335 lines
12 KiB
Nix
335 lines
12 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
# Version tagging
|
|
nextcloudVersion = "33.0.0";
|
|
redisVersion = "8.6-alpine";
|
|
databaseVersion = "11.8";
|
|
onlyofficeVersion = "9.2";
|
|
whiteboardVersion = "v1.5.6";
|
|
# Helper
|
|
helper = import ./lib.nix { inherit config pkgs lib; };
|
|
cfg = config.numbus.services.nextcloud;
|
|
# Container config
|
|
name = "nextcloud";
|
|
in
|
|
|
|
helper.mkPodmanService {
|
|
inherit name;
|
|
description = "Nextcloud, your own online office suite";
|
|
defaultPort = "1100";
|
|
generatedSecrets = {
|
|
DB_NAME = "xkcdpass -n 2 -d -";
|
|
DB_USERNAME = "xkcdpass -n 2 -d -";
|
|
DB_PASSWORD = "xkcdpass -n 10 -d -";
|
|
REDIS_PASSWORD = "xkcdpass -n 10 -d -";
|
|
ONLYOFFICE_PASSWORD = "xkcdpass -n 10 -d -";
|
|
WHITEBOARD_PASSWORD = "xkcdpass -n 10 -d -";
|
|
SMTP_PASSWORD = "cat ${config.numbus.mail.smtpPasswordPath}";
|
|
};
|
|
middlewares = [ "nextcloudSecureHeaders" ];
|
|
dirPermissions = [
|
|
"100032:100 ${cfg.dataDir}"
|
|
"100032:100 ${cfg.configDir}"
|
|
"100032:100 ${cfg.configDir}/web"
|
|
"100999:100 ${cfg.configDir}/redis"
|
|
"100999:100 ${cfg.configDir}/database"
|
|
"1000:100 ${cfg.configDir}/onlyoffice"
|
|
"1000:100 ${cfg.configDir}/onlyoffice/log"
|
|
"1000:100 ${cfg.configDir}/onlyoffice/cache"
|
|
"1000:100 ${cfg.configDir}/onlyoffice/data"
|
|
"1000:100 ${cfg.configDir}/onlyoffice/database"
|
|
];
|
|
|
|
# Compose file good
|
|
composeText = ''
|
|
services:
|
|
nextcloud-server:
|
|
image: docker.io/library/nextcloud:${nextcloudVersion}
|
|
container_name: nextcloud-server
|
|
hostname: nextcloud-server
|
|
networks:
|
|
nextcloud:
|
|
ports:
|
|
- "${cfg.port}:80/tcp"
|
|
volumes:
|
|
- ${cfg.configDir}/web:/var/www/html
|
|
- ${cfg.dataDir}:/mnt/ncdata
|
|
environment:
|
|
MYSQL_HOST: nextcloud-database:3306
|
|
MYSQL_DATABASE: $DB_NAME
|
|
MYSQL_USER: $DB_USERNAME
|
|
MYSQL_PASSWORD: $DB_PASSWORD
|
|
REDIS_HOST: nextcloud-redis
|
|
REDIS_HOST_PASSWORD: $REDIS_PASSWORD
|
|
NEXTCLOUD_TRUSTED_DOMAINS: ${cfg.subdomain}.${config.numbus.services.domain}
|
|
NEXTCLOUD_DATA_DIR: /mnt/ncdata
|
|
SMTP_SECURE: tls
|
|
SMTP_HOST: ${config.numbus.mail.smtpServer}
|
|
SMTP_PORT: ${toString config.numbus.mail.smtpPort}
|
|
SMTP_NAME: ${config.numbus.mail.smtpUsername}
|
|
SMTP_PASSWORD: $SMTP_PASSWORD
|
|
MAIL_FROM_ADDRESS: nextcloud-noreply
|
|
MAIL_DOMAIN: ${config.numbus.services.domain}
|
|
APACHE_DISABLE_REWRITE_IP: 1
|
|
OVERWRITEPROTOCOL: https
|
|
TRUSTED_PROXIES: 10.89.0.0/16
|
|
NC_default_phone_region: "${config.numbus.language}"
|
|
NC_default_language: "${config.numbus.language}"
|
|
NC_default_locale: "${config.numbus.locale}"
|
|
NC_default_timezone: "${config.time.timeZone}"
|
|
NC_maintenance_window_start: "1"
|
|
PHP_MEMORY_LIMIT: 1024M
|
|
PHP_OPCACHE_MEMORY_CONSUMPTION: 256
|
|
depends_on:
|
|
- nextcloud-database
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- NET_RAW
|
|
restart: unless-stopped
|
|
nextcloud-redis:
|
|
image: docker.io/library/redis:${redisVersion}
|
|
container_name: nextcloud-redis
|
|
hostname: nextcloud-redis
|
|
user: '1000:1000'
|
|
networks:
|
|
nextcloud:
|
|
volumes:
|
|
- ${cfg.configDir}/redis:/data
|
|
command: redis-server --requirepass $REDIS_PASSWORD --save 60 1 --loglevel warning
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- NET_RAW
|
|
restart: unless-stopped
|
|
nextcloud-database:
|
|
image: docker.io/library/mariadb:${databaseVersion}
|
|
container_name: nextcloud-database
|
|
hostname: nextcloud-database
|
|
user: '1000:1000'
|
|
networks:
|
|
nextcloud:
|
|
volumes:
|
|
- ${cfg.configDir}/database:/var/lib/mysql
|
|
environment:
|
|
MARIADB_DATABASE: $DB_NAME
|
|
MARIADB_USER: $DB_USERNAME
|
|
MARIADB_PASSWORD: $DB_PASSWORD
|
|
MARIADB_RANDOM_ROOT_PASSWORD: true
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- NET_RAW
|
|
command:
|
|
- "--transaction-isolation=READ-COMMITTED"
|
|
- "--binlog-format=ROW"
|
|
restart: unless-stopped
|
|
nextcloud-onlyoffice:
|
|
container_name: nextcloud-onlyoffice
|
|
