Skip to content

Latest commit

 

History

History
949 lines (776 loc) · 45.2 KB

G033 - Deploying services 02 ~ Nextcloud - Part 4 - Nextcloud server.md

File metadata and controls

949 lines (776 loc) · 45.2 KB
Raw

G033 - Deploying services 02 ~ Nextcloud - Part 4 - Nextcloud server

In this fourth part of the Nextcloud platform guide you'll configure the Nextcloud server itself as another component of the whole thing.

Considerations about the Nextcloud server

The Nextcloud server is a PHP application that needs a web service like Apache or Nginx to render its pages. The default image for Nextcloud is an Apache-based one, which is more straightforward to setup, while using Nginx is rather more complex. In this document I'll show you how to declare the Nextcloud server with Apache. You'll find an alternative configuration with Nginx and other ideas at the G911 appendix guide.

On the other hand, there's the detail of the certificate required to encrypt communications between clients and the Nextcloud server. The certificate itself is the wildcard one you already created back in the G029 guide, where you also deployed the cert-manager service into your Kubernetes cluster. You need to replicate the secret associated to that certificate in the namespace for this whole Nextcloud platform project, but that is something you'll do in the final part of this Nextcloud guide. Here you'll only see how that secret is referenced in the resource definition where is required.

Nextcloud server Kustomize project's folders

As with the other components, you need a folder structure for this Kustomize project.

$ mkdir -p $HOME/k8sprjs/nextcloud/components/server-nextcloud/{configs,resources,secrets}

Nextcloud server configuration files

This Apache-based Nextcloud server needs a couple of configuration files and another one with a bunch of key-value parameters.

Configuration file ports.conf

The ports.conf file is where you must indicate to Apache which ports it has to listen on.

  1. Create the ports.conf file under the configs folder.

    $ touch $HOME/k8sprjs/nextcloud/components/server-nextcloud/configs/ports.conf

  2. Copy the content below in ports.conf.

    Listen 443

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

    There's only one port configured here, the 443 which is the one used for HTTPS connections. The last line is just to inform the vim editor about this file's format.

Configuration file 000-default.conf

The 000-default.conf is another Apache configuration file in which you set up all the neccesary parameters to make the Nextcloud site available and SSL enabled.

  1. Create 000-default.conf in the configs path.

    $ touch $HOME/k8sprjs/nextcloud/components/server-nextcloud/configs/000-default.conf

  2. Fill 000-default.conf with the following Apache configuration.

    MinSpareServers 4
MaxSpareServers 16
StartServers 10
MaxConnectionsPerChild 2048

LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so
SSLSessionCache shmcb:/var/tmp/apache_ssl_scache(512000)

<VirtualHost *:443>
  Protocols http/1.1
  ServerAdmin [email protected]
  ServerName nextcloud.deimos.cloud
  ServerAlias nxc.deimos.cloud

  Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"

  DocumentRoot /var/www/html
  DirectoryIndex index.php

  LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
  SSLEngine on
  SSLCertificateFile /etc/ssl/certs/wildcard.deimos.cloud-tls.crt
  SSLCertificateKeyFile /etc/ssl/certs/wildcard.deimos.cloud-tls.key

  <Directory /var/www/html/>
    Options FollowSymlinks MultiViews
    AllowOverride All
    Require all granted

    <IfModule mod_dav.c>
      Dav off
    </IfModule>

    SetEnv HOME /var/www/html
    SetEnv HTTP_HOME /var/www/html
    Satisfy Any

  </Directory>

  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

    This configuration above is a modified version of one found in the official Nextcloud documentation.

    • The first thing you must be aware of is that the Apache instance you're going to run uses the default MPM (Multi-Processing Module) prefork module. This influences what parameters you have available and their effects to the configuration of the processes spawned by Apache.

      • The parameters at the top of the configuration adjust the number of Apache processes running in parallel in your setup. The MaxConnectionsPerChild indicates how many connections each process can handle before being respawned. To know more about these parameters, check the official Apache MPM prefork documentation.

    • For Apache to be able to maintain a cache of SSL sessions, it requires to load (with the LoadModule directive) the socache_shmcb_module since it doesn't come loaded by default. As you might suppose, the path to the mod_socache_shmcb.so library exists only within the container.

    • Notice how the VirtualHost is configured with the port 443 for listening to incoming requests.

