chore(nextcloud): reconfigure for reverse proxy

[martinohmann]

No description provided.

[github-actions]

--- kubernetes/apps/default/nextcloud/app Kustomization: flux-system/nextcloud HelmRelease: default/nextcloud

+++ kubernetes/apps/default/nextcloud/app Kustomization: flux-system/nextcloud HelmRelease: default/nextcloud

@@ -44,24 +44,26 @@

       repository: public.ecr.aws/docker/library/nextcloud
       tag: 28.0.1-fpm-alpine
     ingress:
       annotations:
         hajimari.io/group: storage
         hajimari.io/icon: simple-icons:nextcloud
+        nginx.ingress.kubernetes.io/cors-allow-headers: X-Forwarded-For
+        nginx.ingress.kubernetes.io/enable-cors: 'true'
         nginx.ingress.kubernetes.io/server-snippet: |-
           server_tokens off;
           proxy_hide_header X-Powered-By;
           rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
           rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
           rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
           rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
           location = /.well-known/carddav {
-            return 301 https://$host/remote.php/dav;
+            return 301 $scheme://$host/remote.php/dav;
           }
           location = /.well-known/caldav {
-            return 301 https://$host/remote.php/dav;
+            return 301 $scheme://$host/remote.php/dav;
           }
           location = /robots.txt {
             allow all;
             log_not_found off;
             access_log off;
           }
@@ -91,27 +93,20 @@

       serviceMonitor:
         enabled: false
     nextcloud:
       configs:
         local.config.php: |-
           <?php
-          $CONFIG = [
-            'trusted_proxies' => [
+          $CONFIG = array(
+            'trusted_proxies' => array(
               '127.0.0.1',
-              '10.42.0.0/16',
-              '10.43.0.0/16',
-              '172.16.0.0/16',
-            ],
-            'overwritehost' => 'cloud.18b.haus',
-            'overwriteprotocol' => 'https',
-            'overwrite.cli.url' => 'https://cloud.18b.haus/',
-            'forwarded_for_headers' => ['HTTP_X_FORWARDED_FOR'],
-            'default_phone_region' => 'DE',
-            'trashbin_retention_obligation' => 'auto, 30',
+              '10.0.0.0/8',
+            ),
+            'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
             'auth.bruteforce.protection.enabled' => true,
-          ];
+          );
       existingSecret:
         enabled: true
         passwordKey: ADMIN_PASS
         secretName: nextcloud-secret
         tokenKey: TOKEN
         usernameKey: ADMIN_USER
@@ -164,12 +159,14 @@

     persistence:
       enabled: true
       existingClaim: nextcloud
       nextcloudData:
         enabled: true
         existingClaim: nextcloud-nfs
+    phpClientHttpsFix:
+      enabled: true
     readinessProbe:
       enabled: true
       failureThreshold: 3
       initialDelaySeconds: 5
       periodSeconds: 10
       successThreshold: 1

[github-actions]

--- HelmRelease: default/nextcloud ConfigMap: default/nextcloud-config

+++ HelmRelease: default/nextcloud ConfigMap: default/nextcloud-config

@@ -7,27 +7,20 @@

     app.kubernetes.io/name: nextcloud
     app.kubernetes.io/instance: nextcloud
     app.kubernetes.io/managed-by: Helm
 data:
   local.config.php: |-
     <?php
-    $CONFIG = [
-      'trusted_proxies' => [
+    $CONFIG = array(
+      'trusted_proxies' => array(
         '127.0.0.1',
-        '10.42.0.0/16',
-        '10.43.0.0/16',
-        '172.16.0.0/16',
-      ],
-      'overwritehost' => 'cloud.18b.haus',
-      'overwriteprotocol' => 'https',
-      'overwrite.cli.url' => 'https://cloud.18b.haus/',
-      'forwarded_for_headers' => ['HTTP_X_FORWARDED_FOR'],
-      'default_phone_region' => 'DE',
-      'trashbin_retention_obligation' => 'auto, 30',
+        '10.0.0.0/8',
+      ),
+      'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
       'auth.bruteforce.protection.enabled' => true,
-    ];
+    );
   .htaccess: |-
     # line below if for Apache 2.4
     <ifModule mod_authz_core.c>
     Require all denied
     </ifModule>
     # line below if for Apache 2.2
--- HelmRelease: default/nextcloud Deployment: default/nextcloud

+++ HelmRelease: default/nextcloud Deployment: default/nextcloud

@@ -24,21 +24,23 @@

       labels:
         app.kubernetes.io/name: nextcloud
         app.kubernetes.io/instance: nextcloud
         app.kubernetes.io/component: app
         nextcloud-redis-client: 'true'
       annotations:
-        nextcloud-config-hash: 1ea4d5cde3bd31538a8af7aaaa654f332ce841ca7bd5de466b7a62700cc992d5
+        nextcloud-config-hash: 09b21208995df5c41972f115167fde205b969ab2341a298e5eca492d7b7e7b7a
         php-config-hash: b42c4841da13ab0c6d450941f1d15997c7ee914e8f09152d25ac1af57d0ccc8c
         nginx-config-hash: 18dd8f905a93ed27f032e9ae68084222ed7e5926f7144cda17b979780f4da54b
     spec:
       containers:
       - name: nextcloud
         image: public.ecr.aws/docker/library/nextcloud:28.0.1-fpm-alpine
         imagePullPolicy: IfNotPresent
         env:
+        - name: OVERWRITEPROTOCOL
+          value: https
         - name: POSTGRES_HOST
           valueFrom:
             secretKeyRef:
               name: nextcloud-secret
               key: INIT_POSTGRES_HOST
         - name: POSTGRES_DB
@@ -220,12 +222,14 @@

       - name: nextcloud-cron
         image: public.ecr.aws/docker/library/nextcloud:28.0.1-fpm-alpine
         imagePullPolicy: IfNotPresent
         command:
         - /cron.sh
         env:
+        - name: OVERWRITEPROTOCOL
+          value: https
         - name: POSTGRES_HOST
           valueFrom:
             secretKeyRef:
               name: nextcloud-secret
               key: INIT_POSTGRES_HOST
         - name: POSTGRES_DB
--- HelmRelease: default/nextcloud Ingress: default/nextcloud

+++ HelmRelease: default/nextcloud Ingress: default/nextcloud

@@ -8,24 +8,26 @@

     app.kubernetes.io/instance: nextcloud
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: app
   annotations:
     hajimari.io/group: storage
     hajimari.io/icon: simple-icons:nextcloud
+    nginx.ingress.kubernetes.io/cors-allow-headers: X-Forwarded-For
+    nginx.ingress.kubernetes.io/enable-cors: 'true'
     nginx.ingress.kubernetes.io/server-snippet: |-
       server_tokens off;
       proxy_hide_header X-Powered-By;
       rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
       rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
       rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
       rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
       location = /.well-known/carddav {
-        return 301 https://$host/remote.php/dav;
+        return 301 $scheme://$host/remote.php/dav;
       }
       location = /.well-known/caldav {
-        return 301 https://$host/remote.php/dav;
+        return 301 $scheme://$host/remote.php/dav;
       }
       location = /robots.txt {
         allow all;
         log_not_found off;
         access_log off;
       }