feat(nextcloud): get rid of errors in config

devices/nos/modules/arion/nextcloud/compose.nix

@@ -1,16 +1,18 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }: let
   inherit (config.sops) secrets;
   inherit (config.arion) rwDataDir;
   inherit (lib) concatStrings;
 
+  mainContainerName = "app-server";
   rwPath = rwDataDir + "/nextcloud";
 in {
   arion.projects."nextcloud" = {
-    "app-server" = {
+    "${mainContainerName}" = {
       image = ./images/nextcloud.nix;
       restart = "always";
 
@@ -31,7 +33,7 @@ in {
         POSTGRES_HOST = "nextcloud-db";
         REDIS_HOST = "nextcloud-cache";
         REDIS_HOST_PASSWORD = "password";
-        TRUSTED_PROXIES = "cloud.nelim.org";
+        TRUSTED_PROXIES = "cloud.nelim.org nginx-server";
         NEXTCLOUD_INIT_HTACCESS = "true";
       };
     };
@@ -103,4 +105,23 @@ in {
       ];
     };
   };
+
+  # Cron job
+  systemd.timers.nextcloud-cron = {
+    description = "Timer For Nextcloud Cron";
+    wantedBy = ["timers.target"];
+
+    timerConfig.OnBootSec = "5m";
+    timerConfig.OnUnitActiveSec = "5m";
+  };
+  systemd.services.nextcloud-cron = {
+    description = "Nextcloud Cron";
+    requires = ["arion-nextcloud.service"];
+    after = ["arion-nextcloud.service"];
+
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.docker}/bin/docker exec -u www-data ${mainContainerName} php -f /var/www/html/cron.php";
+    };
+  };
 }

devices/nos/modules/arion/nextcloud/nginx.conf

@@ -9,7 +9,6 @@ events {
 }
 
 http {
-
     upstream backend {
         server app-server:9000;
         #server unix:/var/run/php/php7.4-fpm.sock;
@@ -63,7 +62,7 @@ http {
         add_header X-Download-Options "noopen" always;
         add_header X-Frame-Options "SAMEORIGIN" always;
         add_header X-Permitted-Cross-Domain-Policies "none" always;
-        add_header X-Robots-Tag                         "none"          always;
+        add_header X-Robots-Tag "noindex, nofollow" always;
         add_header X-XSS-Protection "1; mode=block" always;
 
         # Remove X-Powered-By, which is an information leak
@@ -86,14 +85,22 @@ http {
         }
 
         location ^~ /.well-known {
+            location = /.well-known/carddav {
+                return 301 /remote.php/dav/;
+            }
+            location = /.well-known/caldav {
+                return 301 /remote.php/dav/;
+            }
 
-            location = /.well-known/carddav { return 301 /remote.php/dav/; }
-            location = /.well-known/caldav  { return 301 /remote.php/dav/; }
             #location = /.well-known/webfinger { return 301 /index.php/.well-known/webfinger/; }
             #location = /.well-known/nodeinfo { return 301 /index.php/.well-known/nodeinfo/; }}
 
-            location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
-            location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
+            location /.well-known/acme-challenge {
+                try_files $uri $uri/ =404;
+            }
+            location /.well-known/pki-validation {
+                try_files $uri $uri/ =404;
+            }
 
             # Let Nextcloud's API for `/.well-known` URIs handle all other
             # requests by passing them to the front-end controller.
@@ -107,8 +114,12 @@ http {
         }
 
         # Rules borrowed from `.htaccess` to hide certain paths from clients
-        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
-        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
+        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) {
+            return 404;
+        }
+        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
+            return 404;
+        }
 
         location ~* ^/ds-vpath/ {
             rewrite /ds-vpath/(.*) /$1 break;
@@ -152,7 +163,7 @@ http {
             fastcgi_max_temp_file_size 0;
         }
 
-        location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
+        location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
             try_files $uri /index.php$request_uri;
             add_header Cache-Control "public, max-age=15778463, $asset_immutable";
             access_log off; # Optional: Don't log access to assets
@@ -160,7 +171,12 @@ http {
             location ~ \.wasm$ {
                 default_type application/wasm;
             }
+
+            location ~ \.mjs$ {
+                default_type text/javascript;
             }
+        }
+
 
         location ~ \.woff2?$ {
             try_files $uri /index.php$request_uri;