nextcloud values¶
Every value of chart nextcloud 0.8.0, read from values.yaml and values.schema.json. A map is listed with its keys; a map without a description of its own is listed by its keys only. Every value has a default: the chart installs with none given.
| Value | Type | Default | Description |
|---|---|---|---|
route.annotations.cert-manager.io/issuer-kind |
string | ClusterIssuer |
certificate of both hostnames, issued by cert-manager |
route.annotations.cert-manager.io/issuer-name |
string | letsencrypt |
|
route.annotations.haproxy.router.openshift.io/timeout |
string | 3600s |
large uploads and long document sessions |
settings |
object | Settings the setup script applies at every start of Nextcloud | |
settings.maintenanceWindowStart |
integer or string | 1 |
hour (UTC) at which the heavy daily jobs start; empty: not set |
settings.defaultPhoneRegion |
string | "" |
country code for phone numbers without one, such as NL; empty: not set |
settings.repairOnUpgrade |
boolean | true |
once per version: app updates, missing database indices and expensive repair steps |
settings.setupTimeout |
integer | 300 |
seconds the setup script may take; the steps left over wait for a restart |
hsts |
object | Strict-Transport-Security header of Nextcloud and of every Route | |
hsts.enabled |
boolean | true |
|
hsts.header |
string | max-age=31536000;includeSubDomains;preload |
|
secrets.type |
string | kubernetes |
kubernetes: Secrets from the values below. externalSecret: a secret store One of: kubernetes, externalSecret. |
secrets.generator |
object | with type kubernetes: External Secrets Operator makes nextcloud-admin, nextcloud-mariadb and nextcloud-mariadb-root and generates each empty password once | |
secrets.generator.enabled |
boolean | false |
Needs the External Secrets Operator |
secrets.generator.secretTemplate |
object | labels and annotations of the generated Secret nextcloud-admin | |
secrets.generator.secretTemplate.labels |
object | {} |
|
secrets.generator.secretTemplate.annotations |
object | {} |
|
secrets.adminUsername |
string | admin |
|
secrets.adminPassword |
string | "" |
password of the first administrator; empty: generated |
secrets.mariadbPassword |
string | "" |
machine-to-machine secrets; empty: generated once and kept on upgrade |
secrets.mariadbRootPassword |
string | "" |
|
secrets.onlyofficeJwtSecret |
string | "" |
|
secrets.redisPassword |
string | "" |
letters and digits only: the values are used inside URLs and config files |
secrets.whiteboardJwtSecret |
string | "" |
|
secrets.metricsToken |
string | "" |
|
secrets.signalingSecret |
string | "" |
|
secrets.signalingInternalSecret |
string | "" |
|
secrets.signalingHashKey |
string | "" |
32 or 64 characters |
secrets.signalingBlockKey |
string | "" |
16, 24 or 32 characters |
secrets.recordingSecret |
string | "" |
|
secrets.turnSecret |
string | "" |
|
secrets.aiApiKey |
string | "" |
key of the AI endpoint; never generated, required when ai.enabled |
secrets.oidcClientSecret |
string | "" |
secret of the OpenID Connect client; never generated, required when oidc.enabled |
secrets.externalSecret.storeKind |
string | ClusterSecretStore |
|
secrets.externalSecret.storeName |
string | "" |
|
secrets.externalSecret.refreshInterval |
string | 1h |
|
secrets.externalSecret.items |
object | vault item per key; the value is read from the item's password | |
secrets.externalSecret.items.nextcloud-password |
string | nextcloud-admin |
|
secrets.externalSecret.items.mariadb-password |
string | nextcloud-mariadb |
|
secrets.externalSecret.items.mariadb-root-password |
string | nextcloud-mariadb-root |
|
secrets.externalSecret.items.jwt-secret |
