palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

working on nextcloud on orbi

Browse source
This commit is contained in:
Ingolf Wagner 2024-04-10 09:46:17 +02:00
parent 362b209f8c
commit cc2a2a3a75
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
2 changed files with 42 additions and 125 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/machines/orbi/configuration.nix
View file

@ -13,7 +13,7 @@
#./borg.nix #./borg.nix
#./codimd.nix #./codimd.nix
#./gitea.nix #./gitea.nix
#./nextcloud.nix ./nextcloud.nix
#./packages.nix #./packages.nix
#./taskserver.nix #./taskserver.nix
#./vaultwarden.nix #./vaultwarden.nix

165
nixos/machines/orbi/nextcloud.nix
View file

@ -4,38 +4,20 @@
# ------------------------------------------------- # -------------------------------------------------
# https://docs.nextcloud.com/server/stable/admin_manual/maintenance/backup.html # https://docs.nextcloud.com/server/stable/admin_manual/maintenance/backup.html
# https://docs.nextcloud.com/server/stable/admin_manual/maintenance/upgrade.html # https://docs.nextcloud.com/server/stable/admin_manual/maintenance/upgrade.html
#
# ! use lvm snapshots to do rollback !
let let
hostInterface = "enp3s0";
hostAddress = "192.168.100.10";
containerAddress = "192.168.100.11";
nextcloudUid = 1000; nextcloudUid = 1000;
borg_backup_folder = "/media/syncthing/nextcloud_backup/robi"; nextcloudGid = 1000;
nextcloudPort = 8080;
nextcloudHostName = "cloud.ingolf-wagner.de";
phpPackage = pkgs.php73;
nextcloudPackage = pkgs.nextcloud28;
mySQLPackage = pkgs.mysql;
in in
{ {
# Host Setup
# ==========
# give containers internet access
networking.nat.enable = true;
networking.nat.internalInterfaces = [ "ve-nextcloud" ];
networking.nat.externalInterface = hostInterface;
# don't let networkmanager manger container network
networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
# open ports for logging
#networking.firewall.interfaces."ve-nextcloud".allowedTCPPorts =
# [ 5044 12304 12305 ];
#networking.firewall.interfaces."ve-nextcloud".allowedUDPPorts =
# [ 5044 12304 12305 ];
# host nginx # host nginx
# ---------- # ----------
@ -46,14 +28,14 @@ in
enable = true; enable = true;
recommendedProxySettings = true; recommendedProxySettings = true;
virtualHosts = { virtualHosts = {
"nextcloud.ingolf-wagner.de" = { "${nextcloudHostName}" = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
locations = { locations = {
"/" = { "/" = {
proxyPass = "http://${containerAddress}"; proxyPass = "http://localhost:${toString nextcloudPort}";
extraConfig = '' extraConfig = ''
sub_filter "http://nextcloud.ingolf-wagner.de" "https://nextcloud.ingolf-wagner.de"; sub_filter "http://${nextcloudHostName}" "https://${nextcloudHostName}";
# used for view/edit office file via Office Online Server # used for view/edit office file via Office Online Server
client_max_body_size 0; client_max_body_size 0;
proxy_buffering off; # to download files bigger than 1GB proxy_buffering off; # to download files bigger than 1GB
@ -67,28 +49,6 @@ in
priority = 210; priority = 210;
extraConfig = "return 301 $scheme://$host/remote.php/dav;"; extraConfig = "return 301 $scheme://$host/remote.php/dav;";
}; };
#"~ .(?:css|js|svg|gif)$" = {
# proxyPass = "http://${containerAddress}$request_uri";
# extraConfig = ''
# expires 6M; # Cache-Control policy borrowed from `.htaccess`
# access_log off; # Optional: Don't log access to assets
# sub_filter "http://nextcloud.ingolf-wagner.de" "https://nextcloud.ingolf-wagner.de";
# sub_filter "nextcloud.workhorse.private" "nextcloud.ingolf-wagner.de";
# # used for view/edit office file via Office Online Server
# client_max_body_size 0;
# '';
#};
