updates and nixifying

2024-12-18 16:08:17 -06:00
parent c259cb91de
commit c80092f588
26 changed files with 203 additions and 807 deletions
--- a/hosts/nas/apps/nextcloud/default.nix
+++ b/hosts/nas/apps/nextcloud/default.nix
@@ -0,0 +1,143 @@
+{ config, ... }:
+let
+  adminpass = config.sops.secrets."jallen-nas/nextcloud/adminpassword".path;
+  dbpass = config.sops.secrets."jallen-nas/nextcloud/dbpassword".path;
+  smtppassword = config.sops.templates."nextcloud-smtp".content;
+  nextcloudUserId = config.users.users.nix-apps.uid;
+  nextcloudGroupId = config.users.groups.jallen-nas.gid;
+in
+{
+  containers.nextcloud = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "10.0.1.18";
+    localAddress = "10.0.2.18";
+
+    bindMounts = {
+      secrets = {
+        hostPath = "/run/secrets/jallen-nas/nextcloud";
+        isReadOnly = true;
+        mountPoint = "/run/secrets/jallen-nas/nextcloud";
+      };
+
+      data = {
+        hostPath = "/media/nas/main/nextcloud";
+        isReadOnly = false;
+        mountPoint = "/data";
+      };
+    };
+
+    config =
+    { pkgs, lib, ... }:
+    {
+      services = {
+        nextcloud = {
+          enable = true;
+          package = pkgs.nextcloud30;
+          # datadir = "/data";
+          hostName = "localhost";
+          appstoreEnable = true;
+          caching.redis = true;
+          configureRedis = true;
+          config = {
+            adminuser = "mjallen";
+            adminpassFile = adminpass;
+            dbhost = "10.0.1.18:3306";
+            dbtype = "mysql";
+            dbname = "jallen_nextcloud";
+            dbuser = "nextcloud";
+            dbpassFile = dbpass;
+          };
+          settings = {
+            datadirectory = "/data";
+            trusted_domains = [
+              "10.0.1.18:9988"
+              "10.0.1.18:9943"
+              "10.0.2.18:80"
+              "10.0.2.18:443"
+              "cloud.mjallen.dev"
+            ];
+            trusted_proxies = [ "10.0.1.18" ];
+            maintenance_window_start = 6;
+            default_phone_region = "US";
+            mail_from_address = "matt.l.jallen";
+            mail_smtpmode = "smtp";
+            mail_sendmailmode = "smtp";
+            mail_domain = "gmail.com";
+            mail_smtpauth = 1;
+            mail_smtpname = "matt.l.jallen";
+            mail_smtppassword = smtppassword;
+            mail_smtpsecure = "ssl";
+            mail_smtphost = "smtp.gmail.com";
+            mail_smtpport = 465;
+            enable_previews = true;
+            enabledPreviewProviders = [
+              "OC\\\\Preview\\\\PNG"
+              "OC\\\\Preview\\\\JPEG"
+              "OC\\\\Preview\\\\GIF"
+              "OC\\\\Preview\\\\BMP"
+              "OC\\\\Preview\\\\XBitmap"
+              "OC\\\\Preview\\\\MP3"
+              "OC\\\\Preview\\\\TXT"
+              "OC\\\\Preview\\\\MarkDown"
+              "OC\\\\Preview\\\\OpenDocument"
+              "OC\\\\Preview\\\\Krita"
+              "OC\\\\Preview\\\\HEIC"
+            ];
+            installed = true;
+            # config_is_read_only = true;
+          };
+        };
+
+      };
+
+      # Create required users and groups
+      users.users.nextcloud = {
+        isSystemUser = true;
+        uid = lib.mkForce nextcloudUserId;
+        group = "nextcloud";
+      };
+
+      users.groups = {
+        nextcloud = { gid = lib.mkForce nextcloudGroupId; };
+        downloads = {};
+      };
+
+      # Create and set permissions for required directories
+      system.activationScripts.radarr-dirs = ''
+        mkdir -p /data
+
+        chown -R nextcloud:nextcloud /data
+        
+        chmod -R 775 /data
+        
+      '';
+
+      system.stateVersion = "23.11";
+      networking = {
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [ 80 443 ];
+        };
+        # Use systemd-resolved inside the container
+        # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+        useHostResolvConf = lib.mkForce false;
+      };
+      services.resolved.enable = true;
+
+    };
+  };
+
+  networking.nat = {
+    forwardPorts = [
+      {
+        destination = "10.0.2.18:443";
+        sourcePort = 9943;
+      }
+      {
+        destination = "10.0.2.18:80";
+        sourcePort = 9988;
+      }
+    ];
+  };
+}