156 lines
3.8 KiB
Nix
156 lines
3.8 KiB
Nix
{ self, pkgs, config, lib, ... }:
|
|
|
|
{
|
|
imports = [
|
|
./nextcloud-apps.nix
|
|
];
|
|
|
|
age.secrets.nextcloud_db_pass = {
|
|
owner = "nextcloud";
|
|
group = "nextcloud";
|
|
file = "${self}/secrets/cube_nextcloud_db_pass.age";
|
|
};
|
|
|
|
age.secrets.nextcloud_admin_pass = {
|
|
owner = "nextcloud";
|
|
group = "nextcloud";
|
|
file = "${self}/secrets/cube_nextcloud_admin_pass.age";
|
|
};
|
|
|
|
# HTTP
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
|
|
virtualHosts."data.gssws.de" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
};
|
|
};
|
|
|
|
# DATABASES
|
|
services.postgresql = {
|
|
enable = true;
|
|
package = pkgs.postgresql_11;
|
|
|
|
settings = {
|
|
max_connections = "200";
|
|
};
|
|
|
|
ensureDatabases = [ "nextcloud" ];
|
|
ensureUsers = [
|
|
{
|
|
name = "nextcloud";
|
|
ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
|
|
}
|
|
];
|
|
};
|
|
|
|
# REDIS
|
|
services.redis.servers = {
|
|
"nextcloud".enable = true;
|
|
};
|
|
|
|
users.groups."redis-nextcloud".members = [ "nextcloud" ];
|
|
|
|
# Collabora Code server
|
|
virtualisation.oci-containers.containers."nextcloud-collabora-code" = {
|
|
image = "collabora/code";
|
|
autoStart = true;
|
|
ports = [ "127.0.0.1:9980:9980" ];
|
|
environment.domain = "data\\.gssws\\.de";
|
|
extraOptions = [ "--cap-add" "MKNOD" ];
|
|
};
|
|
|
|
services.nginx.virtualHosts."office.gssws.de" =
|
|
let
|
|
proxyPass = "https://127.0.0.1:9980";
|
|
extraConfig = "proxy_ssl_verify off;";
|
|
in
|
|
{
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
|
|
locations."^~ /browser" = {
|
|
inherit proxyPass extraConfig;
|
|
};
|
|
locations."^~ /hosting/discovery" = {
|
|
inherit proxyPass extraConfig;
|
|
};
|
|
locations."^~ /hosting/capabilities" = {
|
|
inherit proxyPass extraConfig;
|
|
};
|
|
locations."~ ^/cool/(.*)/ws''$" = {
|
|
inherit proxyPass extraConfig;
|
|
proxyWebsockets = true;
|
|
};
|
|
locations."~ ^/(c|l)ool" = {
|
|
inherit proxyPass extraConfig;
|
|
};
|
|
locations."^~ /cool/adminws" = {
|
|
inherit proxyPass extraConfig;
|
|
proxyWebsockets = true;
|
|
};
|
|
};
|
|
|
|
# NEXTCLOUD
|
|
systemd.services."nextcloud-setup" = {
|
|
requires = [ "postgresql.service" ];
|
|
after = [ "postgresql.service" ];
|
|
};
|
|
services.nextcloud = {
|
|
enable = true;
|
|
package = pkgs.nextcloud24;
|
|
hostName = "data.gssws.de";
|
|
https = true;
|
|
datadir = "/mnt/internal/nextcloud";
|
|
|
|
caching.apcu = true;
|
|
caching.redis = true;
|
|
|
|
phpPackage = lib.mkForce pkgs.php81;
|
|
|
|
poolSettings = {
|
|
"pm" = "dynamic";
|
|
"pm.max_children" = "128";
|
|
"pm.start_servers" = "64";
|
|
"pm.min_spare_servers" = "32";
|
|
"pm.max_spare_servers" = "76";
|
|
"pm.max_requests" = "500";
|
|
};
|
|
|
|
phpOptions = {
|
|
short_open_tag = "Off";
|
|
expose_php = "Off";
|
|
error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
|
|
display_errors = "stderr";
|
|
"opcache.enable_cli" = "1";
|
|
"opcache.interned_strings_buffer" = "32";
|
|
"opcache.max_accelerated_files" = "100000";
|
|
"opcache.memory_consumption" = "256";
|
|
"opcache.revalidate_freq" = "1";
|
|
"opcache.fast_shutdown" = "1";
|
|
"openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
|
|
catch_workers_output = "yes";
|
|
};
|
|
|
|
config = {
|
|
overwriteProtocol = "https";
|
|
|
|
dbtype = "pgsql";
|
|
dbuser = "nextcloud";
|
|
dbhost = "/run/postgresql";
|
|
dbname = "nextcloud";
|
|
dbpassFile = "/run/agenix/nextcloud_db_pass";
|
|
adminpassFile = "/run/agenix/nextcloud_admin_pass";
|
|
adminuser = "admin";
|
|
|
|
trustedProxies = [ "80.244.242.2" ];
|
|
defaultPhoneRegion = "DE";
|
|
};
|
|
};
|
|
}
|