#"~ .woff2?$" = {
# proxyPass = "http://${containerAddress}$request_uri";
# extraConfig = ''
# expires 7d; # Cache-Control policy borrowed from `.htaccess`
# access_log off; # Optional: Don't log access to assets
# sub_filter "http://nextcloud.ingolf-wagner.de" "https://nextcloud.ingolf-wagner.de";
# sub_filter "nextcloud.workhorse.private" "nextcloud.ingolf-wagner.de";
# # used for view/edit office file via Office Online Server
# client_max_body_size 0;
# '';
#};
}; };
}; };
}; };
@ -102,7 +62,7 @@ in
uid = nextcloudUid; uid = nextcloudUid;
group = "nextcloud"; group = "nextcloud";
}; };
users.groups.nextcloud = { }; users.groups.nextcloud.gid = nextcloudGid;
# Container Setup # Container Setup
@ -126,34 +86,28 @@ in
isReadOnly = true; isReadOnly = true;
}; };
home = { #home = {
# make sure this folder exist on the host # # make sure this folder exist on the host
hostPath = toString "/var/lib/nextcloud"; # hostPath = toString "/var/lib/nextcloud";
mountPoint = "/var/lib/nextcloud"; # mountPoint = "/var/lib/nextcloud";
isReadOnly = false; # isReadOnly = false;
}; #};
db = { #db = {
# make sure this folder exist on the host # # make sure this folder exist on the host
hostPath = toString "/var/lib/nextcloud_mysql"; # hostPath = toString "/var/lib/nextcloud_mysql";
mountPoint = "/var/lib/mysql"; # mountPoint = "/var/lib/mysql";
isReadOnly = false; # isReadOnly = false;
}; #};
media = { #media = {
#mountPoint = toString config.services.syncthing.folders.media.path; # #mountPoint = toString config.services.syncthing.folders.media.path;
#hostPath = toString config.services.syncthing.folders.media.path; # #hostPath = toString config.services.syncthing.folders.media.path;
mountPoint = "/media/syncthing/media"; # mountPoint = "/media/syncthing/media";
hostPath = "/media/media"; # hostPath = "/media/media";
isReadOnly = true; # isReadOnly = true;
}; #};
}; };
# container network setup privateNetwork = false;
# see also nating on host system.
privateNetwork = true;
hostAddress = hostAddress;
localAddress = containerAddress;
autoStart = true; autoStart = true;
config = { config, pkgs, lib, ... }: { config = { config, pkgs, lib, ... }: {
@ -161,13 +115,16 @@ in
# Configuring nameservers for containers is currently broken. # Configuring nameservers for containers is currently broken.
# Therefore in some cases internet connectivity can be broken inside the containers. # Therefore in some cases internet connectivity can be broken inside the containers.
# A temporary workaround is to manually write the /etc/nixos/resolv.conf file like this: # A temporary workaround is to manually write the /etc/nixos/resolv.conf file like this:
environment.etc."resolv.conf".text = "nameserver 8.8.8.8"; #environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
system.stateVersion = "21.05"; system.stateVersion = "23.11";
users.users.nextcloud.uid = nextcloudUid; users.users.nextcloud.uid = nextcloudUid;
services.nginx = { services.nginx = {
defaultListen = [
{ addr = "0.0.0.0"; port = nextcloudPort; }
];
# Use recommended settings # Use recommended settings
recommendedGzipSettings = lib.mkDefault true; recommendedGzipSettings = lib.mkDefault true;
recommendedOptimisation = lib.mkDefault true; recommendedOptimisation = lib.mkDefault true;
@ -175,8 +132,8 @@ in
recommendedTlsSettings = lib.mkDefault true; recommendedTlsSettings = lib.mkDefault true;
}; };
networking.firewall.allowedTCPPorts = [ 80 ]; #networking.firewall.allowedTCPPorts = [ 80 ];
