working nextcloud configuration

This commit is contained in:
Noah Masur 2022-10-02 20:54:26 +00:00
parent f196f546b8
commit 2434376963
6 changed files with 123 additions and 0 deletions

9
apps/loadkey.nix Normal file
View File

@ -0,0 +1,9 @@
{ globals, pkgs, ... }: {
type = "app";
program = builtins.toString (pkgs.writeShellScript "loadkey" ''
${pkgs.melt}/bin/melt restore ~/.ssh/id_ed25519
'');
}

View File

@ -89,6 +89,9 @@
# Display the readme for this repository # Display the readme for this repository
readme = import ./apps/readme.nix { inherit pkgs; }; readme = import ./apps/readme.nix { inherit pkgs; };
# Load the SSH key for this machine
loadkey = import ./apps/loadkey.nix { inherit pkgs; };
}); });
devShells = forAllSystems (system: devShells = forAllSystems (system:

View File

@ -11,11 +11,17 @@ nixpkgs.lib.nixosSystem {
networking.hostName = "oracle"; networking.hostName = "oracle";
bookServer = "books.masu.rs"; bookServer = "books.masu.rs";
streamServer = "stream.masu.rs"; streamServer = "stream.masu.rs";
nextcloudServer = "cloud.masu.rs";
gui.enable = false; gui.enable = false;
colorscheme = (import ../../modules/colorscheme/gruvbox); colorscheme = (import ../../modules/colorscheme/gruvbox);
passwordHash = null; passwordHash = null;
publicKey = publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s"; "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+AbmjGEwITk5CK9y7+Rg27Fokgj9QEjgc9wST6MA3s";
nextcloudS3 = {
bucket = "noahmasur-nextcloud";
hostname = "s3.us-west-002.backblazeb2.com";
key = "0026b0e73b2e2c80000000003";
};
} }
./hardware-configuration.nix ./hardware-configuration.nix
../common.nix ../common.nix
@ -25,5 +31,6 @@ nixpkgs.lib.nixosSystem {
../../modules/services/sshd.nix ../../modules/services/sshd.nix
../../modules/services/calibre.nix ../../modules/services/calibre.nix
../../modules/services/jellyfin.nix ../../modules/services/jellyfin.nix
../../modules/services/nextcloud.nix
]; ];
} }

View File

@ -0,0 +1,98 @@
{ config, pkgs, lib, ... }:
let
adminpassFile = "/var/lib/nextcloud/creds";
s3SecretFile = "/var/lib/nextcloud/creds-s3";
in {
options = {
nextcloudServer = lib.mkOption {
type = lib.types.str;
description = "Hostname for Nextcloud";
};
nextcloudS3 = {
bucket = lib.mkOption {
type = lib.types.str;
description = "S3 bucket name for Nextcloud storage";
};
hostname = lib.mkOption {
type = lib.types.str;
description = "S3 endpoint for Nextcloud storage";
};
key = lib.mkOption {
type = lib.types.str;
description = "S3 access key for Nextcloud storage";
};
};
};
config = {
services.nextcloud = {
enable = true;
package = pkgs.nextcloud24; # Required to specify
https = true;
hostName = "localhost";
config = {
adminpassFile = adminpassFile;
extraTrustedDomains = [ config.nextcloudServer ];
objectstore.s3 = {
enable = true;
bucket = config.nextcloudS3.bucket;
hostname = config.nextcloudS3.hostname;
key = config.nextcloudS3.key;
autocreate = false;
secretFile = s3SecretFile;
};
};
};
# Don't let Nginx use main ports (using Caddy instead)
services.nginx.virtualHosts."localhost".listen = [{
addr = "127.0.0.1";
port = 8080;
}];
caddyRoutes = [{
match = [{ host = [ config.nextcloudServer ]; }];
handle = [{
handler = "reverse_proxy";
upstreams = [{ dial = "localhost:8080"; }];
}];
}];
# Create credentials files
system.activationScripts.nextcloud.text =
let identityFile = "${config.homePath}/.ssh/id_ed25519";
in ''
if [ ! -f "${identityFile}" ]; then
$DRY_RUN_CMD echo -e \nEnter the seed phrase for your SSH key...\n
$DRY_RUN_CMD echo -e \nThen press ^D when complete.\n\n
$DRY_RUN_CMD ${pkgs.melt}/bin/melt restore ${identityFile}
$DRY_RUN_CMD chown ${config.user}:wheel ${identityFile}*
$DRY_RUN_CMD echo -e \n\nContinuing activation.\n\n
fi
if [ ! -f "${adminpassFile}" ]; then
$DRY_RUN_CMD mkdir --parents $VERBOSE_ARG $(dirname ${adminpassFile})
$DRY_RUN_CMD ${pkgs.age}/bin/age --decrypt \
--identity ${identityFile} \
--output ${adminpassFile} \
${builtins.toString ../../private/nextcloud.age}
$DRY_RUN_CMD chown nextcloud:nextcloud ${adminpassFile}
fi
if [ ! -f "${s3SecretFile}" ]; then
$DRY_RUN_CMD mkdir --parents $VERBOSE_ARG $(dirname ${s3SecretFile})
$DRY_RUN_CMD ${pkgs.age}/bin/age --decrypt \
--identity ${identityFile} \
--output ${s3SecretFile} \
${builtins.toString ../../private/nextcloud-s3.age}
$DRY_RUN_CMD chown nextcloud:nextcloud ${s3SecretFile}
fi
'';
};
}

6
private/nextcloud-s3.age Normal file
View File

@ -0,0 +1,6 @@
age-encryption.org/v1
-> ssh-ed25519 MgHaOw 6598vLOAPdLywyCHQtneJRWWVQhjP2ydv40ULRGLrFE
KB4O8c3bcpKkyQbjsg8Hu3m3MP5HQ90YVXy8xXHOTqk
--- mLQsxjZKwwM0jvf79WrLh1IW6mzsfuOHDYJQhjBe2Rg
¹É…®à™XL<07>ÞúÐÖ„¢Îܪr•ñÍáÖÛ×±¯üEŒGûUP™
ÎæTÎHN¢–ñ$Z• +L4 Ð

BIN
private/nextcloud.age Normal file

Binary file not shown.