string | nextcloud-onlyoffice-jwt |
|
secrets.externalSecret.items.redis-password |
string | nextcloud-redis |
|
secrets.externalSecret.items.whiteboard-jwt-secret |
string | nextcloud-whiteboard-jwt |
|
secrets.externalSecret.items.metrics-token |
string | nextcloud-metrics-token |
|
secrets.externalSecret.items.signaling-secret |
string | nextcloud-signaling |
|
secrets.externalSecret.items.signaling-internal-secret |
string | nextcloud-signaling-internal |
|
secrets.externalSecret.items.signaling-hashkey |
string | nextcloud-signaling-hashkey |
|
secrets.externalSecret.items.signaling-blockkey |
string | nextcloud-signaling-blockkey |
|
secrets.externalSecret.items.recording-secret |
string | nextcloud-talk-recording |
|
secrets.externalSecret.items.turn-secret |
string | nextcloud-turn |
|
secrets.externalSecret.items.ai-api-key |
string | nextcloud-ai |
|
secrets.externalSecret.items.oidc-client-secret |
string | nextcloud-oidc-client |
|
database.enabled |
boolean | true |
|
database.legacyRootSecret |
boolean | false |
true for a release installed before 0.6: MariaDB cannot change its root password Secret, so the root password stays in nextcloud-credentials. helm detects it itself |
database.image |
string | docker.io/mariadb:11.4.10 |
|
database.replicas |
integer | 1 |
|
database.metrics.enabled |
boolean | false |
|
database.storage.size |
string | 5Gi |
|
database.storage.storageClassName |
string | "" |
empty: the default StorageClass of the cluster |
database.resources.requests.cpu |
string | 100m |
|
database.resources.requests.memory |
string | 256Mi |
|
database.resources.limits.cpu |
string | 1 |
|
database.resources.limits.memory |
string | 1Gi |
|
onlyoffice.enabled |
boolean | true |
|
onlyoffice.host |
string | "" |
empty: office-<hostname of Nextcloud> |
onlyoffice.image |
string | docker.io/onlyoffice/documentserver:8.2 |
|
onlyoffice.resources.requests.cpu |
string | 250m |
|
onlyoffice.resources.requests.memory |
string | 768Mi |
|
onlyoffice.resources.limits.cpu |
string | 2 |
|
onlyoffice.resources.limits.memory |
string | 4Gi |
|
cache |
object | Redis: file locking and cache; always runs when a component below needs it | |
cache.enabled |
boolean | true |
|
cache.image |
string | docker.io/redis:8.6.2-alpine |
|
cache.maxMemory |
string | 128mb |
|
cache.resources.requests.cpu |
string | 25m |
|
cache.resources.requests.memory |
string | 64Mi |
|
cache.resources.limits.cpu |
string | 500m |
|
cache.resources.limits.memory |
string | 256Mi |
|
notifyPush |
object | Push of file changes and notifications to the clients, under /push | |
notifyPush.enabled |
boolean | true |
|
notifyPush.resources.requests.cpu |
string | 25m |
|
notifyPush.resources.requests.memory |
string | 32Mi |
|
notifyPush.resources.limits.cpu |
string | 500m |
|
notifyPush.resources.limits.memory |
string | 128Mi |
|
whiteboard |
object | Backend of the whiteboard app, under /whiteboard | |
whiteboard.enabled |
boolean | true |
|
whiteboard.image |
string | ghcr.io/nextcloud-releases/aio-whiteboard:latest |
|
whiteboard.resources.requests.cpu |
string | 50m |
|
whiteboard.resources.requests.memory |
string | 128Mi |
|
whiteboard.resources.limits.cpu |
string | 1 |
|
whiteboard.resources.limits.memory |
string | 512Mi |
|
taskprocessing |
object | Worker that runs queued tasks at once instead of at the next cron run | |
taskprocessing.enabled |
boolean | false |
|
taskprocessing.resources.requests.cpu |
string | 50m |
|
taskprocessing.resources.requests.memory |
string | 256Mi |
|
taskprocessing.resources.limits.cpu |
string | 1 |
|
taskprocessing.resources.limits.memory |
string | 768Mi |
|
talk |