    • Since the SSL module, named ssl_module, doesn't come loaded by default in Apache either, you also need to load it with its corresponding LoadModule directive.

    • Below the SSL load module directive, you can see how the SSL engine is enabled and the certificate is expected to be found in the /etc/ssl/certs path within the container.

Properties file params.properties

There are a few values you want to load as parameters in your Kustomize project.

  1. Create the file params.properties under the configs path.

    $ touch $HOME/k8sprjs/nextcloud/components/server-nextcloud/configs/params.properties

  2. Set the parameters below in params.properties.

    nextcloud-admin-username=admin
nextcloud-trusted-domains=192.168.1.42 nextcloud.deimos.cloud nxc.deimos.cloud
cache-redis-svc-cluster-ip=10.43.100.1
db-mariadb-svc-cluster-ip=10.43.100.2

    The key-values above mean the following.

    • nextcloud-admin-username: the name given to the administrator user of your Nextcloud server.

    • nextcloud-trusted-domains: security restriction which tells the Nextcloud server on what IPs or domains can users log into the platform. In other words, these are the only IPs or domains Nextcloud will be accessible from. In this case, I've included the IP that will be assigned by the MetalLB load balancer to the corresponding service resource, and a couple of domains which should be enabled in the network or router's DNS, or on each client's hosts file.

    • cache-redis-svc-cluster-ip and db-mariadb-svc-cluster-ip: the internal cluster IPs of the Redis and MariaDB services. Put here so its easier to locate and change them if necessary.

Nextcloud server password

You need to set one password for Nextcloud's administrator user as a Secret resource.

  1. Create a nextcloud-admin.pwd file in the secrets folder.

    $ touch $HOME/k8sprjs/nextcloud/components/server-nextcloud/secrets/nextcloud-admin.pwd

  2. In the nextcloud-admin.pwd file, put just the string you want to use as password.

    Yo4R_P4s5wORd-f0r_The.n3x7clouD_Adm1niS7r6tor.us3r

    Like in other cases, the string is just a plain unencrypted text. Take care of who can access this file.

Nextcloud server storage

Setting aside the database, which you already configured in the previous part of this guide, you need two persistent volumes for Nextcloud.

  • One PV for storing the files (htmls essentially) of the Nextcloud server itself.
  • One PV to store the Nextcloud users' files.

This means that you have to declare two different claim resources, one per PV.

Claim for the server html files PV

  1. Create a file named html-server-nextcloud.persistentvolumeclaim.yaml under resources.

    $ touch $HOME/k8sprjs/nextcloud/components/server-nextcloud/resources/html-server-nextcloud.persistentvolumeclaim.yaml

  2. Copy the yaml below in html-server-nextcloud.persistentvolumeclaim.yaml.

    apiVersion: v1
kind: PersistentVolumeClaim

metadata:
  name: html-server-nextcloud
spec:
  accessModes:
  - ReadWriteOnce
  storageClassName: local-path
  volumeName: html-nextcloud
  resources:
    requests:
      storage: 1.2G

    If you compared the yaml above with the sole PVC you created for MariaDB, you'll see that the parameters used are exactly the same except in some values (names and storage requested).

Claim for the users data PV

  1. Create a data-server-nextcloud.persistentvolumeclaim.yaml file under resources.

    $ touch $HOME/k8sprjs/nextcloud/components/server-nextcloud/resources/data-server-nextcloud.persistentvolumeclaim.yaml

  2. Fill data-server-nextcloud.persistentvolumeclaim.yaml with the declaration next.

    apiVersion: v1
kind: PersistentVolumeClaim

metadata:
  name: data-server-nextcloud
spec:
  accessModes:
  - ReadWriteOnce
  storageClassName: local-path
  volumeName: data-nextcloud
  resources:
    requests:
      storage: 9.3G

Nextcloud server Stateful resource

Since the Nextcloud server stores data, it's more adequate to deploy it as a StatefulSet rather than a Deployment resource.

