use merge to segment the complex nginx proxy settings
This commit is contained in:
Danilo Reyes
@@ -42,128 +42,203 @@ in
|
||||
collabora = setup.mkOptions "collabora" "collabora" 9980;
|
||||
go-vod.enable = lib.mkEnableOption "Go-VOD video transcoding service";
|
||||
};
|
||||
config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
|
||||
sops.secrets.nextcloud-adminpass = {
|
||||
owner = config.users.users.nextcloud.name;
|
||||
inherit (config.users.users.nextcloud) group;
|
||||
};
|
||||
nixpkgs.config.permittedInsecurePackages = [
|
||||
"nodejs-14.21.3"
|
||||
"openssl-1.1.1v"
|
||||
];
|
||||
users.groups.nextcloud = { inherit gid; };
|
||||
users.users.nextcloud = {
|
||||
inherit uid;
|
||||
isSystemUser = true;
|
||||
group = "nextcloud";
|
||||
extraGroups = [ "render" ];
|
||||
packages = builtins.attrValues {
|
||||
inherit exiftool pytensorflow;
|
||||
inherit (pkgs)
|
||||
ffmpeg
|
||||
mediainfo
|
||||
nodejs
|
||||
perl
|
||||
;
|
||||
config = lib.mkMerge [
|
||||
(lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
|
||||
sops.secrets.nextcloud-adminpass = {
|
||||
owner = config.users.users.nextcloud.name;
|
||||
inherit (config.users.users.nextcloud) group;
|
||||
};
|
||||
};
|
||||
services = {
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
https = false; # vps
|
||||
package = pkgs.nextcloud32;
|
||||
appstoreEnable = true;
|
||||
configureRedis = true;
|
||||
extraAppsEnable = true;
|
||||
enableImagemagick = true;
|
||||
maxUploadSize = "4096M";
|
||||
hostName = cfg.host;
|
||||
caching = {
|
||||
redis = true;
|
||||
memcached = true;
|
||||
apcu = true;
|
||||
nixpkgs.config.permittedInsecurePackages = [
|
||||
"nodejs-14.21.3"
|
||||
"openssl-1.1.1v"
|
||||
];
|
||||
users.groups.nextcloud = { inherit gid; };
|
||||
users.users.nextcloud = {
|
||||
inherit uid;
|
||||
isSystemUser = true;
|
||||
group = "nextcloud";
|
||||
extraGroups = [ "render" ];
|
||||
packages = builtins.attrValues {
|
||||
inherit exiftool pytensorflow;
|
||||
inherit (pkgs)
|
||||
ffmpeg
|
||||
mediainfo
|
||||
nodejs
|
||||
perl
|
||||
;
|
||||
};
|
||||
config = {
|
||||
adminpassFile = config.sops.secrets.nextcloud-adminpass.path;
|
||||
dbtype = "pgsql";
|
||||
dbhost = config.my.postgresSocket;
|
||||
dbname = "nextcloud";
|
||||
};
|
||||
phpOptions = {
|
||||
catch_workers_output = "yes";
|
||||
display_errors = "stderr";
|
||||
error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
|
||||
expose_php = "Off";
|
||||
preview_max_x = 2048;
|
||||
preview_max_y = 2048;
|
||||
short_open_tag = "Off";
|
||||
"opcache.enable_cli" = "1";
|
||||
"opcache.fast_shutdown" = "1";
|
||||
"opcache.interned_strings_buffer" = "16";
|
||||
"opcache.jit" = "1255";
|
||||
"opcache.jit_buffer_size" = "256M";
|
||||
"opcache.max_accelerated_files" = "10000";
|
||||
"opcache.huge_code_pages" = "1";
|
||||
"opcache.enable_file_override" = "1";
|
||||
"opcache.memory_consumption" = "256";
|
||||
"opcache.revalidate_freq" = "60";
|
||||
"opcache.save_comments" = "1";
|
||||
"opcache.validate_timestamps" = "0";
|
||||
"openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
|
||||
};
|
||||
settings = {
|
||||
log_type = "file";
|
||||
loglevel = 1;
|
||||
trusted_proxies = [
|
||||
config.my.localhost
|
||||
config.my.localhost6
|
||||
config.my.ips.router
|
||||
config.my.ips.wg-vps
|
||||
];
|
||||
trusted_domains = [
|
||||
cfg.host
|
||||
config.my.ips.${config.networking.hostName}
|
||||
"localhost"
|
||||
"cloud.rotehaare.art"
|
||||
];
|
||||
overwriteprotocol = "https";
|
||||
"overwrite.cli.url" = "${cfg.url}";
|
||||
forwarded_for_headers = [ "HTTP_X_FORWARDED_FOR" ];
|
||||
default_phone_region = "MX";
|
||||
allow_local_remote_servers = true;
|
||||
mail_smtpmode = "sendmail";
|
||||
mail_sendmailmode = "pipe";
|
||||
preview_ffmpeg_path = "${pkgs.ffmpeg}/bin/ffmpeg";
|
||||
"memories.exiftool" = "${exiftool}/bin/exiftool";
|
||||
"memories.ffmpeg_path" = "${pkgs.ffmpeg}/bin/ffmpeg";
|
||||
"memories.ffprobe_path" = "${pkgs.ffmpeg}/bin/ffprobe";
|
||||
enabledPreviewProviders = [
|
||||
"OC\\Preview\\AVI"
|
||||
"OC\\Preview\\BMP"
|
||||
"OC\\Preview\\GIF"
|
||||
"OC\\Preview\\HEIC"
|
||||
"OC\\Preview\\Image"
|
||||
"OC\\Preview\\JPEG"
|
||||
"OC\\Preview\\Krita"
|
||||
"OC\\Preview\\MKV"
|
||||
"OC\\Preview\\MP3"
|
||||
"OC\\Preview\\MP4"
|
||||
"OC\\Preview\\MarkDown"
|
||||
"OC\\Preview\\Movie"
|
||||
"OC\\Preview\\OpenDocument"
|
||||
"OC\\Preview\\PNG"
|
||||
"OC\\Preview\\TIFF"
|
||||
"OC\\Preview\\TXT"
|
||||
"OC\\Preview\\XBitmap"
|
||||
];
|
||||
};
|
||||
phpExtraExtensions = all: [
|
||||
all.pdlib
|
||||
all.bz2
|
||||
];
|
||||
};
|
||||
nginx.virtualHosts = {
|
||||
"${cfg.host}" = lib.mkIf cfg.enableProxy {
|
||||
services = {
|
||||
nextcloud = {
|
||||
enable = true;
|
||||
https = false; # vps
|
||||
package = pkgs.nextcloud32;
|
||||
appstoreEnable = true;
|
||||
configureRedis = true;
|
||||
extraAppsEnable = true;
|
||||
enableImagemagick = true;
|
||||
maxUploadSize = "4096M";
|
||||
hostName = cfg.host;
|
||||
caching = {
|
||||
redis = true;
|
||||
memcached = true;
|
||||
apcu = true;
|
||||
};
|
||||
config = {
|
||||
adminpassFile = config.sops.secrets.nextcloud-adminpass.path;
|
||||
dbtype = "pgsql";
|
||||
dbhost = config.my.postgresSocket;
|
||||
dbname = "nextcloud";
|
||||
};
|
||||
phpOptions = {
|
||||
catch_workers_output = "yes";
|
||||
display_errors = "stderr";
|
||||
error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
|
||||
expose_php = "Off";
|
||||
preview_max_x = 2048;
|
||||
preview_max_y = 2048;
|
||||
short_open_tag = "Off";
|
||||
"opcache.enable_cli" = "1";
|
||||
"opcache.fast_shutdown" = "1";
|
||||
"opcache.interned_strings_buffer" = "16";
|
||||
"opcache.jit" = "1255";
|
||||
"opcache.jit_buffer_size" = "256M";
|
||||
"opcache.max_accelerated_files" = "10000";
|
||||
"opcache.huge_code_pages" = "1";
|
||||
"opcache.enable_file_override" = "1";
|
||||
"opcache.memory_consumption" = "256";
|
||||
"opcache.revalidate_freq" = "60";
|
||||
"opcache.save_comments" = "1";
|
||||
"opcache.validate_timestamps" = "0";
|
||||
"openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
