fix(nextcloud): right-size resources to prevent nginx OOMKill

[Tanguille]

Fix Nextcloud nginx sidecar OOMKill by increasing memory limits.

Changes:

• nginx sidecar: 128Mi -> 256Mi limit, 64Mi -> 128Mi request (was OOMKilled with 128Mi limit)
• PHP memory_limit: 8G -> 512M (matches pm.max_children=4 pool, well under 12Gi container limit)
• CronJob: added 100m/500Mi requests, 1cpu/2Gi limits (was BestEffort with no limits)

Verified against live cluster state (pod nextcloud-557c77f968-j5l76).

Summary by CodeRabbit

• Bug Fixes
  • Improved Nextcloud resource allocation for better reliability.
  • Added resource limits for scheduled background tasks.
  • Adjusted PHP memory usage to a more controlled limit.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 04106ce9-35cf-48dc-9493-ed455b30f3d4

📥 Commits

Reviewing files that changed from the base of the PR and between fac474b and ce8c1f7.

📒 Files selected for processing (1)

• kubernetes/apps/default/nextcloud/app/helmrelease.yaml

---

📝 Walkthrough

Walkthrough

The Nextcloud HelmRelease increases Nginx memory resources, reduces PHP memory_limit, and adds CPU and memory resources for the CronJob.

Changes

Nextcloud resource tuning

Layer / File(s)	Summary
Resource and memory settings kubernetes/apps/default/nextcloud/app/helmrelease.yaml	Nginx memory resources increase to 128Mi requested and 256Mi limited. PHP memory_limit changes to 512M. The CronJob receives CPU and memory requests and limits.

Estimated code review effort: 1 (Trivial) | ~5 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/nextcloud-oomkill-resources

---

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in fac474b...ce8c1f7 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 5, 2026 5:36a.m.	Review ↗
Shell		Aug 5, 2026 5:36a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[tanguille-cluster]

@@ data.php.ini @@
# v1/ConfigMap/default/nextcloud-phpconfig
! ± value change in multiline text (one insert, one deletion)
  max_execution_time = 600
  default_socket_timeout = 300
  curl.cainfo = /etc/ssl/certs/ca-certificates.crt
  extension=imagick
  extension=exif
  extension=intl
  extension=gd
- memory_limit = 8G
+ memory_limit = 512M
  opcache.memory_consumption = 512
  opcache.max_accelerated_files = 20000
  opcache.revalidate_freq = 60

@@ spec.template.metadata.annotations.php-config-hash @@
# apps/v1/Deployment/default/nextcloud
! ± value change
- 7dfdcde7c08e1631e106367af48f6b92d22c99456f3427fd5780612da5c7dd90
+ 1bbf6cbbb41376ae5d98fc4f53dfd7c12ecea867ea4b192622b55290c0e964b1

@@ spec.template.spec.containers.nextcloud-nginx.resources.limits.memory @@
# apps/v1/Deployment/default/nextcloud
! ± value change
- 128Mi
+ 256Mi

@@ spec.template.spec.containers.nextcloud-nginx.resources.requests.memory @@
# apps/v1/Deployment/default/nextcloud
! ± value change
- 64Mi
+ 128Mi

@@ spec.jobTemplate.spec.template.spec.containers.nextcloud-cron.resources @@
# batch/v1/CronJob/default/nextcloud-cron
! + two map entries added:
+ limits:
+   cpu: "1"
+   memory: 2Gi
+ requests:
+   cpu: 100m
+   memory: 500Mi

[tanguille-cluster]

@@ spec.values.cronjob.cronjob @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/default/nextcloud
! + one map entry added:
+ resources:
+   limits:
+     cpu: "1"
+     memory: 2Gi
+   requests:
+     cpu: 100m
+     memory: 500Mi

