Add Nextcloud deployment and configuration

- Introduced Nextcloud module with Kubernetes resources including deployment, service, ingress, and cron job.
- Configured Apache settings for Nextcloud with SSL support and compression.
- Created secrets for mail and admin credentials.
- Added necessary environment variables for Nextcloud configuration.
- Removed unused Scaleway access and secret keys from secrets and variables.
- Updated CoreDNS module to support custom host overrides.
- Implemented backup bucket policies and lifecycle rules for Scaleway object storage.
- Enhanced IAM policies and applications for backup and email services.
- Added outputs for backup bucket and API keys.

terraform/iac/scaleway/buckets.tf

@@ -43,3 +43,125 @@ resource "scaleway_object_bucket_policy" "policy" {
     ]
   })
 }
+
+resource "random_string" "bucket_suffix" {
+  length  = 8
+  lower   = true
+  upper   = false
+  special = false
+}
+
+resource "scaleway_object_bucket" "backup" {
+  name       = "a13labs-backup-${random_string.bucket_suffix.result}"
+  project_id = var.scaleway_project_id
+  region     = "fr-par"
+
+  lifecycle_rule {
+    id      = "gitea-clean"
+    prefix  = "gitea-backup/"
+    enabled = true
+
+    expiration {
+      days = local.cloud_backup_retention_days
+    }
+  }
+
+  lifecycle_rule {
+    id      = "mail-clean"
+    prefix  = "mail-backup/"
+    enabled = true
+
+    expiration {
+      days = local.cloud_backup_retention_days
+    }
+  }
+}
+
+resource "scaleway_object_bucket_policy" "backup" {
+  bucket = scaleway_object_bucket.backup.name
+  policy = jsonencode({
+    Version = "2023-04-17",
+    Id      = "AllowAccess",
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "user_id:${var.scaleway_user_id}"
+        }
+        Resource = [
+          scaleway_object_bucket.backup.name,
+          "${scaleway_object_bucket.backup.name}/*",
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "application_id:${scaleway_iam_application.backup_app.id}"
+        }
+        Resource = [
+          scaleway_object_bucket.backup.name,
+          "${scaleway_object_bucket.backup.name}/*",
+        ],
+        Condition = {
+          IpAddress = {
+            "aws:SourceIp" = local.instance_ips
+          }
+        },
+      },
+    ]
+  })
+}
+
+resource "scaleway_object_bucket" "sftpgo" {
+  name       = "a13labs-sftpgo-${random_string.bucket_suffix.result}"
+  project_id = var.scaleway_project_id
+  region     = "fr-par"
+}
+
+resource "scaleway_object_bucket_policy" "sftpgo" {
+  bucket = scaleway_object_bucket.sftpgo.name
+  policy = jsonencode({
+    Version = "2023-04-17",
+    Id      = "AllowAccess",
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "user_id:${var.scaleway_user_id}"
+        }
+        Resource = [
+          scaleway_object_bucket.sftpgo.name,
+          "${scaleway_object_bucket.sftpgo.name}/*",
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "application_id:${scaleway_iam_application.sftpgo_app.id}"
+        }
+        Resource = [
+          scaleway_object_bucket.sftpgo.name,
+          "${scaleway_object_bucket.sftpgo.name}/*",
+        ],
+        Condition = {
+          IpAddress = {
+            "aws:SourceIp" = local.instance_ips
+          }
+        },
+      },
+    ]
+  })
+}
+

terraform/iac/scaleway/config.tf

@@ -3,6 +3,8 @@ locals {
     "${local.vps_1.ip}/32",
   ]
 
+  cloud_backup_retention_days = 3
+
   vps_1 = {
     id   = data.terraform_remote_state.contabo.outputs.instances[0].id
     name = data.terraform_remote_state.contabo.outputs.instances[0].name
@@ -19,3 +21,7 @@ data "terraform_remote_state" "contabo" {
   }
 }
 
