added nextcloud

caddy.nix

@@ -22,6 +22,17 @@
       }
       reverse_proxy 192.168.100.11:80
     '';
+
+    # Nextcloud — served by local nginx
+    # (Authelia forward-auth disabled for now; re-enable by uncommenting the
+    #  forward_auth block below.)
+    virtualHosts."nextcloud.srazka.com".extraConfig = ''
+      # forward_auth 127.0.0.1:9091 {
+      #   uri /api/authz/forward-auth
+      #   copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+      # }
+      reverse_proxy 127.0.0.1:8081
+    '';
   };
 
 }

flake.nix

@@ -34,6 +34,7 @@
           ./panel.nix
           ./caddy.nix
           ./authelia.nix
+          ./nextcloud.nix
           ./containers/hello.nix
           agenix.nixosModules.default
 

nextcloud.nix

@@ -0,0 +1,43 @@
+{ config, pkgs, ... }:
+
+{
+  # Admin password is managed by agenix.
+  # Create secrets/nextcloud-admin-pass.age and add it to secrets.nix,
+  # then run: agenix -e secrets/nextcloud-admin-pass.age
+  age.secrets."nextcloud-admin-pass" = {
+    file = ./secrets/nextcloud-admin-pass.age;
+    owner = "nextcloud";
+    group = "nextcloud";
+    mode = "0400";
+  };
+
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud31;
+
+    hostName = "nextcloud.srazka.com";
+    https = true;
+
+    # Let Caddy handle TLS termination; nginx only listens on localhost.
+    nginx.listen = [
+      {
+        addr = "127.0.0.1";
+        port = 8081;
+      }
+    ];
+
+    config = {
+      adminuser = "admin";
+      adminpassFile = config.age.secrets."nextcloud-admin-pass".path;
+      dbtype = "sqlite";
+    };
+
+    # Tell Nextcloud it's behind a trusted reverse proxy.
+    settings = {
+      trusted_proxies = [ "127.0.0.1" ];
+      overwriteprotocol = "https";
+      overwritehost = "nextcloud.srazka.com";
+      default_phone_region = "NL";
+    };
+  };
+}

secrets.nix

@@ -16,4 +16,7 @@ in
   "secrets/authelia-session-secret.age".publicKeys = users ++ systems;
   # The hashed users database (contains bcrypt-hashed passwords)
   "secrets/authelia-users.age".publicKeys         = users ++ systems;
+
+  # Nextcloud admin password (plaintext, read by the nextcloud service)
+  "secrets/nextcloud-admin-pass.age".publicKeys   = users ++ systems;
 }

secrets/nextcloud-admin-pass.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 Ol8kbg ypgLLSmZCK/jQS8/uKJGeDWC43OhCigFSGpk0MC2JAw
+w/u0IN7WgxGFRU3kCJSfXqDOH0nlg+sSpFuiO9NPQvE
+-> ssh-ed25519 QGvsHg gDVyEkB5CUpP7Be0mwxRdq6RRcoFj2n9K3zFqjNAb1U
+BJRF6q2jTRoIrl5O+eaU/BwjCAxMQRGbc+KwkQR6kxk
+-> ssh-ed25519 yjVKVA rszu7lwBrISpY+0rZjWqTD4dvm+cGMCyKs+y/aBtFTc
+B24IaVCqM/CGSlsbIcPK3mPBx//GPrmfyAYs8+OJ5tA
+-> ssh-ed25519 4XPa+g KVSML0PYT8mz0roVaqosSTlocPhQwkdv3YSKENi0FnM
+oAP+LCd3aRoX12sFfKyN1eyRBwVtYLRsrcD1sg5KVY8
+--- llY5vR1FnmECDPARltvUulM3GbW+7D73M0A6XKyTg44
+«:Vÿ^ÑÇ}7<>Péž$~B”1üiÏz‚
Íê<>bÑ2<C391>s+€Ó)K[