nixos-config/machines/orbi/media-nextcloud.nix

200 lines
6.2 KiB
Nix
Raw Normal View History

2024-06-03 20:01:14 +02:00
{ pkgs, config, factsGenerator, ... }:
2023-12-09 17:15:50 +01:00
# don't forget the database backup before upgrading
# -------------------------------------------------
# https://docs.nextcloud.com/server/stable/admin_manual/maintenance/backup.html
# https://docs.nextcloud.com/server/stable/admin_manual/maintenance/upgrade.html
let
nextcloudUid = 1000;
2024-04-10 09:46:17 +02:00
nextcloudGid = 1000;
2024-05-27 21:02:15 +02:00
nextcloudPort = 9080;
2024-04-11 19:51:10 +02:00
nextcloudHostName = "nextcloud.ingolf-wagner.de";
2023-12-09 17:15:50 +01:00
2024-04-10 09:46:17 +02:00
phpPackage = pkgs.php73;
2024-05-27 21:02:15 +02:00
nextcloudPackage = pkgs.nextcloud29;
2024-04-10 09:46:17 +02:00
mySQLPackage = pkgs.mysql;
2023-12-09 17:15:50 +01:00
in
{
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 80 443 ];
services.nginx = {
enable = true;
recommendedProxySettings = true;
virtualHosts = {
2024-04-10 09:46:17 +02:00
"${nextcloudHostName}" = {
2023-12-09 17:15:50 +01:00
forceSSL = true;
enableACME = true;
locations = {
"/" = {
2024-04-10 09:46:17 +02:00
proxyPass = "http://localhost:${toString nextcloudPort}";
2023-12-09 17:15:50 +01:00
extraConfig = ''
2024-04-10 09:46:17 +02:00
sub_filter "http://${nextcloudHostName}" "https://${nextcloudHostName}";
2023-12-09 17:15:50 +01:00
# used for view/edit office file via Office Online Server
client_max_body_size 0;
proxy_buffering off; # to download files bigger than 1GB
'';
};
"= /.well-known/carddav" = {
priority = 210;
extraConfig = "return 301 $scheme://$host/remote.php/dav;";
};
"= /.well-known/caldav" = {
priority = 210;
extraConfig = "return 301 $scheme://$host/remote.php/dav;";
};
};
};
};
};
2024-06-03 20:01:14 +02:00
clanCore.facts.services.nextcloud_root = factsGenerator.password { service = "nextcloud"; name = "root"; };
clanCore.facts.services.nextcloud_database = factsGenerator.password { service = "nextcloud"; name = "database"; };
2023-12-09 17:15:50 +01:00
# Container Setup
# ===============
#
# running:
# * nextcloud (php)
# * mysql
containers.nextcloud = {
bindMounts = {
rootpassword = {
2024-06-03 20:01:14 +02:00
hostPath = config.clanCore.facts.services.nextcloud_root.secret."nextcloud.root".path;
2024-06-05 15:43:26 +02:00
mountPoint = "/run/secrets/nextcloud.root.intput";
2023-12-09 17:15:50 +01:00
isReadOnly = true;
};
databasepassword = {
2024-06-03 20:01:14 +02:00
hostPath = config.clanCore.facts.services.nextcloud_database.secret."nextcloud.database".path;
2024-06-05 15:43:26 +02:00
mountPoint = "/run/secrets/nextcloud.database.input";
2023-12-09 17:15:50 +01:00
isReadOnly = true;
};
};
2024-04-10 09:46:17 +02:00
privateNetwork = false;
2023-12-09 17:15:50 +01:00
autoStart = true;
2024-05-18 12:02:21 +02:00
config = { config, lib, ... }: {
nixpkgs.pkgs = pkgs;
2024-05-18 23:57:31 +02:00
imports = [ ../../components/monitor/container.nix ];
2024-05-18 12:02:21 +02:00
system.stateVersion = "23.11";
