feat(k8s): add K8s manifests for all homelab services

traefik, gitea, adguard, nextcloud, errorpages, homepages,
uptime-kuma, kener, checkmk, headscale, dockmon, metube,
downtify, portainer, netronome, userbot

Includes Helm values, deployments, services, ingress routes,
configmaps, secrets (placeholders), postgres statefulsets,
kustomize overlays, and Traefik dynamic configuration.

nextcloud/compose.yaml

@@ -6,15 +6,13 @@ services:
     container_name: nextcloud-aio-mastercontainer # Do not change
     volumes:
       - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # Do not change (backup) 
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /var/run/docker.sock:/var/run/docker.sock
       - /dev/dri:/dev/dri
+    ports:
+      - 8080:8080
     networks:
       - nextcloud-aio
       - proxy # Optional: Connects the mastercontainer to the proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      # ports:
-      # - 8081:80 # may be removed if under reverse-proxy
-      # - 8443:8443 
-      # - 8888:8080 # AIO
 
     labels:
       - "traefik.enable=true"

nextcloud/k8s/external-service.yaml

@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-apache
+  namespace: nextcloud
+spec:
+  ports:
+  - port: 11000
+    targetPort: 11000
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: nextcloud-apache
+  namespace: nextcloud
+  labels:
+    kubernetes.io/service-name: nextcloud-apache
+addressType: IPv4
+ports:
+- port: 11000
+  protocol: TCP
+endpoints:
+- addresses:
+  - "192.168.49.1"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-aio
+  namespace: nextcloud
+spec:
+  ports:
+  - port: 8080
+    targetPort: 8080
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: nextcloud-aio
+  namespace: nextcloud
+  labels:
+    kubernetes.io/service-name: nextcloud-aio
+addressType: IPv4
+ports:
+- port: 8080
+  protocol: TCP
+endpoints:
+- addresses:
+  - "192.168.49.1"

nextcloud/k8s/ingress.yaml

@@ -0,0 +1,115 @@
+# Nextcloud
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-dev
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`nextcloud.gigaforust.internal`)
+    kind: Rule
+    middlewares:
+    - name: nextcloud-chain@file
+    services:
+    - name: nextcloud-apache
+      port: 11000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-local
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`nextcloud.workstation.internal`)
+    kind: Rule
+    middlewares:
+    - name: nextcloud-chain@file
+    services:
+    - name: nextcloud-apache
+      port: 11000
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nextcloud-prod
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`nextcloud.forust.xyz`)
+    kind: Rule
+    middlewares:
+    - name: nextcloud-chain@file
+    services:
+    - name: nextcloud-apache
+      port: 11000
+  tls:
+    {}
+---
+# Nextcloud AIO
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: naio-dev
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`naio.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: nextcloud-aio
+      port: 8080
+      scheme: https
+      serversTransport: insecureTransport@file
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: naio-local
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`naio.workstation.internal`)
+    kind: Rule
+    services:
+    - name: nextcloud-aio
+      port: 8080
+      scheme: https
+      serversTransport: insecureTransport@file
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: naio-prod
+  namespace: nextcloud
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`naio.forust.xyz`)
+    kind: Rule
+    services:
+    - name: nextcloud-aio
+      port: 8080
+      scheme: https
+      serversTransport: insecureTransport@file
+  tls:
+    {}

nextcloud/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nextcloud

nextcloud/k8s/servers-transport.yaml

@@ -0,0 +1,7 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: insecure-transport
+  namespace: nextcloud
+spec:
+  insecureSkipVerify: true