nixos-config/stubbfelnix
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

update nextloud

Browse Source
This commit is contained in:
stubbfel
2022-11-19 19:15:41 +01:00
parent 5b1b8e0d25
commit c2a005a465
1 changed files with 80 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

178
services/nextcloud.nix
View File

@@ -45,17 +45,19 @@ let
${myPhp}/bin/php \ ${myPhp}/bin/php \
decrypt-all-files.php "$@" decrypt-all-files.php "$@"
''; '';
phpfpmSocketName = "/run/phpfpm/nextcloud.sock";
in in
{ {
users.groups.nextcloud.members = [ "nextcloud" "nginx" ];
services.nginx.virtualHosts."cloud.stubbe.rocks" = { services.nginx.virtualHosts."cloud.stubbe.rocks" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
serverName = "cloud.stubbe.rocks"; serverName = "cloud.stubbe.rocks";
root = "/var/www/nextcloud/"; root = "/var/www/nextcloud/";
extraConfig = '' extraConfig = ''
index index.php index.html /index.php$request_uri; index index.php index.html /index.php$request_uri;
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block"; add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none; add_header X-Robots-Tag none;
@@ -65,125 +67,105 @@ in
add_header Referrer-Policy no-referrer; add_header Referrer-Policy no-referrer;
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
client_max_body_size 1024M; client_max_body_size 1024M;
fastcgi_buffers 64 4K; fastcgi_buffers 64 4K;
fastcgi_hide_header X-Powered-By; fastcgi_hide_header X-Powered-By;
gzip on; gzip on;
gzip_vary on; gzip_vary on;
gzip_comp_level 4; gzip_comp_level 4;
gzip_min_length 256; gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
error_page 403 /core/templates/403.php; rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
error_page 404 /core/templates/404.php; rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
''; '';
locations = {
locations = {
"= /robots.txt" = { "= /robots.txt" = {
priority = 100; priority = 100;
extraConfig = '' extraConfig = ''
allow all; allow all;
log_not_found off;
access_log off; access_log off;
''; '';
}; };
"= /" = {
priority = 100;
extraConfig = ''
if ( $http_user_agent ~ ^DavClnt ) {
return 302 /remote.php/webdav/$is_args$args;
}
'';
};
"/" = { "/" = {
priority = 900; priority = 900;
extraConfig = "rewrite ^ /index.php;"; extraConfig = "rewrite ^ /index.php;";
}; };
"^~ /.well-known" = { "~ ^/store-apps" = {
priority = 201;
extraConfig = "root /var/lib/nextcloud;";
};
"~ ^/nix-apps" = {
priority = 201;
extraConfig = "root /var/lib/nextcloud;";
};
"^~ /.well-known" = {
priority = 210; priority = 210;
extraConfig = '' extraConfig = ''
absolute_redirect off;
location = /.well-known/carddav { location = /.well-known/carddav {
return 301 $scheme://$host/remote.php/dav; return 301 /remote.php/dav;
} }
location = /.well-known/caldav { location = /.well-known/caldav {
return 301 $scheme://$host/remote.php/dav; return 301 /remote.php/dav;
} }
location ~ ^/\.well-known/(?!acme-challenge|pki-validation) { location ~ ^/\.well-known/(?!acme-challenge|pki-validation) {
return 301 $scheme://$host/index.php$request_uri; return 301 /index.php$request_uri;
} }
try_files $uri $uri/ =404; try_files $uri $uri/ =404;
''; '';
}; };
# PHP files "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)".extraConfig = ''
"~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\\.php(?:$|/)" = { return 404;
'';
"~ ^/(?:\\.(?!well-known)|autotest|occ|issue|indie|db_|console)".extraConfig = ''
return 404;
'';
"~ ^\\/(?:index|remote|public|cron|core\\/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|oc[ms]-provider\\/.+|.+\\/richdocumentscode\\/proxy)\\.php(?:$|\\/)" = {
priority = 500;
extraConfig = '' extraConfig = ''
fastcgi_split_path_info ^(.+\\.php)(/.*)$; include ${config.services.nginx.package}/conf/fastcgi.conf;
include ${pkgs.nginx}/conf/fastcgi_params; fastcgi_split_path_info ^(.+?\.php)(\\/.*)$;
set $path_info $fastcgi_path_info;
try_files $fastcgi_script_name =404;
