From 3507a04fcee4b413ff99d5a3cd77d6f188eb1264 Mon Sep 17 00:00:00 2001 From: Jurn Wubben Date: Tue, 29 Jul 2025 11:03:04 +0200 Subject: [PATCH 1/3] DerekBot: breadbot update --- secrets/bread-dcbot.age | Bin 1009 -> 1124 bytes system/server/derekBot.nix | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/secrets/bread-dcbot.age b/secrets/bread-dcbot.age index 81ae673fa70e39c73ce58ef4fbae133889cf1f74..e65c88bd9b882ef55c2e2bf2f372502f7b60c6d3 100644 GIT binary patch delta 1038 zcmey!{)A(KPQ6EJN^WFQZltk)g_mP~l7B|Fcc`zse`3C~QASCXp|fvURZdxMN^wbf zAeTvcuzpZjSZP?OaiP0KM3QGoRB=>Zs7JA7s7XprXl`JoNuXI?h_-u$374*&LUD11 zZfc5=si~o*f^S-od6=U@Zb6Bkc7%43rDt(^U`l{tlv|3Cp>I)Tg=LasO177CNWQOU zpl^U{s)cbVSCBLGLtJ3D+(i%0&>k=obs|gGn`zx4DzBp^E0(mvy2Q&i*r&# z1Ii-;{8B<)%aTkB(u4fH{R1p>(%dTC9gAHjpJf!U4@=J|jwlZ_@U(RCvM{O0ckxe* z$V_r_42Uo^Gmdhy46bktOA9qjD$H=@@-a5jb_uU^&NdAUO}8|O$V+wgaVZG$N^~`M z%yLPO@~QBuD2u2}@yPW>kAbkjN;88%g;WcpKo4z~0`26`#H7kVNA3FTydaabO3!>Z zGb8=b3In5JeV2?%@3JbVa;}ncUq{nS%UrLBaC4IgBkv&d5(D#aZPSXVK+~#%+^RGm z!wi4_^b%8pY%X10U4_sLZJ+EaQ{ONz-=xf-l-#HcqmsakfZ~u0uRyOXC*xHA3{St5 zfPmugY_6owC*7PxxYO#V9qBnPrky1g?dB4!AHP!Ykw?*ShAZ*&?WW5H`QF<8{?;$H ze{N0DOq-Y*@+#)-TVnH+A#0z_>m7o}iv14O=1%0<~`}XIKa{y(=}b zk9Xa3=~LIm1mpgO^W9~)C9YVlJCk*?=<@MyZHu{wz9|V?Uhb{9BY&*?<9o$>e{BU< zCOFDOHx_?7=b&(K%|gy*KCzCAFMk(I_#X7^@J=}J06^~CCSD@KVi+ehD?T5vJ-)(#I=J%63H@?M59lq1`Jtk%T zVaHj{3jbWpcjO+zMV_AM7m#v$|AAkYqEqtz N9JOV&E^n9g0RWm|lPv%M delta 922 zcmaFD@sWLkPJMobw||6Bes-dxiFsLYKxl?@ev)@oUa(hiZb(F=sfSyVf3CSvM6ypt zK37mixN};#uV;Efw^&Hpm)A+aao~xB$uw8LUD11 zZfc5=si~o*f^S-od6=U@Zm6?&qN|yAiBGv}VTGYbsGFCMb4t07vyZF3S8h^KaZYKt zo3me@t3g#VS46l)W<|1TSU_ZOrc+soTZzBBVX$XnWl?UBd2w#3L8NwguyaPCXOX|> z#E;_PQKqh`5dl#qrQVi>1tEFH5tf13e(AY|VZp)4k=mxgewE>dX=&Ptmf@aUfg$N- z7U5yq1-`~c{;7^Z=AJ2zo~eZ?k-?Q&?m<(Ji3U%=*_Y95jtTM{Y@hlH2cJ<2l zDlqVN&rON)iwN^G*AELskAbkjN;88%g*?N^LhX$F(DJOzBCpcoB#-*whz!RZFPA_! zSBngv^88Y_vOGCpgb3o zP_OigVlJ`vt%uVtEL&f1pwwe~=U_J1)mv%ZOi2M=+ve@{NUL4 z{CDg6w(r+2C#E&~9M|gT zagWaAf=5d#B7faYpS?TiO!cN$jfcKXc<}x9?F+pJ!-5x|@RX~I>{f^i(0IAuo@1)$ ztc{y^|C!HrF)@2;cHgyh^_n?X0(X9Sdb77dY+n^eQEvR2X=ndfrWvYLF10?dKb`sf xcd_YqGmMVBSv`I8;+&Uuy|1+w`fXir+9kMWhEIM2PfW)3WhQ3EpA9zK0{{fwV@Uu2 diff --git a/system/server/derekBot.nix b/system/server/derekBot.nix index 4c5791f..c71da3d 100644 --- a/system/server/derekBot.nix +++ b/system/server/derekBot.nix @@ -53,7 +53,7 @@ in { cd "${programDir}" git fetch - git reset --hard HEAD + git reset --hard origin/HEAD DENO_DIR=${denoDir} deno i ''; From 1f8a4e0e79a940dfedd8bcd97367bfdcfe5d3c2e Mon Sep 17 00:00:00 2001 From: Jurn Wubben Date: Fri, 25 Jul 2025 14:40:16 +0200 Subject: [PATCH 2/3] Added base nexcloud --- secrets/default.nix | 4 ++ secrets/nextcloud-admin-pass.age | 17 +++++ secrets/secrets.nix | 1 + system/server/default.nix | 1 + system/server/nextcloud.nix | 109 +++++++++++++++++++++++++++++++ 5 files changed, 132 insertions(+) create mode 100644 secrets/nextcloud-admin-pass.age create mode 100644 system/server/nextcloud.nix diff --git a/secrets/default.nix b/secrets/default.nix index b2ffdcc..eb03533 100644 --- a/secrets/default.nix +++ b/secrets/default.nix @@ -42,5 +42,9 @@ in { file = ./immich-oidc.age; owner = abstrServiceUser "immich"; }; + nextcloud-admin-pass = mkIf server { + file = ./nextcloud-admin-pass.age; + owner = "nextcloud"; + }; }; } diff --git a/secrets/nextcloud-admin-pass.age b/secrets/nextcloud-admin-pass.age new file mode 100644 index 0000000..23c404a --- /dev/null +++ b/secrets/nextcloud-admin-pass.age @@ -0,0 +1,17 @@ +age-encryption.org/v1 +-> ssh-ed25519 GQzYWA Njcl+VZAFcfupb9luHQjSAzzPar8k0G0WVU8EtS37EY +8IPsa1mz7qpxOmzXRNCwcp2KsBH45nM6M4D5vm1BgE8 +-> ssh-ed25519 MfR7VA WjSU/1VNHqylcPlaB+5FIyY879kQy/c+AyfdHrt6Xyo +KIDdbbNcy+DQ9q+Eo8dzxDMlq8vR8XeKvRps+/ghe+E +-> ssh-ed25519 +cvRTg eEExK1tU/S//HUL4x0SsJw8taRdOgLnOntUlpqVvMwk +7pB4ROtshkMGw/D4mkVdi7a3vYGoIyCodSCsKcplTws +-> ssh-ed25519 WCPLrA dNpd63ZB4ZlsgMlvdPeiW8VguhPkgRjCBor66cTAq1Q +IFSbLiZs8QBAqruyV3Zuoe6iE5ctW4Aw+8ipQ/5rUGM +-> ssh-ed25519 7/ziYw asgAI0TYuK4irNyoq/WFVCBrWC7NIJU5S4HQEfqEWTA +YoCVz1GzZ+swKb/qT+hhnTy3/mcBDFkaHAomzyApY6I +-> ssh-ed25519 VQy60Q 3XY6OcWrf3ZmXJNMo0tPrXofyjNtvt9VQaewkDZymTs ++JLpflAACxg6Esvq43FedOs56BuGa/6usymtfZl96nI +--- 4dcH0MunNPsvsrUmFGYIgSMsgS2BNluJOa9ZmgZro6k +Ød+ +Tðß +5òB}¢GÊkKÐ9Èšžqû$(q`†u$¶ù“»êÿ“Hˆ¦gC!÷ \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index df90563..72393aa 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -22,4 +22,5 @@ in { "zitadel-key.age".publicKeys = keys; "forgejo-mailpass.age".publicKeys = keys; "immich-oidc.age".publicKeys = keys; + "nextcloud-admin-pass.age".publicKeys = keys; } diff --git a/system/server/default.nix b/system/server/default.nix index c6ac1c8..7319695 100644 --- a/system/server/default.nix +++ b/system/server/default.nix @@ -10,6 +10,7 @@ ./matrix.nix ./temp.nix ./zitadel.nix + ./nextcloud.nix ]; options.niksos.server = lib.mkEnableOption "server servcies (such as caddy)."; #TODO: per service option. } diff --git a/system/server/nextcloud.nix b/system/server/nextcloud.nix new file mode 100644 index 0000000..8014370 --- /dev/null +++ b/system/server/nextcloud.nix @@ -0,0 +1,109 @@ +{ + config, + pkgs, + lib, + ... +}: let + inherit (config.niksos) server; + host = "cloud.jsw.tf"; + nginxRoot = config.services.nginx.virtualHosts.${host}.root; + fpmSocket = config.services.phpfpm.pools.nextcloud.socket; +in { + services = lib.mkIf server { + nextcloud = { + enable = true; + hostName = host; + + # Need to manually increment with every major upgrade. + package = pkgs.nextcloud31; + + database.createLocally = true; + configureRedis = true; + + maxUploadSize = "16G"; + https = true; + + autoUpdateApps.enable = true; + extraAppsEnable = true; + extraApps = with config.services.nextcloud.package.packages.apps; { + # https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/nextcloud/packages/nextcloud-apps.json + inherit calendar contacts mail notes tasks; + }; + + settings = { + default_phone_region = "NL"; + enabledPreviewProviders = [ + "OC\\Preview\\BMP" + "OC\\Preview\\GIF" + "OC\\Preview\\JPEG" + "OC\\Preview\\Krita" + "OC\\Preview\\MarkDown" + "OC\\Preview\\MP3" + "OC\\Preview\\OpenDocument" + "OC\\Preview\\PNG" + "OC\\Preview\\TXT" + "OC\\Preview\\XBitmap" + "OC\\Preview\\HEIC" + ]; + }; + config = { + adminuser = "jsw-admin"; + adminpassFile = "${config.age.secrets.nextcloud-admin-pass.path}"; + dbtype = "pgsql"; + }; + }; + + caddy.virtualHosts.