From 4191a5a1c9ac3ae8cb1565be219266190f18466f Mon Sep 17 00:00:00 2001 From: "pierre.geeraert" Date: Wed, 14 Oct 2026 14:49:09 +0100 Subject: [PATCH] add middlewares for nextcloud --- applications/module.tf | 3 +- applications/variables.auto.tfvars | 16 ++++----- external_manifests/nextcloud/middlewares.yaml | 30 ++++++++++++++++ infrastructure/module.tf | 1 + modules/ingress/ingress.tf | 35 +++++++++++-------- 5 files changed, 62 insertions(+), 23 deletions(-) create mode 100644 external_manifests/nextcloud/middlewares.yaml diff --git a/applications/module.tf b/applications/module.tf index 6c53b0c..d29fcbd 100644 --- a/applications/module.tf +++ b/applications/module.tf @@ -61,6 +61,7 @@ variable "kubernetes" { liveness_tcp_socket = optional(number) liveness_http_get = optional(string) liveness_http_get_path = optional(string) + middlewares = optional(string) database = optional(map(string)) database_command = optional(list(string)) database_args = optional(list(string)) @@ -125,7 +126,7 @@ locals { ]) } -resource "kubernetes_manifest" "manifest" { +resource "kubernetekubernetes_manifests_manifest" "manifest" { for_each = { for item in local.kubernetes_manifests : item.key => item } manifest = yamldecode(file(each.value.manifest)) diff --git a/applications/variables.auto.tfvars b/applications/variables.auto.tfvars index defdb8f..bcfe192 100644 --- a/applications/variables.auto.tfvars +++ b/applications/variables.auto.tfvars @@ -584,14 +584,14 @@ kubernetes = { nextcloud = { - #enabled = false - #namespace = "next" - #replicas = 0 - image = "nextcloud:29.0.3-apache" - domain_name = ["nextcloud"] - service_port = [80] - secret_ref = ["nextcloud-credentials"] - secret_import = ["b207c4b6-0489-4ab2-a032-b4a400a708e0"] + image = "nextcloud:29.0.3-apache" + domain_name = ["nextcloud"] + service_port = [80] + secret_ref = ["nextcloud-credentials"] + secret_import = ["b207c4b6-0489-4ab2-a032-b4a400a708e0"] + extra_manifest = ["../external_manifests/nextcloud/middlewares.yaml"] + middlewares = "kube-system-nextcloud-carddav-redirect@kubernetescrd,kube-system-nextcloud-caldav-redirect@kubernetescrd,kube-system-health-check-response@kubernetescrd" + database = { image = "docker.io/library/postgres:14" mountPath = "/var/lib/postgresql/data" diff --git a/external_manifests/nextcloud/middlewares.yaml b/external_manifests/nextcloud/middlewares.yaml new file mode 100644 index 0000000..860d87f --- /dev/null +++ b/external_manifests/nextcloud/middlewares.yaml @@ -0,0 +1,30 @@ +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: nextcloud-carddav-redirect + namespace: kube-system # Recommended to put global middlewares in kube-system or a shared ingress namespace +spec: + redirectRegex: + regex: "^https://(.*)/\\.well-known/carddav" + replacement: "https://$1/remote.php/dav" + permanent: true +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: nextcloud-caldav-redirect + namespace: kube-system +spec: + redirectRegex: + regex: "^https://(.*)/\\.well-known/caldav" + replacement: "https://$1/remote.php/dav" + permanent: true +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: health-check-response + namespace: kube-system +spec: + customResponse: + status: 200 diff --git a/infrastructure/module.tf b/infrastructure/module.tf index 2636d76..83bd9a2 100644 --- a/infrastructure/module.tf +++ b/infrastructure/module.tf @@ -62,6 +62,7 @@ variable "kubernetes" { liveness_tcp_socket = optional(number) liveness_http_get = optional(string) liveness_http_get_path = optional(string) + middlewares = optional(string) database = optional(map(string)) database_command = optional(list(string)) database_args = optional(list(string)) diff --git a/modules/ingress/ingress.tf b/modules/ingress/ingress.tf index 834c140..66a7143 100644 --- a/modules/ingress/ingress.tf +++ b/modules/ingress/ingress.tf @@ -1,15 +1,16 @@ variable "kubernetes_input" { type = map(object({ - name = optional(string) - docker = optional(bool) - namespace = optional(string) - connected_namespace = optional(string, "") - service_port = optional(list(number)) - service_type = optional(string, "ClusterIP") - domain_name = optional(list(string)) - legacy_domain = optional(bool, false) - exposed = optional(bool, true) - enabled = optional(bool, true) + name = optional(string) + docker = optional(bool) + namespace = optional(string) + connected_namespace = optional(string, "") + service_port = optional(list(number)) + service_type = optional(string, "ClusterIP") + domain_name = optional(list(string)) + middlewares = optional(string) + legacy_domain = optional(bool, false) + exposed = optional(bool, true) + enabled = optional(bool, true) })) } @@ -23,10 +24,16 @@ resource "kubernetes_ingress_v1" "automatic_ingress" { name = "${each.key}-ingress" namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - annotations = { - "cert-manager.io/cluster-issuer" = "letsencrypt-prod" - "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure" - } + annotations = merge( + { + "cert-manager.io/cluster-issuer" = "letsencrypt-prod" + "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure" + }, + # Simply injects the middleware string if it is present and not empty + lookup(each.value, "middlewares", "") != "" ? { + "traefik.ingress.kubernetes.io/router.middlewares" = each.value.middlewares + } : {} + ) } spec {