[Nextcloud] Split Nextcloud Containers and PVC's BREAKING CHANGE (#2949)

* Move to FPM container and add HPB support

* initial work on more security

* actually tested hpb

* add migration script

* minor questions.yaml tweaks

* remove access_url from configmap

* make the hpb url generate a tad more readable

charts/stable/nextcloud/templates/_configmap.tpl

@@ -13,23 +13,17 @@
 {{- end }}
 {{- end }}
 {{- end }}
+
+
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: nextcloudconfig
 data:
-  NEXTCLOUD_TRUSTED_DOMAINS: {{ ( printf "%v %v %v %v %v" "test.fakedomain.dns" ( .Values.env.NODE_IP | default "localhost" ) ( printf "%v-%v" .Release.Name "nextcloud" ) ( printf "%v-%v" .Release.Name "nextcloud-hpb" ) $hosts ) | quote }}
+  NEXTCLOUD_TRUSTED_DOMAINS: {{ ( printf "%v %v %v %v %v %v %v %v" "test.fakedomain.dns" "localhost" "127.0.0.1" ( printf "%v:%v" "127.0.0.1" .Values.service.main.ports.main.port ) ( .Values.env.AccessIP | default "localhost" ) ( printf "%v-%v" .Release.Name "nextcloud" ) ( printf "%v-%v" .Release.Name "nextcloud-backend" ) $hosts ) | quote }}
   {{- if .Values.ingress.main.enabled }}
   APACHE_DISABLE_REWRITE_IP: "1"
   {{- end }}
 
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: hpbconfig
-data:
-  NEXTCLOUD_URL: {{ ( printf "%v-%v" .Release.Name "nextcloud" ) | quote }}
-
 {{- end -}}

charts/stable/nextcloud/templates/_cronjob.tpl

@@ -1,9 +1,10 @@
 {{/* Define the cronjob */}}
 {{- define "nextcloud.cronjob" -}}
+{{- if .Values.cronjob.enabled -}}
 {{- $jobName := include "tc.common.names.fullname" . }}
 
 ---
-apiVersion: batch/v1beta1
+apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: {{ printf "%s-cronjob" $jobName }}
@@ -31,12 +32,17 @@ spec:
           {{- end }}
           containers:
             - name: {{ .Chart.Name }}
-              image: "{{ .Values.image.repository }}:{{ default .Values.image.tag }}"
+              image: '{{ include "tc.common.images.selector" . }}'
               imagePullPolicy: {{ default .Values.image.pullPolicy }}
-              command: [ "php" ]
-              args:
-                - "-f"
-                - "/var/www/html/cron.php"
+              command:
+                - "/bin/sh"
+                - "-c"
+                - |
+                  /bin/bash <<'EOF'
+                  echo "running nextcloud cronjob..."
+                  php -f /var/www/html/cron.php
+                  echo "cronjob finished"
+                  EOF
               # Will mount configuration files as www-data (id: 33) by default for nextcloud
               {{- with (include "tc.common.controller.volumeMounts" . | trim) }}
               volumeMounts:
@@ -45,7 +51,9 @@ spec:
               securityContext:
                 runAsUser: 33
                 runAsGroup: 33
+                readOnlyRootFilesystem: true
+                runAsNonRoot: true
               resources:
 {{ toYaml .Values.resources | indent 16 }}
-
+{{- end -}}
 {{- end -}}

