matt1432/nixos-configs
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

feat(nextcloud): get rid of errors in config
All checks were successful
Discord / discord commits (push) Has been skipped
Details

Browse source
This commit is contained in:
matt1432 2024-04-24 09:36:52 -04:00
parent bc1efb0d25
commit 6cf090e2f2
2 changed files with 92 additions and 55 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
devices/nos/modules/arion/nextcloud/compose.nix
View file

@ -1,16 +1,18 @@
{
config,
lib,
pkgs,
...
}: let
inherit (config.sops) secrets;
inherit (config.arion) rwDataDir;
inherit (lib) concatStrings;
mainContainerName = "app-server";
rwPath = rwDataDir + "/nextcloud";
in {
arion.projects."nextcloud" = {
"app-server" = {
"${mainContainerName}" = {
image = ./images/nextcloud.nix;
restart = "always";
@ -31,7 +33,7 @@ in {
POSTGRES_HOST = "nextcloud-db";
REDIS_HOST = "nextcloud-cache";
REDIS_HOST_PASSWORD = "password";
TRUSTED_PROXIES = "cloud.nelim.org";
TRUSTED_PROXIES = "cloud.nelim.org nginx-server";
NEXTCLOUD_INIT_HTACCESS = "true";
};
};
@ -103,4 +105,23 @@ in {
];
};
};
# Cron job
systemd.timers.nextcloud-cron = {
description = "Timer For Nextcloud Cron";
wantedBy = ["timers.target"];
timerConfig.OnBootSec = "5m";
timerConfig.OnUnitActiveSec = "5m";
};
systemd.services.nextcloud-cron = {
description = "Nextcloud Cron";
requires = ["arion-nextcloud.service"];
after = ["arion-nextcloud.service"];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.docker}/bin/docker exec -u www-data ${mainContainerName} php -f /var/www/html/cron.php";
};
};
}

122
devices/nos/modules/arion/nextcloud/nginx.conf
View file

@ -1,39 +1,38 @@
user www-data;
worker_processes 1;
user www-data;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
worker_connections 1024;
}
http {
upstream backend {
server app-server:9000;
#server unix:/var/run/php/php7.4-fpm.sock;
server app-server:9000;
#server unix:/var/run/php/php7.4-fpm.sock;
}
# Set the `immutable` cache control options only for assets with a cache busting `v` argument
map $arg_v $asset_immutable {
"" "";
default "immutable";
"" "";
default "immutable";
}
include /etc/nginx/mime.types;
default_type application/octet-stream;
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
access_log /var/log/nginx/access.log main;
sendfile on;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
keepalive_timeout 65;
map $http_host $this_host {
"" $host;
@ -46,27 +45,27 @@ http {
}
map $http_x_forwarded_host $the_host {
default $http_x_forwarded_host;
"" $this_host;
default $http_x_forwarded_host;
"" $this_host;
}
server {
listen 80;
# The below allows for being behind a reverse proxy and allowing the Nextcloud app to connect
# The below allows for being behind a reverse proxy and allowing the Nextcloud app to connect
server_tokens off;
# Add headers to serve security related headers
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
# HTTP response headers borrowed from Nextcloud `.htaccess`
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "noindex, nofollow" always;
add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak
# Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By;
root /var/www/html;
@ -80,20 +79,28 @@ http {
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients
location = / {
if ( $http_user_agent ~ ^DavClnt ) {
if ( $http_user_agent ~ ^DavClnt ) {
return 302 /remote.php/webdav/$is_args$args;
}
}
location ^~ /.well-known {
location = /.well-known/carddav {
return 301 /remote.php/dav/;
}
location = /.well-known/caldav {
return 301 /remote.php/dav/;
}
location = /.well-known/carddav { return 301 /remote.php/dav/; }
location = /.well-known/caldav { return 301 /remote.php/dav/; }
#location = /.well-known/webfinger { return 301 /index.php/.well-known/webfinger/; }
#location = /.well-known/nodeinfo { return 301 /index.php/.well-known/nodeinfo/; }}
location /.well-known/acme-challenge { try_files $uri $uri/ =404; }
location /.well-known/pki-validation { try_files $uri $uri/ =404; }
location /.well-known/acme-challenge {
try_files $uri $uri/ =404;
}
location /.well-known/pki-validation {
try_files $uri $uri/ =404;
}
# Let Nextcloud's API for `/.well-known` URIs handle all other
# requests by passing them to the front-end controller.
@ -107,25 +114,29 @@ http {
}
# Rules borrowed from `.htaccess` to hide certain paths from clients
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; }
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; }
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) {
return 404;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
return 404;
}
location ~* ^/ds-vpath/ {
rewrite /ds-vpath/(.*) /$1 break;
proxy_pass http://onlyoffice-document-server;
proxy_redirect off;
location ~* ^/ds-vpath/ {
rewrite /ds-vpath/(.*) /$1 break;
proxy_pass http://onlyoffice-document-server;
proxy_redirect off;
client_max_body_size 10G;
client_max_body_size 10G;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $the_host/ds-vpath;
proxy_set_header X-Forwarded-Proto $the_scheme;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $the_host/ds-vpath;
proxy_set_header X-Forwarded-Proto $the_scheme;
}
location ~ \.php(?:$|/) {
@ -152,20 +163,25 @@ http {
fastcgi_max_temp_file_size 0;
}
location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463, $asset_immutable";
access_log off; # Optional: Don't log access to assets
access_log off; # Optional: Don't log access to assets
location ~ \.wasm$ {
default_type application/wasm;
}
location ~ \.mjs$ {
default_type text/javascript;
}
}
location ~ \.woff2?$ {
try_files $uri /index.php$request_uri;
expires 7d; # Cache-Control policy borrowed from `.htaccess`
access_log off; # Optional: Don't log access to assets
expires 7d; # Cache-Control policy borrowed from `.htaccess`
access_log off; # Optional: Don't log access to assets
}
# Rule borrowed from `.htaccess`