object | Nextcloud Talk: signaling server, NATS, TURN server and call recording | |
talk.enabled |
boolean | false |
Calls across networks need a public address for the TURN server |
talk.initImage |
string | docker.io/busybox:1.36 |
|
talk.signaling.host |
string | "" |
empty: signaling-<hostname of Nextcloud> |
talk.signaling.image |
string | ghcr.io/strukturag/nextcloud-spreed-signaling:master |
|
talk.signaling.statsAllowedIps |
string | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 |
addresses that may read the statistics and metrics |
talk.signaling.resources.requests.cpu |
string | 50m |
|
talk.signaling.resources.requests.memory |
string | 64Mi |
|
talk.signaling.resources.limits.cpu |
string | 500m |
|
talk.signaling.resources.limits.memory |
string | 256Mi |
|
talk.nats.image |
string | docker.io/nats:2.10-alpine |
|
talk.nats.resources.requests.cpu |
string | 10m |
|
talk.nats.resources.requests.memory |
string | 32Mi |
|
talk.nats.resources.limits.cpu |
string | 200m |
|
talk.nats.resources.limits.memory |
string | 128Mi |
|
talk.turn.enabled |
boolean | true |
|
talk.turn.host |
string | "" |
public DNS name of the TURN server; empty: turn-<hostname of Nextcloud> |
talk.turn.public |
boolean | false |
true: LoadBalancer Service with a public address and its DNS record |
talk.turn.externalIP |
string | "" |
public address; empty with public: read from the DNS name at pod start |
talk.turn.realm |
string | "" |
empty: the DNS name of the TURN server |
talk.turn.image |
string | docker.io/coturn/coturn:4.7.0-r2 |
|
talk.turn.port |
integer | 3478 |
|
talk.turn.relayPorts |
object | UDP ports for relayed media; every port is a port of the Service | |
talk.turn.relayPorts.min |
integer | 49160 |
|
talk.turn.relayPorts.max |
integer | 49359 |
|
talk.turn.service.type |
string | ClusterIP |
public: true makes this LoadBalancer One of: ClusterIP, LoadBalancer. |
talk.turn.service.annotations |
object | {} |
for example the address pool of the load balancer |
talk.turn.service.externalTrafficPolicy |
string | Local |
|
talk.turn.tls.enabled |
boolean | false |
|
talk.turn.tls.port |
integer | 5349 |
|
talk.turn.tls.issuerKind |
string | ClusterIssuer |
|
talk.turn.tls.issuerName |
string | letsencrypt |
|
talk.turn.resources.requests.cpu |
string | 100m |
|
talk.turn.resources.requests.memory |
string | 96Mi |
|
talk.turn.resources.limits.cpu |
string | 1 |
|
talk.turn.resources.limits.memory |
string | 384Mi |
|
talk.recording.enabled |
boolean | true |
|
talk.recording.image |
string | ghcr.io/nextcloud-releases/aio-talk-recording:latest |
|
talk.recording.timezone |
string | Etc/UTC |
|
talk.recording.storage.size |
string | 10Gi |
|
talk.recording.storage.storageClassName |
string | "" |
|
talk.recording.resources.requests.cpu |
string | 200m |
|
talk.recording.resources.requests.memory |
string | 256Mi |
|
talk.recording.resources.limits.cpu |
string | 2 |
|
talk.recording.resources.limits.memory |
string | 2Gi |
|
oidc |
object | Login with an OpenID Connect provider (app user_oidc); local logins keep working. Active once discoveryUri and clientId are set | |
oidc.enabled |
boolean | true |
|
oidc.identifier |
string | keycloak |
provider name in Nextcloud, shown on the login button |
oidc.discoveryUri |
string | "" |
the provider's /.well-known/openid-configuration |
oidc.clientId |
string | "" |
its secret is secrets.oidcClientSecret |
oidc.scope |
string | openid profile email |
|
oidc.uidClaim |
string | preferred_username |
claims for the Nextcloud user id, display name and email |
oidc.groupsClaim |
string | groups |
claim with the user's groups; groups matching groupsRegex are created and kept in step |
oidc.groupsRegex |
string | "" |