  1. Create a server-apache-nextcloud.statefulset.yaml file under the resources path.

    $ touch $HOME/k8sprjs/nextcloud/components/server-nextcloud/resources/server-apache-nextcloud.statefulset.yaml

  2. Put the yaml declaration below in server-apache-nextcloud.statefulset.yaml.

    apiVersion: apps/v1
kind: StatefulSet

metadata:
  name: server-apache-nextcloud
spec:
  replicas: 1
  serviceName: server-apache-nextcloud
  template:
    spec:
      containers:
      - name: server
        image: nextcloud:22.2-apache
        ports:
        - containerPort: 443
        env:
        - name: NEXTCLOUD_ADMIN_USER
          valueFrom:
            configMapKeyRef:
              name: server-apache-nextcloud
              key: nextcloud-admin-username
        - name: NEXTCLOUD_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              name: server-nextcloud
              key: nextcloud-admin-password
        - name: NEXTCLOUD_TRUSTED_DOMAINS
          valueFrom:
            configMapKeyRef:
              name: server-apache-nextcloud
              key: nextcloud-trusted-domains
        - name: MYSQL_HOST
          valueFrom:
            configMapKeyRef:
              name: server-apache-nextcloud
              key: db-mariadb-svc-cluster-ip
        - name: MYSQL_DATABASE
          valueFrom:
            configMapKeyRef:
              name: db-mariadb
              key: nextcloud-db-name
        - name: MYSQL_USER
          valueFrom:
            configMapKeyRef:
              name: db-mariadb
              key: nextcloud-username
        - name: MYSQL_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-mariadb
              key: nextcloud-user-password
        - name: REDIS_HOST
          valueFrom:
            configMapKeyRef:
              name: server-apache-nextcloud
              key: cache-redis-svc-cluster-ip
        - name: REDIS_HOST_PASSWORD
          valueFrom:
            secretKeyRef:
              name: cache-redis
              key: redis-password
        - name: APACHE_ULIMIT_MAX_FILES
          value: 'ulimit -n 65536'
        lifecycle:
          postStart:
            exec:
              command:
              - "sh"
              - "-c"
              - |
                chown www-data:www-data /var/www/html/data
                apt-get update
                apt-get install -y openrc
                start-stop-daemon --start --background --pidfile /cron.pid --exec /cron.sh
        resources:
          limits:
            memory: 512Mi
        volumeMounts:
        - name: certificate
          subPath: wildcard.deimos.cloud-tls.crt
          mountPath: /etc/ssl/certs/wildcard.deimos.cloud-tls.crt
        - name: certificate
          subPath: wildcard.deimos.cloud-tls.key
          mountPath: /etc/ssl/certs/wildcard.deimos.cloud-tls.key
        - name: apache-config
          subPath: ports.conf
          mountPath: /etc/apache2/ports.conf
        - name: apache-config
          subPath: 000-default.conf
          mountPath: /etc/apache2/sites-available/000-default.conf
        - name: html-storage
          mountPath: /var/www/html
        - name: data-storage
          mountPath: /var/www/html/data
      - name: metrics
        image: xperimental/nextcloud-exporter:0.4.0-15-gbb88fb6
        ports:
        - containerPort: 9205
        env:
        - name: NEXTCLOUD_SERVER
          value: "https://localhost"
        - name: NEXTCLOUD_TLS_SKIP_VERIFY
          value: "true"
        - name: NEXTCLOUD_USERNAME
          valueFrom:
            configMapKeyRef:
              name: server-apache-nextcloud
              key: nextcloud-admin-username
        - name: NEXTCLOUD_PASSWORD
          valueFrom:
            secretKeyRef:
              name: server-nextcloud
              key: nextcloud-admin-password
        resources:
          limits:
            memory: 32Mi
      volumes:
      - name: apache-config
        configMap:
          name: server-apache-nextcloud
          defaultMode: 0644
          items:
          - key: ports.conf
            path: ports.conf
          - key: 000-default.conf
            path: 000-default.conf
      - name: certificate
        secret:
          secretName: wildcard.deimos.cloud-tls
          defaultMode: 0444
          items:
          - key: tls.crt
            path: wildcard.deimos.cloud-tls.crt
          - key: tls.key
            path: wildcard.deimos.cloud-tls.key
      - name: html-storage
        persistentVolumeClaim:
          claimName: html-server-nextcloud
      - name: data-storage
        persistentVolumeClaim:
          claimName: data-server-nextcloud

    Like with Redis and MariaDB, the pod configured in the StatefulSet above has two containers in sidecar pattern.

    • server container: executes the Nextcloud server with its associated Apache service.

      • The image used here provides the stable version of Nextcloud, running on a Debian setup.

      • env section: notice that some values are taken from the secrets and config maps defined for the Redis and MariaDB pods.

