Refactor Nextcloud configuration to use OCC script approach and add email/OIDC support

Major architectural changes:
- Replace config file templating with unified OCC command script
- Remove custom_apps mount overlay that caused Caddy serving issues
- Implement script-based configuration for idempotency and clarity

Configuration improvements:
- Add email/SMTP support with master switch (nextcloud_email_enabled)
- Add OIDC/SSO integration with Authentik support
- Add apps installation (user_oidc, calendar, contacts)
- Enable group provisioning and quota management from OIDC
- Set nextcloud_oidc_unique_uid to false per Authentik docs

Files removed:
- nextcloud.config.php.j2 (replaced by OCC commands)
- redis.config.php.j2 (replaced by OCC commands)
- optimization.yml (merged into configure.yml)

Files added:
- configure-nextcloud.sh.j2 (single source of truth for config)
- configure.yml (deploys and runs configuration script)

Documentation:
- Add comprehensive OIDC setup guide with Authentik integration
- Document custom scope mapping and group provisioning
- Add email configuration examples for common providers
- Update vault variables documentation
- Explain two-phase deployment approach

Host configuration:
- Change admin user from 'admin' to 'joakim'
- Add admin email configuration

roles/nextcloud/tasks/configure.yml

@@ -0,0 +1,36 @@
+---
+# =================================================================
+# Nextcloud Configuration via Script
+# =================================================================
+# Rick-Infra - Nextcloud Role
+#
+# Deploys and runs a configuration script inside the Nextcloud
+# container to set system configuration via OCC commands.
+
+- name: Deploy Nextcloud configuration script
+  template:
+    src: configure-nextcloud.sh.j2
+    dest: "{{ nextcloud_config_dir }}/configure.sh"
+    mode: '0755'
+  tags: [config, nextcloud-config]
+
+- name: Run Nextcloud configuration script
+  command: podman exec --user www-data nextcloud bash /var/www/html/config/configure.sh
+  register: nc_config_result
+  changed_when: false  # Script output doesn't indicate changes reliably
+  failed_when: nc_config_result.rc != 0
+  tags: [config, nextcloud-config]
+
+- name: Display configuration script output
+  debug:
+    msg: "{{ nc_config_result.stdout_lines }}"
+  when: nc_config_result.stdout | length > 0
+  tags: [config, nextcloud-config]
+
+- name: Display configuration script errors
+  debug:
+    msg: "{{ nc_config_result.stderr_lines }}"
+  when: 
+    - nc_config_result.stderr | length > 0
+    - nc_config_result.rc != 0
+  tags: [config, nextcloud-config]

roles/nextcloud/tasks/main.yml

@@ -40,7 +40,6 @@
     - "{{ nextcloud_html_dir }}"
     - "{{ nextcloud_data_dir }}"
     - "{{ nextcloud_config_dir }}"
-    - "{{ nextcloud_custom_apps_dir }}"
   tags: [setup, directories]
 
 - name: Deploy environment configuration
@@ -52,12 +51,9 @@
   notify: restart nextcloud
   tags: [config]
 
-# NOTE: Custom Redis config is deployed AFTER installation completes (see below)
-# to avoid interfering with the container's first-time initialization process
-
-# NOTE: redis-session-override.ini is NOT deployed because we use file-based sessions
-# (not Redis sessions). If you enable REDIS_HOST in the future, you'll need to add
-# proper session lock configuration.
+# NOTE: Nextcloud is configured via OCC commands in a script after installation
+# completes. This avoids interfering with the container's initialization process
+# and provides a clean, explicit configuration approach.
 
