why _?111git statuskubectl apply -n kube-system -f descheduler-cronjob.yaml

apps/nextcloud/Dockerfile

@@ -0,0 +1,86 @@
+FROM nextcloud:24-fpm
+#needed for some reason
+ENV NEXTCLOUD_UPDATE=1 
+
+
+RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
+	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
+	apt-get update && apt-get install -y \
+	procps bash iputils-ping libmagickcore-6.q16-6-extra vim-tiny
+	
+RUN apt-get clean -y && \
+    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+
+RUN	touch /usr/src/nextcloud/data/.ocdata
+COPY config.php /usr/src/nextcloud/config/
+#COPY htaccess-data /usr/src/nextcloud/data/.htaccess
+#COPY apache-default-vhost.conf /etc/apache2/sites-available/000-default.conf
+RUN mv /usr/src/nextcloud/.htaccess /usr/src/nextcloud/.htaccess.bak
+RUN mv /usr/src/nextcloud/config/.htaccess /usr/src/nextcloud/config/.htaccess.bak
+
+#install ca.crt update script to the container
+
+COPY post-start.sh /
+RUN chmod +x /post-start.sh
+
+#RUN set -ex; \
+#    \
+#    apt-get update; \
+#    apt-get install -y --no-install-recommends \
+#        ffmpeg \
+#        libmagickcore-6.q16-6-extra \
+#        procps \
+#        smbclient \
+#        supervisor \
+##       libreoffice \
+#    ; \
+#    rm -rf /var/lib/apt/lists/*
+#
+#RUN set -ex; \
+#    \
+#    savedAptMark="$(apt-mark showmanual)"; \
+#    \
+#    apt-get update; \
+#    apt-get install -y --no-install-recommends \
+#        libbz2-dev \
+#        libc-client-dev \
+#        libkrb5-dev \
+#        libsmbclient-dev \
+#    ; \
+#    \
+#    docker-php-ext-configure imap --with-kerberos --with-imap-ssl; \
+#    docker-php-ext-install \
+#        bz2 \
+#        imap \
+#    ; \
+#    pecl install smbclient; \
+#    docker-php-ext-enable smbclient; \
+#    \
+## reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
+#    apt-mark auto '.*' > /dev/null; \
+#    apt-mark manual $savedAptMark; \
+#    ldd "$(php -r 'echo ini_get("extension_dir");')"/*.so \
+#        | awk '/=>/ { print $3 }' \
+#        | sort -u \
+#        | xargs -r dpkg-query -S \
+#        | cut -d: -f1 \
+#        | sort -u \
+#        | xargs -rt apt-mark manual; \
+#    \
+#    apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+#    apt-get clean -y; \ 
+#	rm -rf /var/cache/apt/*; \
+#    rm -rf /var/lib/apt/lists/*
+#
+#RUN mkdir -p \
+#    /var/log/supervisord \
+#    /var/run/supervisord \
+#;
+#RUN chown www-data:www-data \
+#	/var/log/supervisord \
+#	/var/run/supervisord;
+#	
+#COPY supervisord.conf /
+#
+#CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]

apps/nextcloud/README.md

@@ -0,0 +1,2 @@
+# kubectl -n live-env create configmap nextcloud-config --from-file=config.php
+# kubectl -n live-env create configmap nextcloud-nginx-site --from-file=nginx-site.configmap.conf

