nextcloud: implement OIDC authentication

platforms/nixos/modules/nmasur/presets/services/nextcloud/nextcloud-oidc-secret.age

@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyAzMEJs
+WW9mb1E5MW5vT0tYeDhKSnFSRWZFVFdrL0d6Vk45UUVBd3JubFNvClpIRDYzM1Zh
+dEtMaFNSeEF4aHY2cWpZbUNNMUw0UW93SFV0NVBMZ2wvKzgKLT4gc3NoLWVkMjU1
+MTkgWXlTVU1RIDlGUUQwdlFwd1JiOE9Sb0svWTM4cDVHbGNQeFVDcUJsa0xqZGp6
+SGxkUlUKMHpPSFFSQXZSYjdwNUhnRnUxZzJVQWxLblB5MjBTZjRpM0d4NDJFSk1Z
+RQotPiBzc2gtZWQyNTUxOSBuanZYNUEgK055eTE2NG9yN3FEZ1BSaTZKTGpWUmt0
+YlFWU0hjSnZ3MVZSdE12Y0VVTQovNWpGM2Y0TUlNSHRVQmRJK3VCNTBHTFAzdlYx
+MXNJOVNOdTJiNlZZdWkwCi0+IHNzaC1lZDI1NTE5IENxSU9VQSArblhobTFoN1BQ
+ZUhuL04yVUtTRnF1V0tPR1BVK3lzWUVrMlhJQWxmZXhZClJkUnU0QUxuRnZ3Vjg2
+TVFzdGs5dDJSbFZMQnFRamxObnFpZVBaTExFajQKLT4gc3NoLWVkMjU1MTkgejFP
+Y1p3IFE1clkxRFFZbmVEV01LVWNXaVR6ZkdrcHJYUFNaSXI1STUrSmN5ejJnU2MK
+STRhOWlXTFU2emVvVUkxMmxKc1FmbmJrQ1RFU3RLa2RBSUJlak5CRG1obwotLS0g
+WFhjSmJxSmVMQlR0bjRKWVR1cllmQ1JjUkZZYWpTbEFzTjNQVzRvbHNJbwrrqVI1
+yl6w97t0CDhjOml46f3wlob0kztDAdOFmUSiEVfiQU0eCrfNinQg7aohu5Y8MJpD
+k2Du2m/AV6aIPR47LA==
+-----END AGE ENCRYPTED FILE-----

platforms/nixos/modules/nmasur/presets/services/nextcloud/nextcloud.nix

@@ -33,6 +33,7 @@ in
         # Allow access when hitting either of these hosts or IPs
         trusted_domains = [ hostnames.content ];
         trusted_proxies = [ "127.0.0.1" ];
+        overwriteprotocol = "https";
         maintenance_window_start = 4; # Run jobs at 4am UTC
         log_type = "file";
         loglevel = 1; # Include all actions in the log
@@ -41,6 +42,7 @@ in
       extraApps = {
         calendar = config.services.nextcloud.package.packages.apps.calendar;
         contacts = config.services.nextcloud.package.packages.apps.contacts;
+        user_oidc = config.services.nextcloud.package.packages.apps.user_oidc;
         # These apps are defined and pinned by overlay in flake.
         # news = pkgs.nextcloudApps.news;
         # external = pkgs.nextcloudApps.external;
@@ -211,6 +213,32 @@ in
       before = [ "nextcloud-setup.service" ];
     };
 
+    secrets.nextcloud-oidc-secret = {
+      source = ./nextcloud-oidc-secret.age;
+      dest = "${config.secretsDirectory}/nextcloud-oidc-secret";
+      owner = "nextcloud";
+      group = "nextcloud";
+      permissions = "0440";
+    };
+    systemd.services.nextcloud-oidc-secret-secret = {
+      requiredBy = [ "nextcloud-setup.service" ];
+      before = [ "nextcloud-setup.service" ];
+    };
+
+    # Configure Pocket ID OIDC provider after Nextcloud setup enables apps
+    systemd.services.nextcloud-setup = {
+      after = [ "nextcloud-oidc-secret-secret.service" ];
+      postStart = ''
+        ${config.services.nextcloud.occ}/bin/nextcloud-occ user_oidc:provider pocket-id \
+          --clientid="c8a32c58-a781-4f14-9070-f498fdfda438" \
+          --clientsecret-file="${config.secrets.nextcloud-oidc-secret.dest}" \
+          --discoveryuri="https://${hostnames.auth}/.well-known/openid-configuration" \
+          --scope="openid profile email" \
+          --mapping-uid="preferred_username" \
+          --unique-uid=0
+      '';
+    };
+
     # Grant user access to Nextcloud directories
     users.users.${username}.extraGroups = [ "nextcloud" ];