Compare commits

...

4 commits

9 changed files with 258 additions and 6 deletions

View file

@ -9,5 +9,6 @@ in
forgejo.enable = mkEnableOption "forgejo";
kavita.enable = mkEnableOption "kavita";
samba.enable = mkEnableOption "samba";
nextcloud.enable = mkEnableOption "nextcloud";
};
}

View file

@ -33,6 +33,7 @@
forgejo.enable = true;
kavita.enable = true;
samba.enable = true;
nextcloud.enable = true;
};
};
}

View file

@ -1,5 +1,4 @@
forgejo: ENC[AES256_GCM,data:w/qGCqEsbzhgCmGiy4pqvwjEbIWhOIPjQyQyNtbiBzadrFxG6+cxFQJ1gY/q9tENuogKoVdCtKdHYONM6gs+yd3+/Xk=,iv:u5P7so4J3OeHmnf33ss2X7f8GAA04I0/mw1/MUy6C3Y=,tag:nYhY/ecas7dPYP6FwEnOsg==,type:str]
cockpit: ENC[AES256_GCM,data:5/ztOP1mJwKlcLS0RLqbre2nMOphIg59+/Dqz3njZW7jDJm37gMdgaPpY+eA5IWBMW7gZNCcVA==,iv:mmGsqA7U3rzhZ40BUReMlDaKxzKsDTw0mSZzcpu2QB4=,tag:jwmqiMGbENjX4B8GbPHcjw==,type:str]
router: ENC[AES256_GCM,data:AulD1VVGGYhEEnHEr8TSYLfMyA14BfTUF3QKxlKpbH7G5Eo/CGZaTSQYBzehgmNZKVAZAG1Efe60aSNhlk1ZlGxMnODGw1wV/dAnuTrqd7ixEE/hz9hO1qr1daWRmb73jQpw3XmFeAHBl4XnLIhdLFNXKEcgZBJ7piw5ZXDpG5EhaUrPhKpRMQb+yPkA9eBTI023iFOiJ8du1TF0RuqTUExUSCkcVaNgpn0pwd5tgnM/gAg7SJ0MGNRPaVL0Bq2S5e6SSO90mFcXPEQDk/1jy3Ml7ZFFQ9GrN612X3j2lYLKcwfBH5327pU=,iv:UBxOzdVt8Nof+I/H2wY0Tng8rrKZyt3fPRVLzygxIuo=,tag:TIWvIFy2QGkP1qMlnnMlbQ==,type:str]
sops:
kms: []
gcp_kms: []
@ -15,8 +14,8 @@ sops:
OTBPaGdUZ1ZueUlKMVlhOHBreFV6OVEKBhcqTTA9Vufnn/WAhR5zb08Nsn48zmD2
+bdJf+0B68Z57Q/47fNjvXclqLdDCWToTlIjOTnzVH2oXOWKQQxj6g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-06-13T06:44:09Z"
mac: ENC[AES256_GCM,data:S0/He8nAYp524SIteg1bd7aa4b7OJ2jshP/x+m9Grt+9fI8ZN42XpcW/u7JA6xV2eAJ7ZS4YBt965V6ttJu/Ric0xRzdG/evK9zrG0CFcoY8Di9eBU/KqBSyXxO7E/ZYamp9AQpkO9KzsSBYYStkZe4FjPy/5o4bSCjkLOIPO1w=,iv:OR42uFaNxMHAdaq1JZLz4B+cPZPJw5TP97W+rbHckK0=,tag:BXKF4WSHDZ63eyzNNBR2JA==,type:str]
lastmodified: "2024-06-13T13:48:11Z"
mac: ENC[AES256_GCM,data:LjWV/1NPeN58VHH/lgHTukHHDu0zfqCCLeFoVS4yN91IkjdvvqwvTD74GDigw7lm++6LWILjF0zIlryUHJKg4T+Xztsj/kRntVuhSTXsDUU9mu/AOCLu5P7k4fn+N9rAMh5ML9ukeU+ZxTaOHLfezYMLv2c+01B1iMfjZ2qJ9Q4=,iv:Dh4WG98sfRUrTYnbfrZt0gX0co8lI8DUpdxFMy165GI=,tag:9Nn9UcKijyu6RhUjiUDd4g==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

