No introduction found. Create it?
nextcloud from bjw-s-labs/charts is more popular with 20 repositories.
Install with:
helm repo add nextcloud https://nextcloud.github.io/helm/
helm install nextcloud nextcloud/nextcloud -f values.yamlSee examples from other people.
| Name | Repo | Stars | Version | Timestamp |
|---|---|---|---|---|
| nextcloud | angelnu/k8s-gitops | 178 | 9.4.1 | 5 days ago |
See the most popular values for this chart:
| Key | Types |
|---|---|
| boolean | |
nextcloud.host (12) nextcloud.${SECRET_DOMAIN} | string |
| boolean, string | |
nextcloud.existingSecret.secretName (8) nextcloud-secret | string |
nextcloud.existingSecret.passwordKey (5) nextcloud-password | string |
nextcloud.existingSecret.usernameKey (5) nextcloud-username | string |
| string | |
nextcloud.existingSecret.smtpPasswordKey (2) smtp_password | string |
nextcloud.existingSecret.smtpUsernameKey (2) smtp_username | string |
nextcloud.existingSecret.tokenKey (2) serverinfo_token | string |
nextcloud.extraEnv[].name (5) TRUSTED_PROXIES | string |
nextcloud.extraEnv[].value (4) ${NETWORK_K8S_CLUSTER_CIDR} | string |
nextcloud.extraEnv[].valueFrom.secretKeyRef.key (3) JWT_SECRET_KEY | string |
nextcloud.extraEnv[].valueFrom.secretKeyRef.name (3) nextcloud-whiteboard-secret | string |
nextcloud.configs."proxy.config.php" (4) <?php
$CONFIG = array (
'trusted_proxies' => array(
0 => '127.0.0.1',
1 => '10.0.0.0/8',
2 => '192.168.0.0/16',
),
'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
'allow_local_remote_servers' => true,
'overwriteprotocol' => 'https',
'overwrite.cli.url' => 'https://nextcloud.${SECRET_DOMAIN}',
'overwritehost' => 'nextcloud.${SECRET_DOMAIN}',
); ?> | string |
nextcloud.configs."bulkupload.config.php" (2) <?php
$CONFIG = array (
'bulkupload.enabled' => false,
); | string |
nextcloud.configs."custom.config.php" (2) <?php
$CONFIG = array (
'overwriteprotocol' => 'https',
'overwrite.cli.url' => 'https://nextcloud.${SECRET_DOMAIN}',
'filelocking.enabled' => 'true',
'loglevel' => '2',
'enable_previews' => true,
'trusted_domains' =>
[
'nextcloud',
'nextcloud.${SECRET_DOMAIN}'
]
); | string |
nextcloud.configs."gitops.config.php" (2) <?php
$CONFIG = array (
'appstoreenabled' => true,
#'appstoreurl' => 'https://apps.nextcloud.com/api/v0',
'mail_domain' => '${CLUSTER_DOMAIN}',
'default_phone_region' => 'DE',
# Single replica deployment - value is otherwise only meaningful for multi-server setups
'serverid' => 0,
); | string |
nextcloud.configs."local.config.php" (2) <?php
$CONFIG = array(
'trusted_proxies' => array(
'127.0.0.1',
'10.0.0.0/8',
),
'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
'default_phone_region' => 'DE',
'auth.bruteforce.protection.enabled' => true,
'maintenance_window_start' => 1,
'simpleSignUpLink.shown' => false,
); | string |
nextcloud.configs."https.config.php" (1) <?php
$CONFIG = array (
'overwriteprotocol' => 'https',
'overwritesubport' => false,
); | string |
nextcloud.configs."ingress.config.php" (1) <?php
$CONFIG = array (
'overwrite.cli.url' => 'https://nextcloud.${SECRET_DOMAIN}',
'overwriteprotocol' => 'https',
'allow_local_remote_servers' => true
