SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 22:11:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Refactor container configuration

Browse source
This commit is contained in:
SebastianStork 2024-09-02 13:33:44 +02:00
parent 8af96429ff
commit 380d8202ff
15 changed files with 288 additions and 241 deletions
Download patch file Download diff file Expand all files Collapse all files

103
hosts/stratus/containers/nextcloud/default.nix
View file

@ -1,61 +1,62 @@
{ config, ... }:
{
sops.secrets = {
"nextcloud/admin-password" = { };
"nextcloud/gmail-password" = { };
tailscale-auth-key = { };
};
containers.nextcloud.config =
{
config,
pkgs,
dataDir,
...
}:
{
imports = [ ./email-server.nix ];
systemd.tmpfiles.rules = [
"d /data/nextcloud - - -"
"d /var/lib/tailscale-nextcloud - - -"
];
containers.nextcloud = {
autoStart = true;
ephemeral = true;
macvlans = [ "eno1" ];
bindMounts = {
# Secrets
"/run/secrets/nextcloud".isReadOnly = false;
"/run/secrets/tailscale-auth-key" = { };
# State
"/data/nextcloud".isReadOnly = false;
"/var/lib/tailscale" = {
hostPath = "/var/lib/tailscale-nextcloud";
isReadOnly = false;
sops.secrets."nextcloud/admin-password" = {
owner = config.users.users.nextcloud.name;
inherit (config.users.users.nextcloud) group;
};
};
specialArgs = {
inherit (config.networking) domain;
};
config =
{ domain, ... }:
{
system.stateVersion = "24.05";
systemd.tmpfiles.rules = [
"d ${dataDir}/home 750 nextcloud nextcloud -"
"d ${dataDir}/postgresql 700 postgres postgres -"
];
networking = {
inherit domain;
useNetworkd = true;
useHostResolvConf = false;
services.postgresql.dataDir = "${dataDir}/postgresql";
services.nextcloud = {
enable = true;
package = pkgs.nextcloud29;
home = "${dataDir}/home";
hostName = config.networking.fqdn;
database.createLocally = true;
config = {
dbtype = "pgsql";
adminuser = "admin";
adminpassFile = config.sops.secrets."nextcloud/admin-password".path;
};
systemd.network = {
https = true;
settings = {
overwriteProtocol = "https";
trusted_proxies = [ "127.0.0.1" ];
log_type = "file";
default_phone_region = "DE";
maintenance_window_start = "2"; # UTC
};
configureRedis = true;
maxUploadSize = "4G";
phpOptions."opcache.interned_strings_buffer" = "16";
autoUpdateApps = {
enable = true;
networks."40-mv-eno1" = {
matchConfig.Name = "mv-eno1";
networkConfig.DHCP = "yes";
dhcpV4Config.ClientIdentifier = "mac";
};
startAt = "04:00:00";
};
extraApps = {
inherit (config.services.nextcloud.package.packages.apps) contacts calendar;
};
imports = [
./nextcloud.nix
./email-server.nix
./tailscale.nix
];
};
};
myConfig.tailscale.serve = "80";
};
}

5
hosts/stratus/containers/nextcloud/email-server.nix
View file

@ -1,5 +1,6 @@
{ config, ... }:
{
systemd.tmpfiles.rules = [ "z /run/secrets/nextcloud/gmail-password 400 nextcloud nextcloud -" ];
sops.secrets."nextcloud/gmail-password" = { };
services.nextcloud.settings = {
mail_smtpmode = "sendmail";
@ -15,7 +16,7 @@
port = "587";
user = "nextcloud.stork";
from = "nextcloud.stork@gmail.com";
passwordeval = "cat /run/secrets/nextcloud/gmail-password";
passwordeval = "cat ${config.sops.secrets."nextcloud/gmail-password".path}";
};
};
}

49
hosts/stratus/containers/nextcloud/nextcloud.nix
View file

@ -1,49 +0,0 @@
{
config,
pkgs,
...
}:
{
systemd.tmpfiles.rules = [
"z /run/secrets/nextcloud/admin-password 400 nextcloud nextcloud -"
"d /data/nextcloud/home 750 nextcloud nextcloud -"
"d /data/nextcloud/postgresql 700 postgres postgres -"
];
services.postgresql.dataDir = "/data/nextcloud/postgresql";
services.nextcloud = {
enable = true;
package = pkgs.nextcloud29;
home = "/data/nextcloud/home";
hostName = config.networking.fqdn;
database.createLocally = true;
config = {
dbtype = "pgsql";
adminuser = "admin";
adminpassFile = "/run/secrets/nextcloud/admin-password";
};
https = true;
settings = {
overwriteProtocol = "https";
trusted_proxies = [ "127.0.0.1" ];
log_type = "file";
default_phone_region = "DE";
maintenance_window_start = "2"; # UTC
};
configureRedis = true;
maxUploadSize = "4G";
phpOptions."opcache.interned_strings_buffer" = "16";
autoUpdateApps = {
enable = true;
startAt = "04:00:00";
};
extraApps = {
inherit (config.services.nextcloud.package.packages.apps) contacts calendar;
};
};
}

