From eed70a696962e22c925f5a39f07b2c2802fad605 Mon Sep 17 00:00:00 2001 From: Jakub Dorfman Date: Wed, 15 Jul 2026 16:57:26 +0200 Subject: [PATCH] added nextcloud --- caddy.nix | 11 ++++++++ flake.nix | 1 + nextcloud.nix | 43 ++++++++++++++++++++++++++++++++ secrets.nix | 3 +++ secrets/nextcloud-admin-pass.age | 11 ++++++++ 5 files changed, 69 insertions(+) create mode 100644 nextcloud.nix create mode 100644 secrets/nextcloud-admin-pass.age diff --git a/caddy.nix b/caddy.nix index 0318909..87cb43b 100755 --- a/caddy.nix +++ b/caddy.nix @@ -22,6 +22,17 @@ } reverse_proxy 192.168.100.11:80 ''; + + # Nextcloud — served by local nginx + # (Authelia forward-auth disabled for now; re-enable by uncommenting the + # forward_auth block below.) + virtualHosts."nextcloud.srazka.com".extraConfig = '' + # forward_auth 127.0.0.1:9091 { + # uri /api/authz/forward-auth + # copy_headers Remote-User Remote-Groups Remote-Email Remote-Name + # } + reverse_proxy 127.0.0.1:8081 + ''; }; } diff --git a/flake.nix b/flake.nix index 0003122..e49794e 100644 --- a/flake.nix +++ b/flake.nix @@ -34,6 +34,7 @@ ./panel.nix ./caddy.nix ./authelia.nix + ./nextcloud.nix ./containers/hello.nix agenix.nixosModules.default diff --git a/nextcloud.nix b/nextcloud.nix new file mode 100644 index 0000000..3b8a35c --- /dev/null +++ b/nextcloud.nix @@ -0,0 +1,43 @@ +{ config, pkgs, ... }: + +{ + # Admin password is managed by agenix. + # Create secrets/nextcloud-admin-pass.age and add it to secrets.nix, + # then run: agenix -e secrets/nextcloud-admin-pass.age + age.secrets."nextcloud-admin-pass" = { + file = ./secrets/nextcloud-admin-pass.age; + owner = "nextcloud"; + group = "nextcloud"; + mode = "0400"; + }; + + services.nextcloud = { + enable = true; + package = pkgs.nextcloud31; + + hostName = "nextcloud.srazka.com"; + https = true; + + # Let Caddy handle TLS termination; nginx only listens on localhost. + nginx.listen = [ + { + addr = "127.0.0.1"; + port = 8081; + } + ]; + + config = { + adminuser = "admin"; + adminpassFile = config.age.secrets."nextcloud-admin-pass".path; + dbtype = "sqlite"; + }; + + # Tell Nextcloud it's behind a trusted reverse proxy. + settings = { + trusted_proxies = [ "127.0.0.1" ]; + overwriteprotocol = "https"; + overwritehost = "nextcloud.srazka.com"; + default_phone_region = "NL"; + }; + }; +} diff --git a/secrets.nix b/secrets.nix index 0141976..c04b623 100644 --- a/secrets.nix +++ b/secrets.nix @@ -16,4 +16,7 @@ in "secrets/authelia-session-secret.age".publicKeys = users ++ systems; # The hashed users database (contains bcrypt-hashed passwords) "secrets/authelia-users.age".publicKeys = users ++ systems; + + # Nextcloud admin password (plaintext, read by the nextcloud service) + "secrets/nextcloud-admin-pass.age".publicKeys = users ++ systems; } diff --git a/secrets/nextcloud-admin-pass.age b/secrets/nextcloud-admin-pass.age new file mode 100644 index 0000000..3d6d172 --- /dev/null +++ b/secrets/nextcloud-admin-pass.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> ssh-ed25519 Ol8kbg ypgLLSmZCK/jQS8/uKJGeDWC43OhCigFSGpk0MC2JAw +w/u0IN7WgxGFRU3kCJSfXqDOH0nlg+sSpFuiO9NPQvE +-> ssh-ed25519 QGvsHg gDVyEkB5CUpP7Be0mwxRdq6RRcoFj2n9K3zFqjNAb1U +BJRF6q2jTRoIrl5O+eaU/BwjCAxMQRGbc+KwkQR6kxk +-> ssh-ed25519 yjVKVA rszu7lwBrISpY+0rZjWqTD4dvm+cGMCyKs+y/aBtFTc +B24IaVCqM/CGSlsbIcPK3mPBx//GPrmfyAYs8+OJ5tA +-> ssh-ed25519 4XPa+g KVSML0PYT8mz0roVaqosSTlocPhQwkdv3YSKENi0FnM +oAP+LCd3aRoX12sFfKyN1eyRBwVtYLRsrcD1sg5KVY8 +--- llY5vR1FnmECDPARltvUulM3GbW+7D73M0A6XKyTg44 +:V^}7P$~B1iz b2s+)K[ \ No newline at end of file