53 lines
1.5 KiB
Nix
53 lines
1.5 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
# Admin password is managed by agenix.
|
|
# Create secrets/nextcloud-admin-pass.age and add it to secrets.nix,
|
|
# then run: agenix -e secrets/nextcloud-admin-pass.age
|
|
age.secrets."nextcloud-admin-pass" = {
|
|
file = ./secrets/nextcloud-admin-pass.age;
|
|
owner = "nextcloud";
|
|
group = "nextcloud";
|
|
mode = "0400";
|
|
};
|
|
|
|
services.nextcloud = {
|
|
enable = true;
|
|
package = pkgs.nextcloud33;
|
|
|
|
hostName = "nextcloud.srazka.com";
|
|
https = true;
|
|
|
|
config = {
|
|
adminuser = "admin";
|
|
adminpassFile = config.age.secrets."nextcloud-admin-pass".path;
|
|
dbtype = "sqlite";
|
|
};
|
|
|
|
# Tell Nextcloud it's behind a trusted reverse proxy.
|
|
settings = {
|
|
trusted_proxies = [ "127.0.0.1" ];
|
|
overwriteprotocol = "https";
|
|
overwritehost = "nextcloud.srazka.com";
|
|
default_phone_region = "NL";
|
|
};
|
|
};
|
|
|
|
# Let Caddy handle TLS termination; nginx only listens on localhost.
|
|
# The nextcloud module creates the virtualhost at hostName; we override
|
|
# its listen address here.
|
|
services.nginx.virtualHosts.${config.services.nextcloud.hostName}.listen = [
|
|
{
|
|
addr = "127.0.0.1";
|
|
port = 8081;
|
|
}
|
|
];
|
|
|
|
# The cron timer can fire before nextcloud-setup.service has finished on
|
|
# first boot, causing a "Not installed" failure. Make the cron service wait
|
|
# for setup to complete before it's allowed to run.
|
|
systemd.services.nextcloud-cron = {
|
|
after = [ "nextcloud-setup.service" ];
|
|
requires = [ "nextcloud-setup.service" ];
|
|
};
|
|
}
|