+data "scaleway_account_project" "default" {
+  project_id      = var.scaleway_project_id
+  organization_id = var.scaleway_organization_id
+}

terraform/iac/scaleway/iam.tf

@@ -0,0 +1,72 @@
+resource "scaleway_iam_application" "backup_app" {
+  name = "k8s_backup_app"
+}
+
+resource "scaleway_iam_policy" "object_read_write_backup" {
+  name           = "K8s backup app policy"
+  description    = "Gives k8s backup job access to object storage in project"
+  application_id = scaleway_iam_application.backup_app.id
+
+  rule {
+    project_ids = [data.scaleway_account_project.default.id]
+    permission_set_names = [
+      "ObjectStorageObjectsWrite",
+      "ObjectStorageObjectsRead",
+      "ObjectStorageObjectsDelete",
+      "ObjectStorageBucketsRead"
+    ]
+  }
+}
+
+resource "scaleway_iam_application" "mail_app" {
+  name = "mail_app"
+}
+
+resource "scaleway_iam_policy" "email_full_access" {
+  name           = "Email full access policy"
+  description    = "Gives access to transactional email in project"
+  application_id = scaleway_iam_application.mail_app.id
+
+  rule {
+    project_ids = [data.scaleway_account_project.default.id]
+    permission_set_names = [
+      "TransactionalEmailFullAccess",
+    ]
+  }
+}
+
+resource "scaleway_iam_application" "sftpgo_app" {
+  name = "sftpgo_app"
+}
+
+resource "scaleway_iam_policy" "object_read_write_sftpgo" {
+  name           = "SFtpGo app policy"
+  description    = "Gives sftpgo job access to object storage in project"
+  application_id = scaleway_iam_application.sftpgo_app.id
+
+  rule {
+    project_ids = [data.scaleway_account_project.default.id]
+    permission_set_names = [
+      "ObjectStorageObjectsWrite",
+      "ObjectStorageObjectsRead",
+      "ObjectStorageBucketsRead",
+      "ObjectStorageBucketsWrite",
+      "ObjectStorageObjectsDelete"
+    ]
+  }
+}
+
+resource "scaleway_iam_api_key" "backup_app_api" {
+  application_id = scaleway_iam_application.backup_app.id
+  description    = "k8s backup app API key"
+}
+
+resource "scaleway_iam_api_key" "mail_app_api" {
+  application_id = scaleway_iam_application.mail_app.id
+  description    = "mail access API key"
+}
+
+resource "scaleway_iam_api_key" "sftpgo_app_api" {
+  application_id = scaleway_iam_application.sftpgo_app.id
+  description    = "sftpgo access API key"
+}

terraform/iac/scaleway/outputs.tf

@@ -0,0 +1,34 @@
+output "backup_bucket_name" {
+  description = "The name of the backup bucket."
+  value       = scaleway_object_bucket.backup.name
+}
+
+output "backup_app_api_secret_key" {
+  description = "The secret key for the backup API."
+  value       = scaleway_iam_api_key.backup_app_api.secret_key
+  sensitive   = true
+}
+
+output "backup_app_api_access_key" {
+  description = "The access key for the backup API."
+  value       = scaleway_iam_api_key.backup_app_api.access_key
+  sensitive   = true
+}
+
+output "mail_app_api_secret_key" {
+  description = "The secret key for the mail app API."
+  value       = scaleway_iam_api_key.mail_app_api.secret_key
+  sensitive   = true
+}
+
+output "sftpgo_app_api_access_key" {
+  description = "The access key for the SFTPGo app API."
+  value       = scaleway_iam_api_key.sftpgo_app_api.access_key
+  sensitive   = true
+}
+
+output "sftpgo_app_api_secret_key" {
+  description = "The secret key for the SFTPGo app API."
+  value       = scaleway_iam_api_key.sftpgo_app_api.secret_key
+  sensitive   = true
+}