Rename host proxima to stratus

hosts/stratus/containers/nextcloud/default.nix

@@ -0,0 +1,42 @@
+{ config, ... }:
+{
+  sops.secrets = {
+    "nextcloud/admin-password" = { };
+    "nextcloud/gmail-password" = { };
+    tailscale-auth-key = { };
+  };
+
+  containers.nextcloud = {
+    autoStart = true;
+    ephemeral = true;
+    bindMounts = {
+      "/run/secrets/nextcloud/admin-password" = { };
+      "/run/secrets/nextcloud/gmail-password" = { };
+      "/run/secrets/tailscale-auth-key" = { };
+      "/data/nextcloud".isReadOnly = false;
+      "/data/postgresql".isReadOnly = false;
+      "/var/lib/tailscale" = {
+        hostPath = "/var/lib/tailscale-nextcloud";
+        isReadOnly = false;
+      };
+    };
+
+    specialArgs = {
+      inherit (config.networking) domain;
+    };
+    config =
+      { domain, ... }:
+      {
+        system.stateVersion = "24.05";
+        networking = {
+          inherit domain;
+        };
+
+        imports = [
+          ./nextcloud.nix
+          ./email-server.nix
+          ./tailscale.nix
+        ];
+      };
+  };
+}

hosts/stratus/containers/nextcloud/email-server.nix

@@ -0,0 +1,21 @@
+{
+  systemd.tmpfiles.rules = [ "d /run/secrets/nextcloud/gmail-password 400 nextcloud nextcloud -" ];
+
+  services.nextcloud.settings = {
+    mail_smtpmode = "sendmail";
+    mail_sendmailmode = "pipe";
+  };
+
+  programs.msmtp = {
+    enable = true;
+    accounts.default = {
+      auth = true;
+      tls = true;
+      host = "smtp.gmail.com";
+      port = "587";
+      user = "nextcloud.stork";
+      from = "nextcloud.stork@gmail.com";
+      passwordeval = "cat /run/secrets/nextcloud/gmail-password";
+    };
+  };
+}

hosts/stratus/containers/nextcloud/nextcloud.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+  systemd.tmpfiles.rules = [ "d /run/secrets/nextcloud/admin-password 400 nextcloud nextcloud -" ];
+
+  services.postgresql.dataDir = "/data/postgresql";
+
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud29;
+    home = "/data/nextcloud";
+    hostName = "localhost";
+
+    database.createLocally = true;
+    config = {
+      dbtype = "pgsql";
+      adminuser = "admin";
+      adminpassFile = "/run/secrets/nextcloud/admin-password";
+    };
+
+    https = true;
+    settings = {
+      overwriteProtocol = "https";
+      trusted_domains = [ config.networking.fqdn ];
+      log_type = "file";
+      default_phone_region = "DE";
+      maintenance_window_start = "2"; # UTC
+    };
+
+    configureRedis = true;
+    maxUploadSize = "4G";
+    phpOptions."opcache.interned_strings_buffer" = "16";
+
+    autoUpdateApps = {
+      enable = true;
+      startAt = "04:00:00";
+    };
+    extraApps = {
+      inherit (config.services.nextcloud.package.packages.apps) contacts calendar;
+    };
+  };
+}

hosts/stratus/containers/nextcloud/tailscale.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  services.tailscale = {
+    enable = true;
+    authKeyFile = "/run/secrets/tailscale-auth-key";
+    useRoutingFeatures = "server";
+    interfaceName = "userspace-networking";
+    extraUpFlags = [ "--ssh" ];
+  };
+
+  systemd.services.nextcloud-serve = {
+    after = [
+      "tailscaled.service"
+      "tailscaled-autoconnect.service"
+    ];
+    wants = [ "tailscaled.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig.Type = "oneshot";
+    script = ''
+      ${lib.getExe pkgs.tailscale} cert ${config.networking.fqdn}
+      ${lib.getExe pkgs.tailscale} serve reset
+      ${lib.getExe pkgs.tailscale} serve --bg 80
+    '';
+  };
+}