2023-12-09 17:15:50 +01:00
# Configuring nameservers for containers is currently broken.
# Therefore in some cases internet connectivity can be broken inside the containers.
# A temporary workaround is to manually write the /etc/nixos/resolv.conf file like this:
2024-04-10 09:46:17 +02:00
#environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
2023-12-09 17:15:50 +01:00
2024-06-05 15:43:26 +02:00
systemd.tmpfiles.settings.nextcloud = {
2024-06-05 17:40:02 +02:00
"/run/secrets/nextcloud.root"."C+" = {
2024-06-05 15:43:26 +02:00
user = "nextcloud";
group = "nextcloud";
mode = "400";
argument = "/run/secrets/nextcloud.root.input";
};
2024-06-05 17:40:02 +02:00
"/run/secrets/nextcloud.database"."C+" = {
2024-06-05 15:43:26 +02:00
user = "nextcloud";
group = "nextcloud";
mode = "400";
argument = "/run/secrets/nextcloud.database.input";
};
};
2023-12-09 17:15:50 +01:00
users.users.nextcloud.uid = nextcloudUid;
services.nginx = {
2024-04-10 09:46:17 +02:00
defaultListen = [
{ addr = "0.0.0.0"; port = nextcloudPort; }
];
2023-12-09 17:15:50 +01:00
# Use recommended settings
recommendedGzipSettings = lib.mkDefault true;
recommendedOptimisation = lib.mkDefault true;
recommendedProxySettings = lib.mkDefault true;
recommendedTlsSettings = lib.mkDefault true;
};
# nextcloud database
# ==================
#
# set user password:
# -----------------
# #> mysql
# mysql> ALTER USER 'nextcloud'@'localhost' IDENTIFIED BY 'nextcloud-password';
#
# recreate database:
# ------------------
# mysql> DROP DATABASE nextcloud;
# mysql> CREATE DATABASE nextcloud;
#
# migration:
# ----------
# nextcloud-occ db:convert-type --all-apps mysql nextcloud 127.0.0.1 nextcloud
#
# 4-byte stuff:
# -------------
# https://docs.nextcloud.com/server/18/admin_manual/configuration_database/mysql_4byte_support.html
# if you do this don't forget --default-character-set=utf8mb4 for mysqldump
services.mysql = {
enable = true;
2024-04-10 09:46:17 +02:00
package = mySQLPackage;
2023-12-09 17:15:50 +01:00
# https://nixos.org/manual/nixos/stable/release-notes.html#sec-release-20.09-incompatibilities
ensureDatabases = [ "nextcloud" ];
ensureUsers = [{
name = "nextcloud";
ensurePermissions = { "nextcloud.*" = "ALL PRIVILEGES"; };
}];
settings.mysqld = {
innodb_large_prefix = true;
innodb_file_format = "barracuda";
innodb_file_per_table = 1;
innodb_read_only_compressed = 0;
};
};
# Backup database
# ---------------
services.mysqlBackup = {
enable = true;
databases = config.services.mysql.ensureDatabases;
singleTransaction = true;
};
systemd.services."mysql-backup".serviceConfig = {
ExecStartPre = [ "+/run/current-system/sw/bin/nextcloud-occ maintenance:mode --on" ];
ExecStopPost = [ "+/run/current-system/sw/bin/nextcloud-occ maintenance:mode --off" ];
};
# in php
services.phpfpm = {
2024-04-10 09:46:17 +02:00
phpPackage = phpPackage;
2023-12-09 17:15:50 +01:00
phpOptions = ''
opcache.revalidate_freq = 10
'';
};
# nextcloud setup
services.nextcloud = {
enable = true;
2024-04-10 09:46:17 +02:00
package = nextcloudPackage;
2023-12-09 17:15:50 +01:00
autoUpdateApps.enable = true;
2024-04-10 09:46:17 +02:00
hostName = nextcloudHostName;
2023-12-09 17:15:50 +01:00
https = true;
2024-05-27 21:02:15 +02:00
settings = {
overwriteprotocol = "https";
default_phone_region = "DE";
loglevel = 2;
};
2023-12-09 17:15:50 +01:00
config = {
2024-06-05 15:43:26 +02:00
adminpassFile = "/run/secrets/nextcloud.root";
2024-05-27 21:02:15 +02:00
#overwriteProtocol = "https";
2023-12-09 17:15:50 +01:00
dbtype = "mysql";
2024-06-05 15:43:26 +02:00
dbpassFile = "/run/secrets/nextcloud.database";
2024-05-27 19:10:54 +02:00
dbhost = "localhost:3306";
2023-12-09 17:15:50 +01:00
};
};
};
};
}