working nextcloud configuration

apps/loadkey.nix

@@ -0,0 +1,9 @@
+{ globals, pkgs, ... }: {
+
+  type = "app";
+
+  program = builtins.toString (pkgs.writeShellScript "loadkey" ''
+    ${pkgs.melt}/bin/melt restore ~/.ssh/id_ed25519
+  '');
+
+}

flake.nix

@@ -89,6 +89,9 @@
           # Display the readme for this repository
           readme = import ./apps/readme.nix { inherit pkgs; };
 
+          # Load the SSH key for this machine
+          loadkey = import ./apps/loadkey.nix { inherit pkgs; };
+
         });
 
       devShells = forAllSystems (system:

hosts/oracle/default.nix

@@ -11,11 +11,17 @@ nixpkgs.lib.nixosSystem {
       networking.hostName = "oracle";
       bookServer = "books.masu.rs";
       streamServer = "stream.masu.rs";
+      nextcloudServer = "cloud.masu.rs";
       gui.enable = false;
       colorscheme = (import ../../modules/colorscheme/gruvbox);
       passwordHash = null;
       publicKey =
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
+      nextcloudS3 = {
+        bucket = "noahmasur-nextcloud";
+        hostname = "s3.us-west-002.backblazeb2.com";
+        key = "0026b0e73b2e2c80000000003";
+      };
     }
     ./hardware-configuration.nix
     ../common.nix
@@ -25,5 +31,6 @@ nixpkgs.lib.nixosSystem {
     ../../modules/services/sshd.nix
     ../../modules/services/calibre.nix
     ../../modules/services/jellyfin.nix
+    ../../modules/services/nextcloud.nix
   ];
 }

modules/services/nextcloud.nix

@@ -0,0 +1,98 @@
+{ config, pkgs, lib, ... }:
+
+let
+  adminpassFile = "/var/lib/nextcloud/creds";
+  s3SecretFile = "/var/lib/nextcloud/creds-s3";
+
+in {
+
+  options = {
+
+    nextcloudServer = lib.mkOption {
+      type = lib.types.str;
+      description = "Hostname for Nextcloud";
+    };
+
+    nextcloudS3 = {
+      bucket = lib.mkOption {
+        type = lib.types.str;
+        description = "S3 bucket name for Nextcloud storage";
+      };
+      hostname = lib.mkOption {
+        type = lib.types.str;
+        description = "S3 endpoint for Nextcloud storage";
+      };
+      key = lib.mkOption {
+        type = lib.types.str;
+        description = "S3 access key for Nextcloud storage";
+      };
+    };
+  };
+
+  config = {
+
+    services.nextcloud = {
+      enable = true;
+      package = pkgs.nextcloud24; # Required to specify
+      https = true;
+      hostName = "localhost";
+      config = {
+        adminpassFile = adminpassFile;
+        extraTrustedDomains = [ config.nextcloudServer ];
+        objectstore.s3 = {
+          enable = true;
+          bucket = config.nextcloudS3.bucket;
+          hostname = config.nextcloudS3.hostname;
+          key = config.nextcloudS3.key;
+          autocreate = false;
+          secretFile = s3SecretFile;
+        };
+      };
+    };
+
+    # Don't let Nginx use main ports (using Caddy instead)
+    services.nginx.virtualHosts."localhost".listen = [{
+      addr = "127.0.0.1";
+      port = 8080;
+    }];
+
+    caddyRoutes = [{
+      match = [{ host = [ config.nextcloudServer ]; }];
+      handle = [{
+        handler = "reverse_proxy";
+        upstreams = [{ dial = "localhost:8080"; }];
+      }];
+    }];
+
+    # Create credentials files
+    system.activationScripts.nextcloud.text =
+      let identityFile = "${config.homePath}/.ssh/id_ed25519";
+      in ''
+        if [ ! -f "${identityFile}" ]; then
+          $DRY_RUN_CMD echo -e \nEnter the seed phrase for your SSH key...\n
+          $DRY_RUN_CMD echo -e \nThen press ^D when complete.\n\n
+          $DRY_RUN_CMD ${pkgs.melt}/bin/melt restore ${identityFile}
+          $DRY_RUN_CMD chown ${config.user}:wheel ${identityFile}*
+          $DRY_RUN_CMD echo -e \n\nContinuing activation.\n\n
+        fi
+        if [ ! -f "${adminpassFile}" ]; then
+          $DRY_RUN_CMD mkdir --parents $VERBOSE_ARG $(dirname ${adminpassFile})
+          $DRY_RUN_CMD ${pkgs.age}/bin/age --decrypt \
+            --identity ${identityFile} \
+            --output ${adminpassFile} \
+            ${builtins.toString ../../private/nextcloud.age}
+          $DRY_RUN_CMD chown nextcloud:nextcloud ${adminpassFile}
+        fi
+        if [ ! -f "${s3SecretFile}" ]; then
+          $DRY_RUN_CMD mkdir --parents $VERBOSE_ARG $(dirname ${s3SecretFile})
+          $DRY_RUN_CMD ${pkgs.age}/bin/age --decrypt \
+            --identity ${identityFile} \
+            --output ${s3SecretFile} \
+            ${builtins.toString ../../private/nextcloud-s3.age}
+          $DRY_RUN_CMD chown nextcloud:nextcloud ${s3SecretFile}
+        fi
+      '';
+
+  };
+
+}

private/nextcloud-s3.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 MgHaOw 6598vLOAPdLywyCHQtneJRWWVQhjP2ydv40ULRGLrFE
+KB4O8c3bcpKkyQbjsg8Hu3m3MP5HQ90YVXy8xXHOTqk
+--- mLQsxjZKwwM0jvf79WrLh1IW6mzsfuOHDYJQhjBe2Rg
+¹É…®à™XL<07>ÞúÐÖ„¢Îܪr•ñÍáÖÛ×±¯üEŒGûUP™
+ΖæTÎHN
¢–ñ$Z•+L4Ð