        • NEXTCLOUD_ADMIN_USER and NEXTCLOUD_ADMIN_PASSWORD: define the administrator user for the Nextcloud server, creating it when the server autoinstalls itself.
        • NEXTCLOUD_TRUSTED_DOMAINS: where the list of trusted domains must be set.
        • MYSQL_HOST and MYSQL_DATABASE: the IP of the MariaDB service and the database instance's name Nextcloud has to use.
        • MYSQL_USER and MYSQL_PASSWORD: the user Nextcloud has to use to connect to its own database on the MariaDB server.
        • REDIS_HOST and REDIS_HOST_PASSWORD: the IP to the Redis service and the password require to authenticate in that server.
        • APACHE_ULIMIT_MAX_FILES: increases the number of files Apache can open at the same time.

      • lifecycle.postStart.exec.command: this defines a command meant to be executed right after the container has started. In this case, a number of them are required for Nextcloud to run properly.

        • The sh command is the shell that will execute the command.

        • The -c line is an option for the sh command to make it read and execute the following strings as commands.

        • | is the yaml code to indicate that a literal scalar begins that includes the following lines. Thanks to this feature, you can just put each command line one below another without concatenating them with &&.

        • The chown command line ensures that the folder where Nextcloud stores all the user data is owned by www-data, which is the user that runs the Nextcloud service in the container.

        • The apt-get commands are for installing the latest version of the openrc command in the container.

        • The start-stop-daemon command starts a cron service that your Nextcloud server will use to run its background jobs.

          BEWARE!
          The apt-get and start-stop-daemon command lines only work with the Debian-based images of Nextcloud, not the Alpine ones. With Alpine images you have to replace those command lines with the following ones.

          apk add openrc
start-stop-daemon --background /cron.sh

          As you can see, these command lines do essentially the same thing, but in a way fitting to an Alpine system.

      • volumeMounts section: mounts the certificate and the two Apache configuration files, and also the two storage volumes needed by this Nextcloud setup.

        • wildcard.deimos.cloud-tls.crt and wildcard.deimos.cloud-tls.key: these two files set up the certificate and all must be in the /etc/ssl/certs path, since is the one set in the 000-default.conf Apache file. These files are found within the Secret resource associated to the wildcard.deimos.cloud-tls certificate you created in the G029 guide.
        • ports.conf is mounted in the default path expected by Apache, /etc/apache2/ports.conf.
        • 000-default.conf is also put in a default Apache path, /etc/apache2/sites-available/000-default.conf.
        • /var/www/html: the path where Nextcloud is installed.
        • /var/www/html/data: where Nextcloud stores the users' data. This folder must be owned by the www-data user that exists within the container.

    • metrics container: runs the Prometheus metrics exporter of Nextcloud.

      • The image for this Prometheus exporter is set to be always the latest one available, and probably runs on a Debian system but its not specified.

      • env section:

        • NEXTCLOUD_SERVER: since this container runs on the same pod as the Nextcloud server, it's set as localhost.
        • NEXTCLOUD_TLS_SKIP_VERIFY: since the certificate is self-signed and this service is running on the same pod, there's little need of checking the certificate when this service connects to Nextcloud.
        • NEXTCLOUD_USERNAME and NEXTCLOUD_PASSWORD: here you'll be forced to use the same administrator user you defined for the Nextcloud server, since its the only one you have at this point.

    • template.spec.volumes: here you have enabled the two volumes prepared for Nextcloud, but also the configuration files for Apache, and the certificate files available in the wildcard.deimos.cloud-tls secret. Notice how the permission mode of these files are handled with the defaultMode parameter.

Nextcloud server Service resource

Your Nextcloud server requires a Service resource named server-apache-nextcloud to offer its functionality.

  1. Create a server-apache-nextcloud.service.yaml file under resources.

    $ touch $HOME/k8sprjs/nextcloud/components/server-nextcloud/resources/server-apache-nextcloud.service.yaml

  2. Copy in server-apache-nextcloud.service.yaml the Service declaration next.

    apiVersion: v1
kind: Service

metadata:
  annotations:
    prometheus.io/scrape: "true"
    prometheus.io/port: "9205"
  name: server-apache-nextcloud
spec:
  type: LoadBalancer
  clusterIP: 10.43.100.3
  loadBalancerIP: 192.168.1.42
  ports:
  - port: 443
    protocol: TCP
    name: apache
  - port: 9205
    protocol: TCP
    name: metrics

    This Service resource is mostly like the others you've seen before, but with the following differences.