); | string |
nextcloud.configs."log.php" (1) <?php
$CONFIG = array (
"log_type" => "file",
); | string |
nextcloud.configs."oidc.config.php" (1) <?php
$CONFIG = array (
'allow_local_remote_servers' => true,
'shareapi_restrict_user_enumeration_to_group' => true,
); | string |
nextcloud.configs."others.config.php" (1) <?php
$CONFIG = array (
'maintenance_window_start' => 1,
); | string |
nextcloud.configs."redis.config.php" (1) <?php
$CONFIG = array (
'memcache.local' => '\\OC\\Memcache\\Redis',
'memcache.distributed' => '\OC\Memcache\Redis',
'memcache.locking' => '\OC\Memcache\Redis',
'redis' => array(
'host' => getenv('REDIS_HOST'),
'port' => getenv('REDIS_HOST_PORT') ?: 6379,
'password' => getenv('REDIS_HOST_PASSWORD')
)
); | string |
nextcloud.configs."sso.config.php" (1) <?php
$CONFIG = array(
'allow_user_to_change_display_name' => false,
'lost_password_link' => 'disabled',
'oidc_login_client_id' => getenv('OIDC_CLIENT_ID'),
'oidc_login_client_secret' => getenv('OIDC_CLIENT_SECRET'),
'oidc_login_provider_url' => 'https://identity.18b.haus/application/o/nextcloud/',
'oidc_login_end_session_redirect' => true,
'oidc_login_logout_url' => 'https://identity.18b.haus/application/o/nextcloud/end-session/',
'oidc_login_hide_password_form' => true,
'oidc_login_disable_registration' => false,
'oidc_login_webdav_enabled' => true,
'oidc_login_attributes' => array(
'id' => 'sub',
'name' => 'name',
'mail' => 'email',
'groups' => 'nextcloud_groups',
'quota' => 'nextcloud_quota',
'is_admin' => 'nextcloud_admin',
),
'oidc_login_scope' => 'openid profile email nextcloud',
'oidc_login_default_group' => 'oidc',
'oidc_create_groups' => true,
'oidc_login_auto_redirect' => false, // bypass via /login?noredir=1
); | string |
nextcloud.configs."user_oidc.config.php" (1) <?php
$CONFIG = array (
'user_oidc' => [
'user_search_match_emails' => false,
],
); | string |
nextcloud.datadir (4) /var/www/data | string |
nextcloud.extraInitContainers[].image (4) ghcr.io/home-operations/postgres-init:18.6 | string |
| string | |
nextcloud.extraInitContainers[].envFrom[].secretRef.name (3) nextcloud-secret | string |
nextcloud.extraInitContainers[].command[] (2) - sh | string |
| string | |
nextcloud.extraInitContainers[].volumeMounts[].name (2) nextcloud-data | string |
| number | |
nextcloud.phpConfigs."uploadLimit.ini" (4) upload_max_filesize = 16G
post_max_size = 16G
max_input_time = 3600
max_execution_time = 3600
| string |
nextcloud.phpConfigs."override_max_file_size.ini" (2) upload_max_filesize=16G
post_max_size=16G | string |
nextcloud.phpConfigs."www.conf" (2) [www]
user = www-data
group = www-data
listen = 127.0.0.1:9000
pm = dynamic
pm.max_children = 57
pm.start_servers = 14
pm.min_spare_servers = 14
pm.max_spare_servers = 42
pm.max_requests = 500
pm.process_idle_timeout = 10s
| string |
nextcloud.phpConfigs."hardening.ini" (1) ; PHP2Shell (CVE-2026-109619): session.upload_progress writes upload
; filenames unsanitized into session files and is confirmed exploitable
; even on patched PHP. Hardly used and hardly tested - disable it
; (PHP recommends keeping it off even after patching).
