nextcloud: create service

hosts/poseidon/default.nix

@@ -114,6 +114,10 @@ in
       domain = "monitoring.${config.networking.domain}";
     };
 
+    nextcloud = {
+      enable = true;
+    };
+
     postgresql-backup = {
       enable = true;
     };

secrets/default.nix

@@ -12,6 +12,8 @@ with lib;
     miniflux-admin-credentials = lib.fileContents ./miniflux-admin-credentials.secret;
     borg-backup-repo = lib.fileContents ./borg-backup-repo.secret;
     transmission-password = lib.fileContents ./transmission.secret;
+    nextcloud-admin-pass = lib.fileContents ./nextcloud-admin-pass.secret;
+    nextcloud-admin-user = lib.fileContents ./nextcloud-admin-user.secret;
 
     wireguard = pkgs.callPackage ./wireguard.nix { };
   };

services/default.nix

@@ -11,6 +11,7 @@
     ./media.nix
     ./miniflux.nix
     ./monitoring.nix
+    ./nextcloud.nix
     ./nginx.nix
     ./postgresql-backup.nix
     ./tgv.nix

services/nextcloud.nix

@@ -0,0 +1,73 @@
+{ lib, config, pkgs, ... }:
+
+# TODO: setup prometheus exporter
+
+let
+  cfg = config.my.services.nextcloud;
+  my = config.my;
+  domain = config.networking.domain;
+  dbName = "nextcloud";
+in
+{
+  options.my.services.nextcloud = {
+    enable = lib.mkEnableOption "NextCloud";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # FIXME: set postgresql package globally
+    services.postgresql = {
+      enable = true;
+
+      ensureDatabases = [ dbName ];
+      ensureUsers = [
+        {
+          name = "nextcloud";
+          ensurePermissions = {
+            "DATABASE ${dbName}" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    services.postgresqlBackup = {
+      databases = [ dbName ];
+    };
+
+    services.nextcloud = {
+      enable = true;
+
+      hostName = "cloud.${domain}";
+      https = true;
+      package = pkgs.nextcloud21;
+
+      maxUploadSize = "1G";
+
+      config = {
+        overwriteProtocol = "https";
+
+        defaultPhoneRegion = "FR";
+
+        dbtype = "pgsql";
+        dbuser = "nextcloud";
+        dbname = dbName;
+        dbhost = "/run/postgresql";
+
+        adminuser = my.secrets.nextcloud-admin-user;
+        adminpass = my.secrets.nextcloud-admin-pass;
+      };
+    };
+
+    services.nginx = {
+      virtualHosts = {
+        "cloud.${domain}" = {
+          forceSSL = true;
+          enableACME = true;
+        };
+      };
+    };
+
+    my.services.borg-backup = lib.mkIf cfg.enable {
+      paths = [ config.services.nextcloud.home ];
+    };
+  };
+}