nixos-config/machines/orbi/media-nextcloud.nix

248 lines
7.3 KiB
Nix
Raw Normal View History

2024-08-29 03:26:04 +02:00
{
pkgs,
2024-09-15 01:32:21 +02:00
lib,
2024-08-29 03:26:04 +02:00
config,
factsGenerator,
components,
2024-08-31 18:28:34 +02:00
inputs,
2024-08-29 03:26:04 +02:00
...
}:
2023-12-09 17:15:50 +01:00
# don't forget the database backup before upgrading
# -------------------------------------------------
# https://docs.nextcloud.com/server/stable/admin_manual/maintenance/backup.html
# https://docs.nextcloud.com/server/stable/admin_manual/maintenance/upgrade.html
let
2024-06-10 17:45:47 +02:00
# todo : let nextcloud run as media, this would make this part easier.
nextcloudUid = config.ids.uids.transmission;
2024-06-10 17:45:47 +02:00
nextcloudGid = config.ids.gids.transmission;
2024-05-27 21:02:15 +02:00
nextcloudPort = 9080;
2024-04-11 19:51:10 +02:00
nextcloudHostName = "nextcloud.ingolf-wagner.de";
2023-12-09 17:15:50 +01:00
2024-04-10 09:46:17 +02:00
phpPackage = pkgs.php73;
2024-05-27 21:02:15 +02:00
nextcloudPackage = pkgs.nextcloud29;
2024-04-10 09:46:17 +02:00
mySQLPackage = pkgs.mysql;
2023-12-09 17:15:50 +01:00
in
{
2024-08-29 03:26:04 +02:00
networking.firewall.allowedTCPPorts = [
80
443
];
networking.firewall.allowedUDPPorts = [
80
443
];
2023-12-09 17:15:50 +01:00
healthchecks.http.nextcloud = {
2024-09-16 02:06:03 +02:00
url = "https://nextcloud.ingolf-wagner.de/login";
expectedContent = "Login";
};
2024-09-15 01:32:21 +02:00
2023-12-09 17:15:50 +01:00
services.nginx = {
enable = true;
recommendedProxySettings = true;
virtualHosts = {
2024-04-10 09:46:17 +02:00
"${nextcloudHostName}" = {
2023-12-09 17:15:50 +01:00
forceSSL = true;
enableACME = true;
locations = {
"/" = {
2024-04-10 09:46:17 +02:00
proxyPass = "http://localhost:${toString nextcloudPort}";
2023-12-09 17:15:50 +01:00
extraConfig = ''
2024-04-10 09:46:17 +02:00
sub_filter "http://${nextcloudHostName}" "https://${nextcloudHostName}";
2023-12-09 17:15:50 +01:00
# used for view/edit office file via Office Online Server
client_max_body_size 0;
proxy_buffering off; # to download files bigger than 1GB
'';
};
"= /.well-known/carddav" = {
priority = 210;
extraConfig = "return 301 $scheme://$host/remote.php/dav;";
};
"= /.well-known/caldav" = {
priority = 210;
extraConfig = "return 301 $scheme://$host/remote.php/dav;";
};
};
};
};
};
2024-08-29 03:26:04 +02:00
clan.core.facts.services.nextcloud_root = factsGenerator.password {
service = "nextcloud";
name = "root";
};
clan.core.facts.services.nextcloud_database = factsGenerator.password {
service = "nextcloud";
name = "database";
};
2023-12-09 17:15:50 +01:00
# Container Setup
# ===============
#
# running:
# * nextcloud (php)
# * mysql
containers.nextcloud = {
bindMounts = {
rootpassword = {
2024-06-19 13:19:55 +02:00
hostPath = config.clan.core.facts.services.nextcloud_root.secret."nextcloud.root".path;
2024-06-05 15:43:26 +02:00
mountPoint = "/run/secrets/nextcloud.root.intput";
2023-12-09 17:15:50 +01:00
isReadOnly = true;
};
databasepassword = {
2024-06-19 13:19:55 +02:00
hostPath = config.clan.core.facts.services.nextcloud_database.secret."nextcloud.database".path;
2024-06-05 15:43:26 +02:00
mountPoint = "/run/secrets/nextcloud.database.input";
2023-12-09 17:15:50 +01:00
isReadOnly = true;
};
2024-06-10 17:45:47 +02:00
share = {
hostPath = config.services.syncthing.settings.folders.share.path;
mountPoint = "/media/share";
isReadOnly = true;
};
2023-12-09 17:15:50 +01:00
};
2024-04-10 09:46:17 +02:00
privateNetwork = false;
2023-12-09 17:15:50 +01:00
autoStart = true;
2024-08-29 03:26:04 +02:00
config =
{ config, lib, ... }:
{
nixpkgs.pkgs = pkgs;
2024-08-31 18:28:34 +02:00
imports = [
"${components}/monitor/container.nix"
inputs.nix-topology.nixosModules.default
];
2024-08-29 03:26:04 +02:00
system.stateVersion = "23.11";
services.logrotate.checkConfig = false; # because uid 3000 does not exist in here
