From 2434376963845ac00e8836ab2d875068133fcd5f Mon Sep 17 00:00:00 2001 From: Noah Masur <7386960+nmasur@users.noreply.github.com> Date: Sun, 2 Oct 2022 20:54:26 +0000 Subject: [PATCH] working nextcloud configuration --- apps/loadkey.nix | 9 +++ flake.nix | 3 + hosts/oracle/default.nix | 7 +++ modules/services/nextcloud.nix | 98 +++++++++++++++++++++++++++++++++ private/nextcloud-s3.age | 6 ++ private/nextcloud.age | Bin 0 -> 246 bytes 6 files changed, 123 insertions(+) create mode 100644 apps/loadkey.nix create mode 100644 modules/services/nextcloud.nix create mode 100644 private/nextcloud-s3.age create mode 100644 private/nextcloud.age diff --git a/apps/loadkey.nix b/apps/loadkey.nix new file mode 100644 index 0000000..c02de30 --- /dev/null +++ b/apps/loadkey.nix @@ -0,0 +1,9 @@ +{ globals, pkgs, ... }: { + + type = "app"; + + program = builtins.toString (pkgs.writeShellScript "loadkey" '' + ${pkgs.melt}/bin/melt restore ~/.ssh/id_ed25519 + ''); + +} diff --git a/flake.nix b/flake.nix index 3b1fac4..d1aff1c 100644 --- a/flake.nix +++ b/flake.nix @@ -89,6 +89,9 @@ # Display the readme for this repository readme = import ./apps/readme.nix { inherit pkgs; }; + # Load the SSH key for this machine + loadkey = import ./apps/loadkey.nix { inherit pkgs; }; + }); devShells = forAllSystems (system: diff --git a/hosts/oracle/default.nix b/hosts/oracle/default.nix index 62cf364..0af38e9 100644 --- a/hosts/oracle/default.nix +++ b/hosts/oracle/default.nix @@ -11,11 +11,17 @@ nixpkgs.lib.nixosSystem { networking.hostName = "oracle"; bookServer = "books.masu.rs"; streamServer = "stream.masu.rs"; + nextcloudServer = "cloud.masu.rs"; gui.enable = false; colorscheme = (import ../../modules/colorscheme/gruvbox); passwordHash = null; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s"; + nextcloudS3 = { + bucket = "noahmasur-nextcloud"; + hostname = "s3.us-west-002.backblazeb2.com"; + key = "0026b0e73b2e2c80000000003"; + }; } ./hardware-configuration.nix ../common.nix @@ -25,5 +31,6 @@ nixpkgs.lib.nixosSystem { ../../modules/services/sshd.nix ../../modules/services/calibre.nix ../../modules/services/jellyfin.nix + ../../modules/services/nextcloud.nix ]; } diff --git a/modules/services/nextcloud.nix b/modules/services/nextcloud.nix new file mode 100644 index 0000000..415a8c7 --- /dev/null +++ b/modules/services/nextcloud.nix @@ -0,0 +1,98 @@ +{ config, pkgs, lib, ... }: + +let + adminpassFile = "/var/lib/nextcloud/creds"; + s3SecretFile = "/var/lib/nextcloud/creds-s3"; + +in { + + options = { + + nextcloudServer = lib.mkOption { + type = lib.types.str; + description = "Hostname for Nextcloud"; + }; + + nextcloudS3 = { + bucket = lib.mkOption { + type = lib.types.str; + description = "S3 bucket name for Nextcloud storage"; + }; + hostname = lib.mkOption { + type = lib.types.str; + description = "S3 endpoint for Nextcloud storage"; + }; + key = lib.mkOption { + type = lib.types.str; + description = "S3 access key for Nextcloud storage"; + }; + }; + }; + + config = { + + services.nextcloud = { + enable = true; + package = pkgs.nextcloud24; # Required to specify + https = true; + hostName = "localhost"; + config = { + adminpassFile = adminpassFile; + extraTrustedDomains = [ config.nextcloudServer ]; + objectstore.s3 = { + enable = true; + bucket = config.nextcloudS3.bucket; + hostname = config.nextcloudS3.hostname; + key = config.nextcloudS3.key; + autocreate = false; + secretFile = s3SecretFile; + }; + }; + }; + + # Don't let Nginx use main ports (using Caddy instead) + services.nginx.virtualHosts."localhost".listen = [{ + addr = "127.0.0.1"; + port = 8080; + }]; + + caddyRoutes = [{ + match = [{ host = [ config.nextcloudServer ]; }]; + handle = [{ + handler = "reverse_proxy"; + upstreams = [{ dial = "localhost:8080"; }]; + }]; + }]; + + # Create credentials files + system.activationScripts.nextcloud.text = + let identityFile = "${config.homePath}/.ssh/id_ed25519"; + in '' + if [ ! -f "${identityFile}" ]; then + $DRY_RUN_CMD echo -e \nEnter the seed phrase for your SSH key...\n + $DRY_RUN_CMD echo -e \nThen press ^D when complete.\n\n + $DRY_RUN_CMD ${pkgs.melt}/bin/melt restore ${identityFile} + $DRY_RUN_CMD chown ${config.user}:wheel ${identityFile}* + $DRY_RUN_CMD echo -e \n\nContinuing activation.\n\n + fi + if [ ! -f "${adminpassFile}" ]; then + $DRY_RUN_CMD mkdir --parents $VERBOSE_ARG $(dirname ${adminpassFile}) + $DRY_RUN_CMD ${pkgs.age}/bin/age --decrypt \ + --identity ${identityFile} \ + --output ${adminpassFile} \ + ${builtins.toString ../../private/nextcloud.age} + $DRY_RUN_CMD chown nextcloud:nextcloud ${adminpassFile} + fi + if [ ! -f "${s3SecretFile}" ]; then + $DRY_RUN_CMD mkdir --parents $VERBOSE_ARG $(dirname ${s3SecretFile}) + $DRY_RUN_CMD ${pkgs.age}/bin/age --decrypt \ + --identity ${identityFile} \ + --output ${s3SecretFile} \ + ${builtins.toString ../../private/nextcloud-s3.age} + $DRY_RUN_CMD chown nextcloud:nextcloud ${s3SecretFile} + fi + ''; + + }; + +} diff --git a/private/nextcloud-s3.age b/private/nextcloud-s3.age new file mode 100644 index 0000000..14aad0a --- /dev/null +++ b/private/nextcloud-s3.age @@ -0,0 +1,6 @@ +age-encryption.org/v1 +-> ssh-ed25519 MgHaOw 6598vLOAPdLywyCHQtneJRWWVQhjP2ydv40ULRGLrFE +KB4O8c3bcpKkyQbjsg8Hu3m3MP5HQ90YVXy8xXHOTqk +--- mLQsxjZKwwM0jvf79WrLh1IW6mzsfuOHDYJQhjBe2Rg +ɅXLܪrױEGUP +ΖTHN$Z +L4 \ No newline at end of file diff --git a/private/nextcloud.age b/private/nextcloud.age new file mode 100644 index 0000000000000000000000000000000000000000..77526b6596398552bc8d57e1c7b76f2b79683152 GIT binary patch literal 246 zcmV_K|*h1Ge}u^GjBOeN=i{SQ)XsoI8Rr4R99_LWqK=GFii?FMNczqOJ!kG zT2(nQc~fd)bY^KwD?v7QVNyXsPi#U?LQYv@No6x-MNJAVEiE8tN^fCrQaEsHPjyo< zVp>aVNJcU?S#f%1OKNmyK|ym~%Qc(&e#L$H*Wq|4w@}KwsI6eqsKL%(O w9)AbuS8smQol&)kjaymIZ%)-gKBGgdSdg$w#39g+>lk2Ly9xs!ow8X7n=av2v;Y7A literal 0 HcmV?d00001