nextcloud: implement OIDC authentication

docs/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 2026-09-07
+
+- **Configured OpenID Connect (OIDC) authentication for Nextcloud**:
+  - Added `user_oidc` to `services.nextcloud.extraApps`.
+  - Added secret management for `nextcloud-oidc-secret.age` via `secrets.nextcloud-oidc-secret` with owner `nextcloud` and group `nextcloud` (0440).
+  - Configured `systemd.services.nextcloud-oidc-secret-secret` to be required by and order before `nextcloud-setup.service`.
+  - Set `services.nextcloud.settings.overwriteprotocol = "https"` to ensure correct scheme handling for redirect URIs behind reverse proxy.
+  - Configured automated idempotent upsert of the Pocket ID provider via `systemd.services.nextcloud-setup.postStart` running `nextcloud-occ user_oidc:provider pocket-id` with client ID `c8a32c58-a781-4f14-9070-f498fdfda438`, `--clientsecret-file`, discovery URI `https://${hostnames.auth}/.well-known/openid-configuration`, `--mapping-uid="preferred_username"`, and `--unique-uid=0` to connect OIDC logins directly to existing local Nextcloud accounts.
+  - Updated `docs/oidc-services.md` with the verified configuration and callback URI (`https://cloud.masu.rs/apps/user_oidc/code`).
+
 ## 2026-09-06
 
 - **Configured OpenID Connect (OIDC) authentication for Immich**:

docs/oidc-services.md

@@ -121,15 +121,39 @@ All client secrets should be encrypted with `agenix` under the respective servic
 ### 3. Nextcloud (`cloud.masu.rs`)
 - **Pocket ID Redirect URI:** `https://cloud.masu.rs/apps/user_oidc/code`
 - **Setup in `nextcloud/nextcloud.nix`:**
-  1. Add `user_oidc` to `services.nextcloud.extraApps`.
-  2. Configure the provider via `nextcloud-occ`:
-     ```bash
-     nextcloud-occ user_oidc:provider pocket-id \
-       --clientid="<client_id>" \
-       --clientsecret="<client_secret>" \
-       --discoveryuri="https://auth.masu.rs/.well-known/openid-configuration" \
-       --scope="openid profile email"
-     ```
+  ```nix
+  secrets.nextcloud-oidc-secret = {
+    source = ./nextcloud-oidc-secret.age;
+    dest = "${config.secretsDirectory}/nextcloud-oidc-secret";
+    owner = "nextcloud";
+    group = "nextcloud";
+    permissions = "0440";
+  };
+  systemd.services.nextcloud-oidc-secret-secret = {
+    requiredBy = [ "nextcloud-setup.service" ];
+    before = [ "nextcloud-setup.service" ];
+  };
+
+  services.nextcloud = {
+    settings.overwriteprotocol = "https";
+    extraApps = {
+      user_oidc = config.services.nextcloud.package.packages.apps.user_oidc;
+    };
+  };
+
+  systemd.services.nextcloud-setup = {
+    after = [ "nextcloud-oidc-secret-secret.service" ];
+    postStart = ''
+      ${config.services.nextcloud.occ}/bin/nextcloud-occ user_oidc:provider pocket-id \
+        --clientid="c8a32c58-a781-4f14-9070-f498fdfda438" \
+        --clientsecret-file="${config.secrets.nextcloud-oidc-secret.dest}" \
+        --discoveryuri="https://${hostnames.auth}/.well-known/openid-configuration" \
+        --scope="openid profile email" \
+        --mapping-uid="preferred_username" \
+        --unique-uid=0
+    '';
+  };
+  ```
 
 ### 4. Grafana (`metrics.masu.rs`)
 - **Pocket ID Redirect URI:** `https://metrics.masu.rs/login/generic_oauth`