 - name: Create Quadlet systemd directory (system scope)
   file:
@@ -130,13 +126,9 @@
   changed_when: false
   tags: [verification]
 
-- name: Deploy custom Redis caching configuration (post-installation)
-  template:
-    src: redis.config.php.j2
-    dest: "{{ nextcloud_config_dir }}/redis.config.php"
-    mode: '0644'
-  notify: restart nextcloud
-  tags: [config, redis]
+- name: Configure Nextcloud via OCC script
+  include_tasks: configure.yml
+  tags: [config, configure]
 
 - name: Truncate nextcloud.log to prevent bloat
   shell: |
@@ -149,10 +141,6 @@
   include_tasks: cron.yml
   tags: [cron, background-jobs]
 
-- name: Optimize database and apply configuration
-  include_tasks: optimization.yml
-  tags: [optimization, database]
-
 - name: Display Nextcloud deployment status
   debug:
     msg: |
@@ -167,7 +155,8 @@
       ⚙️  Configuration:
       - Redis caching enabled (application-level cache & file locking)
       - PHP sessions use file-based storage (not Redis)
-      - Custom redis.config.php deployed post-installation
+      - Database optimizations applied
+      - Configuration via OCC commands
       
       🚀 Ready for file storage and collaboration!
       

roles/nextcloud/tasks/optimization.yml

@@ -1,64 +0,0 @@
----
-# =================================================================
-# Nextcloud Database Optimization
-# =================================================================
-# Rick-Infra - Nextcloud Role
-#
-# Performs database maintenance tasks to optimize performance
-# and resolve setup warnings about missing indices and migrations
-
-- name: Add missing database indices
-  command: >
-    podman exec --user www-data nextcloud
-    php occ db:add-missing-indices
-  register: nextcloud_indices
-  changed_when: "'indices added' in nextcloud_indices.stdout or 'Check indices' in nextcloud_indices.stdout"
-  failed_when: 
-    - nextcloud_indices.rc != 0
-    - "'already exists' not in nextcloud_indices.stderr"
-
-- name: Convert filecache bigint columns
-  command: >
-    podman exec --user www-data nextcloud
-    php occ db:convert-filecache-bigint --no-interaction
-  register: nextcloud_bigint
-  changed_when: "'converted' in nextcloud_bigint.stdout"
-  failed_when:
-    - nextcloud_bigint.rc != 0
-    - "'already' not in nextcloud_bigint.stdout"
-  timeout: 300  # 5 minutes for large databases
-
-- name: Update mimetype database mappings
-  command: >
-    podman exec --user www-data nextcloud
-    php occ maintenance:repair --include-expensive
-  register: nextcloud_repair
-  changed_when: "'updated' in nextcloud_repair.stdout or 'repaired' in nextcloud_repair.stdout"
-  failed_when: nextcloud_repair.rc != 0
-  timeout: 600  # 10 minutes for expensive repairs
-
-- name: Configure maintenance window
-  command: >
-    podman exec --user www-data nextcloud
-    php occ config:system:set maintenance_window_start --value={{ nextcloud_maintenance_window_start }} --type=integer
-  register: nextcloud_maintenance_window
-  changed_when: "'set' in nextcloud_maintenance_window.stdout"
-  failed_when: nextcloud_maintenance_window.rc != 0
-
-- name: Configure default phone region
-  command: >
-    podman exec --user www-data nextcloud
-    php occ config:system:set default_phone_region --value={{ nextcloud_default_phone_region }}
-  register: nextcloud_phone_region
-  changed_when: "'set' in nextcloud_phone_region.stdout"
-  failed_when: nextcloud_phone_region.rc != 0
-
-- name: Display optimization results
-  debug:
-    msg: |
-      Database optimization complete:
-      - Indices: {{ 'Added' if 'indices added' in nextcloud_indices.stdout else 'Already optimized' }}
-      - BigInt: {{ 'Converted' if 'converted' in nextcloud_bigint.stdout else 'Already converted' }}
-      - Mimetypes: {{ 'Updated' if 'updated' in nextcloud_repair.stdout else 'Up to date' }}
-      - Maintenance window: {{ nextcloud_maintenance_window_start }}:00 UTC
-      - Phone region: {{ nextcloud_default_phone_region }}