image:
  repository: tccr.io/tccr/nextcloud-fpm
  pullPolicy: IfNotPresent
  tag: v28.0.4@sha256:09a4ab06204736f0acc55556a61ae71a544fb6f4728f95d4c74d5b1c30497dd0
nginxImage:
  repository: nginxinc/nginx-unprivileged
  pullPolicy: IfNotPresent
  tag: 1.26.0@sha256:4099c02ef0e3a89fb51dad1392421aefcd1b302e751aae6ed39174d89bfadc4e
imaginaryImage:
  repository: tccr.io/tccr/nextcloud-imaginary
  pullPolicy: IfNotPresent
  tag: v20230401@sha256:6be7b4432a536d6004b94edea7dd3573f0cc061328b729ed8043236a0784f98c
hpbImage:
  repository: tccr.io/tccr/nextcloud-push-notify
  pullPolicy: IfNotPresent
  tag: v0.6.10@sha256:f175c4f28b2a9346401875f80e7007316cf3e38f74bb49de940961a98b63458b
clamavImage:
  repository: clamav/clamav
  pullPolicy: IfNotPresent
  tag: 1.3.1@sha256:0f66a329bbaec3cc345a474568ae81d261af5ee01f5747c5acd1b489ff2a46b1
collaboraImage:
  repository: collabora/code
  pullPolicy: IfNotPresent
  tag: 23.05.10.1.1@sha256:1b9e3f43fecaa7d41e761a992d5a854de5b54404532498daea3c4bb17b557d90

nextcloud:
  # Initial Credentials
  credentials:
    initialAdminUser: admin
    initialAdminPassword: adminpass
  # General settings
  general:
    # Custom Nextcloud Scripts
    run_optimize: true
    default_phone_region: GR
    # IP used for exposing nextcloud,
    # often the loadbalancer IP
    accessIP: ""
    # Allows Nextcloud to connect to unsecure (http) endpoints
    force_enable_allow_local_remote_servers: false
  # File settings
  files:
    shared_folder_name: Shared
    max_chunk_size: 10485760
  # Expiration settings
  expirations:
    activity_expire_days: 90
    trash_retention_obligation: auto
    versions_retention_obligation: auto
  # Previews settings
  previews:
    enabled: true
    # It will also deploy the container
    imaginary: true
    cron: true
    schedule: "*/30 * * * *"
    max_x: 2048
    max_y: 2048
    max_memory: 1024
    max_file_size_image: 50
    # Setting for Imaginary
    max_allowed_resolution: 18.0
    jpeg_quality: 60
    square_sizes: 32 256
    width_sizes: 256 384
    height_sizes: 256
    # Casings are important
    # https://github.com/nextcloud/server/blob/master/config/config.sample.php#L1269
    # Only the last part of the provider is needed
    providers:
      - PNG
      - JPEG
  # Logging settings
  logging:
    log_level: 2
    log_file: /var/www/html/data/logs/nextcloud.log
    log_audit_file: /var/www/html/data/logs/audit.log
    log_date_format: d/m/Y H:i:s
  # ClamAV settings
  clamav:
    # It will also deploy the container
    # Note that this runs as root
    enabled: false
    stream_max_length: 26214400
    file_max_size: -1
    infected_action: only_log
  # Notify Push settings
  notify_push:
    # It will also deploy the container
    enabled: true
  # Collabora settings
  collabora:
    # It will also deploy the container
    enabled: false
    # default|compact|tabbed
    interface_mode: default
    username: admin
    password: changeme
    dictionaries:
      - de_DE
      - en_GB
      - en_US
      - el_GR
      - es_ES
      - fr_FR
      - pt_BR
      - pt_PT
      - it
      - nl
      - ru
  onlyoffice:
    # It will not deploy the container
    # Only add the OnlyOffice settings
    enabled: false
    url: ""
    internal_url: ""
    verify_ssl: true
    jwt: ""
    jwt_header: Authorization
  # PHP settings
  php:
    memory_limit: 1G
    upload_limit: 10G
    pm_max_children: 180
    pm_start_servers: 18
    pm_min_spare_servers: 12
    pm_max_spare_servers: 30
  opcache:
    interned_strings_buffer: 32
    max_accelerated_files: 10000
    memory_consumption: 128
    revalidate_freq: 60
    jit_buffer_size: 128
# Do NOT edit below this line
workload:
  # Nextcloud php-fpm
  main:
    type: Deployment
    podSpec:
      containers:
        main:
          enabled: true
          primary: true
          envFrom:
            - configMapRef:
                name: nextcloud-config
          probes:
            liveness:
              enabled: true
              type: exec
              command: /healthcheck.sh
            readiness:
              enabled: true
              type: exec
              command: /healthcheck.sh
            startup:
              enabled: true
              type: tcp
              port: "{{ .Values.service.nextcloud.ports.nextcloud.targetPort }}"
  nginx:
    enabled: true
    type: Deployment
    strategy: RollingUpdate
    replicas: 1
    podSpec:
      containers:
        nginx:
          enabled: true
          primary: true
          imageSelector: nginxImage
          resources:
            excludeExtra: true
          probes:
            readiness:
              enabled: true
              path: /robots.txt
              port: "{{ .Values.service.main.ports.main.port }}"
              httpHeaders:
                Host: kube.internal.healthcheck
            liveness:
              enabled: true
              path: /robots.txt
              port: "{{ .Values.service.main.ports.main.port }}"
              httpHeaders:
                Host: kube.internal.healthcheck
            startup:
              enabled: true
              type: tcp
              port: "{{ .Values.service.main.ports.main.port }}"
  notify:
    enabled: true
    type: Deployment
    strategy: RollingUpdate
    replicas: 1
    podSpec:
      containers:
        notify:
          primary: true
          enabled: true
          imageSelector: hpbImage
          resources:
            excludeExtra: true
          envFrom:
            - configMapRef:
                name: hpb-config
          probes:
            readiness:
              enabled: true
              path: /push/test/cookie
              port: 7867
              httpHeaders:
                Host: kube.internal.healthcheck
            liveness:
              enabled: true
              path: /push/test/cookie
              port: 7867
              httpHeaders:
                Host: kube.internal.healthcheck
            startup:
              enabled: true
              type: tcp
              port: 7867
  imaginary:
    enabled: true
    type: Deployment
    strategy: RollingUpdate
    replicas: 1
    podSpec:
      containers:
        imaginary:
          primary: true
          enabled: true
          imageSelector: imaginaryImage
          resources:
            excludeExtra: true
          command: imaginary
          args:
            - -p
            - "{{ .Values.service.imaginary.ports.imaginary.port }}"
            - -concurrency
            - "10"
            - -max-allowed-resolution
            - "{{ .Values.nextcloud.previews.max_allowed_resolution }}"
            - -enable-url-source
            - -return-size
          probes:
            readiness:
              enabled: true
              path: /health
              port: "{{ .Values.service.imaginary.ports.imaginary.port }}"
            liveness:
              enabled: true
              path: /health
              port: "{{ .Values.service.imaginary.ports.imaginary.port }}"
            startup:
              enabled: true
              type: tcp
              port: "{{ .Values.service.imaginary.ports.imaginary.port }}"
  clamav:
    enabled: true
    type: Deployment
    strategy: RollingUpdate
    replicas: 1
    podSpec:
      containers:
        clamav:
          primary: true
          enabled: true
          imageSelector: clamavImage
          resources:
            excludeExtra: true
          # FIXME: https://github.com/Cisco-Talos/clamav/issues/478
          securityContext:
            runAsUser: 0
            runAsGroup: 0
            runAsNonRoot: false
            readOnlyRootFilesystem: false
          envFrom:
            - configMapRef:
                name: clamav-config
          probes:
            readiness:
              enabled: true
              type: exec
              command: clamdcheck.sh
            liveness:
              enabled: true
              type: exec
              command: clamdcheck.sh
            startup:
              enabled: true
              type: tcp
              port: "{{ .Values.service.clamav.ports.clamav.targetPort }}"
  collabora:
    enabled: true
    type: Deployment
    strategy: RollingUpdate
    replicas: 1
    podSpec:
      containers:
        collabora:
          primary: true
          enabled: true
          imageSelector: collaboraImage
          resources:
            excludeExtra: true
          securityContext:
            runAsUser: 100
            runAsGroup: 102
            readOnlyRootFilesystem: false
            allowPrivilegeEscalation: true
            capabilities:
              add:
                - CHOWN
                - FOWNER
                - SYS_CHROOT
                - MKNOD
          envFrom:
            - configMapRef:
                name: collabora-config
          probes:
            readiness:
              enabled: true
              type: http
              path: /collabora/
              port: "{{ .Values.service.collabora.ports.collabora.targetPort }}"
            liveness:
              enabled: true
              type: http
              path: /collabora/
              port: "{{ .Values.service.collabora.ports.collabora.targetPort }}"
            startup:
              enabled: true
              type: tcp
              port: "{{ .Values.service.collabora.ports.collabora.targetPort }}"
cronjobs:
  # Don't change names, it's used in the persistence
  - name: nextcloud-cron
    enabled: true
    schedule: "*/5 * * * *"
    cmd:
      - echo "Running [php -f /var/www/html/cron.php] ..."
