aly.codes / infra
Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform. cute.haus
ansible terraform nix k8s
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

k8s: migrate nextcloud to dedicated namespace

Move the nextcloud HelmRelease to its own namespace with a dedicated
valkey (added previously), repoint REDIS_HOST to the local instance, and
re-target the SSO env secret via a per-client namespace override in the
OIDC bootstrap playbook. Resolves the shared-valkey DB 0 overlap with
paperless and isolates nextcloud's blast radius.

Aly Raffauf (Jul 1, 2026, 11:37 PM EDT) 6298c3c9 5f18874c

+12 -7
+4 -2
ansible/playbooks/tasks/integrations/_write-secret-and-restart.yml
··· 4 4 # secret_name — K8s Secret name 5 5 # secret_data — dict of env var names → values 6 6 # deployment_name — Deployment to restart on change 7 + # The target namespace is client_spec.namespace if set (per-client override), 8 + # else the playbook-level k8s_namespace default. 7 9 - name: "[{{ client_spec.slug }}] Write SSO env Secret" 8 10 kubernetes.core.k8s: 9 11 state: present ··· 12 14 kind: Secret 13 15 metadata: 14 16 name: "{{ secret_name }}" 15 - namespace: "{{ k8s_namespace }}" 17 + namespace: "{{ client_spec.namespace | default(k8s_namespace) }}" 16 18 labels: 17 19 app.kubernetes.io/managed-by: ansible-oidc-bootstrap 18 20 app.kubernetes.io/component: sso-env ··· 29 31 state: patched 30 32 api_version: apps/v1 31 33 kind: Deployment 32 - namespace: "{{ k8s_namespace }}" 34 + namespace: "{{ client_spec.namespace | default(k8s_namespace) }}" 33 35 name: "{{ deployment_name }}" 34 36 definition: 35 37 spec:
+3
ansible/playbooks/vars/oidc-clients.yml
··· 74 74 isPublic: false 75 75 pkceEnabled: true 76 76 integration: nextcloud 77 + # nextcloud runs in its own namespace; write the SSO env Secret and 78 + # restart the Deployment there instead of the playbook default. 79 + namespace: nextcloud
+1 -1
k8s/charts/nextcloud/templates/configmap.yaml
··· 19 19 POSTGRES_DB: "nextcloud" 20 20 POSTGRES_USER: "nextcloud" 21 21 22 - REDIS_HOST: "valkey.default.svc" 22 + REDIS_HOST: "valkey.nextcloud.svc" 23 23 REDIS_HOST_PORT: "6379" 24 24 25 25 OBJECTSTORE_S3_BUCKET: "aly-nextcloud"
+1 -1
k8s/flux/apps/releases.yaml
··· 388 388 spec: 389 389 interval: 15m 390 390 releaseName: nextcloud 391 - targetNamespace: default 391 + targetNamespace: nextcloud 392 392 install: 393 393 remediation: 394 394 retries: 3
+3 -3
k8s/flux/secrets/nextcloud-env.sops.yaml
··· 8 8 kind: ENC[AES256_GCM,data:XFnM1wwS,iv:uCrY2sARWNCcKmmdLS4xwgX4wBj75DxjjwHci/lrvrs=,tag:EHLSCJ/tZtPFh8P2CHsPXg==,type:str] 9 9 metadata: 10 10 name: ENC[AES256_GCM,data:8yn97igRWV9RksPmKw==,iv:3I4s0FJDi+oOq7NT0nsQMd9gI1+TPx3RhQH6XPQzkRQ=,tag:cRS4gS07dUfGRzTh1/9HOA==,type:str] 11 - namespace: ENC[AES256_GCM,data:5sB/UD30dA==,iv:uNkfz1Phj9KW56ql+F7MHWD99jdPEVgAEFNPqVTg0EY=,tag:b0lNxTLqn8WPVM+xeBJW8w==,type:str] 11 + namespace: ENC[AES256_GCM,data:BTuAVpMXSBYY,iv:p3QcBrn432suywyepEHMPCafHDfsLrCM7sD6lgW8mGw=,tag:fHVAGVc2hUuflvAeZaW7KQ==,type:str] 12 12 sops: 13 13 age: 14 14 - enc: | ··· 218 218 i2Z/s6AQHzTlTSFK3avxHLN1NhUUXHzbJ/ucvkn51lbo76oeQulF4g== 219 219 -----END AGE ENCRYPTED FILE----- 220 220 recipient: age1yq47x0cyf95jg372v84ttptgnppsrfmxshsua6p58ecmgzxc5c0s5stfth 221 - lastmodified: "2026-07-01T19:42:05Z" 222 - mac: ENC[AES256_GCM,data:YXhTz72+FQkmRFkv/5XMQOMWi9LkMbtZmYkujgjmatQ5fwNalt+3k/WC0U/gdAfp6WaY4ZNFq7/bJ7SACDIILZOLfc4ZU7YDMZ5vGZcSPT5NRIe5hStcdNxK7c0UKS4Swpv7Z1M5vGpSWf1klYaAYyri1FZGfvsRsEhn9+Rmp+A=,iv:RRr8ytyYSJ1i1nAtBAU+g1KKOsP6g9tFyci2hbZgH5I=,tag:3mU+bb+Znc8x4Yx4m6zYYA==,type:str] 221 + lastmodified: "2026-07-02T03:28:00Z" 222 + mac: ENC[AES256_GCM,data:QrXr0Vb5d4zqj60bcAKuBjBsoz81AvOzkzDCQJDwP6XVwaP/ksmxtd9UKF00yD5WfHnmC4o3IRPPoQsyKSx4UGA1jSuYambD0gS1jl/FPKOI+YodBKrhhIkRIZ6mbN1tAExvQSRZ9XbcpjQSFvSVdNhgA4spKQLohrvwkJ/U9KU=,iv:cu9jlKa5gCUkuB3VTyQ4FVHxtsc88yZgaCYRiPJMl0g=,tag:coLUgQ4NZLd0DimJjq9JHw==,type:str] 223 223 unencrypted_suffix: _unencrypted 224 224 version: 3.13.1