feat(nextcloud): get rid of errors in config
All checks were successful
Discord / discord commits (push) Has been skipped

This commit is contained in:
matt1432 2024-04-24 09:36:52 -04:00
parent bc1efb0d25
commit 6cf090e2f2
2 changed files with 92 additions and 55 deletions

View file

@ -1,16 +1,18 @@
{ {
config, config,
lib, lib,
pkgs,
... ...
}: let }: let
inherit (config.sops) secrets; inherit (config.sops) secrets;
inherit (config.arion) rwDataDir; inherit (config.arion) rwDataDir;
inherit (lib) concatStrings; inherit (lib) concatStrings;
mainContainerName = "app-server";
rwPath = rwDataDir + "/nextcloud"; rwPath = rwDataDir + "/nextcloud";
in { in {
arion.projects."nextcloud" = { arion.projects."nextcloud" = {
"app-server" = { "${mainContainerName}" = {
image = ./images/nextcloud.nix; image = ./images/nextcloud.nix;
restart = "always"; restart = "always";
@ -31,7 +33,7 @@ in {
POSTGRES_HOST = "nextcloud-db"; POSTGRES_HOST = "nextcloud-db";
REDIS_HOST = "nextcloud-cache"; REDIS_HOST = "nextcloud-cache";
REDIS_HOST_PASSWORD = "password"; REDIS_HOST_PASSWORD = "password";
TRUSTED_PROXIES = "cloud.nelim.org"; TRUSTED_PROXIES = "cloud.nelim.org nginx-server";
NEXTCLOUD_INIT_HTACCESS = "true"; NEXTCLOUD_INIT_HTACCESS = "true";
}; };
}; };
@ -103,4 +105,23 @@ in {
]; ];
}; };
}; };
# Cron job
systemd.timers.nextcloud-cron = {
description = "Timer For Nextcloud Cron";
wantedBy = ["timers.target"];
timerConfig.OnBootSec = "5m";
timerConfig.OnUnitActiveSec = "5m";
};
systemd.services.nextcloud-cron = {
description = "Nextcloud Cron";
requires = ["arion-nextcloud.service"];
after = ["arion-nextcloud.service"];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.docker}/bin/docker exec -u www-data ${mainContainerName} php -f /var/www/html/cron.php";
};
};
} }

View file

@ -9,7 +9,6 @@ events {
} }
http { http {
upstream backend { upstream backend {
server app-server:9000; server app-server:9000;
#server unix:/var/run/php/php7.4-fpm.sock; #server unix:/var/run/php/php7.4-fpm.sock;
@ -63,7 +62,7 @@ http {
add_header X-Download-Options "noopen" always; add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always; add_header X-Robots-Tag "noindex, nofollow" always;
add_header X-XSS-Protection "1; mode=block" always; add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak # Remove X-Powered-By, which is an information leak
@ -86,14 +85,22 @@ http {
} }
location ^~ /.well-known { location ^~ /.well-known {
location = /.well-known/carddav {
return 301 /remote.php/dav/;
}
location = /.well-known/caldav {
return 301 /remote.php/dav/;
}
location = /.well-known/carddav { return 301 /remote.php/dav/; }
location = /.well-known/caldav { return 301 /remote.php/dav/; }
#location = /.well-known/webfinger { return 301 /index.php/.well-known/webfinger/; } #location = /.well-known/webfinger { return 301 /index.php/.well-known/webfinger/; }
#location = /.well-known/nodeinfo { return 301 /index.php/.well-known/nodeinfo/; }} #location = /.well-known/nodeinfo { return 301 /index.php/.well-known/nodeinfo/; }}
location /.well-known/acme-challenge { try_files $uri $uri/ =404; } location /.well-known/acme-challenge {
location /.well-known/pki-validation { try_files $uri $uri/ =404; } try_files $uri $uri/ =404;
}
location /.well-known/pki-validation {
try_files $uri $uri/ =404;
}
# Let Nextcloud's API for `/.well-known` URIs handle all other # Let Nextcloud's API for `/.well-known` URIs handle all other
# requests by passing them to the front-end controller. # requests by passing them to the front-end controller.
@ -107,8 +114,12 @@ http {
} }
# Rules borrowed from `.htaccess` to hide certain paths from clients # Rules borrowed from `.htaccess` to hide certain paths from clients
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) {
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } return 404;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
return 404;
}
location ~* ^/ds-vpath/ { location ~* ^/ds-vpath/ {
rewrite /ds-vpath/(.*) /$1 break; rewrite /ds-vpath/(.*) /$1 break;
@ -152,7 +163,7 @@ http {
fastcgi_max_temp_file_size 0; fastcgi_max_temp_file_size 0;
} }
location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ { location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463, $asset_immutable"; add_header Cache-Control "public, max-age=15778463, $asset_immutable";
access_log off; # Optional: Don't log access to assets access_log off; # Optional: Don't log access to assets
@ -160,7 +171,12 @@ http {
location ~ \.wasm$ { location ~ \.wasm$ {
default_type application/wasm; default_type application/wasm;
} }
location ~ \.mjs$ {
default_type text/javascript;
} }
}
location ~ \.woff2?$ { location ~ \.woff2?$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;