = "/status.php"
            }
            initial_delay_seconds = 30
            period_seconds        = 10
            success_threshold     = 1
            failure_threshold     = 3
          }

          liveness_probe {
            tcp_socket {
              port = "http"
            }
            initial_delay_seconds = 5
            period_seconds        = 10
            success_threshold     = 1
            failure_threshold     = 3
          }

          dynamic "env" {
            for_each = local.nextcloud_env_vars
            content {
              name  = env.key
              value = env.value
            }
          }

          security_context {
            allow_privilege_escalation = false
          }

          dynamic "env" {
            for_each = local.nextcloud_secrets
            content {
              name = env.key
              value_from {
                secret_key_ref {
                  key  = env.value.key
                  name = env.value.name
                }
              }
            }
          }
          port {
            container_port = 80
            name           = "http"
          }
          dynamic "port" {
            for_each = var.tls_enabled ? [1] : []
            content {
              container_port = 443
              name           = "https"
            }
          }
          volume_mount {
            mount_path = "/var/www/html"
            name       = "html-data"
          }
          dynamic "volume_mount" {
            for_each = local.apache_confs
            content {
              mount_path = "/etc/apache2/conf-enabled/${volume_mount.key}"
              name       = "apache-confs"
              sub_path   = volume_mount.key
              read_only  = true
            }
          }
          dynamic "volume_mount" {
            for_each = local.apache_sites
            content {
              mount_path = "/etc/apache2/sites-enabled/${volume_mount.key}"
              name       = "apache-sites"
              sub_path   = volume_mount.key
              read_only  = true
            }
          }
          dynamic "volume_mount" {
            for_each = local.apache_mods_load
            content {
              mount_path = "/etc/apache2/mods-enabled/${volume_mount.key}"
              name       = "apache-mods-load"
              sub_path   = volume_mount.key
              read_only  = true
            }
          }
          dynamic "volume_mount" {
            for_each = local.apache_mods_conf
            content {
              mount_path = "/etc/apache2/mods-enabled/${volume_mount.key}"
              name       = "apache-mods-conf"
              sub_path   = volume_mount.key
              read_only  = true
            }
          }
          dynamic "volume_mount" {
            for_each = var.tls_enabled ? [1] : []
            content {
              mount_path = "/etc/ssl/certs/private"
              name       = "internal-cert"
              read_only  = true
            }
          }
        }
        volume {
          name = "html-data"
          host_path {
            path = var.nextcloud_data
          }
        }
        volume {
          name = "apache-confs"
          config_map {
            name = kubernetes_config_map.apache_confs.metadata[0].name
          }
        }
        volume {
          name = "apache-sites"
          config_map {
            name = kubernetes_config_map.apache_sites.metadata[0].name
          }
        }
        volume {
          name = "apache-mods-load"
          config_map {
            name = kubernetes_config_map.apache_mods_load.metadata[0].name
          }
        }
        volume {
          name = "apache-mods-conf"
          config_map {
            name = kubernetes_config_map.apache_mods_conf.metadata[0].name
          }
        }
        dynamic "volume" {
          for_each = var.tls_enabled ? [1] : []
          content {
            name = "internal-cert"
            secret {
              secret_name = kubernetes_manifest.internal_cert[0].manifest["metadata"]["name"]
              items {
                key  = "tls.crt"
                path = "tls.crt"
              }
              items {
                key  = "tls.key"
                path = "tls.key"
              }
            }
          }
        }
      }
    }
  }
  lifecycle {
    replace_triggered_by = [
      kubernetes_deployment.nextcloud_redis
    ]
  }
}