nix-config/hosts/nas/apps/nextcloud/default.nix

{ config, pkgs, ... }:
let
  adminpass = config.sops.secrets."jallen-nas/nextcloud/adminpassword".path;
  smtppassword = builtins.readFile config.sops.secrets."jallen-nas/nextcloud/smtppassword".path;
  nextcloudUserId = config.users.users.nix-apps.uid;
  nextcloudGroupId = config.users.groups.jallen-nas.gid;
  nextcloudPackage = pkgs.unstable.nextcloud30;
in
{
  containers.nextcloud = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = "10.0.1.18";
    localAddress = "10.0.2.18";

    bindMounts = {
      secrets = {
        hostPath = "/run/secrets/jallen-nas/nextcloud";
        isReadOnly = true;
        mountPoint = "/run/secrets/jallen-nas/nextcloud";
      };

      data = {
        hostPath = "/media/nas/main/nextcloud";
        isReadOnly = false;
        mountPoint = "/data";
      };

      "/var/lib/nextcloud" = {
        hostPath = "/media/nas/ssd/nix-app-data/nextcloud";
        isReadOnly = false;
        mountPoint = "/var/lib/nextcloud";
      };

      # "/var/lib/onlyoffice" = {
      #   hostPath = "/media/nas/ssd/nix-app-data/onlyoffice";
      #   isReadOnly = false;
      #   mountPoint = "/var/lib/onlyoffice";
      # };
    };

    config =
      { pkgs, lib, ... }:
      {
        imports = [ ../../../../share/nvidia ];
        nixpkgs.config.allowUnfree = true;
        networking.extraHosts = ''
            10.0.1.18 host.containers protonmail-bridge
          '';

        services = {
          nextcloud = {
            enable = true;
            package = nextcloudPackage;
            # datadir = "/data";
            database.createLocally = true;
            hostName = "cloud.mjallen.dev";
            appstoreEnable = true;
            caching.redis = true;
            configureRedis = true;
            enableImagemagick = true;
            https = true;

            config = {
              adminuser = "mjallen";
              adminpassFile = adminpass;
              dbhost = "localhost";
              dbtype = "sqlite";
              dbname = "nextcloud";
              dbuser = "nextcloud";
            };
            settings = {
              loglevel = 3;
              allow_local_remote_servers = true;
              upgrade.disable-web = false;
              datadirectory = "/data";
              trusted_domains = [
                "10.0.1.18:9988"
                "10.0.1.18:9943"
                "10.0.2.18:80"
                "10.0.2.18:443"
                "cloud.mjallen.dev"
              ];
              opcache.interned_strings_buffer = 16;
              trusted_proxies = [ "10.0.1.18" ];
              maintenance_window_start = 6;
              default_phone_region = "US";
              mail_from_address = "matt.l.jallen";
              mail_smtpmode = "smtp";
              mail_sendmailmode = "smtp";
              mail_domain = "gmail.com";
              mail_smtpauth = 1;
              mail_smtpname = "matt.l.jallen";
              mail_smtppassword = smtppassword;
              mail_smtpsecure = "ssl";
              mail_smtphost = "smtp.gmail.com";
              mail_smtpport = 465;
              enable_previews = true;
              enabledPreviewProviders = [
                "OC\\Preview\\PNG"
                "OC\\Preview\\JPEG"
                "OC\\Preview\\GIF"
                "OC\\Preview\\BMP"
                "OC\\Preview\\XBitmap"
                "OC\\Preview\\MP3"
                "OC\\Preview\\TXT"
                "OC\\Preview\\MarkDown"
                "OC\\Preview\\OpenDocument"
                "OC\\Preview\\Krita"
                "OC\\Preview\\HEIC"
                "OC\\Preview\\Movie"
                "OC\\Preview\\MSOffice2003"
                "OC\\Preview\\MSOffice2007"
                "OC\\Preview\\MSOfficeDoc"
              ];
              installed = true;
              user_oidc = {
                auto_provision = false;
                soft_auto_provision = false;
              };
            };
          };
        };

        # System packages
        environment.systemPackages = with pkgs; [
          cudaPackages.cudnn
          cudatoolkit
          ffmpeg
          libtensorflow-bin
          nextcloud30
          nodejs
          # onlyoffice-documentserver
          sqlite
        ];

        # Create required users and groups
        users.users.nextcloud = {
          isSystemUser = true;
          uid = lib.mkForce nextcloudUserId;
          group = "nextcloud";
        };

        # users.users.onlyoffice = {
        #   group = lib.mkForce "nextcloud";
        # };

        users.groups = {
          nextcloud = {
            gid = lib.mkForce nextcloudGroupId;
          };
          downloads = { };
        };

        # Create and set permissions for required directories
        system.activationScripts.nextcloud-dirs = ''
          mkdir -p /data

          chown -R nextcloud:nextcloud /data

          chown  -R nextcloud:nextcloud /run/secrets/jallen-nas/nextcloud

          chmod -R 775 /data

          chmod  -R 750 /run/secrets/jallen-nas/nextcloud

        '';

        hardware = {
          graphics = {
            enable = true;
            # setLdLibraryPath = true;
          };
        };

        programs = {
          nix-ld.enable = true;
        };

        share.hardware.nvidia = {
          enable = true;
          enableBeta = true;
          enableOpen = true;
          nvidiaSettings = true;
          enableNvidiaDocker = true;
        };

        system.stateVersion = "23.11";
        networking = {
          firewall = {
            enable = true;
            allowedTCPPorts = [
              80
              443
            ];
          };
          # Use systemd-resolved inside the container
          # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
          useHostResolvConf = lib.mkForce false;
        };
        services.resolved.enable = true;

      };
  };

  networking = {
    nat = {
      forwardPorts = [
        {
          destination = "10.0.2.18:443";
          sourcePort = 9943;
        }
        {
          destination = "10.0.2.18:80";
          sourcePort = 9988;
        }
        {
          destination = "10.0.2.18:8000";
          sourcePort = 8000;
        }
      ];
    };
  };
}