${host}.extraConfig = '' + encode zstd gzip + + root * ${nginxRoot} + + redir /.well-known/carddav /remote.php/dav 301 + redir /.well-known/caldav /remote.php/dav 301 + redir /.well-known/* /index.php{uri} 301 + redir /remote/* /remote.php{uri} 301 + + header { + Strict-Transport-Security max-age=31536000 + Permissions-Policy interest-cohort=() + X-Content-Type-Options nosniff + X-Frame-Options SAMEORIGIN + Referrer-Policy no-referrer + X-XSS-Protection "1; mode=block" + X-Permitted-Cross-Domain-Policies none + X-Robots-Tag "noindex, nofollow" + -X-Powered-By + } + + php_fastcgi unix/${fpmSocket} { + root ${nginxRoot} + env front_controller_active true + env modHeadersAvailable true + } + + @forbidden { + path /build/* /tests/* /config/* /lib/* /3rdparty/* /templates/* /data/* + path /.* /autotest* /occ* /issue* /indie* /db_* /console* + not path /.well-known/* + } + error @forbidden 404 + + @immutable { + path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite + query v=* + } + header @immutable Cache-Control "max-age=15778463, immutable" + + @static { + path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite + not query v=* + } + header @static Cache-Control "max-age=15778463" + + @woff2 path *.woff2 + header @woff2 Cache-Control "max-age=604800" + + file_server + ''; + }; +} From e8e216e25f39886bf05247111684d243302d17d9 Mon Sep 17 00:00:00 2001 From: Jurn Wubben Date: Fri, 25 Jul 2025 14:52:31 +0200 Subject: [PATCH 3/3] Nextcloud: added caddy to nextcloud group so that it can read socket. --- system/server/nextcloud.nix | 182 ++++++++++++++++++------------------ 1 file changed, 93 insertions(+), 89 deletions(-) diff --git a/system/server/nextcloud.nix b/system/server/nextcloud.nix index 8014370..4bfa5bf 100644 --- a/system/server/nextcloud.nix +++ b/system/server/nextcloud.nix @@ -9,101 +9,105 @@ nginxRoot = config.services.nginx.virtualHosts.${host}.root; fpmSocket = config.services.phpfpm.pools.nextcloud.socket; in { - services = lib.mkIf server { - nextcloud = { - enable = true; - hostName = host; + config = lib.mkIf server { + users.groups.nextcloud.members = ["nextcloud" "caddy"]; + services = { + nextcloud = { + enable = true; + hostName = host; - # Need to manually increment with every major upgrade. - package = pkgs.nextcloud31; + # Need to manually increment with every major upgrade. + package = pkgs.nextcloud31; - database.createLocally = true; - configureRedis = true; + database.createLocally = true; + configureRedis = true; - maxUploadSize = "16G"; - https = true; + maxUploadSize = "16G"; + https = true; - autoUpdateApps.enable = true; - extraAppsEnable = true; - extraApps = with config.services.nextcloud.package.packages.apps; { - # https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/nextcloud/packages/nextcloud-apps.json - inherit calendar contacts mail notes tasks; + autoUpdateApps.enable = true; + extraAppsEnable = true; + extraApps = with config.services.nextcloud.package.packages.apps; { + # https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/nextcloud/packages/nextcloud-apps.json + inherit calendar contacts mail notes tasks; + }; + + settings = { + default_phone_region = "NL"; + enabledPreviewProviders = [ + "OC\\Preview\\BMP" + "OC\\Preview\\GIF" + "OC\\Preview\\JPEG" + "OC\\Preview\\Krita" + "OC\\Preview\\MarkDown" + "OC\\Preview\\MP3" + "OC\\Preview\\OpenDocument" + "OC\\Preview\\PNG" + "OC\\Preview\\TXT" + "OC\\Preview\\XBitmap" + "OC\\Preview\\HEIC" + ]; + }; + config = { + adminuser = "jsw-admin"; + adminpassFile = "${config.age.secrets.nextcloud-admin-pass.path}"; + dbtype = "pgsql"; + }; }; - settings = { - default_phone_region = "NL"; - enabledPreviewProviders = [ - "OC\\Preview\\BMP" - "OC\\Preview\\GIF" - "OC\\Preview\\JPEG" - "OC\\Preview\\Krita" - "OC\\Preview\\MarkDown" - "OC\\Preview\\MP3" - "OC\\Preview\\OpenDocument" - "OC\\Preview\\PNG" - "OC\\Preview\\TXT" - "OC\\Preview\\XBitmap" - "OC\\Preview\\HEIC" - ]; - }; - config = { - adminuser = "jsw-admin"; - adminpassFile = "${config.age.secrets.nextcloud-admin-pass.path}"; - dbtype = "pgsql"; - }; + nginx.enable = lib.mkForce false; + caddy.virtualHosts."${host}".extraConfig = '' + encode zstd gzip + + root * ${nginxRoot} + + redir /.well-known/carddav /remote.php/dav 301 + redir /.well-known/caldav /remote.php/dav 301 + redir /.well-known/* /index.php{uri} 301 + redir /remote/* /remote.php{uri} 301 + + header { + Strict-Transport-Security max-age=31536000 + Permissions-Policy interest-cohort=() + X-Content-Type-Options nosniff + X-Frame-Options SAMEORIGIN + Referrer-Policy no-referrer + X-XSS-Protection "1; mode=block" + X-Permitted-Cross-Domain-Policies none + X-Robots-Tag "noindex, nofollow" + -X-Powered-By + } + + php_fastcgi unix/${fpmSocket} { + root ${nginxRoot} + env front_controller_active true + env modHeadersAvailable true + } + + @forbidden { + path /build/* /tests/* /config/* /lib/* /3rdparty/* /templates/* /data/* + path /.* /autotest* /occ* /issue* /indie* /db_* /console* + not path /.well-known/* + } + error @forbidden 404 + + @immutable { + path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite + query v=* + } + header @immutable Cache-Control "max-age=15778463, immutable" + + @static { + path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite + not query v=* + } + header @static Cache-Control "max-age=15778463" + + @woff2 path *.woff2 + header @woff2 Cache-Control "max-age=604800" + + file_server + ''; }; - - caddy.virtualHosts.${host}.extraConfig = '' - encode zstd gzip - - root * ${nginxRoot} - - redir /.well-known/carddav /remote.php/dav 301 - redir /.well-known/caldav /remote.php/dav 301 - redir /.well-known/* /index.php{uri} 301 - redir /remote/* /remote.php{uri} 301 - - header { - Strict-Transport-Security max-age=31536000 - Permissions-Policy interest-cohort=() - X-Content-Type-Options nosniff - X-Frame-Options SAMEORIGIN - Referrer-Policy no-referrer - X-XSS-Protection "1; mode=block" - X-Permitted-Cross-Domain-Policies none - X-Robots-Tag "noindex, nofollow" - -X-Powered-By - } - - php_fastcgi unix/${fpmSocket} { - root ${nginxRoot} - env front_controller_active true - env modHeadersAvailable true - } - - @forbidden { - path /build/* /tests/* /config/* /lib/* /3rdparty/* /templates/* /data/* - path /.* /autotest* /occ* /issue* /indie* /db_* /console* - not path /.well-known/* - } - error @forbidden 404 - - @immutable { - path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite - query v=* - } - header @immutable Cache-Control "max-age=15778463, immutable" - - @static { - path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite - not query v=* - } - header @static Cache-Control "max-age=15778463" - - @woff2 path *.woff2 - header @woff2 Cache-Control "max-age=604800" - - file_server - ''; }; }