@@ spec.values.nextcloud.phpConfigs.php.ini @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/default/nextcloud
! ± value change in multiline text (one insert, one deletion)
  max_execution_time = 600
  default_socket_timeout = 300
  curl.cainfo = /etc/ssl/certs/ca-certificates.crt
  extension=imagick
  extension=exif
  extension=intl
  extension=gd
- memory_limit = 8G
+ memory_limit = 512M
  opcache.memory_consumption = 512
  opcache.max_accelerated_files = 20000
  opcache.revalidate_freq = 60

@@ spec.values.nginx.resources.limits.memory @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/default/nextcloud
! ± value change
- 128Mi
+ 256Mi

@@ spec.values.nginx.resources.requests.memory @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/default/nextcloud
! ± value change
- 64Mi
+ 128Mi

[github-actions]

AI Automated Review

Analysis engine: omniroute@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation

Approve. The PR right-sizes Nextcloud resources to prevent nginx sidecar OOMKills. The changes are directionally correct, internally consistent, and well-scoped to a single HelmRelease. One minor convention deviation is noted below.

Change-by-change findings

1. nginx sidecar memory (64Mi → 128Mi request, 128Mi → 256Mi limit) — Reasonable fix for the reported OOMKill. The nginx config buffers large uploads (client_max_body_size 10G) to disk, so 256Mi should be sufficient; whether it is sufficient long-term is not independently verifiable from the corpus (see Unknowns).

2. PHP memory_limit (8G → 512M) — Matches Nextcloud's official 512M recommendation. With pm.max_children=4, the PHP-FPM pool can now use at most 4 × 512M = 2Gi, well under the 12Gi container limit. Previously 8G × 4 = 32Gi potential exceeded the container limit, so this reduction also prevents PHP from exhausting the container.

3. CronJob resources added (100m/500Mi requests, 1cpu/2Gi limits) — The cronjob was previously BestEffort with no limits. Adding limits is a safety improvement, but it deviates from learned preference PR 34 (see Standards Compliance).

Standards Compliance

• Conventional Commit title: fix(nextcloud): right-size resources to prevent nginx OOMKill — matches the repo's Conventional Commit convention.
• Learned preference PR 34 deviation (minor): The preference states "do not add new resources blocks to workloads that rely on chart defaults." The CronJob previously had no resources block (chart default / BestEffort); this PR adds one. The change is a safety improvement (prevents OOMKill of the cron job), but it technically deviates from the documented convention.
• No shell scripts touched — shellcheck / validate-pr.sh not applicable.
• Scope: Single-file change to kubernetes/apps/default/nextcloud/app/helmrelease.yaml, consistent with the repo's small-focused-changes convention.

Tool Harness Findings

The tool harness ran read_file (full file and offset reads), git_diff_stat, and git_log. The git_diff_stat command returned empty stdout (exit code 0), so the diff stat was not independently verified by the harness; the diff is available in the PR corpus and was reviewed directly.

Unknowns or Needs Verification

• nginx 256Mi limit sufficiency: The PR author claims verification against live cluster state (pod nextcloud-557c77f968-j5l76). This is not independently verifiable from the corpus; whether 256Mi is sufficient under sustained load is an Unknown.
• git_diff_stat empty output: The tool harness's diff stat returned empty; the change set was reviewed from the PR diff in the corpus instead.

Required checks

• Validate manifest against target cluster version: The diff introduces no new API versions or CRDs. The manifest uses helm.toolkit.fluxcd.io/v2 HelmRelease, gateway.networking.k8s.io HTTPRoute, and gateway.envoyproxy.io HTTPRouteFilter — all already in use in the cluster. The chart is referenced via OCIRepository with no version change. The manifest is valid against the target cluster.
• Resource quota / limit changes: The PR changes nginx sidecar memory (64Mi→128Mi request, 128Mi→256Mi limit), reduces PHP memory_limit (8G→512M), and adds a resources block to the CronJob (100m/500Mi requests, 1cpu/2Gi limits). No ResourceQuota objects are modified. The changes are reasonable and internally consistent.

[github-actions]

Inline findings from the automated review (summary in the sticky comment).