fastcgi_param PATH_INFO $path_info;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param HTTPS "on";
fastcgi_param HTTPS on; fastcgi_param modHeadersAvailable true;
fastcgi_param modHeadersAvailable true;
fastcgi_param front_controller_active true; fastcgi_param front_controller_active true;
fastcgi_pass unix:/run/phpfpm/nextcloud.sock; fastcgi_pass unix:${phpfpmSocketName};
fastcgi_intercept_errors on; fastcgi_intercept_errors on;
fastcgi_request_buffering off; fastcgi_request_buffering off;
fastcgi_read_timeout 120s;
''; '';
}; };
"~ \\.(?:css|js|woff2?|svg|gif|map)$".extraConfig = ''
"~ ^/(?:updater|ocs-provider)(?:$|/)" = { try_files $uri /index.php$request_uri;
tryFiles = "$uri/ =404"; expires 6M;
index = "index.php"; access_log off;
}; '';
# CSS and JavaScript files "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
"~* ^/(?!apps-local).*\\.(?:css|js)$" = { try_files $uri/ =404;
tryFiles = "$uri /index.php$request_uri"; index index.php;
extraConfig = '' '';
add_header Cache-Control "public, max-age=15778463"; "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = ''
add_header Strict-Transport-Security "max-age=31536000;includeSubDomains"; try_files $uri /index.php$request_uri;
add_header X-Content-Type-Options nosniff; access_log off;
add_header X-XSS-Protection "1; mode=block"; '';
add_header X-Robots-Tag none; };
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header Referrer-Policy no-referrer;
add_header X-Frame-Options sameorigin;
'';
};
# Other static assets
"~* ^/(?!apps-local).*\\.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$" = {
tryFiles = "$uri /index.php$request_uri";
extraConfig = ''
add_header Cache-Control "public, max-age=15778463";
add_header Strict-Transport-Security "max-age=31536000;includeSubDomains";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header Referrer-Policy no-referrer;
add_header X-Frame-Options sameorigin;
'';
};
# Locally installed apps:
#
# No need to specify location for PHP files of installed apps???
#
# CSS and JavaScript files for installed apps
"~* ^/apps-local/.*\\.(?:css|js)$" = {
root = "/var/nextcloud";
tryFiles = "$uri =404";
};
# Other static assets for installed apps
"~* ^/apps-local/.*\\.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$" = {
root = "/var/nextcloud";
tryFiles = "$uri =404";
};
"~ ^/(?:build|tests|config|lib|3rdparty|templates|data|\\.|autotest|occ|issue|indie|db_|console)" = {
extraConfig = "deny all;";
};
};
}; };
environment.systemPackages = [ occ daf ]; environment.systemPackages = [ occ daf ];
# Option I: PHP-FPM pool for Nextcloud # Option I: PHP-FPM pool for Nextcloud
services.phpfpm.pools.nextcloud = let services.phpfpm.pools.nextcloud = let
phpfpmSocketName = "/run/phpfpm/nextcloud.sock";
phpfpmUser = "nextcloud"; phpfpmUser = "nextcloud";
phpfpmGroup = "nextcloud"; phpfpmGroup = "nextcloud";
server = "nginx"; server = "nginx";
@@ -211,18 +193,18 @@ in
services.cron.enable = true; services.cron.enable = true;
services.redis.servers."".enable = true; services.redis.servers."".enable = true;
systemd.timers.nextcloud-cron = { #systemd.timers.nextcloud-cron = {
wantedBy = [ "timers.target" ]; # wantedBy = [ "timers.target" ];
timerConfig.OnBootSec = "5m"; # timerConfig.OnBootSec = "5m";
timerConfig.OnUnitActiveSec = "15m"; # timerConfig.OnUnitActiveSec = "15m";
timerConfig.Unit = "nextcloud-cron.service"; # timerConfig.Unit = "nextcloud-cron.service";
}; #};
systemd.services.nextcloud-cron = { #systemd.services.nextcloud-cron = {
environment.NEXTCLOUD_CONFIG_DIR = "/var/www/nextcloud/config"; # environment.NEXTCLOUD_CONFIG_DIR = "/var/www/nextcloud/config";
serviceConfig.Type = "oneshot"; # serviceConfig.Type = "oneshot";
serviceConfig.User = "nextcloud"; # serviceConfig.User = "nextcloud";
serviceConfig.ExecStart = "${myPhp}/bin/php --define apc.enable_cli=1 -f /var/www/nextcloud/cron.php"; # serviceConfig.ExecStart = "${myPhp}/bin/php --define apc.enable_cli=1 -f /var/www/nextcloud/cron.php";
}; #};
} }