session.upload_progress.enabled = 0
| string |
nextcloud.phpConfigs."opcache.ini" (1) opcache.memory_consumption = 256
| string |
| number | |
| boolean | |
| number | |
| boolean | |
nextcloud.securityContext.capabilities.add[] (1) - NET_BIND_SERVICE | string |
| string | |
| number | |
| boolean | |
| boolean | |
| boolean | |
| boolean | |
| boolean | |
| boolean | |
| boolean | |
nextcloud.extraVolumeMounts[].mountPath (3) /video | string |
nextcloud.extraVolumeMounts[].name (3) nfs-video | string |
nextcloud.extraVolumeMounts[].subPath (1) redis-session.ini | string |
nextcloud.extraVolumes[].name (3) nfs-video | string |
| string | |
| string | |
| string | |
nextcloud.extraVolumes[].nfs.path (1) ${NFS_VIDEO} | string |
nextcloud.extraVolumes[].nfs.server (1) ${NFS_SERVER} | string |
nextcloud.hooks.before-starting (3) #!/bin/bash
set -exu # Remove the -u if you encounter issues booting
cd /var/www/html
# NOTE (issue #10): no flock here. A flock on data/ (NFS) proved
# unreliable: the re-exec pattern looped forever, the pod never got
# Ready and the helm upgrade rolled back. The exec liveness probe
# detects hook activity via the hook script process (the
# before-[s]tarting pgrep clause), so no lock is needed.
# Upgrade
./occ upgrade || /bin/true
./occ maintenance:mode --off || /bin/true
./occ app:update --all || /bin/true
./occ db:add-missing-indices || /bin/true
./occ maintenance:repair --include-expensive || /bin/true
# SSO
# mapping-uid must be preferred_username, not sub: Authentik's sub
# claim for this provider resolves to the user's email, which does
# not match our existing (SAML-era) short usernames - using it
# caused user_oidc to silently create a brand-new duplicate account
# per user instead of matching their existing one.
test -d custom_apps/user_oidc || ./occ app:install user_oidc
./occ user_oidc:provider sso \
--clientid="${NEXTCLOUD_OIDC_CLIENT_ID}" \
--clientsecret="${NEXTCLOUD_OIDC_CLIENT_SECRET}" \
--discoveryuri="${NEXTCLOUD_OIDC_URL}" \
--unique-uid=0 \
--group-provisioning=1 \
--group-whitelist-regex='${NEXTCLOUD_OIDC_GROUPS_WHITELISTED_REGEX}' \
--group-restrict-login-to-whitelist=1 \
--mapping-uid=preferred_username \
--mapping-email=email \
--mapping-display-name=name \
--mapping-groups=groups \
--mapping-quota=quota
./occ config:app:set --value=0 user_oidc allow_multiple_user_backends # Only login with SSO
# notify_push
test -d custom_apps/notify_push || ./occ app:install notify_push
./occ notify_push:setup https://${NEXTCLOUD_OVERRIDE_HOST}/push || echo "Could not setup notify_push"
# collabora
test -d custom_apps/richdocuments || ./occ app:install richdocuments
./occ config:app:set richdocuments wopi_url --value https://${COLLABORA_HOST}
./occ richdocuments:activate-config
# whiteboard
test -d custom_apps/whiteboard || ./occ app:install whiteboard
./occ config:app:set whiteboard collabBackendUrl --value "https://${WHITEBOARD_HOST}"
./occ config:app:set whiteboard jwt_secret_key --value "$WHITEBOARD_JWT_SECRET_KEY"