|
||||
};
|
||||
settings = {
|
||||
log_type = "file";
|
||||
loglevel = 1;
|
||||
trusted_proxies = [
|
||||
config.my.localhost
|
||||
config.my.localhost6
|
||||
config.my.ips.router
|
||||
config.my.ips.wg-vps
|
||||
];
|
||||
trusted_domains = [
|
||||
cfg.host
|
||||
config.my.ips.${config.networking.hostName}
|
||||
"localhost"
|
||||
"cloud.rotehaare.art"
|
||||
];
|
||||
overwriteprotocol = "https";
|
||||
"overwrite.cli.url" = "${cfg.url}";
|
||||
forwarded_for_headers = [ "HTTP_X_FORWARDED_FOR" ];
|
||||
default_phone_region = "MX";
|
||||
allow_local_remote_servers = true;
|
||||
mail_smtpmode = "sendmail";
|
||||
mail_sendmailmode = "pipe";
|
||||
preview_ffmpeg_path = "${pkgs.ffmpeg}/bin/ffmpeg";
|
||||
"memories.exiftool" = "${exiftool}/bin/exiftool";
|
||||
"memories.ffmpeg_path" = "${pkgs.ffmpeg}/bin/ffmpeg";
|
||||
"memories.ffprobe_path" = "${pkgs.ffmpeg}/bin/ffprobe";
|
||||
enabledPreviewProviders = [
|
||||
"OC\\Preview\\AVI"
|
||||
"OC\\Preview\\BMP"
|
||||
"OC\\Preview\\GIF"
|
||||
"OC\\Preview\\HEIC"
|
||||
"OC\\Preview\\Image"
|
||||
"OC\\Preview\\JPEG"
|
||||
"OC\\Preview\\Krita"
|
||||
"OC\\Preview\\MKV"
|
||||
"OC\\Preview\\MP3"
|
||||
"OC\\Preview\\MP4"
|
||||
"OC\\Preview\\MarkDown"
|
||||
"OC\\Preview\\Movie"
|
||||
"OC\\Preview\\OpenDocument"
|
||||
"OC\\Preview\\PNG"
|
||||
"OC\\Preview\\TIFF"
|
||||
"OC\\Preview\\TXT"
|
||||
"OC\\Preview\\XBitmap"
|
||||
];
|
||||
};
|
||||
phpExtraExtensions = all: [
|
||||
all.pdlib
|
||||
all.bz2
|
||||
];
|
||||
};
|
||||
};
|
||||
virtualisation.oci-containers.containers = {
|
||||
go-vod = lib.mkIf config.my.servers.go-vod.enable {
|
||||
autoStart = true;
|
||||
image = "radialapps/go-vod";
|
||||
environment = {
|
||||
TZ = config.my.timeZone;
|
||||
NEXTCLOUD_HOST = "https://${config.services.nextcloud.hostName}";
|
||||
NVIDIA_VISIBLE_DEVICES = "all";
|
||||
};
|
||||
volumes = [ "ncdata:/var/www/html:ro" ];
|
||||
extraOptions = [
|
||||
"--device=/dev/dri" # VA-API (omit for NVENC)
|
||||
];
|
||||
};
|
||||
collabora = lib.mkIf cfgC.enable {
|
||||
autoStart = true;
|
||||
image = "collabora/code:latest";
|
||||
ports = [ "${toString cfgC.port}:${toString cfgC.port}" ];
|
||||
environment = {
|
||||
TZ = config.my.timeZone;
|
||||
domain = cfg.host;
|
||||
aliasgroup1 = "${cfg.url}:443";
|
||||
aliasgroup2 = "https://cloud.rotehaare.art:443";
|
||||
server_name = cfgC.host;
|
||||
dictionaries = "en_CA en_US es_MX es_ES fr_FR it pt_BR ru";
|
||||
extra_params = ''
|
||||
--o:ssl.enable=false
|
||||
--o:ssl.termination=true
|
||||
--o:remote_font_config.url=${cfg.url}/apps/richdocuments/settings/fonts.json
|
||||
--o:logging.level=information
|
||||
'';
|
||||
DONT_GEN_SSL_CERT = "1";
|
||||
SLEEPFORDEBUGGER = "0";
|
||||
};
|
||||
extraOptions = [
|
||||
"--cap-add"
|
||||
"MKNOD"
|
||||
];
|
||||
};
|
||||
};
|
||||
systemd = lib.mkIf cfg.enableCron {
|
||||
services = {
|
||||
nextcloud-cron.path = [ pkgs.perl ];
|
||||
nextcloud-cronjob =
|
||||
let
|
||||
inherit (inputs.jawz-scripts.packages.x86_64-linux) nextcloud-cronjob;
|
||||
in
|
||||
