added nextcloud

nextcloud.nix

@@ -0,0 +1,43 @@
+{ config, pkgs, ... }:
+
+{
+  # Admin password is managed by agenix.
+  # Create secrets/nextcloud-admin-pass.age and add it to secrets.nix,
+  # then run: agenix -e secrets/nextcloud-admin-pass.age
+  age.secrets."nextcloud-admin-pass" = {
+    file = ./secrets/nextcloud-admin-pass.age;
+    owner = "nextcloud";
+    group = "nextcloud";
+    mode = "0400";
+  };
+
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud31;
+
+    hostName = "nextcloud.srazka.com";
+    https = true;
+
+    # Let Caddy handle TLS termination; nginx only listens on localhost.
+    nginx.listen = [
+      {
+        addr = "127.0.0.1";
+        port = 8081;
+      }
+    ];
+
+    config = {
+      adminuser = "admin";
+      adminpassFile = config.age.secrets."nextcloud-admin-pass".path;
+      dbtype = "sqlite";
+    };
+
+    # Tell Nextcloud it's behind a trusted reverse proxy.
+    settings = {
+      trusted_proxies = [ "127.0.0.1" ];
+      overwriteprotocol = "https";
+      overwritehost = "nextcloud.srazka.com";
+      default_phone_region = "NL";
+    };
+  };
+}