nextcloud changelog¶
0.8.0¶
Released 2026-10-25.
Changes¶
Nextcloud 34.0.5¶
The chart runs Nextcloud 34.0.5 (image 34.0.5-apache, pinned by digest).
Nextcloud upgrades one major version at a time: this release moves
instances from 33 to 34, and the next major (35) follows in a later
chart release.
Store apps are updated after an upgrade¶
A major upgrade disables store apps that have no release for the new version. With settings.repairOnUpgrade (on by default), the setup step that runs once per Nextcloud version now updates all store apps first, so OnlyOffice, Talk, the whiteboard, user_oidc and the other apps the chart enables come back on their compatible release.
Upgrade¶
The first start after the upgrade runs the database migration
(occ upgrade) with Nextcloud in maintenance mode; it takes a few
minutes on a small instance. Take a backup first. An instance on
Nextcloud 33 must take this release before 0.9.0.
0.7.0¶
Released 2026-10-25.
Changes¶
Login with OpenID Connect¶
The chart sets up the app user_oidc once oidc.discoveryUri and oidc.clientId are given (oidc.enabled is true by default). Users log in with the provider, local logins keep working, and groups from the groups claim are created and kept in step. oidc.groupsRegex limits the login to users with a matching group; a group admin in the claim makes the user an administrator. With oidc.bearer, API and WebDAV calls with a Bearer token of the provider are accepted and create the user on the first call, which lets agents use Nextcloud with their own token.
The client secret is secrets.oidcClientSecret, or the vault item nextcloud-oidc-client with secrets.type externalSecret.
Upgrade¶
Nothing changes until oidc.discoveryUri and oidc.clientId are set.
0.6.0¶
Released 2026-10-24.
Changes¶
nextcloud 0.6.0 splits the credentials Secret (#40)¶
nextcloud-credentials held the administrator, the database user, the database root password and an SMTP host nobody read. It is now three Secrets with the keys username and password: nextcloud-admin, nextcloud-mariadb and nextcloud-mariadb-root. The MariaDB database reads only its own two, so it can run without Nextcloud, and the admin Secret matches the default keys of a vault copy.
An upgrade keeps every password: the Secrets are seeded from the former nextcloud-credentials. MariaDB refuses a change of rootPasswordSecretKeyRef, so a release from 0.5 or older keeps its root password in nextcloud-credentials; helm detects that from the live MariaDB object, Argo CD needs database.legacyRootSecret=true.
The dead smtp.host value is removed. With the generator, each Secret has its own ExternalSecret and Password generator.
Tested as a tenant on berry-compute: 0.5.0 upgraded to this version with unchanged password hashes, database and admin login; a fresh install with the generator wrote each Secret once.
0.5.0¶
Released 2026-10-24.
Changes¶
nextcloud 0.5.0 generates passwords with ESO (#39)¶
With secrets.generator.enabled the External Secrets Operator owns the Secret nextcloud-credentials and generates each empty administrator and database password once (Password generator, refreshPolicy CreatedOnce, immutable target). Argo CD renders without cluster access, so the lookup-based generation could not keep a password there; a caller no longer has to pass the passwords as values.
Labels and annotations of the generated Secret are a value, so a platform can mark it, for example to copy the login to a vault. The default stays off and renders the same objects as 0.4.11.
0.4.11¶
Released 2026-10-21.
Changes¶
nextcloud 0.4.11 pins the PHP 8.4.27 image (#28)¶
Docker Hub rebuilt nextcloud:33.0.10-apache on PHP 8.4.27, which fixes php2shell (CVE-2026-109618, CVE-2026-109619). Pin that build by digest so every node runs the fixed image, whatever it cached for the tag.
0.4.10¶
Released 2026-10-21.
Changes¶
nextcloud 0.4.10 runs Nextcloud 33.0.10 (#27)¶
Nextcloud 33.0.8-apache is a frozen tag and never receives the PHP fix for CVE-2026-109618 and CVE-2026-109619 (php2shell). Move to the maintained 33.0.10-apache tag, built on PHP 8.4.27 or later.
0.4.9¶
Released 2026-10-13.
Changes¶
Write chart labels as literals (#7)¶
Every chart built its labels through a helper that took a dict and
returned all five labels, so a reader had to open the helper to learn
what an object is called. app, app.kubernetes.io/name and
app.kubernetes.io/component are now literal lines on each object. One
helper per chart,
The nextcloud topology table is gone as well: the console keys (runtime, vcs-uri, connects-to, custom-icon) are literal lines on the workloads.
A value stays an expression where it must follow a name that is one: the fullname in mkdocs, omniroute and mailu, the upstream name override in mailu, and the loop and helper arguments in nextcloud.
No selector, pod template or value changes. The rendered objects are the same as before.
The contributor rules still asked for one helper that emits all five
labels. They now state what the charts do: three literal labels on
each object,
ci/check_labels.py reads the rendered objects, not the helper, so it needs no change.
The templates of every chart changed, and a change to a chart raises its version. The rendered objects are the same, so this is a patch.
nextcloud keeps bundling mailu 0.1.5: the dependency is resolved from the published repository, and 0.1.6 renders the same objects.
0.4.8¶
Released 2026-10-11.
