ansible-role-nextcloud/tasks/main.yml

#SPDX-License-Identifier: MIT-0
---
# tasks file for ansible-role-nextcloud
- name: Add NextCloud repo
  kubernetes.core.helm_repository:
    name: nextcloud
    repo_url: https://nextcloud.github.io/helm/
  register: repo

- name: Update Helm repos
  command: helm repo update
  #when: repo.changed

- name: Deploy NextCloud
  kubernetes.core.helm:
    name: nextcloud
    chart_ref: nextcloud/nextcloud
    release_namespace: nextcloud
    create_namespace: true
    values:
      image:
        pullPolicy: Always
      livenessProbe:
        initialDelaySeconds: 300
      readinessProbe:
        initialDelaySeconds: 300
      nextcloud:
        host: nextcloud.eom.dev
        username: nextcloud_admin
        password: "{{ nextcloud_admin_password }}"
        configs:
          proxy.config.php: |-
            <?php
            $CONFIG = array (
              'overwriteprotocol' => 'https',
              'trusted_proxies' => array(
                0 => '127.0.0.1',
                1 => '10.0.0.0/8',
              ),
              'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
            );
      mail:
        enabled: true
        fromAddress: nextcloud
        domain: postfix.eom.dev
        smtp:
          host: postfix.eom.dev
          secure: ssl
          port: 587
          authtype: LOGIN
          name: nextcloud
          password: "{{ nextcloud_admin_password }}"
      persistence:
        enabled: true
        size: 8Ti
      metrics:
        enabled: true
      cronjob:
        enabled: true
      redis:
        #global:
            #defaultStorageClass: r720-nfs-client
        imagePullPolicy: Always
        enabled: true
        auth:
          password: "{{ redis_auth_password }}"
      ingress:
        enabled: true
        className: nginx
        annotations:
          #nginx.ingress.kubernetes.io/enable-cors: "true"
          #nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For"
          nginx.ingress.kubernetes.io/proxy-body-size: 4G
          kubernetes.io/tls-acme: "true"
          cert-manager.io/cluster-issuer: ca-issuer
          # Keep this in sync with the README.md:
          nginx.ingress.kubernetes.io/server-snippet: |-
            server_tokens off;
            proxy_hide_header X-Powered-By;
            rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
            rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
            rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
            rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
            location = /.well-known/carddav {
              return 301 $scheme://$host/remote.php/dav;
            }
            location = /.well-known/caldav {
              return 301 $scheme://$host/remote.php/dav;
            }
            location = /robots.txt {
              allow all;
              log_not_found off;
              access_log off;
            }
            location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
              deny all;
            }
            location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
              deny all;
            }
        tls:
          - hosts:
            - nextcloud.eom.dev
            secretName: nextcloud-tls
      internalDatabase:
        enabled: false
      externalDatabase:
        enabled: true
        type: postgresql
        host: postgresql
        user: nextcloud
        password: "{{ nextcloud_admin_password }}"
        database: nextcloud
      postgresql:
        enabled: true
        image:
          tag: 16.6.0-debian-12-r2
        global:
          postgresql:
            auth:
              username: nextcloud
              password: "{{ nextcloud_admin_password }}"
              database: nextcloud
        primary:
          persistence:
            enabled: true
            size: 2Ti

# --- Sign-in through Dex (user_oidc). Access stays curated: no accounts are
# auto-created, so only users the LDAP backend already sees (members of
# NextCloud Users) can sign in. Admin fallback: /login?direct=1
- name: Find the Nextcloud pod
  kubernetes.core.k8s_info:
    kind: Pod
    namespace: nextcloud
    label_selectors:
      - app.kubernetes.io/name=nextcloud
      - app.kubernetes.io/component=app
    field_selectors:
      - status.phase=Running
  register: nextcloud_pods

- name: Configure Dex sign-in, quota and LDAP filter with occ
  kubernetes.core.k8s_exec:
    namespace: nextcloud
    pod: "{{ nextcloud_pods.resources[0].metadata.name }}"
    container: nextcloud
    command: "su -s /bin/sh www-data -c {{ item | quote }}"
  loop:
    - php occ app:install user_oidc || php occ app:enable user_oidc
    - >-
      php occ user_oidc:provider Dex --clientid=nextcloud
      --clientsecret={{ nextcloud_dex_client_secret | quote }}
      --discoveryuri=https://dex.eom.dev/.well-known/openid-configuration
      --scope="openid email profile groups" --unique-uid=0
      --mapping-uid=preferred_username --mapping-display-name=name
      --mapping-email=email --check-bearer=0 --group-provisioning=0
    - php occ config:system:set user_oidc auto_provision --type=boolean --value=false
    - php occ config:app:set user_oidc allow_multiple_user_backends --value=0
    - php occ config:app:set files default_quota --value="1 GB"
    - >-
      php occ ldap:set-config s01 ldapUserFilter
      "(&(|(objectclass=posixAccount)(objectclass=inetOrgPerson))(|(memberof=cn=NextCloud Users,ou=NextCloud,ou=Services,dc=eom,dc=dev)))"
  register: nextcloud_occ
  changed_when: false
  failed_when: nextcloud_occ.rc != 0 and 'already installed' not in (nextcloud_occ.stdout | default(''))
  no_log: true