    • This Service's type is LoadBalancer, meaning that it'll take the next available IP from the MetalLB pool to use as external public IP in your network. But you can also set manually an IP, picked from the ones available in the load balancer's pool, with the loadBalancerIP parameter set below.

    • A LoadBalancer type service can also have an internal clusterIP, and you can see how I've chosen to set it with an IP that follows the ones assigned to the Redis and MariaDB services. You could leave this value unassigned and allow Kubernetes to give it any internal cluster IP, but consider that having a known static IP can be an advantage on certain situations.

    • With the loadBalancerIP parameter you can tell a LoadBalancer type service what IP you want it to get from your cluster's load balancer (MetalLB in this case). In the yaml above, 192.168.1.42 is right the next one after the IP already assigned to the Traefik service (192.168.1.41). By setting this manually, you ensure that the service has the same IP as the one specified in the nextcloud-trusted-domains parameter declared in the params.properties file.

Nextcloud server Kustomize project

With all the necessary elements for your Nextcloud server component declared in their respective files, you can put them together as a Kustomize project.

  1. Create a kustomization.yaml file in the server-nextcloud folder.

    $ touch $HOME/k8sprjs/nextcloud/components/server-nextcloud/kustomization.yaml

  2. Fill kustomization.yaml with the following yaml.

    # Nextcloud server setup
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

commonLabels:
  app: server-nextcloud

resources:
- resources/data-server-nextcloud.persistentvolumeclaim.yaml
- resources/html-server-nextcloud.persistentvolumeclaim.yaml
- resources/server-apache-nextcloud.service.yaml
- resources/server-apache-nextcloud.statefulset.yaml

replicas:
- name: server-apache-nextcloud
  count: 1

images:
- name: nextcloud
  newTag: 22.2-apache
- name: xperimental/nextcloud-exporter
  newTag: 0.4.0-15-gbb88fb6

configMapGenerator:
- name: server-apache-nextcloud
  envs:
  - configs/params.properties
  files:
  - configs/000-default.conf
  - configs/ports.conf

secretGenerator:
- name: server-nextcloud
  files:
  - nextcloud-admin-password=secrets/nextcloud-admin.pwd

    This kustomization.yaml, compared to the ones you've already set up for the Redis and MariaDB cases, doesn't have anything in particular to highlight. All the parameters specified there should be familiar to you at this point.

Validating the Kustomize yaml output

As with the other components, you should check the output generated by this Kustomize project.

  1. Generate the yaml with kubectl kustomize as usual.

    $ kubectl kustomize $HOME/k8sprjs/nextcloud/components/server-nextcloud | less

  2. See if your yaml output looks like the one below.

    apiVersion: v1
data:
  000-default.conf: |
    MinSpareServers 4
    MaxSpareServers 16
    StartServers 10
    MaxConnectionsPerChild 2048

    LoadModule socache_shmcb_module /usr/lib/apache2/modules/mod_socache_shmcb.so
    SSLSessionCache shmcb:/var/tmp/apache_ssl_scache(512000)

    <VirtualHost *:443>
      Protocols http/1.1
      ServerAdmin [email protected]
      ServerName nextcloud.deimos.cloud
      ServerAlias nxc.deimos.cloud

      Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"

      DocumentRoot /var/www/html
      DirectoryIndex index.php

      LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
      SSLEngine on
      SSLCertificateFile /etc/ssl/certs/wildcard.deimos.cloud-tls.crt
      SSLCertificateKeyFile /etc/ssl/certs/wildcard.deimos.cloud-tls.key

      <Directory /var/www/html/>
        Options FollowSymlinks MultiViews
        AllowOverride All
        Require all granted

        <IfModule mod_dav.c>
          Dav off
        </IfModule>

        SetEnv HOME /var/www/html
        SetEnv HTTP_HOME /var/www/html
        Satisfy Any

      </Directory>

      ErrorLog ${APACHE_LOG_DIR}/error.log
      CustomLog ${APACHE_LOG_DIR}/access.log combined
    </VirtualHost>
  cache-redis-svc-cluster-ip: 10.43.100.1
  db-mariadb-svc-cluster-ip: 10.43.100.2
  nextcloud-admin-username: admin
  nextcloud-trusted-domains: 192.168.1.42 nextcloud.deimos.cloud nxc.deimos.cloud
  ports.conf: |
    Listen 443