{
|
||||
description = "Runs various nextcloud-related cronjobs";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = [
|
||||
pkgs.bash
|
||||
nextcloud-cronjob
|
||||
];
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
RestartSec = 30;
|
||||
ExecStart = "${nextcloud-cronjob}/bin/nextcloud-cronjob";
|
||||
};
|
||||
};
|
||||
};
|
||||
timers.nextcloud-cronjob = {
|
||||
enable = true;
|
||||
description = "Runs various nextcloud-related cronjobs";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnCalendar = "*:0/10";
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
(lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
|
||||
my.servers.nextcloud.useDefaultProxy = false;
|
||||
services.nginx.virtualHosts = {
|
||||
"${cfg.host}" = {
|
||||
forceSSL = false; # vps
|
||||
enableACME = false; # vps
|
||||
http2 = false; # vps
|
||||
@@ -243,76 +318,6 @@ in
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
virtualisation.oci-containers.containers = {
|
||||
go-vod = lib.mkIf config.my.servers.go-vod.enable {
|
||||
autoStart = true;
|
||||
image = "radialapps/go-vod";
|
||||
environment = {
|
||||
TZ = config.my.timeZone;
|
||||
NEXTCLOUD_HOST = "https://${config.services.nextcloud.hostName}";
|
||||
NVIDIA_VISIBLE_DEVICES = "all";
|
||||
};
|
||||
volumes = [ "ncdata:/var/www/html:ro" ];
|
||||
extraOptions = [
|
||||
"--device=/dev/dri" # VA-API (omit for NVENC)
|
||||
];
|
||||
};
|
||||
collabora = lib.mkIf cfgC.enable {
|
||||
autoStart = true;
|
||||
image = "collabora/code:latest";
|
||||
ports = [ "${toString cfgC.port}:${toString cfgC.port}" ];
|
||||
environment = {
|
||||
TZ = config.my.timeZone;
|
||||
domain = cfg.host;
|
||||
aliasgroup1 = "${cfg.url}:443";
|
||||
aliasgroup2 = "https://cloud.rotehaare.art:443";
|
||||
server_name = cfgC.host;
|
||||
dictionaries = "en_CA en_US es_MX es_ES fr_FR it pt_BR ru";
|
||||
extra_params = ''
|
||||
--o:ssl.enable=false
|
||||
--o:ssl.termination=true
|
||||
--o:remote_font_config.url=${cfg.url}/apps/richdocuments/settings/fonts.json
|
||||
--o:logging.level=information
|
||||
'';
|
||||
DONT_GEN_SSL_CERT = "1";
|
||||
SLEEPFORDEBUGGER = "0";
|
||||
};
|
||||
extraOptions = [
|
||||
"--cap-add"
|
||||
"MKNOD"
|
||||
];
|
||||
};
|
||||
};
|
||||
systemd = lib.mkIf cfg.enableCron {
|
||||
services = {
|
||||
nextcloud-cron.path = [ pkgs.perl ];
|
||||
nextcloud-cronjob =
|
||||
let
|
||||
inherit (inputs.jawz-scripts.packages.x86_64-linux) nextcloud-cronjob;
|
||||
in
|
||||
{
|
||||
description = "Runs various nextcloud-related cronjobs";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = [
|
||||
pkgs.bash
|
||||
nextcloud-cronjob
|
||||
];
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
RestartSec = 30;
|
||||
ExecStart = "${nextcloud-cronjob}/bin/nextcloud-cronjob";
|
||||
};
|
||||
};
|
||||
};
|
||||
timers.nextcloud-cronjob = {
|
||||
enable = true;
|
||||
description = "Runs various nextcloud-related cronjobs";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnCalendar = "*:0/10";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user