# # integration_openai
# test -d custom_apps/integration_openai || ./occ app:install integration_openai
# ./occ config:app:set integration_openai service_name --value "kvant"
# ./occ config:app:set integration_openai url --value "${KVANT_LLM_URL}"
# ./occ config:app:set integration_openai api_key --value "${KVANT_LLM_APIKEY}"
# ./occ config:app:set integration_openai chunk_size --value 100000
# Other installed apps
APPS=(
announcementcenter
assistant
bookmarks
calendar
call_summary_bot
context_chat
deck # Kanban for small projects
drawio
# extract # Error installing
# files_archive # PHP with a version lower than 8.4 is required.
# files_markdown # Not updated
files_mindmap
# files_rightclick # cannot be installed because it is not compatible with this version of the server.
forms
groupfolders
impersonate
integration_github
integration_jira
integration_mastodon
integration_paperless
mail
notes
spreed # Talk
)
for app in ${APPS[@]}; do
test -d custom_apps/$app || ./occ app:install $app
done
# Theme
./occ theming:config name "Casa Nextcloud"
./occ theming:config url "${NEXTCLOUD_OVERRIDE_HOST}"
# ./occ theming:config imprintUrl "https://kvant.cloud/en/terms"
# ./occ theming:config privacyUrl "https://kvant.cloud/en/privacy-policy"
# ./occ theming:config slogan "The Swiss Sovereign Cloud: Your Data, Our Territory"
# ./occ theming:config primary_color "#8FEAFF"
# ./occ theming:config disable-user-theming --reset
# ./occ theming:config background "/themeFiles/background.png"
# ./occ theming:config logo "/themeFiles/kvant_logo.png"
# ./occ theming:config logoheader "/themeFiles/kvant_logo.png"
./occ theming:config favicon --reset
# start a task worker
nohup ./occ background-job:worker 'OC\TaskProcessing\SynchronousBackgroundJob' &
# talk (High-performance backend - signaling only, no TURN yet)
./occ talk:signaling:delete "wss://${TALK_HOST}" || /bin/true
./occ talk:signaling:add --verify -- "wss://${TALK_HOST}" "$TALK_SIGNALING_SECRET"
# ./occ talk:turn:delete turn nextcloud-talk-turn.${NEXTCLOUD_OVERRIDE_HOST} udp,tcp
# ./occ talk:turn:add --secret ${TURN_SECRET} turn nextcloud-talk-turn.${NEXTCLOUD_OVERRIDE_HOST} udp,tcp
| string |
nextcloud.hooks.post-upgrade (3) # based on https://github.com/nextcloud/all-in-one/blob/25c580bca370eaead5f1fad9d3842a9c49562dff/Containers/nextcloud/entrypoint.sh#L451-L457
php occ maintenance:repair --include-expensive
php occ db:add-missing-indices
php occ db:add-missing-columns
php occ db:add-missing-primary-keys | string |
nextcloud.hooks.post-installation (2) printf "Add missing DB indices\n"
php occ db:add-missing-indices | string |
nextcloud.mail.domain (3) ${CLUSTER_DOMAIN} | string |
| boolean | |
nextcloud.mail.fromAddress (3) nextcloud | string |
nextcloud.mail.smtp.port (2) ${CLUSTER_MAIL_SERVER_PORT} | string, number |
nextcloud.mail.smtp.host (1) ${CLUSTER_MAIL_SERVER} | string |
| string | |
nextcloud.strategy.type (2) RollingUpdate | string |
| number | |
| number | |
nextcloud.password (1) ${NEXTCLOUD_ADMIN_PASSWORD} | string |
| number | |
nextcloud.podSecurityContext.sysctls[].name (1) net.ipv4.ip_unprivileged_port_start | string |
| string | |
nextcloud.trustedDomains[] (1) - ${NEXTCLOUD_OVERRIDE_HOST} | string |
nextcloud.username (1) ${NEXTCLOUD_ADMIN_USERNAME} | string |
| boolean | |
| boolean | |
persistence.nextcloudData.existingClaim (6) nextcloud-data | string |
| string | |
persistence.nextcloudData.accessMode (1) ReadWriteOnce | string |
| string | |
persistence.existingClaim (7) nextcloud | string |
| string | |
persistence.accessMode (2) ReadWriteOnce | string |
persistence.storageClass (2) ceph-block | string |
| boolean | |
externalDatabase.type (8) postgresql | string |