      - php -f /var/www/html/cron.php
      - echo "Finished [php -f /var/www/html/cron.php]"
  - name: preview-cron
    enabled: "{{ .Values.nextcloud.previews.cron }}"
    schedule: "{{ .Values.nextcloud.previews.schedule }}"
    cmd:
      - echo "Running [occ preview:pre-generate] ..."
      - occ preview:pre-generate
      - echo "Finished [occ preview:pre-generate]"
service:
  # Main service links to ingress easier
  # That's why the nginx is swapped with nextcloud
  main:
    targetSelector: nginx
    ports:
      main:
        targetSelector: nginx
        port: 8080
  nextcloud:
    enabled: true
    targetSelector: main
    ports:
      nextcloud:
        enabled: true
        targetSelector: main
        port: 9000
        targetPort: 9000
  notify:
    enabled: true
    targetSelector: notify
    ports:
      notify:
        enabled: true
        primary: true
        port: 7867
        targetPort: 7867
        targetSelector: notify
      metrics:
        enabled: true
        port: 7868
        targetSelector: notify
  imaginary:
    enabled: true
    targetSelector: imaginary
    ports:
      imaginary:
        enabled: true
        port: 9090
        targetSelector: imaginary
  clamav:
    enabled: true
    targetSelector: clamav
    ports:
      clamav:
        enabled: true
        port: 3310
        targetPort: 3310
        targetSelector: clamav
  collabora:
    enabled: true
    targetSelector: collabora
    ports:
      collabora:
        enabled: true
        port: 9980
        targetPort: 9980
        targetSelector: collabora
persistence:
  php-tune:
    enabled: true
    type: configmap
    objectName: php-tune
    targetSelector:
      main:
        main:
          mountPath: /usr/local/etc/php-fpm.d/zz-tune.conf
          subPath: zz-tune.conf
          readOnly: true
  redis-session:
    enabled: true
    type: configmap
    objectName: redis-session
    targetSelector:
      main:
        main:
          mountPath: /usr/local/etc/php/conf.d/redis-session.ini
          subPath: redis-session.ini
          readOnly: true
  opcache-recommended:
    enabled: true
    type: configmap
    objectName: opcache
    targetSelector:
      main:
        main:
          mountPath: /usr/local/etc/php/conf.d/opcache-recommended.ini
          subPath: opcache-recommended.ini
          readOnly: true
  nginx:
    enabled: true
    type: configmap
    objectName: nginx-config
    targetSelector:
      nginx:
        nginx:
          mountPath: /etc/nginx/nginx.conf
          subPath: nginx.conf
          readOnly: true
  nginx-temp:
    enabled: true
    type: emptyDir
    targetSelector:
      nginx:
        nginx:
          mountPath: /tmp/nginx
  html:
    enabled: true
    targetSelector:
      main:
        main:
          mountPath: /var/www/html
      nextcloud-cron:
        nextcloud-cron:
          mountPath: /var/www/html
      preview-cron:
        preview-cron:
          mountPath: /var/www/html
      nginx:
        nginx:
          mountPath: /var/www/html
          readOnly: true
  config:
    enabled: true
    targetSelector:
      main:
        main:
          mountPath: /var/www/html/config
      nextcloud-cron:
        nextcloud-cron:
          mountPath: /var/www/html/config
      preview-cron:
        preview-cron:
          mountPath: /var/www/html/config
      notify:
        notify:
          mountPath: /var/www/html/config
          readOnly: true
      nginx:
        nginx:
          mountPath: /var/www/html/config
          readOnly: true
  data:
    enabled: true
    targetSelector:
      main:
        main:
          mountPath: /var/www/html/data
        init-perms:
          mountPath: /var/www/html/data
      nextcloud-cron:
        nextcloud-cron:
          mountPath: /var/www/html/data
      preview-cron:
        preview-cron:
          mountPath: /var/www/html/data
      nginx:
        nginx:
          mountPath: /var/www/html/data
          readOnly: true
cnpg:
  main:
    enabled: true
    user: nextcloud
    database: nextcloud
redis:
  enabled: true
  includeCommon: true
  username: default
portal:
  open:
    enabled: true
updated: true

ingress:
  main:
    required: true