    # vim: syntax=apache ts=4 sw=4 sts=4 sr noet
kind: ConfigMap
metadata:
  labels:
    app: server-nextcloud
  name: server-apache-nextcloud-fcckh8bk2d
---
apiVersion: v1
data:
  nextcloud-admin-password: |
    OXE0OHVvbmJvaXU0ODkwdW9paG5nw6x1eTM0ODkwOTIzdWttbmFwamTEusOxamdwYmFpdTM5MHVp
    b3UzOTAzMnVpMDl1bmdhb3BpamRkYcOxejM5a2zDkXFla2oK
kind: Secret
metadata:
  labels:
    app: server-nextcloud
  name: server-nextcloud-mmd5t7577c
type: Opaque
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    prometheus.io/port: "9205"
    prometheus.io/scrape: "true"
  labels:
    app: server-nextcloud
  name: server-apache-nextcloud
spec:
  clusterIP: 10.43.100.3
  loadBalancerIP: 192.168.1.42
  ports:
  - name: server
    port: 443
    protocol: TCP
  - name: metrics
    port: 9205
    protocol: TCP
  selector:
    app: server-nextcloud
  type: LoadBalancer
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    app: server-nextcloud
  name: data-server-nextcloud
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 9.3G
  storageClassName: local-path
  volumeName: data-nextcloud
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    app: server-nextcloud
  name: html-server-nextcloud
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1.2G
  storageClassName: local-path
  volumeName: html-nextcloud
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: server-nextcloud
  name: server-apache-nextcloud
spec:
  replicas: 1
  selector:
    matchLabels:
      app: server-nextcloud
  serviceName: server-apache-nextcloud
  template:
    metadata:
      labels:
        app: server-nextcloud
    spec:
      containers:
      - env:
        - name: NEXTCLOUD_ADMIN_USER
          valueFrom:
            configMapKeyRef:
              key: nextcloud-admin-username
              name: server-apache-nextcloud-fcckh8bk2d
        - name: NEXTCLOUD_ADMIN_PASSWORD
          valueFrom:
            secretKeyRef:
              key: nextcloud-admin-password
              name: server-nextcloud-mmd5t7577c
        - name: NEXTCLOUD_TRUSTED_DOMAINS
          valueFrom:
            configMapKeyRef:
              key: nextcloud-trusted-domains
              name: server-apache-nextcloud-fcckh8bk2d
        - name: MYSQL_HOST
          valueFrom:
            configMapKeyRef:
              key: db-mariadb-svc-cluster-ip
              name: server-apache-nextcloud-fcckh8bk2d
        - name: MYSQL_DATABASE
          valueFrom:
            configMapKeyRef:
              key: nextcloud-db-name
              name: db-mariadb
        - name: MYSQL_USER
          valueFrom:
            configMapKeyRef:
              key: nextcloud-username
              name: db-mariadb
        - name: MYSQL_PASSWORD
          valueFrom:
            secretKeyRef:
              key: nextcloud-user-password
              name: db-mariadb
        - name: REDIS_HOST
          valueFrom:
            configMapKeyRef:
              key: cache-redis-svc-cluster-ip
              name: server-apache-nextcloud-fcckh8bk2d
        - name: REDIS_HOST_PASSWORD
          valueFrom:
            secretKeyRef:
              key: redis-password
              name: cache-redis
        - name: APACHE_ULIMIT_MAX_FILES
          value: ulimit -n 65536
        image: nextcloud:22.2-apache
        lifecycle:
          postStart:
            exec:
              command:
              - sh
              - -c
              - |
                chown www-data:www-data /var/www/html/data
                apt-get update
                apt-get install -y openrc
                start-stop-daemon --start --background --pidfile /cron.pid --exec /cron.sh
        name: server
        ports:
        - containerPort: 443
        resources:
          limits:
            memory: 512Mi
        volumeMounts:
        - mountPath: /etc/ssl/certs/wildcard.deimos.cloud-tls.crt
          name: certificate
          subPath: wildcard.deimos.cloud-tls.crt
        - mountPath: /etc/ssl/certs/wildcard.deimos.cloud-tls.key
          name: certificate
          subPath: wildcard.deimos.cloud-tls.key
        - mountPath: /etc/apache2/ports.conf
          name: apache-config
          subPath: ports.conf
        - mountPath: /etc/apache2/sites-available/000-default.conf
          name: apache-config
          subPath: 000-default.conf
        - mountPath: /var/www/html
          name: html-storage
        - mountPath: /var/www/html/data
          name: data-storage
      - env:
        - name: NEXTCLOUD_SERVER
          value: https://localhost
        - name: NEXTCLOUD_TLS_SKIP_VERIFY
          value: "true"
        - name: NEXTCLOUD_USERNAME
          valueFrom:
            configMapKeyRef:
              key: nextcloud-admin-username
              name: server-apache-nextcloud-fcckh8bk2d
        - name: NEXTCLOUD_PASSWORD
          valueFrom:
            secretKeyRef:
              key: nextcloud-admin-password
              name: server-nextcloud-mmd5t7577c
        image: xperimental/nextcloud-exporter:0.4.0-15-gbb88fb6
        name: metrics
        ports:
        - containerPort: 9205
        resources:
          limits:
            memory: 32Mi
      volumes:
      - configMap:
          defaultMode: 420
          items:
          - key: ports.conf
            path: ports.conf
          - key: 000-default.conf
            path: 000-default.conf
          name: server-apache-nextcloud-fcckh8bk2d
        name: apache-config
      - name: certificate
        secret:
          defaultMode: 292
          items:
          - key: tls.crt
            path: wildcard.deimos.cloud-tls.crt
          - key: tls.key
            path: wildcard.deimos.cloud-tls.key
          secretName: wildcard.deimos.cloud-tls
      - name: html-storage
        persistentVolumeClaim:
          claimName: html-server-nextcloud
      - name: data-storage
        persistentVolumeClaim:
          claimName: data-server-nextcloud

