ADD : nextcloud conf
parent
58e4b2c38f
commit
f38d4896fd
|
|
@ -0,0 +1,24 @@
|
|||
{ pkgs, ... }: {
|
||||
imports = [
|
||||
<agenix/modules/age.nix>
|
||||
];
|
||||
|
||||
environment.systemPackages = [ (pkgs.callPackage <agenix/pkgs/agenix.nix> {}) ];
|
||||
age.secrets.secret_restic = {
|
||||
file = ./secrets/secret_restic.age;
|
||||
path = "/run/restic_pass";
|
||||
};
|
||||
age.secrets.secret_nextcloud_admin = {
|
||||
file = ./secrets/nextcloud-admin-pass.age;
|
||||
path = "/run/nextcloud-admin";
|
||||
owner = "nextcloud";
|
||||
group = "nextcloud";
|
||||
};
|
||||
age.secrets.secret_nextcloud_db = {
|
||||
file = ./secrets/nextcloud-db-pass.age;
|
||||
path = "/run/nextcloud-db";
|
||||
owner = "nextcloud";
|
||||
group = "nextcloud";
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{config, pkgs, ...}:
|
||||
{
|
||||
services.restic.backups = {
|
||||
localbackup = {
|
||||
initialize = true;
|
||||
passwordFile = "/run/restic_pass";
|
||||
paths = [ "/var/lib/nextcloud/data/" ];
|
||||
repository = "rest:https://back.atlanticaweb.fr/Nextcloud";
|
||||
timerConfig = {
|
||||
OnCalendar = "00:05";
|
||||
RandomizedDelaySec = "5h";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
{ pkgs, ... }: {
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./nextcloud.nix
|
||||
./backup.nix
|
||||
../modules/users.nix
|
||||
../modules/common.nix
|
||||
../modules/prometheus-node.nix
|
||||
./agenix.nix
|
||||
# <agenix/modules/age.nix>
|
||||
];
|
||||
|
||||
system.stateVersion = "21.05";
|
||||
boot.cleanTmpDir = true;
|
||||
zramSwap.enable = true;
|
||||
networking.hostName = "next";
|
||||
services.openssh.enable = true;
|
||||
users.users.root.openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUA1RW6JwZasspAp8qmFRFnlV5WXjhLfStAAkM+KYLv lucazeau.alexandre@gmail.com"
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 22 9002];
|
||||
services.qemuGuest.enable = true;
|
||||
|
||||
# environment.systemPackages = [ (pkgs.callPackage <agenix/pkgs/agenix.nix> {}) ];
|
||||
# age.secrets.secret_restic = {
|
||||
# file = ./secrets/secret_restic.age;
|
||||
# path = "/run/restic_pass";
|
||||
# };
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{ modulesPath, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
boot.initrd.kernelModules = [ "nvme" ];
|
||||
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,86 @@
|
|||
{config, pkgs, ...}:
|
||||
{
|
||||
|
||||
# Enable Nginx
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
# Use recommended settings
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
|
||||
# Only allow PFS-enabled ciphers with AES256
|
||||
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
|
||||
|
||||
# Setup Nextcloud virtual host to listen on ports
|
||||
virtualHosts = {
|
||||
|
||||
"next.atlanticaweb.fr" = {
|
||||
## Force HTTP redirect to HTTPS
|
||||
forceSSL = true;
|
||||
## LetsEncrypt
|
||||
enableACME = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.defaults.email = "lucazeau.alexandre@gmail.com";
|
||||
security.acme.acceptTerms = true;
|
||||
|
||||
# Actual Nextcloud Config
|
||||
services.nextcloud = {
|
||||
enable = true;
|
||||
package = pkgs.nextcloud24;
|
||||
hostName = "next.atlanticaweb.fr";
|
||||
# Enable built-in virtual host management
|
||||
# Takes care of somewhat complicated setup
|
||||
# See here: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/nextcloud.nix#L529
|
||||
|
||||
|