| boolean, string | |
| string | |
externalDatabase.existingSecret.secretName (7) nextcloud-secret | string |
| string | |
| string | |
| string | |
externalDatabase.database (5) nextcloud | string |
externalDatabase.host (4) dev-postgres16-rw.database.svc.cluster.local. | string |
externalDatabase.user (2) nextcloud | string |
externalDatabase.password (1) ${NEXTCLOUD_DBPASS} | string |
image.tag (9) 9.1.2@sha256:418652cfb58ef879d4978c33553735d7147016032d5aefaa14c828e611eb9dfd | string |
image.flavor (5) fpm-alpine | string |
image.repository (5) nextcloud | string |
image.pullPolicy (3) IfNotPresent | string |
image.registry (1) public.ecr.aws | string |
| boolean | |
ingress.className (5) traefik | string |
| string | |
ingress.annotations."nginx.ingress.kubernetes.io/server-snippet" (3) server_tokens off;
proxy_hide_header X-Powered-By;
# Nextcloud's own JSON 404 responses (e.g. .well-known/webfinger) must pass
# through untouched - the cluster-wide custom error page (error_page +
# proxy_intercept_errors, set globally in the ingress-nginx http block)
# strips headers our own admin setup checks rely on (X-NEXTCLOUD-WELL-KNOWN).
# The disable-proxy-intercept-errors annotation does NOT achieve this on
# its own - it only emits an override when this location also carries its
# own custom-http-errors annotation, so we set the directive directly.
proxy_intercept_errors off;
rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last;
rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last;
rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
deny all;
} | string |
ingress.annotations."cert-manager.io/cluster-issuer" (2) letsencrypt-prod | string |
ingress.annotations."hajimari.io/icon" (2) simple-icons:nextcloud | string |
ingress.annotations."external-dns.alpha.kubernetes.io/target" (1) external.${SECRET_DOMAIN} | string |
| string | |
| string | |
ingress.annotations."gethomepage.dev/icon" (1) sh-nextcloud | string |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
| string | |
ingress.pathType (4) Prefix | string |
ingress.tls[].hosts[] (2) - nextcloud.samholton.com | string |
ingress.tls[].secretName (2) nextcloud-tls | string |
ingress.main.annotations."cert-manager.io/cluster-issuer" (1) letsencrypt-production | string |
| string | |
ingress.main.annotations."external-dns.alpha.kubernetes.io/target" (1) ipv4.${SECRET_DOMAIN} | string |
| string | |
ingress.main.annotations."traefik.ingress.kubernetes.io/router.middlewares" (1) networking-cloudflare-only@kubernetescrd | string |
| boolean | |
ingress.main.hosts[].host (1) nextcloud.${SECRET_DOMAIN} | string |
| string | |
| string | |
| string | |
ingress.main.tls[].hosts[] (1) - nextcloud.${SECRET_DOMAIN} | string |
ingress.main.tls[].secretName (1) nextcloud-tls | string |
ingress."nginx.ingress.kubernetes.io/server-snippet" (1) server_tokens off;
proxy_hide_header X-Powered-By;
rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav;
}
location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
deny all;
} | string |
| boolean | |
| number | |
| number | |
| boolean | |
cronjob.schedule (2) */5 * * * * | string |
| boolean | |
| number | |
cronjob.cronjob.schedule (1) */5 * * * * | string |
| boolean | |
| number | |
| boolean | |
| number | |
| number | |
| string | |
| string | |
| string | |
| number | |
| string | |
| string | |
| string | |
| number | |
cronjob.type (1) cronjob | string |
| boolean | |
| boolean | |
redis.auth.existingSecret (2) nextcloud-helm-values | string |
redis.auth.existingSecretPasswordKey (2) REDIS_PASSWORD | string |
redis.architecture (2) standalone | string |
| boolean | |
| string | |