    There's one particular but important thing you must notice in this yaml:

    • As expected, the ConfigMap and Secret resources you've defined in this Kustomize project have their names appended with a hash suffix.

    • On the other hand, the names of the config map db-mariadb and the secrets db-mariadb and cache-redis remain unchanged, because they haven't been defined in this particular Kustomize project, they're external resources just being referenced here. But don't worry, this is also expected and that will be fixed in the final part of this guide.

    • Remember that Kustomize transforms the values you put at the defaultMode parameters set for the files you configure as volumes. You already saw this happening while preparing the Redis Kustomize project.

Don't deploy this Nextcloud server project on its own

This Nextcloud server cannot be deployed on its own because is missing several things.

  • The two persistent volumes it needs to store it's server files and users data.

  • It won't find the external resources it needs to run, like the config maps or secrets of the other components. Their names won't match with the ones this Kustomize project has, and also the certificate's secret isn't replicated in the right namespace.

So, again I must tell you to wait to the upcoming final part of this Nextcloud guide, where you'll add the missing parts, tie everything together and deploy the whole setup in one go.

Background jobs on Nextcloud

There's a particular thing that I've left out of this guide, and is the configuration of a cronjob for the background tasks Nextcloud requires to do regularly. The problem is that I haven't found a proper or convincing setup to apply in this guide, so I'll leave you here a bunch of references about this matter.

Relevant system paths

Folders in kubectl client system

  • $HOME/k8sprjs/nextcloud/components/server-nextcloud
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/configs
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/resources
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/secrets

Files in kubectl client system

  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/kustomization.yaml
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/configs/000-default.conf
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/configs/params.properties
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/configs/ports.conf
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/resources/data-server-nextcloud.persistentvolumeclaim.yaml
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/resources/html-server-nextcloud.persistentvolumeclaim.yaml
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/resources/server-apache-nextcloud.service.yaml
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/resources/server-apache-nextcloud.statefulset.yaml
  • $HOME/k8sprjs/nextcloud/components/server-nextcloud/secrets/nextcloud-admin.pwd

References

Kubernetes

ConfigMaps and secrets

Storage

StatefulSets

Environment variables

Executing multiple commands in lifecycle (postStart/preStop) of containers

Cronjob

Nextcloud

Apache httpd

YAML

Navigation

<< Previous (G033. Deploying services 02. Nextcloud Part 3) | +Table Of Contents+ | Next (G033. Deploying services 02. Nextcloud Part 5) >>