networking.firewall.allowedUDPPorts = [ 80 ]; #networking.firewall.allowedUDPPorts = [ 80 ];
# nextcloud database # nextcloud database
# ================== # ==================
@ -201,7 +158,7 @@ in
# if you do this don't forget --default-character-set=utf8mb4 for mysqldump # if you do this don't forget --default-character-set=utf8mb4 for mysqldump
services.mysql = { services.mysql = {
enable = true; enable = true;
package = pkgs.mysql; package = mySQLPackage;
# https://nixos.org/manual/nixos/stable/release-notes.html#sec-release-20.09-incompatibilities # https://nixos.org/manual/nixos/stable/release-notes.html#sec-release-20.09-incompatibilities
ensureDatabases = [ "nextcloud" ]; ensureDatabases = [ "nextcloud" ];
ensureUsers = [{ ensureUsers = [{
@ -222,7 +179,6 @@ in
enable = true; enable = true;
databases = config.services.mysql.ensureDatabases; databases = config.services.mysql.ensureDatabases;
singleTransaction = true; singleTransaction = true;
location = "/var/lib/nextcloud/database_backups";
}; };
systemd.services."mysql-backup".serviceConfig = { systemd.services."mysql-backup".serviceConfig = {
ExecStartPre = [ "+/run/current-system/sw/bin/nextcloud-occ maintenance:mode --on" ]; ExecStartPre = [ "+/run/current-system/sw/bin/nextcloud-occ maintenance:mode --on" ];
@ -231,7 +187,7 @@ in
# in php # in php
services.phpfpm = { services.phpfpm = {
phpPackage = pkgs.php73; phpPackage = phpPackage;
phpOptions = '' phpOptions = ''
opcache.revalidate_freq = 10 opcache.revalidate_freq = 10
''; '';
@ -240,17 +196,16 @@ in
# nextcloud setup # nextcloud setup
services.nextcloud = { services.nextcloud = {
enable = true; enable = true;
package = pkgs.nextcloud27; package = nextcloudPackage;
autoUpdateApps.enable = true; autoUpdateApps.enable = true;
# nginx.enable = true; # nginx.enable = true;
# enableBrokenCiphersForSSE = false; # see https://github.com/NixOS/nixpkgs/pull/198470 # enableBrokenCiphersForSSE = false; # see https://github.com/NixOS/nixpkgs/pull/198470
hostName = "nextcloud.ingolf-wagner.de"; hostName = nextcloudHostName;
logLevel = 2; logLevel = 2;
https = true; https = true;
config = { config = {
adminpassFile = "/run/secrets/nextcloud_root_password"; adminpassFile = "/run/secrets/nextcloud_root_password";
overwriteProtocol = "https"; overwriteProtocol = "https";
trustedProxies = [ "144.76.13.147" hostAddress ];
dbtype = "mysql"; dbtype = "mysql";
dbpassFile = "/run/secrets/nextcloud_database_password"; dbpassFile = "/run/secrets/nextcloud_database_password";
dbport = 3306; dbport = 3306;
@ -260,42 +215,4 @@ in
}; };
}; };
# Backup Config
# -------------
#backup.dirs = [
# "/home/nextcloud/config"
# "/home/nextcloud/database_backups" # created by mysqlBackup
#];
# Backup Files
# ------------
services.borgbackup.jobs = {
"nextcloud-to-media" = {
repo = borg_backup_folder;
# make sure syncthing is capable of reading the files
postHook = ''
chown -R syncthing:syncthing ${borg_backup_folder}
'';
compression = "lz4";
paths = [
"/var/lib/nextcloud/data/tina/files"
"/var/lib/nextcloud/data/palo/files"
"/var/lib/nextcloud/data/palo-windows/files"
];
doInit = true;
encryption = {
mode = "repokey-blake2";
passCommand = "cat ${config.sops.secrets.backup_repository_passphrase.path}";
};
startAt = "0/3:00:00";
prune.keep = {
within = "2d"; # Keep all backups in the last 10 days.
daily = 10; # Keep 10 additional end of day archives
weekly = 8; # Keep 8 additional end of week archives.
month = 8; # Keep 8 additional end of month archives.
};
};
};
} }