004-vps-migration #5
@@ -52,116 +52,138 @@ in
|
|||||||
"nodejs-14.21.3"
|
"nodejs-14.21.3"
|
||||||
"openssl-1.1.1v"
|
"openssl-1.1.1v"
|
||||||
];
|
];
|
||||||
users.groups.nextcloud = { inherit gid; };
|
users = {
|
||||||
users.users.nextcloud = {
|
groups.nextcloud = { inherit gid; };
|
||||||
inherit uid;
|
users.nextcloud = {
|
||||||
isSystemUser = true;
|
inherit uid;
|
||||||
group = "nextcloud";
|
isSystemUser = true;
|
||||||
extraGroups = [ "render" ];
|
group = "nextcloud";
|
||||||
packages = builtins.attrValues {
|
extraGroups = [ "render" ];
|
||||||
inherit exiftool pytensorflow;
|
packages = builtins.attrValues {
|
||||||
inherit (pkgs)
|
inherit exiftool pytensorflow;
|
||||||
ffmpeg
|
inherit (pkgs)
|
||||||
mediainfo
|
ffmpeg
|
||||||
nodejs
|
mediainfo
|
||||||
perl
|
nodejs
|
||||||
;
|
perl
|
||||||
|
;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
services.nextcloud = {
|
services = {
|
||||||
enable = true;
|
nextcloud = {
|
||||||
https = false; # vps
|
enable = true;
|
||||||
package = pkgs.nextcloud32;
|
https = false; # vps
|
||||||
appstoreEnable = true;
|
package = pkgs.nextcloud32;
|
||||||
configureRedis = true;
|
appstoreEnable = true;
|
||||||
extraAppsEnable = true;
|
configureRedis = true;
|
||||||
enableImagemagick = true;
|
extraAppsEnable = true;
|
||||||
maxUploadSize = "4096M";
|
enableImagemagick = true;
|
||||||
hostName = cfg.host;
|
maxUploadSize = "4096M";
|
||||||
caching = {
|
hostName = cfg.host;
|
||||||
redis = true;
|
caching = {
|
||||||
memcached = true;
|
redis = true;
|
||||||
apcu = true;
|
memcached = true;
|
||||||
};
|
apcu = true;
|
||||||
config = {
|
};
|
||||||
adminpassFile = config.sops.secrets.nextcloud-adminpass.path;
|
config = {
|
||||||
dbtype = "pgsql";
|
adminpassFile = config.sops.secrets.nextcloud-adminpass.path;
|
||||||
dbhost = config.my.postgresSocket;
|
dbtype = "pgsql";
|
||||||
dbname = "nextcloud";
|
dbhost = config.my.postgresSocket;
|
||||||
};
|
dbname = "nextcloud";
|
||||||
phpOptions = {
|
};
|
||||||
catch_workers_output = "yes";
|
phpOptions = {
|
||||||
display_errors = "stderr";
|
catch_workers_output = "yes";
|
||||||
error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
|
display_errors = "stderr";
|
||||||
expose_php = "Off";
|
error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
|
||||||
preview_max_x = 2048;
|
expose_php = "Off";
|
||||||
preview_max_y = 2048;
|
preview_max_x = 2048;
|
||||||
short_open_tag = "Off";
|
preview_max_y = 2048;
|
||||||
"opcache.enable_cli" = "1";
|
short_open_tag = "Off";
|
||||||
"opcache.fast_shutdown" = "1";
|
"opcache.enable_cli" = "1";
|
||||||
"opcache.interned_strings_buffer" = "16";
|
"opcache.fast_shutdown" = "1";
|
||||||
"opcache.jit" = "1255";
|
"opcache.interned_strings_buffer" = "16";
|
||||||
"opcache.jit_buffer_size" = "256M";
|
"opcache.jit" = "1255";
|
||||||
"opcache.max_accelerated_files" = "10000";
|
"opcache.jit_buffer_size" = "256M";
|
||||||
"opcache.huge_code_pages" = "1";
|
"opcache.max_accelerated_files" = "10000";
|
||||||
"opcache.enable_file_override" = "1";
|
"opcache.huge_code_pages" = "1";
|
||||||