| string | |
| number | |
| number | |
| number | |
| number | |
| number | |
| number | |
| boolean | |
| number | |
| number | |
| number | |
| number | |
| number | |
| number | |
redis.password (1) redis-password | string |
| boolean | |
| boolean | |
| number | |
| number | |
| number | |
| number | |
| number | |
| boolean | |
| number | |
| number | |
| number | |
| number | |
| number | |
| boolean | |
| number | |
| number | |
| number | |
| number | |
| number | |
| boolean | |
| string | |
| string | |
| string | |
| string | |
| boolean | |
nginx.image.repository (1) public.ecr.aws/nginx/nginx | string |
| number | |
| string | |
| number, string | |
| string | |
| string | |
| boolean | |
| string | |
| boolean | |
| boolean | |
| boolean | |
| number | |
auth.aclUsers.default.passwordKey (2) redis-password | string |
auth.aclUsers.default.permissions (2) ~* &* +@all | string |
auth.enabled (2) true | boolean |
auth.usersExistingSecret (2) nextcloud-secrets | string |
| boolean | |
| number | |
| number | |
| number | |
collabora.collabora.extra_params (2) --o:ssl.termination=true --o:ssl.enable=false --o:logging.disable_server_audit=true --o:security.mount_jail_tree=false | string |
collabora.collabora.aliasgroups[].aliases[] (1) - https://cloud.${SECRET_DOMAIN} | string |
collabora.collabora.aliasgroups[].host (1) http://nextcloud.default.svc.cluster.local:8080 | string |
collabora.collabora.env[].name (1) dictionaries | string |
collabora.collabora.env[].value (1) en_US en_GB pl_PL | string |
| boolean | |
collabora.collabora.existingSecret.passwordKey (1) COLLABORA_PASSWORD | string |
collabora.collabora.existingSecret.secretName (1) nextcloud-secret | string |
collabora.collabora.existingSecret.usernameKey (1) COLLABORA_USERNAME | string |
collabora.collabora.server_name (1) collabora.${SECRET_DOMAIN} | string |
| boolean | |
| string | |
| string | |
| boolean | |
collabora.ingress.hosts[].host (1) ${COLLABORA_HOST} | string |
| string | |
collabora.ingress.hosts[].paths[].pathType (1) ImplementationSpecific | string |
collabora.ingress.tls[].hosts[] (1) - ${COLLABORA_HOST} | string |
| boolean | |
| string | |
| string | |
| string | |
| string | |
| boolean | |
| string | |
| boolean | |
| number | |
| boolean | |
| number | |
collabora.securityContext.seccompProfile.localhostProfile (1) cool-seccomp-profile.json | string |
| string | |
| boolean | |
| boolean | |
| string | |
deploymentAnnotations."secret.reloader.stakater.com/reload" (1) nextcloud,nextcloud-init-db | string |
fullnameOverride (2) nextcloud-redis | string |
| boolean | |
mariadb.db.name (1) nextcloud | string |
mariadb.db.password (1) db-password | string |
mariadb.db.user (1) nextcloud | string |
mariadb.master.persistence.accessMode (1) ReadWriteOnce | string |
| boolean | |
| string | |
| boolean | |
| boolean | |
mariadb.rootUser.password (1) root-db-password | string |
| boolean | |
postgresql.existingSecret (1) nextcloud | string |
postgresql.postgresqlDatabase (1) nextcloud | string |
postgresql.postgresqlUsername (1) nextcloud | string |
| boolean | |
postgresql.primary.persistence.existingClaim (1) nextcloud-postgres | string |
postgresql.secretKeys.adminPasswordKey (1) postgresql_password | string |
| string | |
| number | |
| string | |
| string | |
| string | |
env.TZ (1) ${TIMEZONE} | string |
| number | |
hpa.enabled (1) true | boolean |
| number | |
podAnnotations."configmap.reloader.stakater.com/reload" (1) nextcloud-settings | string |
| string | |
rbac.enabled (1) true | boolean |
| boolean | |
rbac.serviceaccount.name (1) nextcloud | string |
securityContext.fsGroupChangePolicy (1) OnRootMismatch | string |