[bulbashenko-com-deploy]

Всё, что накопилось в dev (staging) с прошлого релиза. Merge = релиз в prod: Flux раскатит main.

Приложения

• Deploy auth db3ef21: Add the Nextcloud OIDC client and the cloud-users group (Add the Nextcloud OIDC client and the cloud-users group auth#38) (024a012)

Изменения

• Add Nextcloud on the Storage Box behind the tunnel (Add Nextcloud on the Storage Box behind the tunnel #153)

Warning

В staging не проверялось, впервые применится в prod этим релизом:

• apps/production/
• clusters/hel1/
• infrastructure/controllers/
• terraform/

Note

Есть изменения в terraform/: план — в комментарии OpenTofu ниже; CI применит его после мержа.

Метод мержа — только merge commit (история нужна, чтобы следующий релиз видел, что уже выкачено).
Откат: revert merge-коммита релиза в main. Обновляется scripts/release-pr.sh.

[github-actions]

OpenTofu: Plan: 2 to add, 1 to change, 0 to destroy. (applied by CI when this reaches main)

plan

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place (current -> planned)

OpenTofu will perform the following actions:

  # cloudflare_dns_record.cloud will be created
  + resource "cloudflare_dns_record" "cloud" {
      + comment                 = "[nextcloud] files, calendars and contacts (public), via Tunnel"
      + comment_modified_on     = (known after apply)
      + content                 = "86ba9b1b-b87b-45ec-a811-825aa7658c8b.cfargotunnel.com"
      + created_on              = (known after apply)
      + id                      = (known after apply)
      + include_shadow_metadata = false
      + meta                    = (known after apply)
      + modified_on             = (known after apply)
      + name                    = "cloud.bulbashenko.com"
      + proxiable               = (known after apply)
      + proxied                 = true
      + settings                = (known after apply)
      + tags                    = (known after apply)
      + tags_modified_on        = (known after apply)
      + ttl                     = 1
      + type                    = "CNAME"
      + zone_id                 = "abb0bea137c9c120a465f8a609c98e02"
    }

  # cloudflare_zero_trust_tunnel_cloudflared_config.hel1 will be updated in-place
  ~ resource "cloudflare_zero_trust_tunnel_cloudflared_config" "hel1" {
      ~ config     = {
          ~ ingress = [
              ~ {
                  + hostname = "cloud.bulbashenko.com"
                  ~ service  = "http_status:404" -> "http://traefik.kube-system.svc.cluster.local:80"
                },
              + {
                  + service = "http_status:404"
                },
                # (7 unchanged elements hidden)
            ]
        }
      ~ created_at = "2026-10-12T00:22:18Z" -> (known after apply)
        id         = "86ba9b1b-b87b-45ec-a811-825aa7658c8b"
      ~ source     = "cloudflare" -> (known after apply)
      ~ version    = 3 -> (known after apply)
        # (2 unchanged attributes hidden)
    }

  # hcloud_storage_box_subaccount.nextcloud will be created
  + resource "hcloud_storage_box_subaccount" "nextcloud" {
      + access_settings = {
          + reachable_externally = false
          + readonly             = false
          + samba_enabled        = true
          + ssh_enabled          = false
          + webdav_enabled       = false
        }
      + description     = "Nextcloud data directory (SMB)"
      + home_directory  = "nextcloud"
      + id              = (known after apply)
      + labels          = {}
      + name            = (known after apply)
      + password        = (sensitive value)
      + server          = (known after apply)
      + storage_box_id  = 671089
      + username        = (known after apply)
    }

Plan: 2 to add, 1 to change, 0 to destroy.

Changes to Outputs:
  + storage_box_nextcloud_username    = (known after apply)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.
exit status 2
exit status 2