apps/nextcloud/config.php

@@ -0,0 +1,60 @@
+<?php
+//
+// Manually deployed by yourself
+//
+$CONFIG = array(
+    'config_is_read_only' => false,
+    'htaccess.RewriteBase' => '/',
+    'memcache.local' => '\\OC\\Memcache\\APCu',
+    'apps_paths' => array(
+        0 => array(
+            'path' => '/var/www/html/apps',
+            'url' => '/apps',
+            'writable' => false
+        ),
+        1 => array(
+            'path' => '/var/www/html/custom_apps',
+            'url' => '/custom_apps',
+            'writable' => true
+        )
+    ),
+    'objectstore' => array(
+        'class' => '\\OC\\Files\\ObjectStore\\S3',
+        'arguments' => array(
+            'bucket' => 'nextcloud',
+            'key' => 'nextcloud',
+            'secret' => 'tWnc3zdxcDUvcX5f9uY7RRYvKLcWI1KY',
+            'region' => '',
+            'hostname' => 'minio.live-infra.svc.cluster.local',
+            'port' => '443',
+            'objectPrefix' => 'urn:oid:',
+            'autocreate' => false,
+            'use_ssl' => true,
+            'use_path_style' => true,
+            'legacy_auth' => false
+        )
+    ),
+    'instanceid' => 'ocsxqijfvpf7',
+    'passwordsalt' => 'OTjmXJP0VKlw+OLja6wUxbHlZk4Txw',
+    'secret' => '0g94SdF7A2k/LHTKUM+8HwEDFgF1zz7I/sMauap02/d8G677',
+    'trusted_domains' => array(
+        0 => 'nc.lan'
+    ),
+    'trusted_proxies' => array(
+        0 => '172.23.255.1', 
+        1 => '127.0.0.1'
+    ),
+    'datadirectory' => '/var/www/html/data',
+    'dbtype' => 'pgsql',
+    'version' => '24.0.0',
+    'overwrite.cli.url' => 'http://nc.lan',
+    'dbname' => 'nextcloud',
+    'dbhost' => 'postgres.live-env.svc.cluster.local:5432',
+    'dbport' => '',
+    'dbtableprefix' => 'oc_',
+    'dbuser' => 'nextcloud',
+    'dbpassword' => 'Vb7yHzmE5HIjfU4hf89aXAmEEmxAnMdB',
+    'installed' => true,
+    'default_phone_region' => 'DE',
+    'updater.release.channel' => 'stable',
+);

apps/nextcloud/deployment.yaml

@@ -0,0 +1,140 @@
+#we use postgresql:
+#create database nextcloud;
+#create user nextcloud with encrypted password 'secret';
+#grant all privileges on database nextcloud to nextcloud;
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud
+  labels:
+    app: nextcloud
+    release: latest
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nextcloud
+      release: latest
+  template:
+    metadata:
+      labels:
+        app: nextcloud
+        release: latest
+    spec:
+      volumes:
+        - name: nextcloud-nginx-site
+          configMap:
+            name: nextcloud-nginx-site
+        - name: nextcloud-config
+          configMap:
+            name: nextcloud-config
+        - name: www-data
+          emptyDir: {}
+      containers:
+        - name: nginx-proxy
+          image: nginx
+          volumeMounts:
+            - name: nextcloud-nginx-site
+              mountPath: /etc/nginx/conf.d
+            - name: www-data
+              mountPath: /var/www/html
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+        - name: nextcloud
+          image: cr.lan/nextcloud:latest
+          lifecycle:
+            postStart:
+              exec:
+                command: 
+                  - /post-start.sh
+          volumeMounts:
+            - name: www-data
+              mountPath: /var/www/html
+            #- name: nextcloud-config
+            #  mountPath: /var/www/html/config/config.php
+            #  subPath: config.php
+          env:
+            - name: TZ
+              value: "Europe/Berlin"
+            - name: POSTGRES_HOST
+              value: postgres.live-env.svc.cluster.local:5432
+            - name: POSTGRES_DB
+              value: nextcloud
+            - name: POSTGRES_USER
+              value: nextcloud
+            - name: POSTGRES_PASSWORD
+              value: Vb7yHzmE5HIjfU4hf89aXAmEEmxAnMdB
+            - name: NEXTCLOUD_TRUSTED_DOMAINS
+              value: nc nc.lan 172.23.255.1
+            - name: OBJECTSTORE_S3_HOST
+              value: minio.live-infra.svc.cluster.local
+            - name: OBJECTSTORE_S3_BUCKET
+              value: nextcloud
+            - name: OBJECTSTORE_S3_KEY
+              value: nextcloud
+            - name: OBJECTSTORE_S3_SECRET
+              value: tWnc3zdxcDUvcX5f9uY7RRYvKLcWI1KY
+            - name: OBJECTSTORE_S3_PORT
+              value: "443"
+            - name: OBJECTSTORE_S3_USEPATH_STYLE
+              value: "true"
+            - name: OBJECTSTORE_S3_SSL
+              value: "true"
+          ports:
+            - name: php-fpm
+              containerPort: 9000
+              protocol: TCP
+#          startupProbe:
+#            httpGet:
+#              path: /
+#              port: http
+#           livenessProbe:
+#             httpGet:
+#               path: /
+#               port: http
+#           readinessProbe:
+#             httpGet:
+#               path: /
+#               port: http
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "768Mi"
+              cpu: "3000m"
+         
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud
+spec:
+  ports:
+  - name: http
+    port: 80
+  selector:
+    app: nextcloud
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+    name: nextcloud
+    annotations:
+      kubernetes.io/ingress.class: nginx
+      ingress.kubernetes.io/whitelist-x-forwarded-for: "true"
+      nginx.ingress.kubernetes.io/proxy-body-size: 512m
+spec:
+    rules:
+    - host: nc.lan
+      http:
+          paths:
+          - backend:
+              service:
+                name: nextcloud
+                port: 
+                  name: http
+            path: / 
+            pathType: Prefix