Changes¶
Let the gate pass on a clean clone¶
The check job failed on main: helm could not build the dependencies of mailu and nextcloud, because it builds only from repositories added by name, and the lock file of nextcloud named mailu 0.1.0 while Chart.yaml asks for 0.1.4. The gate now adds the repositories a chart names, and the lock file matches Chart.yaml again.
Bundle the labelled mailu in nextcloud¶
mailu 0.1.5 carries the app labels on its objects. nextcloud still bundled 0.1.4, so the mail server inside a nextcloud release stayed unlabelled. The render with the new dependency differs from the old one in labels and annotations only.
0.4.7¶
Released 2026-10-11.
Changes¶
Label every chart object¶
Every object a chart renders from its own templates now carries app and the app.kubernetes.io labels name, component, part-of and version, so the console and label queries can tell which application and which component an object belongs to. Each chart gets one small helper that emits them.
Workloads and the database and cache resources also get a runtime icon, the upstream source address and, where a component depends on another, a connects-to arrow for the topology view.
The labels sit on the object's own metadata only. Pod templates and selectors are unchanged, so an upgrade restarts no pod. Three charts hash a rendered file into a pod annotation (n8n, odoo, vaultwarden): that hash is taken without the new labels and keeps its value.
Objects of the upstream subcharts are labelled where the upstream chart has a value that reaches object metadata only: the workload of bifrost, the objects of mailu except its Redis subchart, and the workload, volumes and imaginary Service of nextcloud.
All ten charts move up one patch version.
0.4.6¶
Released 2026-10-09.
Changes¶
Write external-dns annotations under both prefixes¶
external-dns v0.23 reads external-dns.kubernetes.io/ instead of external-dns.alpha.kubernetes.io/. The public Services carry the hostname and ttl annotations under both, so their records follow with either version.
0.4.5¶
Released 2026-10-08.
Changes¶
Let cert-manager make the DKIM key of the mail server¶
The platform publishes the DKIM record from the Secret that holds the key. The DNSEndpoint no longer asks for an MX record: the platform's DNS provider cannot write one. TXT values carry their quotes, the form in which the provider stores them.
0.4.4¶
Released 2026-10-08.
Changes¶
Add DNS records and address sharing to mailu and nextcloud¶
0.4.3¶
Released 2026-10-07.
Changes¶
Reword the GitLab SSH note and use a coloured Nextcloud icon¶
Group nextcloud workloads in the console topology view¶
0.4.2¶
Released 2026-10-07.
Changes¶
Name GRN.CLOUD B.V. as chart provider¶
0.4.1¶
Released 2026-10-05.
Changes¶
Keep the nextcloud setup script from blocking the start¶
On one upgrade the script waited forever for an exclusive lock on config.php that nothing visible held, the startup probe killed the container, and Nextcloud stayed down. Version 0.4.1 runs every step under a timeout and a total budget and skips what fails, tests the lock before the first write and gives the file a new inode when it cannot be locked, and starts cron only once Nextcloud serves.
0.4.0¶
Released 2026-10-05.
Changes¶
Add AI, OnlyOffice setup and public TURN to nextcloud¶
Version 0.4.0 connects OnlyOffice by itself, adds the AI integration against an OpenAI-compatible endpoint, lets the TURN server take a public address from a load balancer and advertise it by resolving its own name, and opens that port in the project's network policy.
The setup script now sets the whiteboard secret in the form the app accepts, Apache sends the HSTS header, and the maintenance window and mimetype repair are applied, so the setup checks pass. Secrets are no longer written to the pod log.
0.3.2¶
Released 2026-10-05.
Changes¶
Keep a scheduled backup out of Argo CD health¶
Argo CD rates a MariaDB Backup that waits for its schedule as Progressing, so a managed Nextcloud with backup never became Healthy before the first nightly run.
0.3.1¶
Released 2026-10-05.
Changes¶
Claim a given backup bucket name in nextcloud¶
The bucket of the database backup was read back from the claim, which a renderer without cluster access cannot do, so Argo CD never created the Backup. With backup.s3.bucket set the claim now asks for that name.
0.3.0¶
Released 2026-10-05.
Changes¶
Add Talk, push, whiteboard, monitoring and backup to nextcloud¶
Version 0.3.0 carries the rest of what the platform's own Nextcloud runs: Redis, notify-push and the whiteboard (on by default), Talk with signaling, TURN and recording, the task worker, exporters with alert rules, and a scheduled database backup to a bucket claim (off by default). Every secret is generated once; nothing asks for a public address unless the TURN Service is set to LoadBalancer.
0.2.0¶
Released 2026-10-04.
Changes¶
Use Routes in the nextcloud chart¶
Argo CD waits for the load-balancer status of an Ingress, which the router never sets, so a managed Nextcloud stayed Progressing for good. Version 0.2.0 templates two Routes with cert-manager annotations instead.
0.1.0¶
Released 2026-10-04.
Changes¶
Add nextcloud chart¶
Nextcloud on the upstream chart with a MariaDB custom resource and an OnlyOffice document server, as a tenant installs it: no SCC binding, the containers that need root ask for UID 0, OnlyOffice without the MKNOD capability, secrets generated once, own Ingress for both hostnames. Depends on the mailu chart, on by default.
Talk, the whiteboard, notify-push, the task worker, monitoring and backup of the private chart are not part of this first version.