diff --git a/services/nextcloud.nix b/services/nextcloud.nix index 10cc73d..593cc43 100644 --- a/services/nextcloud.nix +++ b/services/nextcloud.nix @@ -45,17 +45,19 @@ let ${myPhp}/bin/php \ decrypt-all-files.php "$@" ''; + + phpfpmSocketName = "/run/phpfpm/nextcloud.sock"; in { - + users.groups.nextcloud.members = [ "nextcloud" "nginx" ]; services.nginx.virtualHosts."cloud.stubbe.rocks" = { enableACME = true; forceSSL = true; serverName = "cloud.stubbe.rocks"; root = "/var/www/nextcloud/"; extraConfig = '' - index index.php index.html /index.php$request_uri; + index index.php index.html /index.php$request_uri; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; @@ -65,125 +67,105 @@ in add_header Referrer-Policy no-referrer; add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; client_max_body_size 1024M; - fastcgi_buffers 64 4K; - fastcgi_hide_header X-Powered-By; - gzip on; - gzip_vary on; - gzip_comp_level 4; - gzip_min_length 256; - gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; - gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; - error_page 403 /core/templates/403.php; - error_page 404 /core/templates/404.php; - rewrite ^/.well-known/host-meta /public.php?service=host-meta last; - rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last; + fastcgi_buffers 64 4K; + fastcgi_hide_header X-Powered-By; + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + rewrite ^/.well-known/host-meta /public.php?service=host-meta last; + rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last; ''; - - locations = { + locations = { "= /robots.txt" = { priority = 100; extraConfig = '' allow all; - log_not_found off; access_log off; ''; }; + "= /" = { + priority = 100; + extraConfig = '' + if ( $http_user_agent ~ ^DavClnt ) { + return 302 /remote.php/webdav/$is_args$args; + } + ''; + }; "/" = { priority = 900; extraConfig = "rewrite ^ /index.php;"; }; - "^~ /.well-known" = { + "~ ^/store-apps" = { + priority = 201; + extraConfig = "root /var/lib/nextcloud;"; + }; + "~ ^/nix-apps" = { + priority = 201; + extraConfig = "root /var/lib/nextcloud;"; + }; + "^~ /.well-known" = { priority = 210; extraConfig = '' + absolute_redirect off; location = /.well-known/carddav { - return 301 $scheme://$host/remote.php/dav; + return 301 /remote.php/dav; } location = /.well-known/caldav { - return 301 $scheme://$host/remote.php/dav; + return 301 /remote.php/dav; } location ~ ^/\.well-known/(?!acme-challenge|pki-validation) { - return 301 $scheme://$host/index.php$request_uri; - } - + return 301 /index.php$request_uri; + } try_files $uri $uri/ =404; ''; }; - # PHP files - "~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\\.php(?:$|/)" = { + "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)".extraConfig = '' + return 404; + ''; + "~ ^/(?:\\.(?!well-known)|autotest|occ|issue|indie|db_|console)".extraConfig = '' + return 404; + ''; + "~ ^\\/(?:index|remote|public|cron|core\\/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|oc[ms]-provider\\/.+|.+\\/richdocumentscode\\/proxy)\\.php(?:$|\\/)" = { + priority = 500; extraConfig = '' - fastcgi_split_path_info ^(.+\\.php)(/.*)$; - include ${pkgs.nginx}/conf/fastcgi_params; + include ${config.services.nginx.package}/conf/fastcgi.conf; + fastcgi_split_path_info ^(.+?\.php)(\\/.*)$; + set $path_info $fastcgi_path_info; + try_files $fastcgi_script_name =404; + fastcgi_param PATH_INFO $path_info; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; - fastcgi_param PATH_INFO $fastcgi_path_info; - fastcgi_param HTTPS on; - fastcgi_param modHeadersAvailable true; + fastcgi_param HTTPS "on"; + fastcgi_param modHeadersAvailable true; fastcgi_param front_controller_active true; - fastcgi_pass unix:/run/phpfpm/nextcloud.sock; + fastcgi_pass unix:${phpfpmSocketName}; fastcgi_intercept_errors on; fastcgi_request_buffering off; + fastcgi_read_timeout 120s; ''; }; - - "~ ^/(?:updater|ocs-provider)(?:$|/)" = { - tryFiles = "$uri/ =404"; - index = "index.php"; - }; - # CSS and JavaScript files - "~* ^/(?!apps-local).