haccfiles/hosts/hainich/services/nextcloud.nix

# TODOs before actually using this
# - change root auth to use adminpassFile
# - figure out how to use multiple pools (do we need this?)
# - how to enable ldap?
#
# Additional notes:
#  - there is a services.nextcloud.phpExtraExtensions, which may be
#    useful for this, but it's only in nixos-unstable for now
#  - there's a services.nextcloud.autoUpdateApps – do we trust nextcloud
#    enough to enable it, or will everything break if we do?



{pkgs, config, ...}:

{

  containers.nextcloud = {

    autoStart = true;
    privateNetwork = true;
    hostAddress = "192.168.110.1";
    localAddress = "192.168.110.10";

    config = { pkgs, ... }: {

      environment.systemPackages = [ pkgs.htop ];

      imports = [ ../../../modules/nextcloud.nix ];

      services.nextcloud-patched = {
        enable = true;

        # must be set manually; may not be incremented by more than one at
        # a time, otherwise nextcloud WILL break
        package = pkgs.nextcloud21;

        hostName = "cloud2.infra4future.de";
        config = {
          dbtype = "pgsql";
          dbuser = "nextcloud";
          dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
          dbname = "nextcloud";
          # there's also a adminpassFile option, but for testing this seems
          # enough (less fiddling with getting the file into a nixos
          # container for ad-hoc setups)
          adminpass = "lushfjwebrwhjebr";
          adminuser = "root";
        };

        caching.redis = true;

        # multiple pools may be doable using services.phpfpm.pools,
        # but i have not tried this yet. The nextcloud module defines a
        # pool "nextcloud"
        poolSettings = {
          pm = "dynamic";
          "pm.max_children" = "32";
          "pm.max_requests" = "500";
          "pm.max_spare_servers" = "4";
          "pm.min_spare_servers" = "2";
          "pm.start_servers" = "2";
        };

        extraOptions = {
          instanceid = "ocxlphb7fbju";
          redis = {
            host = "/run/redis/redis.sock";
            port = 0;
            dbindex = 0;
            password = "secret";
            timeout = 1.5;
          };
          datadirectory = "/mnt/ncdata";
          mail_smtpmode = "smtp";
          mail_smtpsecure = "ssl";
          mail_sendmailmode = "smtp";
          mail_from_address = "noreply";
          mail_domain = "infra4future.de";
          mail_smtpauthtype = "PLAIN";
          mail_smtpauth = 1;
          mail_smtphost = "mail.hacc.space";
          mail_smtpport = 465;
          mail_smtpname = "noreply@infra4future.de";
          loglevel = 0;
        };

        # passwordsalt, secret, and mail_smtppassword go in here
        secretFile = "/secret/secrets.json";

      };

      services.redis = {
        enable = true;
        unixSocket = "/var/run/redis/redis.sock";
      };

      services.postgresql = {
        enable = true;
        ensureDatabases = [ "nextcloud" ];
        ensureUsers = [
          { # by default, postgres has unix sockets enabled, and allows a
          # system user `nextcloud` to log in without other authentication
          name = "nextcloud";
          ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
          }
        ];
      };

      # ensure that postgres is running *before* running the setup
      systemd.services."nextcloud-setup" = {
        requires = ["postgresql.service"];
        after = ["postgresql.service"];
      };

      networking.firewall.enable = false;

      services.coredns = {
        enable = true;
        config = ''
          .:53 {
            forward . 1.1.1.1
          }
        '';
      };
    };
  };

  services.nginx.virtualHosts."cloud2.infra4future.de" = {
    locations."/".proxyPass = "http://${config.containers.nextcloud.localAddress}:80";
    enableACME = true;
    forceSSL = true;
  };


  networking.nat.enable = true;
  networking.nat.internalInterfaces = ["ve-nextcloud"];
  networking.nat.externalInterface = "enp6s0";

}