nix-config/hosts/nas/apps/nextcloud/default.nix

{ config, pkgs, ... }:
let
  adminpass = config.sops.secrets."jallen-nas/nextcloud/adminpassword".path;
  smtppassword = config.sops.templates."nextcloud-smtp".content;
  nextcloudUserId = config.users.users.nix-apps.uid;
  nextcloudGroupId = config.users.groups.jallen-nas.gid;
  nextcloudPackage = pkgs.unstable.nextcloud30;
in
{
  containers.nextcloud = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = "10.0.1.18";
    localAddress = "10.0.2.18";

    bindMounts = {
      secrets = {
        hostPath = "/run/secrets/jallen-nas/nextcloud";
        isReadOnly = true;
        mountPoint = "/run/secrets/jallen-nas/nextcloud";
      };

      data = {
        hostPath = "/media/nas/main/nextcloud";
        isReadOnly = false;
        mountPoint = "/data";
      };

      "/var/lib/nextcloud" = {
        hostPath = "/media/nas/ssd/nix-app-data/nextcloud";
        isReadOnly = false;
        mountPoint = "/var/lib/nextcloud";
      };

      # "/var/lib/onlyoffice" = {
      #   hostPath = "/media/nas/ssd/nix-app-data/onlyoffice";
      #   isReadOnly = false;
      #   mountPoint = "/var/lib/onlyoffice";
      # };
    };

    config =
      { pkgs, lib, ... }:
      {
        nixpkgs.config.allowUnfree = true;

        services = {
          nextcloud = {
            enable = true;
            package = nextcloudPackage;
            # datadir = "/data";
            database.createLocally = true;
            hostName = "cloud.mjallen.dev";
            appstoreEnable = true;
            caching.redis = true;
            configureRedis = true;
            enableImagemagick = true;
            https = true;

            config = {
              adminuser = "mjallen";
              adminpassFile = adminpass;
              dbhost = "localhost";
              dbtype = "sqlite";
              dbname = "nextcloud";
              dbuser = "nextcloud";
            };
            settings = {
              allow_local_remote_servers = true;
              upgrade.disable-web = false;
              datadirectory = "/data";
              trusted_domains = [
                "10.0.1.18:9988"
                "10.0.1.18:9943"
                "10.0.2.18:80"
                "10.0.2.18:443"
                "cloud.mjallen.dev"
              ];
              trusted_proxies = [ "10.0.1.18" ];
              maintenance_window_start = 6;
              default_phone_region = "US";
              mail_from_address = "matt.l.jallen";
              mail_smtpmode = "smtp";
              mail_sendmailmode = "smtp";
              mail_domain = "gmail.com";
              mail_smtpauth = 1;
              mail_smtpname = "matt.l.jallen";
              mail_smtppassword = smtppassword;
              mail_smtpsecure = "ssl";
              mail_smtphost = "smtp.gmail.com";
              mail_smtpport = 465;
              enable_previews = true;
              enabledPreviewProviders = [
                "OC\\\\Preview\\\\PNG"
                "OC\\\\Preview\\\\JPEG"
                "OC\\\\Preview\\\\GIF"
                "OC\\\\Preview\\\\BMP"
                "OC\\\\Preview\\\\XBitmap"
                "OC\\\\Preview\\\\MP3"
                "OC\\\\Preview\\\\TXT"
                "OC\\\\Preview\\\\MarkDown"
                "OC\\\\Preview\\\\OpenDocument"
                "OC\\\\Preview\\\\Krita"
                "OC\\\\Preview\\\\HEIC"
              ];
              installed = true;
              user_oidc = {
                auto_provision = false;
                soft_auto_provision = false;
              };
            };
          };
        };

        # System packages
        environment.systemPackages = with pkgs; [
          libtensorflow-bin
          nextcloud30
          nodejs
          # onlyoffice-documentserver
          sqlite
        ];

        # Create required users and groups
        users.users.nextcloud = {
          isSystemUser = true;
          uid = lib.mkForce nextcloudUserId;
          group = "nextcloud";
        };

        # users.users.onlyoffice = {
        #   group = lib.mkForce "nextcloud";
        # };

        users.groups = {
          nextcloud = {
            gid = lib.mkForce nextcloudGroupId;
          };
          downloads = { };
        };

        # Create and set permissions for required directories
        system.activationScripts.nextcloud-dirs = ''
          mkdir -p /data

          chown -R nextcloud:nextcloud /data

          chown  -R nextcloud:nextcloud /run/secrets/jallen-nas/nextcloud

          chmod -R 775 /data

          chmod  -R 750 /run/secrets/jallen-nas/nextcloud

        '';

        system.stateVersion = "23.11";
        networking = {
          firewall = {
            enable = true;
            allowedTCPPorts = [
              80
              443
            ];
          };
          # Use systemd-resolved inside the container
          # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
          useHostResolvConf = lib.mkForce false;
        };
        services.resolved.enable = true;

      };
  };

  networking.nat = {
    forwardPorts = [
      {
        destination = "10.0.2.18:443";
        sourcePort = 9943;
      }
      {
        destination = "10.0.2.18:80";
        sourcePort = 9988;
      }
      {
        destination = "10.0.2.18:8000";
        sourcePort = 8000;
      }
    ];
  };
}