Add Nextcloud deployment and configuration
- Introduced Nextcloud module with Kubernetes resources including deployment, service, ingress, and cron job. - Configured Apache settings for Nextcloud with SSL support and compression. - Created secrets for mail and admin credentials. - Added necessary environment variables for Nextcloud configuration. - Removed unused Scaleway access and secret keys from secrets and variables. - Updated CoreDNS module to support custom host overrides. - Implemented backup bucket policies and lifecycle rules for Scaleway object storage. - Enhanced IAM policies and applications for backup and email services. - Added outputs for backup bucket and API keys.
This commit is contained in:
@@ -0,0 +1,285 @@
|
||||
resource "kubernetes_namespace" "nextcloud" {
|
||||
metadata {
|
||||
annotations = {
|
||||
name = "nextcloud"
|
||||
}
|
||||
|
||||
labels = {
|
||||
name = "nextcloud"
|
||||
}
|
||||
|
||||
name = "nextcloud"
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_manifest" "internal_cert" {
|
||||
count = var.tls_enabled ? 1 : 0
|
||||
manifest = {
|
||||
apiVersion = "cert-manager.io/v1"
|
||||
kind = "Certificate"
|
||||
metadata = {
|
||||
name = "internal-cert"
|
||||
namespace = kubernetes_namespace.nextcloud.metadata[0].name
|
||||
}
|
||||
spec = {
|
||||
secretName = "internal-cert"
|
||||
issuerRef = {
|
||||
name = var.issuer
|
||||
kind = "ClusterIssuer"
|
||||
}
|
||||
commonName = var.fqdn
|
||||
dnsNames = [var.fqdn]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map" "apache_confs" {
|
||||
metadata {
|
||||
name = "nextcloud-apache-confs"
|
||||
namespace = kubernetes_namespace.nextcloud.metadata[0].name
|
||||
}
|
||||
data = local.apache_confs
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map" "apache_mods_load" {
|
||||
metadata {
|
||||
name = "nextcloud-apache-mods-load"
|
||||
namespace = kubernetes_namespace.nextcloud.metadata[0].name
|
||||
}
|
||||
data = local.apache_mods_load
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map" "apache_mods_conf" {
|
||||
metadata {
|
||||
name = "nextcloud-apache-mods-enabled"
|
||||
namespace = kubernetes_namespace.nextcloud.metadata[0].name
|
||||
}
|
||||
data = local.apache_mods_conf
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map" "apache_sites" {
|
||||
metadata {
|
||||
name = "nextcloud-apache-sites"
|
||||
namespace = kubernetes_namespace.nextcloud.metadata[0].name
|
||||
}
|
||||
data = local.apache_sites
|
||||
}
|
||||
|
||||
resource "kubernetes_service_account" "nextcloud_service_account" {
|
||||
|
||||
metadata {
|
||||
name = "nextcloud-app-sa"
|
||||
namespace = kubernetes_namespace.nextcloud.metadata[0].name
|
||||
}
|
||||
|
||||
automount_service_account_token = false
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_deployment" "nextcloud_apache" {
|
||||
|
||||
depends_on = [
|
||||
kubernetes_deployment.nextcloud_redis
|
||||
]
|
||||
|
||||
metadata {
|
||||
name = "nextcloud-app"
|
||||
namespace = kubernetes_namespace.nextcloud.metadata[0].name
|
||||
}
|
||||
spec {
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "nextcloud"
|
||||
}
|
||||
}
|
||||
strategy {
|
||||
type = "Recreate"
|
||||
}
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "nextcloud"
|
||||
}
|
||||
annotations = {
|
||||
"checksum/apache_confs" = local.apache_confs_checksum
|
||||
"checksum/apache_sites" = local.apache_sites_checksum
|
||||
"checksum/apache_mods_load" = local.apache_mods_load_checksum
|
||||
"checksum/apache_mods_conf" = local.apache_mods_conf_checksum
|
||||
}
|
||||
}
|
||||
spec {
|
||||
service_account_name = kubernetes_service_account.nextcloud_service_account.metadata[0].name
|
||||
|
||||
container {
|
||||
name = "nextcloud"
|
||||
image = "nextcloud:${var.tag}"
|
||||
image_pull_policy = "Always"
|
||||
|
||||
resources {
|
||||