# Configuring nameservers for containers is currently broken.
# Therefore in some cases internet connectivity can be broken inside the containers.
# A temporary workaround is to manually write the /etc/nixos/resolv.conf file like this:
#environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
systemd.tmpfiles.settings.nextcloud = {
"/run/secrets/nextcloud.root"."C+" = {
user = "nextcloud";
group = "nextcloud";
mode = "400";
argument = "/run/secrets/nextcloud.root.input";
};
"/run/secrets/nextcloud.database"."C+" = {
user = "nextcloud";
group = "nextcloud";
mode = "400";
argument = "/run/secrets/nextcloud.database.input";
};
2024-06-05 15:43:26 +02:00
};
2023-12-09 17:15:50 +01:00
2024-08-29 03:26:04 +02:00
users.users.nextcloud.uid = nextcloudUid;
users.groups.nextcloud = {
gid = nextcloudGid;
members = [ "nextcloud" ];
};
2023-12-09 17:15:50 +01:00
2024-08-29 03:26:04 +02:00
services.nginx = {
defaultListen = [
{
addr = "0.0.0.0";
port = nextcloudPort;
}
];
# Use recommended settings
recommendedGzipSettings = lib.mkDefault true;
recommendedOptimisation = lib.mkDefault true;
recommendedProxySettings = lib.mkDefault true;
recommendedTlsSettings = lib.mkDefault true;
2023-12-09 17:15:50 +01:00
};
2024-08-29 03:26:04 +02:00
# nextcloud database
# ==================
#
# set user password:
# -----------------
# #> mysql
# mysql> ALTER USER 'nextcloud'@'localhost' IDENTIFIED BY 'nextcloud-password';
#
# recreate database:
# ------------------
# mysql> DROP DATABASE nextcloud;
# mysql> CREATE DATABASE nextcloud;
#
# migration:
# ----------
# nextcloud-occ db:convert-type --all-apps mysql nextcloud 127.0.0.1 nextcloud
#
# 4-byte stuff:
# -------------
# https://docs.nextcloud.com/server/18/admin_manual/configuration_database/mysql_4byte_support.html
# if you do this don't forget --default-character-set=utf8mb4 for mysqldump
services.mysql = {
enable = true;
package = mySQLPackage;
# https://nixos.org/manual/nixos/stable/release-notes.html#sec-release-20.09-incompatibilities
ensureDatabases = [ "nextcloud" ];
ensureUsers = [
{
name = "nextcloud";
ensurePermissions = {
"nextcloud.*" = "ALL PRIVILEGES";
};
}
];
settings.mysqld = {
innodb_large_prefix = true;
innodb_file_format = "barracuda";
innodb_file_per_table = 1;
innodb_read_only_compressed = 0;
};
};
2023-12-09 17:15:50 +01:00
2024-08-29 03:26:04 +02:00
# Backup database
# ---------------
services.mysqlBackup = {
enable = true;
databases = config.services.mysql.ensureDatabases;
singleTransaction = true;
};
systemd.services."mysql-backup".serviceConfig = {
ExecStartPre = [ "+/run/current-system/sw/bin/nextcloud-occ maintenance:mode --on" ];
ExecStopPost = [ "+/run/current-system/sw/bin/nextcloud-occ maintenance:mode --off" ];
};
2023-12-09 17:15:50 +01:00
2024-08-29 03:26:04 +02:00
# in php
services.phpfpm = {
phpPackage = phpPackage;
phpOptions = ''
opcache.revalidate_freq = 10
'';
2024-05-27 21:02:15 +02:00
};
2024-08-29 03:26:04 +02:00
# nextcloud setup
services.nextcloud = {
enable = true;
package = nextcloudPackage;
autoUpdateApps.enable = true;
hostName = nextcloudHostName;
https = true;
settings = {
overwriteprotocol = "https";
default_phone_region = "DE";
loglevel = 2;
};
config = {
adminpassFile = "/run/secrets/nextcloud.root";
#overwriteProtocol = "https";
dbtype = "mysql";
dbpassFile = "/run/secrets/nextcloud.database";
dbhost = "localhost:3306";
};
2023-12-09 17:15:50 +01:00
};
};
};
}