"opcache.memory_consumption" = "256";
|
"opcache.enable_file_override" = "1";
|
||||||
"opcache.revalidate_freq" = "60";
|
"opcache.memory_consumption" = "256";
|
||||||
"opcache.save_comments" = "1";
|
"opcache.revalidate_freq" = "60";
|
||||||
"opcache.validate_timestamps" = "0";
|
"opcache.save_comments" = "1";
|
||||||
"openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
|
"opcache.validate_timestamps" = "0";
|
||||||
};
|
"openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
|
||||||
settings = {
|
};
|
||||||
log_type = "file";
|
settings = {
|
||||||
loglevel = 1;
|
log_type = "file";
|
||||||
trusted_proxies = [
|
loglevel = 1;
|
||||||
config.my.localhost
|
trusted_proxies = [
|
||||||
config.my.localhost6
|
config.my.localhost
|
||||||
config.my.ips.router
|
config.my.localhost6
|
||||||
config.my.ips.wg-vps
|
config.my.ips.router
|
||||||
|
config.my.ips.wg-vps
|
||||||
|
];
|
||||||
|
trusted_domains = [
|
||||||
|
cfg.host
|
||||||
|
config.my.ips.${config.networking.hostName}
|
||||||
|
"localhost"
|
||||||
|
"cloud.rotehaare.art"
|
||||||
|
];
|
||||||
|
overwriteprotocol = "https";
|
||||||
|
"overwrite.cli.url" = "${cfg.url}";
|
||||||
|
forwarded_for_headers = [ "HTTP_X_FORWARDED_FOR" ];
|
||||||
|
default_phone_region = "MX";
|
||||||
|
allow_local_remote_servers = true;
|
||||||
|
mail_smtpmode = "sendmail";
|
||||||
|
mail_sendmailmode = "pipe";
|
||||||
|
preview_ffmpeg_path = "${pkgs.ffmpeg}/bin/ffmpeg";
|
||||||
|
"memories.exiftool" = "${exiftool}/bin/exiftool";
|
||||||
|
"memories.ffmpeg_path" = "${pkgs.ffmpeg}/bin/ffmpeg";
|
||||||
|
"memories.ffprobe_path" = "${pkgs.ffmpeg}/bin/ffprobe";
|
||||||
|
enabledPreviewProviders = [
|
||||||
|
"OC\\Preview\\AVI"
|
||||||
|
"OC\\Preview\\BMP"
|
||||||
|
"OC\\Preview\\GIF"
|
||||||
|
"OC\\Preview\\HEIC"
|
||||||
|
"OC\\Preview\\Image"
|
||||||
|
"OC\\Preview\\JPEG"
|
||||||
|
"OC\\Preview\\Krita"
|
||||||
|
"OC\\Preview\\MKV"
|
||||||
|
"OC\\Preview\\MP3"
|
||||||
|
"OC\\Preview\\MP4"
|
||||||
|
"OC\\Preview\\MarkDown"
|
||||||
|
"OC\\Preview\\Movie"
|
||||||
|
"OC\\Preview\\OpenDocument"
|
||||||
|
"OC\\Preview\\PNG"
|
||||||
|
"OC\\Preview\\TIFF"
|
||||||
|
"OC\\Preview\\TXT"
|
||||||
|
"OC\\Preview\\XBitmap"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
phpExtraExtensions = all: [
|
||||||
|
all.pdlib
|
||||||
|
all.bz2
|
||||||
];
|
];
|
||||||
trusted_domains = [
|
};
|
||||||
cfg.host
|
nginx.virtualHosts.${cfg.host} = {
|
||||||
config.my.ips.${config.networking.hostName}
|
forceSSL = false;
|
||||||
"localhost"
|
enableACME = false;
|
||||||
|
http2 = false;
|
||||||
|
serverAliases = [
|
||||||
|
"cloud.servidos.lat"
|
||||||
"cloud.rotehaare.art"
|
"cloud.rotehaare.art"
|
||||||
];
|
];
|
||||||
overwriteprotocol = "https";
|
listen = [
|
||||||
"overwrite.cli.url" = "${cfg.url}";
|
{
|
||||||
forwarded_for_headers = [ "HTTP_X_FORWARDED_FOR" ];
|
addr = config.my.ips.wg-server;
|
||||||
default_phone_region = "MX";
|
port = 8081;
|
||||||
allow_local_remote_servers = true;
|
}
|
||||||
mail_smtpmode = "sendmail";
|
{
|
||||||
mail_sendmailmode = "pipe";
|
addr = config.my.localhost;
|
||||||
