matt1432/nixos-configs
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

feat(nextcloud): get rid of errors in config
All checks were successful
Discord / discord commits (push) Has been skipped
Details

Browse source
This commit is contained in:
matt1432 2024-04-24 09:36:52 -04:00
parent bc1efb0d25
commit 6cf090e2f2
2 changed files with 92 additions and 55 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
devices/nos/modules/arion/nextcloud/compose.nix
View file

@ -1,16 +1,18 @@
{ {
config, config,
lib, lib,
pkgs,
... ...
}: let }: let
inherit (config.sops) secrets; inherit (config.sops) secrets;
inherit (config.arion) rwDataDir; inherit (config.arion) rwDataDir;
inherit (lib) concatStrings; inherit (lib) concatStrings;
mainContainerName = "app-server";
rwPath = rwDataDir + "/nextcloud"; rwPath = rwDataDir + "/nextcloud";
in { in {
arion.projects."nextcloud" = { arion.projects."nextcloud" = {
"app-server" = { "${mainContainerName}" = {
image = ./images/nextcloud.nix; image = ./images/nextcloud.nix;
restart = "always"; restart = "always";
@ -31,7 +33,7 @@ in {
POSTGRES_HOST = "nextcloud-db"; POSTGRES_HOST = "nextcloud-db";
REDIS_HOST = "nextcloud-cache"; REDIS_HOST = "nextcloud-cache";
REDIS_HOST_PASSWORD = "password"; REDIS_HOST_PASSWORD = "password";
TRUSTED_PROXIES = "cloud.nelim.org"; TRUSTED_PROXIES = "cloud.nelim.org nginx-server";
NEXTCLOUD_INIT_HTACCESS = "true"; NEXTCLOUD_INIT_HTACCESS = "true";
}; };
}; };
@ -103,4 +105,23 @@ in {
]; ];
}; };
}; };
# Cron job
systemd.timers.nextcloud-cron = {
description = "Timer For Nextcloud Cron";
wantedBy = ["timers.target"];
timerConfig.OnBootSec = "5m";
timerConfig.OnUnitActiveSec = "5m";
};
systemd.services.nextcloud-cron = {
description = "Nextcloud Cron";
requires = ["arion-nextcloud.service"];
after = ["arion-nextcloud.service"];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.docker}/bin/docker exec -u www-data ${mainContainerName} php -f /var/www/html/cron.php";
};
};
} }