only users with a group matching this regex may log in, for example ^(admin|acme-admins)$; a group admin in the claim makes the user a Nextcloud administrator. Empty: no restriction |
oidc.bearer |
boolean | true |
API and WebDAV calls with a Bearer token of the provider; the user is created on first call |
ai |
object | Assistant on an OpenAI-compatible API; also runs the worker and Redis | |
ai.enabled |
boolean | false |
|
ai.url |
string | "" |
address of the API, ending in /v1; required when enabled |
ai.models |
object | default model per kind; empty: the choice of the app | |
ai.models.completion |
string | "" |
|
ai.models.image |
string | "" |
|
ai.models.speechToText |
string | "" |
|
ai.models.textToSpeech |
string | "" |
|
ai.providers |
object | switch off what the endpoint does not serve | |
ai.providers.chat |
boolean | true |
|
ai.providers.text |
boolean | true |
|
ai.providers.translation |
boolean | true |
|
ai.providers.imageAnalysis |
boolean | true |
|
ai.providers.imageGeneration |
boolean | false |
|
ai.providers.speechToText |
boolean | false |
|
ai.providers.textToSpeech |
boolean | false |
|
monitoring |
object | Exporters, ServiceMonitors and alert rules | |
monitoring.enabled |
boolean | false |
|
monitoring.interval |
string | 30s |
|
monitoring.freeSpaceBytes |
integer | 10737418240 |
alert below this free space for user files |
monitoring.nextcloudExporterImage |
string | docker.io/xperimental/nextcloud-exporter:0.9.1 |
|
monitoring.redisExporterImage |
string | docker.io/oliver006/redis_exporter:v1.67.0 |
|
monitoring.blackboxExporterImage |
string | docker.io/prom/blackbox-exporter:v0.25.0 |
|
monitoring.natsExporterImage |
string | docker.io/natsio/prometheus-nats-exporter:0.19.2 |
|
monitoring.resources |
object | of every exporter | |
monitoring.resources.requests.cpu |
string | 10m |
|
monitoring.resources.requests.memory |
string | 32Mi |
|
monitoring.resources.limits.cpu |
string | 200m |
|
monitoring.resources.limits.memory |
string | 128Mi |
|
backup |
object | Dump of the database to an S3 bucket claimed with an ObjectBucketClaim | |
backup.enabled |
boolean | false |
|
backup.storageClassName |
string | "" |
StorageClass of the bucket claim; required when enabled |
backup.schedule |
string | 0 2 * * * |
empty: one backup at once, none scheduled |
backup.maxRetention |
string | 720h |
|
backup.s3.bucket |
string | "" |
empty: a generated name and the address the bucket claim reports; set both for a renderer without cluster access, such as Argo CD |
backup.s3.endpoint |
string | "" |
|
backup.s3.region |
string | us-east-1 |
|
backup.s3.tls |
object | false: plain HTTP inside the cluster, on port 80 when the claim says 443 | |
backup.s3.tls.enabled |
boolean | false |
|
backup.s3.tls.caSecretKeyRef |
object | {} |
Secret key with the CA of the endpoint, as |
backup.resources.requests.cpu |
string | 50m |
|
backup.resources.requests.memory |
string | 128Mi |
|
backup.resources.limits.cpu |
string | 300m |
|
backup.resources.limits.memory |
string | 256Mi |
|
mailu |
object | Mail server in the same project; its values are those of the mailu chart | |
mailu.enabled |
boolean | true |
|
mailu.upstream |
object | the mail server uses neither of these; they must be switched off at this depth | |
mailu.upstream.mariadb.enabled |
boolean | false |
|
mailu.upstream.postgresql.enabled |
boolean | false |
|
global.dkim |
object | DKIM signing key of the mail server, made by cert-manager; the platform then publishes the DKIM record. Set at install, see the mailu chart. | |
global.dkim.managed |
boolean | false |
|
global.dkim.selector |
string | dkim |
|
global.dkim.issuer.name |
string | selfsigned |