apps/nextcloud/nginx-site.configmap.conf

@@ -0,0 +1,146 @@
+upstream php-handler {
+    server 127.0.0.1:9000;
+    #server unix:/var/run/php/php7.4-fpm.sock;
+}
+
+#server {
+#    listen 80;
+#    listen [::]:80;
+#    server_name cloud.example.com;
+#
+#    # Enforce HTTPS
+#    return 301 https://$server_name$request_uri;
+#}
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    # Use Mozilla's guidelines for SSL/TLS settings
+    # https://mozilla.github.io/server-side-tls/ssl-config-generator/
+    #ssl_certificate     /etc/ssl/nginx/cloud.example.com.crt;
+    #ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;
+
+    # HSTS settings
+    # WARNING: Only add the preload option once you read about
+    # the consequences in https://hstspreload.org/. This option
+    # will add the domain to a hardcoded list that is shipped
+    # in all major browsers and getting removed from this list
+    # could take several months.
+    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
+
+    # set max upload size
+    client_max_body_size 512M;
+    fastcgi_buffers 64 4K;
+
+    # Enable gzip but do not remove ETag headers
+    gzip on;
+    gzip_vary on;
+    gzip_comp_level 4;
+    gzip_min_length 256;
+    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+    # Pagespeed is not supported by Nextcloud, so if your server is built
+    # with the `ngx_pagespeed` module, uncomment this line to disable it.
+    #pagespeed off;
+
+    # HTTP response headers borrowed from Nextcloud `.htaccess`
+    add_header Referrer-Policy                      "no-referrer"   always;
+    add_header X-Content-Type-Options               "nosniff"       always;
+    add_header X-Download-Options                   "noopen"        always;
+    add_header X-Frame-Options                      "SAMEORIGIN"    always;
+    add_header X-Permitted-Cross-Domain-Policies    "none"          always;
+    add_header X-Robots-Tag                         "none"          always;
+    add_header X-XSS-Protection                     "1; mode=block" always;
+
+    # Remove X-Powered-By, which is an information leak
+    fastcgi_hide_header X-Powered-By;
+
+    # Path to the root of your installation
+    root /var/www/html;
+
+    # Specify how to handle directories -- specifying `/index.php$request_uri`
+    # here as the fallback means that Nginx always exhibits the desired behaviour
+    # when a client requests a path that corresponds to a directory that exists
+    # on the server. In particular, if that directory contains an index.php file,
+    # that file is correctly served; if it doesn't, then the request is passed to
+    # the front-end controller. This consistent behaviour means that we don't need
+    # to specify custom rules for certain paths (e.g. images and other assets,
+    # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
+    # `try_files $uri $uri/ /index.php$request_uri`
+    # always provides the desired behaviour.
+    index index.php index.html /index.php$request_uri;
+
+    # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
+    location = / {
+        if ( $http_user_agent ~ ^DavClnt ) {
+            return 302 /remote.php/webdav/$is_args$args;
+        }
+    }
+
+    location = /robots.txt {
+        allow all;
+        log_not_found off;
+        access_log off;
+    }
+
+    # Make a regex exception for `/.well-known` so that clients can still
+    # access it despite the existence of the regex rule
+    # `location ~ /(\.|autotest|...)` which would otherwise handle requests
+    # for `/.well-known`.
+    location ^~ /.well-known {
+        # The following 6 rules are borrowed from `.htaccess`
+
+        location = /.well-known/carddav     { return 301 /remote.php/dav/; }
+        location = /.well-known/caldav      { return 301 /remote.php/dav/; }
+        # Anything else is dynamically handled by Nextcloud
+        location ^~ /.well-known            { return 301 /index.php$uri; }
+
+        try_files $uri $uri/ =404;
+    }
+
+    # Rules borrowed from `.htaccess` to hide certain paths from clients
+    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
+    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)              { return 404; }
+
+    # Ensure this block, which passes PHP files to the PHP process, is above the blocks
+    # which handle static assets (as seen below). If this block is not declared first,
+    # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
+    # to the URI, resulting in a HTTP 500 error response.
+    location ~ \.php(?:$|/) {
+        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+        set $path_info $fastcgi_path_info;
+
+        try_files $fastcgi_script_name =404;
+
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        fastcgi_param PATH_INFO $path_info;
+        fastcgi_param HTTPS off;
+
+        fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
+        fastcgi_param front_controller_active true;     # Enable pretty urls
+        fastcgi_pass php-handler;
+
+        fastcgi_intercept_errors on;
+        fastcgi_request_buffering off;
+    }
+
+    location ~ \.(?:css|js|svg|gif)$ {
+        try_files $uri /index.php$request_uri;
+        expires 6M;         # Cache-Control policy borrowed from `.htaccess`
+        access_log off;     # Optional: Don't log access to assets
+    }
+
+    location ~ \.woff2?$ {
+        try_files $uri /index.php$request_uri;
+        expires 7d;         # Cache-Control policy borrowed from `.htaccess`
+        access_log off;     # Optional: Don't log access to assets
+    }
+
+    location / {
+        try_files $uri $uri/ /index.php$request_uri;
+    }
+}

