stubbfelnix/services/nextcloud.nix

{ config, pkgs, ... }:
let
  myPhp = pkgs.php74.buildEnv {
    extensions = { enabled, all }: with all; [ imagick opcache apcu redis memcached ] ++ enabled;
    extraConfig = ''
 	opcache.enable=1
	opcache.enable_cli=1
        opcache.interned_strings_buffer=8
        opcache.max_accelerated_files=10000
        opcache.memory_consumption=128
        opcache.save_comments=1
        opcache.revalidate_freq=1
	memory_limit=5G
	post_max_size=5G
	upload_max_filesize=5G
	output_buffering=0
	apc.enable_cli=1
    '';
  };

in
{

    services.nginx.virtualHosts."cloud.stubbe.rocks" = {
        enableACME = true;
        forceSSL = true;
        serverName = "cloud.stubbe.rocks";
        root = "/var/www/nextcloud/";
        extraConfig = ''
          client_max_body_size 1024M;
          fastcgi_buffers 64 4K; 	
	  gzip on;
	  gzip_vary on;
	  gzip_comp_level 4;
	  gzip_min_length 256;
	  gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
	  gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
          error_page 403 /core/templates/403.php;
          error_page 404 /core/templates/404.php;
	  add_header Strict-Transport-Security "max-age=31536000;includeSubDomains";
	  add_header X-Content-Type-Options nosniff;
	  add_header X-XSS-Protection "1; mode=block";
	  add_header X-Robots-Tag none;
	  add_header X-Download-Options noopen;
	  add_header X-Permitted-Cross-Domain-Policies none;
	  add_header Referrer-Policy no-referrer;
	  add_header X-Frame-Options sameorigin;		
        '';

        locations = {
          "= /robots.txt" = {
            priority = 100;
            extraConfig = ''
              allow all;
              log_not_found off;
              access_log off;
            '';
          };
          "/" = {
            priority = 900;
            extraConfig = "rewrite ^ /index.php;";
          };
	  "^~ /.well-known" = {
            priority = 210;
            extraConfig = ''
              location = /.well-known/carddav {
                return 301 $scheme://$host/remote.php/dav;
              }
              location = /.well-known/caldav {
                return 301 $scheme://$host/remote.php/dav;
              }
              try_files $uri $uri/ =404;
            '';
          };
          # PHP files
          "~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\\.php(?:$|/)" = {
            extraConfig = ''
              fastcgi_split_path_info ^(.+\\.php)(/.*)$;
              include ${pkgs.nginx}/conf/fastcgi_params;
              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
              fastcgi_param PATH_INFO $fastcgi_path_info;
	      fastcgi_param HTTPS on;
	      fastcgi_param modHeadersAvailable true;
              fastcgi_param front_controller_active true;
              fastcgi_pass unix:/run/phpfpm/nextcloud.sock;
              fastcgi_intercept_errors on;
              fastcgi_request_buffering off;
            '';
          };

	  "~ ^/(?:updater|ocs-provider)(?:$|/)" = {
		tryFiles = "$uri/ =404";
		index = "index.php";
	  };
          # CSS and JavaScript files
          "~* ^/(?!apps-local).*\\.(?:css|js)$" = {
            tryFiles = "$uri /index.php$request_uri";
            extraConfig = ''
                add_header Cache-Control "public, max-age=15778463";
                add_header Strict-Transport-Security "max-age=31536000;includeSubDomains";
                add_header X-Content-Type-Options nosniff;
                add_header X-XSS-Protection "1; mode=block";
                add_header X-Robots-Tag none;
                add_header X-Download-Options noopen;
                add_header X-Permitted-Cross-Domain-Policies none;
                add_header Referrer-Policy no-referrer;
                add_header X-Frame-Options sameorigin;
            '';

          };
          # Other static assets
          "~* ^/(?!apps-local).*\\.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$" = {
            tryFiles = "$uri /index.php$request_uri";
	    extraConfig = ''
		add_header Cache-Control "public, max-age=15778463";
	        add_header Strict-Transport-Security "max-age=31536000;includeSubDomains";
        	add_header X-Content-Type-Options nosniff;
	        add_header X-XSS-Protection "1; mode=block";
        	add_header X-Robots-Tag none;
	        add_header X-Download-Options noopen;
        	add_header X-Permitted-Cross-Domain-Policies none;
	        add_header Referrer-Policy no-referrer;
                add_header X-Frame-Options sameorigin;		
	    '';
          };
          # Locally installed apps:
          #
          # No need to specify location for PHP files of installed apps???
          #
          # CSS and JavaScript files for installed apps
          "~* ^/apps-local/.*\\.(?:css|js)$" = {
            root = "/var/nextcloud";
            tryFiles = "$uri =404";
          };
          # Other static assets for installed apps
          "~* ^/apps-local/.*\\.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$" = {
            root = "/var/nextcloud";
            tryFiles = "$uri =404";
          };
          "~ ^/(?:build|tests|config|lib|3rdparty|templates|data|\\.|autotest|occ|issue|indie|db_|console)" = {
            extraConfig = "deny all;";
          };
      };
  };

    users.extraUsers.nextcloud.packages = [
      myPhp
    ];

    # Option I: PHP-FPM pool for Nextcloud
    services.phpfpm.pools.nextcloud = let
      phpfpmSocketName = "/run/phpfpm/nextcloud.sock";
      phpfpmUser = "nextcloud";
      phpfpmGroup = "nextcloud";
      server = "nginx";
    in
    {
      phpPackage = myPhp;
      settings = {
        "listen" = "${phpfpmSocketName}";
        "listen.owner" = "${server}";
        "listen.group" = "${server}";
        "user" = "${phpfpmUser}";
        "group" = "${phpfpmGroup}";
        "pm" = "dynamic";
	"pm.max_children" = "120";
	"pm.start_servers" = "12";
	"pm.min_spare_servers" = "6";
	"pm.max_spare_servers" = "18";
      };
      phpEnv = {
        NEXTCLOUD_CONFIG_DIR = "/var/www/nextcloud/config";
        PATH = "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin";
      };
  };

services.cron.enable = true;

}