122
devices/nos/modules/arion/nextcloud/nginx.conf
View file

@ -1,39 +1,38 @@
user www-data; user www-data;
worker_processes 1; worker_processes 1;
error_log /var/log/nginx/error.log warn; error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid; pid /var/run/nginx.pid;
events { events {
worker_connections 1024; worker_connections 1024;
} }
http { http {
upstream backend { upstream backend {
server app-server:9000; server app-server:9000;
#server unix:/var/run/php/php7.4-fpm.sock; #server unix:/var/run/php/php7.4-fpm.sock;
} }
# Set the `immutable` cache control options only for assets with a cache busting `v` argument # Set the `immutable` cache control options only for assets with a cache busting `v` argument
map $arg_v $asset_immutable { map $arg_v $asset_immutable {
"" ""; "" "";
default "immutable"; default "immutable";
} }
include /etc/nginx/mime.types; include /etc/nginx/mime.types;
default_type application/octet-stream; default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" ' log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" ' '$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'; '"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main; access_log /var/log/nginx/access.log main;
sendfile on; sendfile on;
#tcp_nopush on; #tcp_nopush on;
keepalive_timeout 65; keepalive_timeout 65;
map $http_host $this_host { map $http_host $this_host {
"" $host; "" $host;
@ -46,27 +45,27 @@ http {
} }
map $http_x_forwarded_host $the_host { map $http_x_forwarded_host $the_host {
default $http_x_forwarded_host; default $http_x_forwarded_host;
"" $this_host; "" $this_host;
} }
server { server {
listen 80; listen 80;
# The below allows for being behind a reverse proxy and allowing the Nextcloud app to connect # The below allows for being behind a reverse proxy and allowing the Nextcloud app to connect
server_tokens off; server_tokens off;
# Add headers to serve security related headers # Add headers to serve security related headers
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;"; add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
# HTTP response headers borrowed from Nextcloud `.htaccess` # HTTP response headers borrowed from Nextcloud `.htaccess`
add_header Referrer-Policy "no-referrer" always; add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always; add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always; add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always; add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "none" always; add_header X-Robots-Tag "noindex, nofollow" always;
add_header X-XSS-Protection "1; mode=block" always; add_header X-XSS-Protection "1; mode=block" always;
# Remove X-Powered-By, which is an information leak # Remove X-Powered-By, which is an information leak
fastcgi_hide_header X-Powered-By; fastcgi_hide_header X-Powered-By;
root /var/www/html; root /var/www/html;
@ -80,20 +79,28 @@ http {
# Rule borrowed from `.htaccess` to handle Microsoft DAV clients # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
location = / { location = / {
if ( $http_user_agent ~ ^DavClnt ) { if ( $http_user_agent ~ ^DavClnt ) {
return 302 /remote.php/webdav/$is_args$args; return 302 /remote.php/webdav/$is_args$args;
} }
} }
location ^~ /.well-known { location ^~ /.well-known {
location = /.well-known/carddav {
return 301 /remote.php/dav/;
}
location = /.well-known/caldav {
return 301 /remote.php/dav/;
}
location = /.well-known/carddav { return 301 /remote.php/dav/; }
location = /.well-known/caldav { return 301 /remote.php/dav/; }
#location = /.well-known/webfinger { return 301 /index.php/.well-known/webfinger/; } #location = /.well-known/webfinger { return 301 /index.php/.well-known/webfinger/; }
#location = /.well-known/nodeinfo { return 301 /index.php/.well-known/nodeinfo/; }} #location = /.well-known/nodeinfo { return 301 /index.php/.well-known/nodeinfo/; }}
location /.well-known/acme-challenge { try_files $uri $uri/ =404; } location /.well-known/acme-challenge {
location /.well-known/pki-validation { try_files $uri $uri/ =404; } try_files $uri $uri/ =404;
}
location /.well-known/pki-validation {
try_files $uri $uri/ =404;
}
# Let Nextcloud's API for `/.well-known` URIs handle all other # Let Nextcloud's API for `/.well-known` URIs handle all other
# requests by passing them to the front-end controller. # requests by passing them to the front-end controller.
@ -107,25 +114,29 @@ http {
} }
# Rules borrowed from `.htaccess` to hide certain paths from clients # Rules borrowed from `.htaccess` to hide certain paths from clients
location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) {
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } return 404;
}
location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
return 404;
}
location ~* ^/ds-vpath/ { location ~* ^/ds-vpath/ {
rewrite /ds-vpath/(.*) /$1 break; rewrite /ds-vpath/(.*) /$1 break;
proxy_pass http://onlyoffice-document-server; proxy_pass http://onlyoffice-document-server;
proxy_redirect off; proxy_redirect off;
client_max_body_size 10G; client_max_body_size 10G;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade"; proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host; proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $the_host/ds-vpath; proxy_set_header X-Forwarded-Host $the_host/ds-vpath;
proxy_set_header X-Forwarded-Proto $the_scheme; proxy_set_header X-Forwarded-Proto $the_scheme;
} }
location ~ \.php(?:$|/) { location ~ \.php(?:$|/) {
@ -152,20 +163,25 @@ http {
fastcgi_max_temp_file_size 0; fastcgi_max_temp_file_size 0;
} }
location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ { location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463, $asset_immutable"; add_header Cache-Control "public, max-age=15778463, $asset_immutable";
access_log off; # Optional: Don't log access to assets access_log off; # Optional: Don't log access to assets
location ~ \.wasm$ { location ~ \.wasm$ {
default_type application/wasm; default_type application/wasm;
} }
location ~ \.mjs$ {
default_type text/javascript;
}
} }
location ~ \.woff2?$ { location ~ \.woff2?$ {
try_files $uri /index.php$request_uri; try_files $uri /index.php$request_uri;
expires 7d; # Cache-Control policy borrowed from `.htaccess` expires 7d; # Cache-Control policy borrowed from `.htaccess`
access_log off; # Optional: Don't log access to assets access_log off; # Optional: Don't log access to assets
} }
# Rule borrowed from `.htaccess` # Rule borrowed from `.htaccess`