charts/stable/nextcloud/templates/_hpb.tpl

@@ -0,0 +1,123 @@
+{{/* Define the hbp container */}}
+{{- define "nextcloud.hpb" -}}
+{{- $jobName := include "tc.common.names.fullname" . }}
+image: '{{ include "tc.common.images.selector" . }}'
+imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+securityContext:
+  runAsUser: 33
+  runAsGroup: 33
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+{{- with (include "tc.common.controller.volumeMounts" . | trim) }}
+volumeMounts:
+  {{ nindent 2 . }}
+{{- end }}
+ports:
+  - containerPort: 7867
+readinessProbe:
+  httpGet:
+    path: /push/test/cookie
+    port: 7867
+    httpHeaders:
+    - name: Host
+      value: "test.fakedomain.dns"
+  initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
+  periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
+  timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
+  failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
+livenessProbe:
+  httpGet:
+    path: /push/test/cookie
+    port: 7867
+    httpHeaders:
+    - name: Host
+      value: "test.fakedomain.dns"
+  initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
+  periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
+  timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
+  failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
+startupProbe:
+  httpGet:
+    path: /push/test/cookie
+    port: 7867
+    httpHeaders:
+    - name: Host
+      value: "test.fakedomain.dns"
+  initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
+  periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
+  timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
+  failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
+command:
+  - "/bin/sh"
+  - "-c"
+  - |
+    /bin/bash <<'EOF'
+    set -m
+    echo "Waiting for notify_push file to be available..."
+    until [ -f /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push ]
+    do
+         sleep 10
+         echo "Notify_push not found... waiting..."
+    done
+    echo "Waiting for Nextcloud to start..."
+    until $(curl --output /dev/null --silent --head --fail -H "Host: test.fakedomain.dns" http://127.0.0.1:8080/status.php); do
+        echo "Nextcloud not found... waiting..."
+        sleep 10
+    done
+    until $(curl --silent --fail -H "Host: test.fakedomain.dns" http://127.0.0.1:8080/status.php | jq --raw-output '.installed' | grep "true"); do
+        echo "Nextcloud not installed... waiting..."
+        sleep 10
+    done
+    echo "Nextcloud instance with Notify_push found... Launching High Performance Backend..."
+    /var/www/html/custom_apps/notify_push/bin/x86_64/notify_push /var/www/html/config/config.php &
+
+    until $(curl --output /dev/null --silent --head --fail -H "Host: test.fakedomain.dns" http://127.0.0.1:7867/push/test/cookie); do
+        echo "High Performance Backend not running ... waiting..."
+        sleep 10
+    done
+    echo  "High Performance Backend found..."
+    {{- $accessurl := (  printf "http://%v:%v" ( .Values.env.AccessIP | default ( printf "%v-%v" .Release.Name "nextcloud" ) ) .Values.service.main.ports.main.port ) }}
+    {{- if .Values.ingress.main.enabled }}
+      {{- with (first .Values.ingress.main.hosts) }}
+      {{- $accessurl = (  printf "https://%s" .host ) }}
+      {{- end }}
+    {{- end }}
+    echo  "Configuring High Performance Backend for url: {{ $accessurl }}"
+    php /var/www/html/occ notify_push:setup {{ $accessurl }}/push
+    fg
+    EOF
+env:
+  - name: NEXTCLOUD_URL
+    value: 'http://127.0.0.1:8080'
+  - name: METRICS_PORT
+    value: '7868'
+  - name: TRUSTED_PROXIES
+    value: "{{ .Values.env.TRUSTED_PROXIES }}"
+  - name: POSTGRES_DB
+    value: "{{ .Values.postgresql.postgresqlDatabase }}"
+  - name: POSTGRES_USER
+    value: "{{ .Values.postgresql.postgresqlUsername }}"
+  - name: POSTGRES_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: dbcreds
+        key: postgresql-password
+  - name: POSTGRES_HOST
+    valueFrom:
+      secretKeyRef:
+        name: dbcreds
+        key: plainporthost
+  - name: REDIS_HOST
+    valueFrom:
+      secretKeyRef:
+        name: rediscreds
+        key: plainhost
+  - name: REDIS_HOST_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: rediscreds
+        key: redis-password
+envFrom:
+  - configMapRef:
+      name: nextcloudconfig
+{{- end -}}

charts/stable/nextcloud/templates/_nginx.tpl

@@ -0,0 +1,54 @@
+{{/* Define the nginx container */}}
+{{- define "nextcloud.nginx" -}}
+image: tccr.io/truecharts/nginx-unprivileged:v1.23.0@sha256:e0e989581b7935192d6023ac4a2c19045df39b69b43b894fedbd09726b34c133
+imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+securityContext:
+  runAsUser: 33
+  runAsGroup: 33
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+{{- with (include "tc.common.controller.volumeMounts" . | trim) }}
+volumeMounts:
+  {{ nindent 2 . }}
+{{- end }}
+  - mountPath: /etc/nginx/nginx.conf
+    name: nginx
+    readOnly: true
+    subPath: nginx.conf
+ports:
+  - containerPort: 8080
+
+readinessProbe:
+  httpGet:
+    path: /robots.txt
+    port: 8080
+    httpHeaders:
+    - name: Host
+      value: "test.fakedomain.dns"
+  initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
+  periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
+  timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
+  failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
+livenessProbe:
+  httpGet:
+    path: /robots.txt
+    port: 8080
+    httpHeaders:
+    - name: Host
+      value: "test.fakedomain.dns"
+  initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
+  periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
+  timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
+  failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
+startupProbe:
+  httpGet:
+    path: /robots.txt
+    port: 8080
+    httpHeaders:
+    - name: Host
+      value: "test.fakedomain.dns"
+  initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
+  periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
+  timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
+  failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
+{{- end -}}

charts/stable/nextcloud/templates/common.yaml

@@ -7,8 +7,13 @@
 {{- $newMiddlewares :=  append .Values.ingress.main.fixedMiddlewares "tc-nextcloud-chain" }}
 {{- $_ := set .Values.ingress.main "fixedMiddlewares" $newMiddlewares -}}
 
-{{/* Render cronjob for nextcloud */}}
-{{- include "nextcloud.cronjob" . }}
+{{- if .Values.hpb.enabled -}}
+{{- $_ := set .Values.additionalContainers "hpb" (include "nextcloud.hpb" . | fromYaml) -}}
+{{- end -}}
+{{- $_ := set .Values.additionalContainers "nginx" (include "nextcloud.nginx" . | fromYaml) -}}
 
 {{/* Render the templates */}}
 {{ include "tc.common.loader.apply" . }}
+
+{{/* Render cronjob for nextcloud */}}
+{{- include "nextcloud.cronjob" . }}