add middlewares for nextcloud

applications/module.tf

@@ -61,6 +61,7 @@ variable "kubernetes" {
     liveness_tcp_socket    = optional(number)
     liveness_http_get      = optional(string)
     liveness_http_get_path = optional(string)
+    middlewares            = optional(string)
     database               = optional(map(string))
     database_command       = optional(list(string))
     database_args          = optional(list(string))
@@ -125,7 +126,7 @@ locals {
   ])
 }
 
-resource "kubernetes_manifest" "manifest" {
+resource "kubernetekubernetes_manifests_manifest" "manifest" {
   for_each = { for item in local.kubernetes_manifests : item.key => item }
 
   manifest = yamldecode(file(each.value.manifest))

applications/variables.auto.tfvars

@@ -584,14 +584,14 @@ kubernetes = {
 
 
   nextcloud = {
-    #enabled       = false
+    image          = "nextcloud:29.0.3-apache"
-    #namespace = "next"
+    domain_name    = ["nextcloud"]
-    #replicas      = 0
+    service_port   = [80]
-    image         = "nextcloud:29.0.3-apache"
+    secret_ref     = ["nextcloud-credentials"]
-    domain_name   = ["nextcloud"]
+    secret_import  = ["b207c4b6-0489-4ab2-a032-b4a400a708e0"]
-    service_port  = [80]
+    extra_manifest = ["../external_manifests/nextcloud/middlewares.yaml"]
-    secret_ref    = ["nextcloud-credentials"]
+    middlewares    = "kube-system-nextcloud-carddav-redirect@kubernetescrd,kube-system-nextcloud-caldav-redirect@kubernetescrd,kube-system-health-check-response@kubernetescrd"
-    secret_import = ["b207c4b6-0489-4ab2-a032-b4a400a708e0"]
+
     database = {
       image     = "docker.io/library/postgres:14"
       mountPath = "/var/lib/postgresql/data"

external_manifests/nextcloud/middlewares.yaml

@@ -0,0 +1,30 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-carddav-redirect
+  namespace: kube-system # Recommended to put global middlewares in kube-system or a shared ingress namespace
+spec:
+  redirectRegex:
+    regex: "^https://(.*)/\\.well-known/carddav"
+    replacement: "https://$1/remote.php/dav"
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-caldav-redirect
+  namespace: kube-system
+spec:
+  redirectRegex:
+    regex: "^https://(.*)/\\.well-known/caldav"
+    replacement: "https://$1/remote.php/dav"
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: health-check-response
+  namespace: kube-system
+spec:
+  customResponse:
+    status: 200

infrastructure/module.tf

@@ -62,6 +62,7 @@ variable "kubernetes" {
     liveness_tcp_socket    = optional(number)
     liveness_http_get      = optional(string)
     liveness_http_get_path = optional(string)
+    middlewares            = optional(string)
     database               = optional(map(string))
     database_command       = optional(list(string))
     database_args          = optional(list(string))

modules/ingress/ingress.tf

@@ -1,15 +1,16 @@
 variable "kubernetes_input" {
   type = map(object({
-    name   = optional(string)
+    name                = optional(string)
-    docker = optional(bool)
+    docker              = optional(bool)
-    namespace              = optional(string)
+    namespace           = optional(string)
-    connected_namespace    = optional(string, "")
+    connected_namespace = optional(string, "")
-    service_port           = optional(list(number))
+    service_port        = optional(list(number))
-    service_type           = optional(string, "ClusterIP")
+    service_type        = optional(string, "ClusterIP")
-    domain_name            = optional(list(string))
+    domain_name         = optional(list(string))
-    legacy_domain          = optional(bool, false)
+    middlewares         = optional(string)
-    exposed                = optional(bool, true)
+    legacy_domain       = optional(bool, false)
-    enabled                = optional(bool, true)
+    exposed             = optional(bool, true)
+    enabled             = optional(bool, true)
   }))
 
 }
@@ -23,10 +24,16 @@ resource "kubernetes_ingress_v1" "automatic_ingress" {
     name      = "${each.key}-ingress"
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
 
-    annotations = {
+    annotations = merge(
-      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+      {
-      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+        "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
-    }
+        "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+      },
+      # Simply injects the middleware string if it is present and not empty
+      lookup(each.value, "middlewares", "") != "" ? {
+        "traefik.ingress.kubernetes.io/router.middlewares" = each.value.middlewares
+      } : {}
+    )
   }
 
   spec {