preview_ffmpeg_path = "${pkgs.ffmpeg}/bin/ffmpeg";
|
port = 8081;
|
||||||
"memories.exiftool" = "${exiftool}/bin/exiftool";
|
}
|
||||||
"memories.ffmpeg_path" = "${pkgs.ffmpeg}/bin/ffmpeg";
|
|
||||||
"memories.ffprobe_path" = "${pkgs.ffmpeg}/bin/ffprobe";
|
|
||||||
enabledPreviewProviders = [
|
|
||||||
"OC\\Preview\\AVI"
|
|
||||||
"OC\\Preview\\BMP"
|
|
||||||
"OC\\Preview\\GIF"
|
|
||||||
"OC\\Preview\\HEIC"
|
|
||||||
"OC\\Preview\\Image"
|
|
||||||
"OC\\Preview\\JPEG"
|
|
||||||
"OC\\Preview\\Krita"
|
|
||||||
"OC\\Preview\\MKV"
|
|
||||||
"OC\\Preview\\MP3"
|
|
||||||
"OC\\Preview\\MP4"
|
|
||||||
"OC\\Preview\\MarkDown"
|
|
||||||
"OC\\Preview\\Movie"
|
|
||||||
"OC\\Preview\\OpenDocument"
|
|
||||||
"OC\\Preview\\PNG"
|
|
||||||
"OC\\Preview\\TIFF"
|
|
||||||
"OC\\Preview\\TXT"
|
|
||||||
"OC\\Preview\\XBitmap"
|
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
phpExtraExtensions = all: [
|
|
||||||
all.pdlib
|
|
||||||
all.bz2
|
|
||||||
];
|
|
||||||
|
|
||||||
};
|
};
|
||||||
virtualisation.oci-containers.containers = {
|
virtualisation.oci-containers.containers = {
|
||||||
go-vod = lib.mkIf config.my.servers.go-vod.enable {
|
go-vod = lib.mkIf config.my.servers.go-vod.enable {
|
||||||
@@ -234,14 +256,14 @@ in
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
})
|
})
|
||||||
(lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
|
(lib.mkIf (cfg.enableProxy && config.my.enableProxy && config.networking.hostName == "vps") {
|
||||||
my.servers.nextcloud.useDefaultProxy = false;
|
my.servers.nextcloud.useDefaultProxy = false;
|
||||||
services.nginx.virtualHosts = {
|
services.nginx.virtualHosts = {
|
||||||
"${cfg.host}" = {
|
"${cfg.host}" = {
|
||||||
forceSSL = false;
|
forceSSL = true;
|
||||||
enableACME = false;
|
enableACME = true;
|
||||||
http2 = false;
|
http2 = true;
|
||||||
default = false;
|
default = true;
|
||||||
serverAliases = [ "cloud.rotehaare.art" ];
|
serverAliases = [ "cloud.rotehaare.art" ];
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
add_header X-XSS-Protection "1; mode=block" always;
|
add_header X-XSS-Protection "1; mode=block" always;
|
||||||
@@ -250,22 +272,17 @@ in
|
|||||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||||
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
||||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_set_header X-Forwarded-Host $host;
|
||||||
'';
|
'';
|
||||||
locations = {
|
locations = {
|
||||||
"/".proxyWebsockets = true;
|
"/" = {
|
||||||
"~ ^/nextcloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|oc[ms]-provider/.+|.+/richdocumentscode/proxy).php(?:$|/)" =
|
proxyPass = cfg.local;
|
||||||
{ };
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
listen = [
|
|
||||||
{
|
|
||||||
addr = config.my.ips.wg-server;
|
|
||||||
port = 8081;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
addr = config.my.localhost;
|
|
||||||
port = 8081;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
"${cfgC.host}" = lib.mkIf cfgC.enableProxy {
|
"${cfgC.host}" = lib.mkIf cfgC.enableProxy {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
|
|||||||
Reference in New Issue
Block a user