*\\.(?:css|js)$" = { - tryFiles = "$uri /index.php$request_uri"; - extraConfig = '' - add_header Cache-Control "public, max-age=15778463"; - add_header Strict-Transport-Security "max-age=31536000;includeSubDomains"; - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Robots-Tag none; - add_header X-Download-Options noopen; - add_header X-Permitted-Cross-Domain-Policies none; - add_header Referrer-Policy no-referrer; - add_header X-Frame-Options sameorigin; - ''; - - }; - # Other static assets - "~* ^/(?!apps-local).*\\.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$" = { - tryFiles = "$uri /index.php$request_uri"; - extraConfig = '' - add_header Cache-Control "public, max-age=15778463"; - add_header Strict-Transport-Security "max-age=31536000;includeSubDomains"; - add_header X-Content-Type-Options nosniff; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Robots-Tag none; - add_header X-Download-Options noopen; - add_header X-Permitted-Cross-Domain-Policies none; - add_header Referrer-Policy no-referrer; - add_header X-Frame-Options sameorigin; - ''; - }; - # Locally installed apps: - # - # No need to specify location for PHP files of installed apps??? - # - # CSS and JavaScript files for installed apps - "~* ^/apps-local/.*\\.(?:css|js)$" = { - root = "/var/nextcloud"; - tryFiles = "$uri =404"; - }; - # Other static assets for installed apps - "~* ^/apps-local/.*\\.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$" = { - root = "/var/nextcloud"; - tryFiles = "$uri =404"; - }; - "~ ^/(?:build|tests|config|lib|3rdparty|templates|data|\\.|autotest|occ|issue|indie|db_|console)" = { - extraConfig = "deny all;"; - }; - }; + "~ \\.(?:css|js|woff2?|svg|gif|map)$".extraConfig = '' + try_files $uri /index.php$request_uri; + expires 6M; + access_log off; + ''; + "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = '' + try_files $uri/ =404; + index index.php; + ''; + "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = '' + try_files $uri /index.php$request_uri; + access_log off; + ''; + }; }; environment.systemPackages = [ occ daf ]; # Option I: PHP-FPM pool for Nextcloud services.phpfpm.pools.nextcloud = let - phpfpmSocketName = "/run/phpfpm/nextcloud.sock"; phpfpmUser = "nextcloud"; phpfpmGroup = "nextcloud"; server = "nginx"; @@ -211,18 +193,18 @@ in services.cron.enable = true; services.redis.servers."".enable = true; -systemd.timers.nextcloud-cron = { - wantedBy = [ "timers.target" ]; - timerConfig.OnBootSec = "5m"; - timerConfig.OnUnitActiveSec = "15m"; - timerConfig.Unit = "nextcloud-cron.service"; -}; +#systemd.timers.nextcloud-cron = { +# wantedBy = [ "timers.target" ]; +# timerConfig.OnBootSec = "5m"; +# timerConfig.OnUnitActiveSec = "15m"; +# timerConfig.Unit = "nextcloud-cron.service"; +#}; -systemd.services.nextcloud-cron = { - environment.NEXTCLOUD_CONFIG_DIR = "/var/www/nextcloud/config"; - serviceConfig.Type = "oneshot"; - serviceConfig.User = "nextcloud"; - serviceConfig.ExecStart = "${myPhp}/bin/php --define apc.enable_cli=1 -f /var/www/nextcloud/cron.php"; -}; +#systemd.services.nextcloud-cron = { +# environment.NEXTCLOUD_CONFIG_DIR = "/var/www/nextcloud/config"; +# serviceConfig.Type = "oneshot"; +# serviceConfig.User = "nextcloud"; +# serviceConfig.ExecStart = "${myPhp}/bin/php --define apc.enable_cli=1 -f /var/www/nextcloud/cron.php"; +#}; }