|
global.dkim.issuer.kind |
string | ClusterIssuer |
|
global.dkim.secretTemplate |
object | {} |
labels and annotations of the Secret that holds the key, by which a platform recognises it and publishes the DKIM record |
global.publicAddress |
object | Public address of the load balancer (MetalLB annotations) | |
global.publicAddress.shared |
boolean | false |
true: the public Services of this project share one address. They then use externalTrafficPolicy Cluster, so a server no longer sees the address of its client. The mail Service never shares: it needs that address to refuse spam and relaying. false: one address per Service. |
global.publicAddress.sharingKey |
string | "" |
Services with the same key share; empty: the name of the project |
global.publicAddress.ip |
string | "" |
with shared: ask for this address; empty: the load balancer assigns one |
hpa.enabled |
boolean | false |
|
hpa.minPods |
integer | 1 |
|
hpa.maxPods |
integer | 5 |
|
hpa.cpuThreshold |
integer | 60 |
|
nextcloud |
object | Values of the upstream Nextcloud chart | |
nextcloud.fullnameOverride |
string | nextcloud |
the templates of this chart refer to these object names |
nextcloud.deploymentLabels |
object | group, icon and arrows in the topology view of the console | |
nextcloud.deploymentLabels.app |
string | nextcloud |
|
nextcloud.deploymentLabels.app.kubernetes.io/part-of |
string | nextcloud |
|
nextcloud.deploymentLabels.app.openshift.io/runtime |
string | php |
|
nextcloud.deploymentAnnotations.app.openshift.io/vcs-uri |
string | https://github.com/nextcloud/server |
|
nextcloud.deploymentAnnotations.app.openshift.io/custom-icon |
string | https://raw.githubusercontent.com/nextcloud/promo/master/nextcloud-icon.svg |
|
nextcloud.deploymentAnnotations.app.openshift.io/connects-to |
string | [{"apiVersion":"apps/v1","kind":"StatefulSet","name":"nextcloud-mariadb"},{"a... |
|
nextcloud.image.flavor |
string | apache |
|
nextcloud.image.tag |
string | 34.0.5-apache@sha256:1f9212adecae32010cdbf137d7e0db78d08c696dc3e77f1eddcbf902... |
|
nextcloud.replicaCount |
integer | 1 |
|
nextcloud.nextcloud.host |
string | nextcloud.example.org |
Hostname of Nextcloud |
nextcloud.nextcloud.existingSecret.enabled |
boolean | true |
|
nextcloud.nextcloud.existingSecret.secretName |
string | nextcloud-admin |
|
nextcloud.nextcloud.existingSecret.usernameKey |
string | username |
|
nextcloud.nextcloud.existingSecret.passwordKey |
string | password |
|
nextcloud.nextcloud.securityContext |
object | the image starts as root and drops to www-data itself | |
nextcloud.nextcloud.securityContext.runAsUser |
integer | 0 |
|
nextcloud.nextcloud.strategy |
object | one replica on a ReadWriteOnce volume | |
nextcloud.nextcloud.strategy.type |
string | Recreate |
|
nextcloud.nextcloud.extraEnv |
array | [{"name": "XDG_CACHE_HOME", "value": "/tmp/.cache"}, {"name": "APACHE_BODY_LI... |
|
nextcloud.nextcloud.extraVolumes |
array | [{"name": "setup", "configMap": {"name": "nextcloud-setup", "defaultMode": 49... |
the setup script of this chart and the secrets it reads |
nextcloud.nextcloud.extraVolumeMounts |
array | [{"name": "setup", "mountPath": "/docker-entrypoint-hooks.d/before-starting/0... |
|
nextcloud.nextcloud.configs.logging.config.php |
string | `<?php | |
| $CONFIG = array( | |||
| 'loglevel' => 2, | |||
| );` | |||
nextcloud.nextcloud.configs.trusted-proxies.config.php |
string | `<?php | |
| $CONFIG = array( | |||
| 'trusted_proxies' => ['10.0.0.0/8', '172.16.0.0/12',...` | |||
nextcloud.nextcloud.defaultConfigs.smtp.config.php |
boolean | false |
|
nextcloud.nextcloud.phpConfigs.upload-max-filesize.ini |
string | `upload_max_filesize 1G | |