||||
# Use HTTPS for links
|
||||
https = true;
|
||||
|
||||
# Auto-update Nextcloud Apps
|
||||
autoUpdateApps.enable = true;
|
||||
# Set what time makes sense for you
|
||||
autoUpdateApps.startAt = "05:00:00";
|
||||
|
||||
config = {
|
||||
# Further forces Nextcloud to use HTTPS
|
||||
overwriteProtocol = "https";
|
||||
|
||||
# Nextcloud PostegreSQL database configuration, recommended over using SQLite
|
||||
dbtype = "pgsql";
|
||||
dbuser = "nextcloud";
|
||||
dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
|
||||
dbname = "nextcloud";
|
||||
dbpassFile = "/run/nextcloud-db";
|
||||
#dbpassFile = "/var/nextcloud-db-pass";
|
||||
|
||||
adminpassFile = "/run/nextcloud-admin";
|
||||
#adminpassFile = "/var/nextcloud-admin-pass";
|
||||
adminuser = "admin";
|
||||
};
|
||||
};
|
||||
|
||||
# Enable PostgreSQL
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
|
||||
# Ensure the database, user, and permissions always exist
|
||||
ensureDatabases = [ "nextcloud" ];
|
||||
ensureUsers = [
|
||||
{ name = "nextcloud";
|
||||
ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
# Ensure that postgres is running before running the setup
|
||||
systemd.services."nextcloud-setup" = {
|
||||
requires = ["postgresql.service"];
|
||||
after = ["postgresql.service"];
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
services.prometheus = {
|
||||
exporters = {
|
||||
node = {
|
||||
enable = true;
|
||||
enabledCollectors = [ "systemd" ];
|
||||
port = 9002;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 AsRWPA 5ZW4bbKR4eBq9udfQt0aSxKLGqeRfK12CKbK5uO8PXQ
|
||||
jFF9AppAOlTo3K1djnZs6RiqgUvdnxD0qa/oiB/MAhs
|
||||
-> ssh-ed25519 AsRWPA l6PCaq/TiVFb5u6ohyQKDGuRkg5dXWOnnkvXRfo9eng
|
||||
YPxMklq50g8aOsWEbkfk8pprzfUOh2ks7g1HoEuGFRQ
|
||||
-> 6p!-grease J= W~
|
||||
MiJKoixj2WhO2O/DBIfPe80yu7mZ8wIVxyfNhw
|
||||
--- CBRiDc/5kln0elYaqSxwgp39zUWfIPv1/QgLCE39CYw
|
||||
>ÓßAê÷+TÚ.<2E>SetݯËö
®ß;{œü‘ÅzªžUF³¡œ2Õ%ßCÈ<>
|
||||
Binary file not shown.
|
|
@ -0,0 +1,11 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 cRwSCQ R0+fx+GjiA4oGjdu1jaMAiXFvOD/TAmh+od55rShTGw
|
||||
FBk21m1dWNmo4X3mnjBhvZrlXAlcUFNiNs96BU8NHCU
|
||||
-> ssh-ed25519 cRwSCQ GAcBRtCTRUnPrXDXpU8It5OQnz+3J8IdqHiWW5k200s
|
||||
rCGGuHZ4helvsIQPLBWDMCPV3ZvOMoJ7kPxmwB+RJGw
|
||||
-> ssh-ed25519 AsRWPA PNboiDuuin5kY7HMLzZYruip0whF9xs1IAr9RNfQwXA
|
||||
3mmQBxi3IGgnHBsWNeUuDvoa3ZMhGJdbRksRQtiRk5k
|
||||
-> :Gel-grease
|
||||
atx1cHPtIL3FMjXKj5+MGm4
|
||||
--- cfMzYeRC6IY4Xsg+tMfT3SpMzwPPi7ZhS68NPbrLwDI
|
||||
:Ïe{*<03>n<Ê1¡“ø?ã9X`ºT:AÁAþÄwëÈç|OÝW
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
let
|
||||
nextcloud-db = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGgO3EpoG14fn0VYC69sSS0iI5ZEB4qx9adFS+L5U5ZB";
|
||||
nextcloud-admin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGgO3EpoG14fn0VYC69sSS0iI5ZEB4qx9adFS+L5U5ZB";
|
||||
restic = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGgO3EpoG14fn0VYC69sSS0iI5ZEB4qx9adFS+L5U5ZB";
|
||||
users_nextcloud = [ nextcloud-db nextcloud-admin ];
|
||||
users_backup = [ restic ];
|
||||
in
|
||||
{
|
||||
"nextcloud-db-pass.age".publicKeys = users_nextcloud;
|
||||
"nextcloud-admin-pass.age".publicKeys = users_nextcloud;
|
||||
"secret_restic.age".publicKeys = users_backup;
|
||||
}
|
||||
|
|
@ -15,6 +15,7 @@
|
|||
procs
|
||||
plocate
|
||||
exa
|
||||
age
|
||||
];
|
||||
# Nix Garbage Collector
|
||||
nix.gc = {
|
||||
|
|
|
|||
Loading…
Reference in New Issue