diff --git a/hosts/defiant/services/nginx.nix b/hosts/defiant/services/nginx.nix index aee37b0..1934c04 100644 --- a/hosts/defiant/services/nginx.nix +++ b/hosts/defiant/services/nginx.nix @@ -45,5 +45,34 @@ "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/"; "git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}"; "wiki.wackattack.eu" = publicProxy "http://pascal.wackattack.home.feal.no/"; + + "cloud.feal.no" = { + listen = [ + { addr = "192.168.10.175"; port = 43443; ssl = true; } + { addr = "192.168.10.175"; port = 43080; ssl = false; } + ]; + enableACME = true; + forceSSL = true; + + extraConfig = '' + server_tokens off; + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + + # HSTS settings + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always; + ''; + locations."/".proxyPass = "http://nextcloud.home.feal.no/"; + }; }; } diff --git a/hosts/voyager/configuration.nix b/hosts/voyager/configuration.nix index 472fbf1..606c2c0 100644 --- a/hosts/voyager/configuration.nix +++ b/hosts/voyager/configuration.nix @@ -15,6 +15,7 @@ ./services/fancontrol.nix ./services/jellyfin.nix ./services/kanidm.nix + ./services/nextcloud.nix ./services/nginx ./services/postgres.nix ./services/timemachine.nix @@ -23,13 +24,14 @@ networking = { hostName = "voyager"; - defaultGateway = "192.168.10.1"; - interfaces.eno1.ipv4 = { - addresses = [ + bridges.br0.interfaces = [ "eno1" ]; + interfaces.br0.useDHCP = false; + interfaces.br0.ipv4.addresses = [ { address = "192.168.10.165"; prefixLength = 24; } - ]; - }; + ]; + hostId = "8e84b235"; + defaultGateway = "192.168.10.1"; }; sops.defaultSopsFile = ../../secrets/voyager/voyager.yaml; diff --git a/hosts/voyager/services/nextcloud.nix b/hosts/voyager/services/nextcloud.nix new file mode 100644 index 0000000..f682ad7 --- /dev/null +++ b/hosts/voyager/services/nextcloud.nix @@ -0,0 +1,79 @@ +{ config, pkgs, lib, ... }: +let + cfg = config.containers.nextcloud.config.services.nextcloud; + hostName = "cloud.feal.no"; +in { + containers.nextcloud = { + autoStart = true; + ephemeral = true; + + privateNetwork = true; + hostBridge = "br0"; + localAddress = "192.168.10.171/24"; + + bindMounts = { + "/var/lib/nextcloud" = { isReadOnly = false; hostPath = "/tank/nextcloud/nextcloud/"; }; + "/var/lib/postgresql" = { isReadOnly = false; hostPath = "/tank/nextcloud/postgresql/"; }; + "/srv/secrets/" = { isReadOnly = true; hostPath = "/tank/nextcloud/secrets/"; }; + }; + + config = { config, pkgs, ... }: { + system.stateVersion = "23.11"; + + networking = { + firewall = { + enable = true; + allowedTCPPorts = [ 80 ]; + }; + + defaultGateway = "192.168.10.1"; + }; + time.timeZone = "Europe/Oslo"; + + services.nextcloud = { + enable = true; + package = pkgs.nextcloud28; + inherit hostName; + home = "/var/lib/nextcloud"; + https = true; + + config = { + dbtype = "pgsql"; + dbuser = "nextcloud"; + dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself + dbname = "nextcloud"; + adminpassFile = "/srv/secrets/adminpass"; + adminuser = "ncadmin"; + }; + + # phpOptions = { + # "opcache.interned_strings_buffer" = "16"; + # "upload_max_filesize" = "4G"; + # "post_max_size" = "4G"; + # "memory_limit" = "4G"; + # }; + + poolSettings = { + "pm" = "ondemand"; + "pm.max_children" = 32; + "pm.process_idle_timeout" = "10s"; + "pm.max_requests" = 500; + }; + }; + + services.postgresql = { + enable = true; + ensureDatabases = [ "nextcloud" ]; + ensureUsers = [ { + name = "nextcloud"; + ensureDBOwnership = true; + } ]; + }; + + systemd.services."nextcloud-setup" = { + requires = [ "postgresql.service" ]; + after = [ "postgresql.service" ]; + }; + }; + }; +}