hostname: nextcloud-onlyoffice
|
|
image: docker.io/onlyoffice/documentserver:${onlyofficeVersion}
|
|
environment:
|
|
- JWT_SECRET=$ONLYOFFICE_PASSWORD
|
|
- REDIS_SERVER_HOST=nextcloud-redis
|
|
- REDIS_SERVER_PORT=6379
|
|
- REDIS_SERVER_PASS=$REDIS_PASSWORD
|
|
- ADMINPANEL_ENABLED=false
|
|
- EXAMPLE_ENABLED=false
|
|
- METRICS_ENABLED=false
|
|
ports:
|
|
- "9980:80/tcp"
|
|
volumes:
|
|
- ${cfg.configDir}/onlyoffice/log:/var/log/onlyoffice
|
|
- ${cfg.configDir}/onlyoffice/cache:/var/lib/onlyoffice
|
|
- ${cfg.configDir}/onlyoffice/data:/var/www/onlyoffice/Data
|
|
- ${cfg.configDir}/onlyoffice/database:/var/lib/postgresql
|
|
cap_drop:
|
|
- NET_RAW
|
|
restart: unless-stopped
|
|
nextcloud-whiteboard:
|
|
image: ghcr.io/nextcloud-releases/whiteboard:${whiteboardVersion}
|
|
container_name: nextcloud-whiteboard
|
|
hostname: nextcloud-whiteboard
|
|
user: '1000:1000'
|
|
ports:
|
|
- "3002:3002/tcp"
|
|
environment:
|
|
NEXTCLOUD_URL: https://${cfg.subdomain}.${config.numbus.services.domain}
|
|
JWT_SECRET_KEY: $WHITEBOARD_PASSWORD
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- NET_RAW
|
|
restart: unless-stopped
|
|
networks:
|
|
nextcloud:
|
|
name: nextcloud
|
|
driver: bridge
|
|
'';
|
|
|
|
extraConfig = {
|
|
environment.etc."traefik/rules/nextcloud-onlyoffice.yaml".text = ''
|
|
http:
|
|
routers:
|
|
nextcloud-onlyoffice:
|
|
rule: "Host(`onlyoffice.${config.numbus.services.domain}`)"
|
|
entrypoints:
|
|
- "websecure"
|
|
service: nextcloud-onlyoffice
|
|
middlewares:
|
|
- "nextcloudSecureHeaders"
|
|
tls:
|
|
certresolver: "cloudflare"
|
|
options: "secureTLS"
|
|
services:
|
|
nextcloud-onlyoffice:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://host.containers.internal:9980"
|
|
'';
|
|
|
|
environment.etc."traefik/rules/nextcloud-whiteboard.yaml".text = ''
|
|
http:
|
|
routers:
|
|
nextcloud-whiteboard:
|
|
rule: "Host(`whiteboard.${config.numbus.services.domain}`)"
|
|
entrypoints:
|
|
- "websecure"
|
|
service: nextcloud-whiteboard
|
|
middlewares:
|
|
- "secureHeaders"
|
|
tls:
|
|
certresolver: "cloudflare"
|
|
options: "secureTLS"
|
|
services:
|
|
nextcloud-whiteboard:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://host.containers.internal:3002"
|
|
'';
|
|
|
|
environment.etc."traefik/rules/nextcloudSecureHeaders.yaml".text = ''
|
|
http:
|
|
middlewares:
|
|
nextcloudSecureHeaders:
|
|
headers:
|
|
FrameDeny: false
|
|
CustomFrameOptionsValue: "SAMEORIGIN"
|
|
AddVaryHeader: true
|
|
BrowserXssFilter: true
|
|
ContentTypeNosniff: true
|
|
ForceSTSHeader: true
|
|
STSSeconds: 315360000
|
|
STSIncludeSubdomains: true
|
|
STSPreload: true
|
|
AccessControlAllowMethods: "GET,OPTIONS,PUT"
|
|
AccessControlAllowOriginList:
|
|
- origin-list-or-null
|
|
AccessControlMaxAge: 100
|
|
ReferrerPolicy: same-origin
|
|
PermissionsPolicy: "vibrate=()"
|
|
ContentSecurityPolicy: >-
|
|
default-src https://onlyoffice.${config.numbus.services.domain} 'self';
|
|
script-src https://onlyoffice.${config.numbus.services.domain} 'self' 'unsafe-inline';
|
|
style-src 'self' 'unsafe-inline';
|
|
connect-src 'self';
|
|
img-src 'self' data:;
|
|
font-src 'self' data:;
|
|
frame-src https://onlyoffice.${config.numbus.services.domain} 'self';
|
|
frame-ancestors https://onlyoffice.${config.numbus.services.domain} 'self';
|
|
object-src 'none';
|
|
base-uri 'self';
|
|
'';
|
|
|
|
systemd.services."${name}-quirk" = {
|
|
description = "Podman container quirk : ${name}";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "${name}.service" "${name}-secrets.service" ];
|
|
onFailure = [ "service-failure-notify@%n.service" ];
|
|
startLimitBurst = 5;
|
|
startLimitIntervalSec = 600;
|
|
path = [ pkgs.coreutils pkgs.sudo pkgs.podman pkgs.systemd pkgs.gnugrep ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
OCC="sudo -u numbus-admin podman exec --user www-data nextcloud-server php occ"
|
|
|
|
[[ ! -e /var/lib/numbus-server/${name}/.env ]] && systemctl start ${name}-secrets.service
|
|
until [[ -e /var/lib/numbus-server/${name}/.env ]]; do
|
|
echo "Waiting for secrets generation..."