22
secrets/nextcloud.yaml Normal file
View file

@ -0,0 +1,22 @@
nextcloud:
homeserver: ENC[AES256_GCM,data:ZX0LfvXQ1h1LInuvRajKpyhAP8AbyGbTs40=,iv:gpADsYG655zUdDC+j0idtVdMCmwjWSFhSJ2Us0BgBkM=,tag:JPHrZ0YZSEI+AqUm6Bb48Q==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1kruum2varzua7w5n6n52vhwyek2arc685rhcwt0u7k2jf5mecsjslkl9ll
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPeWIrNllOYlhnd3FYZGls
TUdDaSs0RHhVMHBxRFJwSWFxS0N5WVUxYXhNCmRTdnNMQy9TMDd1MUxLYSt0OEs5
VTg4TnpqVUdEY1Ywa280NktQYnVVUDgKLS0tIExtUjZXdTViMklLYVFqOHBkQnBV
bDN6M1ZEK3ZsdW5ydHNIc282TVo4YVkKeOgUwUJanhOn034l2B6Xp0UxogGP0/US
Bl+Mt+MYolkkNo3CT6w1bmsDXEDOb1Za8lmsMM1OH13bVpSQ/ygVzQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-06-13T16:14:14Z"
mac: ENC[AES256_GCM,data:QbHr/M2lcH0RFMHA5w+cdft803ZeDLgD7k45/gtM+09PmmQG4UMoHns4PoSxBtHUQkjNtHo53jet+sduC5fuO4Rek8xNsgmoIk7Zd46UU8I4QLxGcXLLWyOvddvR2LH5JpQCXbfHULJBynZskBtTntPg2h9F13PuTehOM0lHykM=,iv:su2ZOOK2v8x9vLgCcGTUJTSREMcxCAQXvhC/FKMk4nU=,tag:t5G+vnMw2KgiWYpSqQN1Cw==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

View file

@ -11,5 +11,11 @@ in
import /etc/caddy/sites-enabled/*
'';
};
sops.secrets."router" = {
sopsFile = ../../secrets/caddy_reverse_proxy.yaml;
path = "/etc/caddy/sites-enabled/router";
mode = "0444";
};
};
}

View file

@ -5,5 +5,6 @@
./cockpit.nix
./forgejo.nix
./samba.nix
./nextcloud.nix
];
}

View file

@ -6,6 +6,11 @@ in
{
config = mkIf cfg.enable {
services.caddy.virtualHosts."git.tigor.web.id".extraConfig = ''
@home_not_login {
not header_regexp Cookie gitea_incredible
path /
}
redir @home_not_login /Tigor
reverse_proxy * unix//run/forgejo/forgejo.sock
'';
@ -13,11 +18,11 @@ in
services.forgejo = {
enable = true;
settings = {
server = {
server = rec {
PROTOCOL = "http+unix";
DOMAIN = "git.tigor.web.id";
HTTP_PORT = 443;
ROOT_URL = "https://${config.services.forgejo.settings.server.DOMAIN}:${toString config.services.forgejo.settings.server.HTTP_PORT}";
ROOT_URL = "https://${DOMAIN}:${toString HTTP_PORT}";
};
service = {
DISABLE_REGISTRATION = true;