apps/nextcloud/post-start.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /usr/local/share/ca-certificates/
+/usr/sbin/update-ca-certificates
+
+#su - www-data --shell=/bin/bash --command="cd /var/www/html && php -d memory_limit=512M ./occ upgrade"
+
+# reinstall/activate apps
+#DIS_APP=( accessibility admin_audit contactsinteraction dashboard files_external
+#		files_rightclick firstrunwizard logreader nextcloud_announcements
+#		serverinfo sharebymail survey_client systemtags ser_ldap weather_status )
+#		
+#EN_APP=( activity cloud_federation_api comments dav encryption federatedfilesharing 
+#		federation files files_pdfviewer files_sharing files_trashbin files_videoplayer 
+#		lookup_server_connector notes notifications oauth2 password_policy photos 
+#		privacy provisioning_api recommendations settings support text theming 
+#		twofactor_backupcodes updatenotification user_status viewer workflowengine
+#		files_versions timetracker tasks deck files_3d )
+#		
+#for APP in ${DIS_APP[@]}; do echo "+${APP}+"; done
+#echo "ENABLED"
+#
+#for APP in ${EN_APP[@]}; do echo "+${APP}+"; done

apps/nextcloud/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-nextcloud
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/nextcloud
+    - name: path-to-dockerfile
+      value: apps/nextcloud/Dockerfile
+    - name: image-name
+      value: cr.lan/nextcloud
+  workspaces:
+    - name: git-source
+      persistentVolumeClaim:
+        claimName: tektoncd-workspaces
+      subPath: tekton/nextcloud