nixos-config/nixos/machines/orbi/media-nextcloud.nix

194 lines
5.7 KiB
Nix
Raw Normal View History

2023-12-09 17:15:50 +01:00
{ pkgs, config, ... }:
# don't forget the database backup before upgrading
# -------------------------------------------------
# https://docs.nextcloud.com/server/stable/admin_manual/maintenance/backup.html
# https://docs.nextcloud.com/server/stable/admin_manual/maintenance/upgrade.html
let
nextcloudUid = 1000;
2024-04-10 09:46:17 +02:00
nextcloudGid = 1000;
nextcloudPort = 8080;
2024-04-11 19:51:10 +02:00
nextcloudHostName = "nextcloud.ingolf-wagner.de";
2023-12-09 17:15:50 +01:00
2024-04-10 09:46:17 +02:00
phpPackage = pkgs.php73;
nextcloudPackage = pkgs.nextcloud28;
mySQLPackage = pkgs.mysql;
2023-12-09 17:15:50 +01:00
in
{
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 80 443 ];
services.nginx = {
enable = true;
recommendedProxySettings = true;
virtualHosts = {
2024-04-10 09:46:17 +02:00
"${nextcloudHostName}" = {
2023-12-09 17:15:50 +01:00
forceSSL = true;
enableACME = true;
locations = {
"/" = {
2024-04-10 09:46:17 +02:00
proxyPass = "http://localhost:${toString nextcloudPort}";
2023-12-09 17:15:50 +01:00
extraConfig = ''
2024-04-10 09:46:17 +02:00
sub_filter "http://${nextcloudHostName}" "https://${nextcloudHostName}";
2023-12-09 17:15:50 +01:00
# used for view/edit office file via Office Online Server
client_max_body_size 0;
proxy_buffering off; # to download files bigger than 1GB
'';
};
"= /.well-known/carddav" = {
priority = 210;
extraConfig = "return 301 $scheme://$host/remote.php/dav;";
};
"= /.well-known/caldav" = {
priority = 210;
extraConfig = "return 301 $scheme://$host/remote.php/dav;";
};
};
};
};
};
sops.secrets.nextcloud_database_password.owner = "nextcloud";
sops.secrets.nextcloud_root_password.owner = "nextcloud";
users.users.nextcloud = {
isSystemUser = true;
uid = nextcloudUid;
group = "nextcloud";
};
2024-04-10 09:46:17 +02:00
users.groups.nextcloud.gid = nextcloudGid;
2023-12-09 17:15:50 +01:00
# Container Setup
# ===============
#
# running:
# * nextcloud (php)
# * mysql
containers.nextcloud = {
# mount host folders
bindMounts = {
rootpassword = {
hostPath = "/run/secrets/nextcloud_root_password";
mountPoint = "/run/secrets/nextcloud_root_password";
isReadOnly = true;
};
databasepassword = {
hostPath = "/run/secrets/nextcloud_database_password";
mountPoint = "/run/secrets/nextcloud_database_password";
isReadOnly = true;
};
};
2024-04-10 09:46:17 +02:00
privateNetwork = false;
2023-12-09 17:15:50 +01:00
autoStart = true;
2024-05-18 12:02:21 +02:00
config = { config, lib, ... }: {
nixpkgs.pkgs = pkgs;
imports = [ ./container-monitoring.nix ];
promtail.port = 3502;
system.stateVersion = "23.11";
2023-12-09 17:15:50 +01:00
# Configuring nameservers for containers is currently broken.
# Therefore in some cases internet connectivity can be broken inside the containers.
# A temporary workaround is to manually write the /etc/nixos/resolv.conf file like this:
2024-04-10 09:46:17 +02:00
#environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
2023-12-09 17:15:50 +01:00
users.users.nextcloud.uid = nextcloudUid;
services.nginx = {
2024-04-10 09:46:17 +02:00
defaultListen = [
{ addr = "0.0.0.0"; port = nextcloudPort; }
];
2023-12-09 17:15:50 +01:00
# Use recommended settings
recommendedGzipSettings = lib.mkDefault true;
recommendedOptimisation = lib.mkDefault true;
recommendedProxySettings = lib.mkDefault true;
recommendedTlsSettings = lib.mkDefault true;
};
# nextcloud database
# ==================
#
# set user password:
# -----------------
# #> mysql
# mysql> ALTER USER 'nextcloud'@'localhost' IDENTIFIED BY 'nextcloud-password';
#
# recreate database:
# ------------------
# mysql> DROP DATABASE nextcloud;
# mysql> CREATE DATABASE nextcloud;
#
# migration:
# ----------
# nextcloud-occ db:convert-type --all-apps mysql nextcloud 127.0.0.1 nextcloud
#
# 4-byte stuff:
# -------------
# https://docs.nextcloud.com/server/18/admin_manual/configuration_database/mysql_4byte_support.html
# if you do this don't forget --default-character-set=utf8mb4 for mysqldump
services.mysql = {
enable = true;
2024-04-10 09:46:17 +02:00
package = mySQLPackage;
2023-12-09 17:15:50 +01:00
# https://nixos.org/manual/nixos/stable/release-notes.html#sec-release-20.09-incompatibilities
ensureDatabases = [ "nextcloud" ];
ensureUsers = [{
name = "nextcloud";
ensurePermissions = { "nextcloud.*" = "ALL PRIVILEGES"; };
}];
settings.mysqld = {
innodb_large_prefix = true;
innodb_file_format = "barracuda";
innodb_file_per_table = 1;
innodb_read_only_compressed = 0;
};
};
# Backup database
# ---------------
services.mysqlBackup = {
enable = true;
databases = config.services.mysql.ensureDatabases;
singleTransaction = true;
};
systemd.services."mysql-backup".serviceConfig = {
ExecStartPre = [ "+/run/current-system/sw/bin/nextcloud-occ maintenance:mode --on" ];
ExecStopPost = [ "+/run/current-system/sw/bin/nextcloud-occ maintenance:mode --off" ];
};
# in php
services.phpfpm = {
2024-04-10 09:46:17 +02:00
phpPackage = phpPackage;
2023-12-09 17:15:50 +01:00
phpOptions = ''
opcache.revalidate_freq = 10
'';
};
# nextcloud setup
services.nextcloud = {
enable = true;
2024-04-10 09:46:17 +02:00
package = nextcloudPackage;
2023-12-09 17:15:50 +01:00
autoUpdateApps.enable = true;
2024-04-10 09:46:17 +02:00
hostName = nextcloudHostName;
2023-12-09 17:15:50 +01:00
logLevel = 2;
https = true;
config = {
adminpassFile = "/run/secrets/nextcloud_root_password";
overwriteProtocol = "https";
dbtype = "mysql";
dbpassFile = "/run/secrets/nextcloud_database_password";
dbport = 3306;
defaultPhoneRegion = "DE";
};
};
};
};
}