View file

@ -0,0 +1,175 @@
# Directly ripped from https://github.com/onny/nixos-nextcloud-testumgebung/blob/main/nextcloud-extras.nix
{ config
, lib
, ...
}:
let
inherit
(lib)
optionalString
escapeShellArg
types
concatStringsSep
mapAttrsToList
mkIf
mkOption
mkDefault
mkForce
;
cfg = config.services.nextcloud;
fpm = config.services.phpfpm.pools.nextcloud;
webserver = config.services.${cfg.webserver};
in
{
options = {
services.nextcloud = {
ensureUsers = mkOption {
default = { };
description = lib.mdDoc ''
List of user accounts which get automatically created if they don't
exist yet. This option does not delete accounts which are not listed
anymore.
'';
example = {
user1 = {
passwordFile = /secrets/user1-localhost;
email = "user1@localhost";
};
user2 = {
passwordFile = /secrets/user2-localhost;
email = "user2@localhost";
};
};
type = types.attrsOf (types.submodule {
options = {
passwordFile = mkOption {
type = types.path;
example = "/path/to/file";
default = null;
description = lib.mdDoc ''
Specifies the path to a file containing the
clear text password for the user.
'';
};
email = mkOption {
type = types.str;
example = "user1@localhost";
default = null;
};
};
});
};
webserver = mkOption {
type = types.enum [ "nginx" "caddy" ];
default = "nginx";
description = ''
Whether to use nginx or caddy for virtual host management.
Further nginx configuration can be done by adapting <literal>services.nginx.virtualHosts.&lt;name&gt;</literal>.
See <xref linkend="opt-services.nginx.virtualHosts"/> for further information.
'';
};
};
};
config = mkIf cfg.enable {
systemd.services.nextcloud-ensure-users = {
enable = true;
script = ''
${optionalString (cfg.ensureUsers != {}) ''
${concatStringsSep "\n" (mapAttrsToList (name: cfg: ''
if ${config.services.nextcloud.occ}/bin/nextcloud-occ user:info "${name}" | grep "user not found"; then
export OC_PASS="$(cat ${escapeShellArg cfg.passwordFile})"
${config.services.nextcloud.occ}/bin/nextcloud-occ user:add --password-from-env "${name}"
fi
if ! ${config.services.nextcloud.occ}/bin/nextcloud-occ user:info "${name}" | grep "user not found"; then
${optionalString (cfg.email != null) ''
${config.services.nextcloud.occ}/bin/nextcloud-occ user:setting "${name}" settings email "${cfg.email}"
''}
fi
'') cfg.ensureUsers)}
''}
'';
wantedBy = [ "multi-user.target" ];
after = [ "nextcloud-setup.service" ];
};
services.phpfpm.pools.nextcloud.settings = {
"listen.owner" = webserver.user;
"listen.group" = webserver.group;
};
users.groups.nextcloud.members = [ "nextcloud" webserver.user ];
services.nginx = lib.mkIf (cfg.webserver == "caddy") {
enable = mkForce false;
};
services.caddy = lib.mkIf (cfg.webserver == "caddy") {
enable = mkDefault true;
virtualHosts."${if cfg.https then "https" else "http"}://${cfg.hostName}" = {
extraConfig = ''
encode zstd gzip
root * ${config.services.nginx.virtualHosts.${cfg.hostName}.root}
redir /.well-known/carddav /remote.php/dav 301
redir /.well-known/caldav /remote.php/dav 301
redir /.well-known/* /index.php{uri} 301
redir /remote/* /remote.php{uri} 301
header {
Strict-Transport-Security max-age=31536000
Permissions-Policy interest-cohort=()
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
Referrer-Policy no-referrer
X-XSS-Protection "1; mode=block"
X-Permitted-Cross-Domain-Policies none
X-Robots-Tag "noindex, nofollow"
-X-Powered-By
}
php_fastcgi unix/${fpm.socket} {
root ${config.services.nginx.virtualHosts.${cfg.hostName}.root}
env front_controller_active true
env modHeadersAvailable true
}
@forbidden {
path /build/* /tests/* /config/* /lib/* /3rdparty/* /templates/* /data/*
path /.* /autotest* /occ* /issue* /indie* /db_* /console*
not path /.well-known/*
}
error @forbidden 404
@immutable {
path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite
query v=*
}
header @immutable Cache-Control "max-age=15778463, immutable"
@static {
path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite
not query v=*
}
header @static Cache-Control "max-age=15778463"
@woff2 path *.woff2
header @woff2 Cache-Control "max-age=604800"
file_server
'';
};
};
};
}

View file

@ -0,0 +1,42 @@
{ config, lib, pkgs, ... }:
let
cfg = config.profile.services.nextcloud;
in
{
imports = [ ./nextcloud-extras.nix ];
config = lib.mkIf cfg.enable {
users.groups.nextcloud.members = [ config.profile.user.name ];
sops.secrets =
let
opts = {
owner = "nextcloud";
sopsFile = ../../secrets/nextcloud.yaml;
};
in
{
"nextcloud/homeserver" = opts;
};
# Do not set services.nextcloud.home. Issues with sandboxing nature of NixOS.
# Instead uses bind mount and fstab to mount seeked directory to /var/lib/nextcloud.
fileSystems."/nas/nextcloud" = {
device = "/var/lib/nextcloud";
fsType = "none";
options = [ "bind" ];
};
services.nextcloud =
let
secrets = config.sops.secrets;
in
{
enable = true;
https = true;
webserver = "caddy";
hostName = "nextcloud.tigor.web.id"; # The nextcloud-extras will ensure Caddy to take care of this.
config = {
adminuser = "homeserver";
adminpassFile = secrets."nextcloud/homeserver".path;
};
};
};
}