| post_max_size 1G | |||
| max_input_time 3600 | |||
| max_execution_tim...` | |||
nextcloud.phpClientHttpsFix.enabled |
boolean | true |
|
nextcloud.phpClientHttpsFix.protocol |
string | https |
|
nextcloud.ingress |
object | the Route is templated by this chart | |
nextcloud.ingress.enabled |
boolean | false |
|
nextcloud.internalDatabase.enabled |
boolean | false |
|
nextcloud.externalDatabase.enabled |
boolean | true |
|
nextcloud.externalDatabase.type |
string | mysql |
|
nextcloud.externalDatabase.host |
string | nextcloud-mariadb |
|
nextcloud.externalDatabase.database |
string | nextcloud |
|
nextcloud.externalDatabase.existingSecret.enabled |
boolean | true |
|
nextcloud.externalDatabase.existingSecret.secretName |
string | nextcloud-mariadb |
|
nextcloud.externalDatabase.existingSecret.usernameKey |
string | username |
|
nextcloud.externalDatabase.existingSecret.passwordKey |
string | password |
|
nextcloud.mariadb.enabled |
boolean | false |
|
nextcloud.postgresql.enabled |
boolean | false |
|
nextcloud.redis.enabled |
boolean | false |
|
nextcloud.collabora.enabled |
boolean | false |
|
nextcloud.metrics.enabled |
boolean | false |
|
nextcloud.cronjob.enabled |
boolean | true |
|
nextcloud.cronjob.sidecar.command |
array | ["sh", "-c", "until curl -fs -m 5 http://localhost/status.php | grep -q '\"in... |
cron starts when Nextcloud serves: after installation, upgrade and setup |
nextcloud.cronjob.sidecar.securityContext.runAsUser |
integer | 0 |
|
nextcloud.cronjob.sidecar.resources.requests.cpu |
string | 50m |
|
nextcloud.cronjob.sidecar.resources.requests.memory |
string | 128Mi |
|
nextcloud.imaginary.enabled |
boolean | true |
|
nextcloud.imaginary.service.labels.app |
string | nextcloud-imaginary |
|
nextcloud.imaginary.service.labels.app.kubernetes.io/part-of |
string | nextcloud |
|
nextcloud.imaginary.securityContext.runAsNonRoot |
boolean | true |
|
nextcloud.imaginary.securityContext.runAsUser |
integer | 1000 |
|
nextcloud.imaginary.resources.requests.cpu |
string | 50m |
|
nextcloud.imaginary.resources.requests.memory |
string | 128Mi |
|
nextcloud.persistence.enabled |
boolean | true |
|
nextcloud.persistence.labels.app |
string | nextcloud |
|
nextcloud.persistence.labels.app.kubernetes.io/part-of |
string | nextcloud |
|
nextcloud.persistence.accessMode |
string | ReadWriteOnce |
|
nextcloud.persistence.size |
string | 10Gi |
|
nextcloud.persistence.nextcloudData.enabled |
boolean | true |
|
nextcloud.persistence.nextcloudData.accessMode |
string | ReadWriteOnce |
|
nextcloud.persistence.nextcloudData.size |
string | 25Gi |
the space for user files |
nextcloud.resources.requests.cpu |
string | 200m |
|
nextcloud.resources.requests.memory |
string | 512Mi |
|
nextcloud.resources.limits.cpu |
string | 2 |
|
nextcloud.resources.limits.memory |
string | 2Gi |
|
nextcloud.startupProbe.enabled |
boolean | true |
|
nextcloud.startupProbe.initialDelaySeconds |
integer | 60 |
|
nextcloud.startupProbe.periodSeconds |
integer | 10 |
|
nextcloud.startupProbe.timeoutSeconds |
integer | 10 |
|
nextcloud.startupProbe.failureThreshold |
integer | 60 |
|
nextcloud.livenessProbe.enabled |
boolean | true |
|
nextcloud.livenessProbe.initialDelaySeconds |
integer | 10 |
|
nextcloud.livenessProbe.periodSeconds |
integer | 10 |
|
nextcloud.livenessProbe.timeoutSeconds |
integer | 10 |
|
nextcloud.livenessProbe.failureThreshold |
integer | 5 |
|
nextcloud.readinessProbe.enabled |
boolean | true |
|
nextcloud.readinessProbe.initialDelaySeconds |
integer | 10 |
|
nextcloud.readinessProbe.periodSeconds |
integer | 10 |
|
nextcloud.readinessProbe.timeoutSeconds |
integer | 10 |
|
nextcloud.readinessProbe.failureThreshold |
integer | 5 |