33
hosts/stratus/containers/nextcloud/secrets.yaml Normal file
View file

@ -0,0 +1,33 @@
tailscale-auth-key: ENC[AES256_GCM,data:KshGpoyKTQQgshWFSwhGWPtwPfP3S2fLkJBxqfu1Mgs/6aexXRo0jMyzvnonxB/HsxFSRCffUuxwQNF8XJY=,iv:8MtERXmpwqgGZxIPmXAcj0KymWvRXKV5svOLZSfWdOU=,tag:refC9jmVzSrLuClo8+J7DA==,type:str]
nextcloud:
admin-password: ENC[AES256_GCM,data:RaFNoEJj2flmwIu2Q/5UgRbITve7CzFg8udQclJO,iv:d95Vo9HMRzmoSU3gcQqO5uP7yW6n7PF6Nx3s6A9bgmc=,tag:ruIW8Ov+wQPOPBWV61MnWw==,type:str]
gmail-password: ENC[AES256_GCM,data:RJXg4KYYwjg2CyzQM9wovDSqB8M=,iv:Tf8egrzoG3rRbzufJGHCTr6W+nCEnJJaSe6hpvr1AmM=,tag:GjlgIEqQDUtjn3mm1QT1uw==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKWFVKV0IzbVVTV1g1c3o1
ZnpwMTFyZ0RhcmhhNk8vd1dYWGdWZHZhNFVRCjE3MG9Wd0ZXNEtrRS84M3hMRVdk
T1BOczN0VmoybUs3dXJUR3FNc2swdlkKLS0tIEFXam96UGlJWnphVzVpRittSXNS
SDU0U0IwTTh6NHI2enZZTEwwd2lkQXMKsHAwayLHW3GfRc90sq0xhN1rF4RkvXSS
+WGyhmI0fik6NPyVN7DNaYhte2IoVJe3RTH2vJigpTLIIziMgTPgFQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1jutruntzdaqs26mpe68pafje23m9n4klm04fva05fcdyvyqnaamsvqf3jr
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSExmaW9CUGo0WWloZDha
c3ZUNy9xVXgvVkdzRHRjWFZERllycG41RENzCnZuazR2RW41VlJNWk9TZjcwcGpM
dnZQQTNSbDBieGhmOW5xU24xeVhpYjQKLS0tIHAzTDV2dHdDNnQ4ZC9ielM3Qyt1
aWFqYXYrMmJBbEQwQWxza1lrdmU4bmMKm0QbJP1QiNVOA7slpocaPxkq9orE8jrP
xxrDtRUZhvEOEZuCD61wWTfgdeI7SFWaSJkN6MgPlvRyuYQ+3TZh3Q==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-09-02T11:38:31Z"
mac: ENC[AES256_GCM,data:E2L8j21dhHLQ/OCIZNMqlH1C5XX0uSGmuQIjetiE8s/LX4fZSR9s4sPzub3gLI5h3EVJKzMU2UFXZATMUfe/1t4PP5nIuggUtxD+VWxtHNaVHJMs+wEWKYE+nITyZ7HGvwBr0sMQ3Sb2DuiQ729nr9hLn1Mbn7uc5o+Z2RJg5Cc=,iv:jEaBwYsO3hW5NtmmZrL6H23qDcTSAGuBLjPRi60Lzco=,tag:pGpL80onRUVQfIYChaBxSg==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.0

31
hosts/stratus/containers/nextcloud/tailscale.nix
View file

@ -1,31 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
services.tailscale = {
enable = true;
authKeyFile = "/run/secrets/tailscale-auth-key";
useRoutingFeatures = "server";
openFirewall = true;
interfaceName = "userspace-networking";
extraUpFlags = [ "--ssh" ];
};
systemd.services.nextcloud-serve = {
after = [
"tailscaled.service"
"tailscaled-autoconnect.service"
];
wants = [ "tailscaled.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script = ''
${lib.getExe pkgs.tailscale} cert ${config.networking.fqdn}
${lib.getExe pkgs.tailscale} serve reset
${lib.getExe pkgs.tailscale} serve --bg 80
'';
};
}