|
|
sleep 5
|
|
done
|
|
source /var/lib/numbus-server/${name}/.env
|
|
|
|
until $OCC status | grep -iq "installed: true" >/dev/null 2>&1; do
|
|
echo "Waiting for Nextcloud to be up and running..."
|
|
sleep 60
|
|
done
|
|
|
|
$OCC db:add-missing-indices
|
|
$OCC maintenance:repair --include-expensive
|
|
|
|
INSTALL_APPS_LIST=( "calendar" "contacts" "mail" "notes" "onlyoffice" "cookbook" "whiteboard" )
|
|
DISABLE_APPS_LIST=( "activity" "federation" "webhook_listeners" "photos" "recommendations" "sharebymail" "teams" "support" "richdocumentscode" )
|
|
|
|
for app in ''${INSTALL_APPS_LIST[@]}; do
|
|
if ! $OCC --no-warnings app:list | grep -iq "$app:"; then
|
|
$OCC --no-warnings app:install "$app"
|
|
fi
|
|
if $OCC --no-warnings app:list --disabled | grep -iq "$app:"; then
|
|
$OCC --no-warnings app:enable "$app"
|
|
fi
|
|
done
|
|
for app in ''${DISABLE_APPS_LIST[@]}; do
|
|
if $OCC --no-warnings app:list --enabled | grep -iq "$app:"; then
|
|
$OCC --no-warnings app:disable "$app"
|
|
fi
|
|
done
|
|
$OCC --no-warnings config:system:set onlyoffice DocumentServerInternalUrl --value="https://onlyoffice.${config.numbus.services.domain}/"
|
|
$OCC --no-warnings config:system:set onlyoffice DocumentServerUrl --value="https://onlyoffice.${config.numbus.services.domain}/"
|
|
$OCC --no-warnings config:system:set onlyoffice jwt_secret --value="$ONLYOFFICE_PASSWORD"
|
|
$OCC --no-warnings config:app:set whiteboard collabBackendUrl --value="https://whiteboard.${config.numbus.services.domain}"
|
|
$OCC --no-warnings config:app:set whiteboard jwt_secret_key --value="$WHITEBOARD_PASSWORD"
|
|
|
|
if [[ ! -f /var/lib/numbus-server/${name}/croned.true ]]; then
|
|
$OCC background:cron
|
|
sudo -u numbus-admin podman exec --user www-data nextcloud-server php -f /var/www/html/cron.php
|
|
touch /var/lib/numbus-server/${name}/croned.true
|
|
fi
|
|
|
|
if [[ ! -f /var/lib/numbus-server/${name}/scanned.true ]]; then
|
|
$OCC files:scan --all
|
|
$OCC files:repair-tree
|
|
touch /var/lib/numbus-server/${name}/scanned.true
|
|
fi
|
|
'';
|
|
};
|
|
|
|
systemd.services."${name}-cron" = {
|
|
description = "Podman container crontab : ${name}";
|
|
after = [ "${name}.service" "${name}-quirk.service" ];
|
|
onFailure = [ "service-failure-notify@%n.service" ];
|
|
path = [ pkgs.sudo pkgs.podman ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecCondition = ''${pkgs.sudo}/bin/sudo -u numbus-admin podman exec --user www-data nextcloud-server php occ status'';
|
|
ExecStart = "${pkgs.sudo}/bin/sudo -u numbus-admin podman exec --user www-data nextcloud-server php -f /var/www/html/cron.php";
|
|
};
|
|
};
|
|
|
|
systemd.timers."${name}-cron" = {
|
|
description = "Timer for Nextcloud cron";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "5m";
|
|
OnUnitActiveSec = "5m";
|
|
Unit = "${name}-cron.service";
|
|
};
|
|
};
|
|
};
|
|
} |