requests = {
|
||||
memory = "200Mi"
|
||||
}
|
||||
}
|
||||
|
||||
readiness_probe {
|
||||
http_get {
|
||||
port = "http"
|
||||
path = "/status.php"
|
||||
}
|
||||
initial_delay_seconds = 30
|
||||
period_seconds = 10
|
||||
success_threshold = 1
|
||||
failure_threshold = 3
|
||||
}
|
||||
|
||||
liveness_probe {
|
||||
tcp_socket {
|
||||
port = "http"
|
||||
}
|
||||
initial_delay_seconds = 5
|
||||
period_seconds = 10
|
||||
success_threshold = 1
|
||||
failure_threshold = 3
|
||||
}
|
||||
|
||||
dynamic "env" {
|
||||
for_each = local.nextcloud_env_vars
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value
|
||||
}
|
||||
}
|
||||
|
||||
security_context {
|
||||
allow_privilege_escalation = false
|
||||
}
|
||||
|
||||
dynamic "env" {
|
||||
for_each = local.nextcloud_secrets
|
||||
content {
|
||||
name = env.key
|
||||
value_from {
|
||||
secret_key_ref {
|
||||
key = env.value.key
|
||||
name = env.value.name
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
port {
|
||||
container_port = 80
|
||||
name = "http"
|
||||
}
|
||||
dynamic "port" {
|
||||
for_each = var.tls_enabled ? [1] : []
|
||||
content {
|
||||
container_port = 443
|
||||
name = "https"
|
||||
}
|
||||
}
|
||||
volume_mount {
|
||||
mount_path = "/var/www/html"
|
||||
name = "html-data"
|
||||
}
|
||||
dynamic "volume_mount" {
|
||||
for_each = local.apache_confs
|
||||
content {
|
||||
mount_path = "/etc/apache2/conf-enabled/${volume_mount.key}"
|
||||
name = "apache-confs"
|
||||
sub_path = volume_mount.key
|
||||
read_only = true
|
||||
}
|
||||
}
|
||||
dynamic "volume_mount" {
|
||||
for_each = local.apache_sites
|
||||
content {
|
||||
mount_path = "/etc/apache2/sites-enabled/${volume_mount.key}"
|
||||
name = "apache-sites"
|
||||
sub_path = volume_mount.key
|
||||
read_only = true
|
||||
}
|
||||
}
|
||||
dynamic "volume_mount" {
|
||||
for_each = local.apache_mods_load
|
||||
content {
|
||||
mount_path = "/etc/apache2/mods-enabled/${volume_mount.key}"
|
||||
name = "apache-mods-load"
|
||||
sub_path = volume_mount.key
|
||||
read_only = true
|
||||
}
|
||||
}
|
||||
dynamic "volume_mount" {
|
||||
for_each = local.apache_mods_conf
|
||||
content {
|
||||
mount_path = "/etc/apache2/mods-enabled/${volume_mount.key}"
|
||||
name = "apache-mods-conf"
|
||||
sub_path = volume_mount.key
|
||||
read_only = true
|
||||
}
|
||||
}
|
||||
dynamic "volume_mount" {
|
||||
for_each = var.tls_enabled ? [1] : []
|
||||
content {
|
||||
mount_path = "/etc/ssl/certs/private"
|
||||
name = "internal-cert"
|
||||
read_only = true
|
||||
}
|
||||
}
|
||||
}
|
||||
volume {
|
||||
name = "html-data"
|
||||
host_path {
|
||||
path = local.nextcloud_data
|
||||
}
|
||||
}
|
||||
volume {
|
||||
name = "apache-confs"
|
||||
config_map {
|
||||
name = kubernetes_config_map.apache_confs.metadata[0].name
|
||||
}
|
||||
}
|
||||
volume {
|
||||
name = "apache-sites"
|
||||
config_map {
|
||||
name = kubernetes_config_map.apache_sites.metadata[0].name
|
||||
}
|
||||
}
|
||||
volume {
|
||||
name = "apache-mods-load"
|
||||
config_map {
|
||||
name = kubernetes_config_map.apache_mods_load.metadata[0].name
|
||||
}
|
||||
}
|
||||
volume {
|
||||
name = "apache-mods-conf"
|
||||
config_map {
|
||||
name = kubernetes_config_map.apache_mods_conf.metadata[0].name
|
||||
}
|
||||
}
|
||||
dynamic "volume" {
|
||||
for_each = var.tls_enabled ? [1] : []
|
||||
content {
|
||||
name = "internal-cert"
|
||||
secret {
|
||||
secret_name = kubernetes_manifest.internal_cert[0].manifest["metadata"]["name"]
|
||||
items {
|
||||
key = "tls.crt"
|
||||
path = "tls.crt"
|
||||
}
|
||||
items {
|
||||
key = "tls.key"
|
||||
path = "tls.key"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
lifecycle {
|
||||
replace_triggered_by = [
|
||||
kubernetes_deployment.nextcloud_redis
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user