Move nspawn containers into nspawn directory

2026-01-22 00:21:34 +01:00 · 2024-09-16 20:41:43 +02:00 · 2024-09-16 20:41:43 +02:00 · 5b1fc56176
commit 5b1fc56176
parent be488a91a7
14 changed files with 2 additions and 1 deletions
--- a/hosts/stratus/containers/nspawn/nextcloud/backup.nix
+++ b/hosts/stratus/containers/nspawn/nextcloud/backup.nix
@ -0,0 +1,43 @@
+{
+  config,
+  pkgs,
+  lib,
+  dataDir,
+  ...
+}:
+{
+  systemd.tmpfiles.rules = [ "d ${dataDir}/backup 700 nextcloud nextcloud -" ];
+
+  myConfig.resticBackup.nextcloud = {
+    enable = true;
+    user = config.users.users.nextcloud.name;
+    healthchecks.enable = true;
+
+    extraConfig = {
+      backupPrepareCommand = ''
+        ${lib.getExe' config.services.nextcloud.occ "nextcloud-occ"} maintenance:mode --on
+        ${lib.getExe' config.services.postgresql.package "pg_dump"} nextcloud --format=custom --file=${dataDir}/backup/db.dump
+      '';
+      backupCleanupCommand = ''
+        ${lib.getExe' config.services.nextcloud.occ "nextcloud-occ"} maintenance:mode --off
+      '';
+      paths = [
+        "${dataDir}/home/data"
+        "${dataDir}/home/config/config.php"
+        "${dataDir}/backup"
+      ];
+    };
+  };
+
+  environment.systemPackages = [
+    (pkgs.writeShellApplication {
+      name = "nextcloud-restore";
+      text = ''
+        sudo -u nextcloud ${lib.getExe' config.services.nextcloud.occ "nextcloud-occ"} maintenance:mode --on
+        sudo -u nextcloud restic-nextcloud restore --target / latest
+        sudo -u nextcloud pg_restore --clean --if-exists --dbname nextcloud ${dataDir}/backup/db.dump
+        sudo -u nextcloud ${lib.getExe' config.services.nextcloud.occ "nextcloud-occ"} maintenance:mode --off
+      '';
+    })
+  ];
+}
--- a/hosts/stratus/containers/nspawn/nextcloud/default.nix
+++ b/hosts/stratus/containers/nspawn/nextcloud/default.nix
@ -0,0 +1,92 @@
+{
+  containers.nextcloud.config =
+    {
+      config,
+      inputs,
+      pkgs,
+      dataDir,
+      ...
+    }:
+    {
+      imports = [
+        ./email-server.nix
+        ./backup.nix
+      ];
+
+      sops.secrets."nextcloud/admin-password" = {
+        owner = config.users.users.nextcloud.name;
+        inherit (config.users.users.nextcloud) group;
+      };
+
+      systemd.tmpfiles.rules = [
+        "d ${dataDir}/home 750 nextcloud nextcloud -"
+        "d ${dataDir}/postgresql 700 postgres postgres -"
+      ];
+
+      services.postgresql.dataDir = "${dataDir}/postgresql";
+
+      services.nextcloud = {
+        enable = true;
+        package = pkgs.nextcloud29;
+        home = "${dataDir}/home";
+        hostName = config.networking.fqdn;
+
+        database.createLocally = true;
+        config = {
+          dbtype = "pgsql";
+          adminuser = "admin";
+          adminpassFile = config.sops.secrets."nextcloud/admin-password".path;
+        };
+
+        https = true;
+        settings = {
+          overwriteProtocol = "https";
+          trusted_proxies = [ "127.0.0.1" ];
+          log_type = "file";
+          default_phone_region = "DE";
+          maintenance_window_start = "2"; # UTC
+          defaultapp = "side_menu";
+        };
+
+        configureRedis = true;
+        maxUploadSize = "16G";
+        phpOptions."opcache.interned_strings_buffer" = "16";
+
+        autoUpdateApps = {
+          enable = true;
+          startAt = "04:00:00";
+        };
+        extraApps = {
+          inherit (config.services.nextcloud.package.packages.apps)
+            calendar
+            contacts
+            onlyoffice
+            memories
+            ;
+
+          twofactor_totp = pkgs.fetchNextcloudApp {
+            url = inputs.nextcloud-twofactor-totp.outPath;
+            sha256 = inputs.nextcloud-twofactor-totp.narHash;
+            license = "agpl3Plus";
+            unpack = true;
+          };
+          news = pkgs.fetchNextcloudApp {
+            url = inputs.nextcloud-news.outPath;
+            sha256 = inputs.nextcloud-news.narHash;
+            license = "agpl3Plus";
+            unpack = true;
+          };
+          side_menu = pkgs.fetchNextcloudApp {
+            url = inputs.nextcloud-side-menu.outPath;
+            sha256 = inputs.nextcloud-side-menu.narHash;
+            license = "agpl3Plus";
+            unpack = true;
+          };
+        };
+      };
+
+      environment.systemPackages = [ pkgs.ffmpeg ];
+
+      myConfig.tailscale.serve = "80";
+    };
+}
--- a/hosts/stratus/containers/nspawn/nextcloud/email-server.nix
+++ b/hosts/stratus/containers/nspawn/nextcloud/email-server.nix
@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  sops.secrets."nextcloud/gmail-password" = { };
+
+  services.nextcloud.settings = {
+    mail_smtpmode = "sendmail";
+    mail_sendmailmode = "pipe";
+  };
+
+  programs.msmtp = {
+    enable = true;
+    accounts.default = {
+      auth = true;
+      tls = true;
+      host = "smtp.gmail.com";
+      port = "587";
+      user = "nextcloud.stork";
+      from = "nextcloud.stork@gmail.com";
+      passwordeval = "cat ${config.sops.secrets."nextcloud/gmail-password".path}";
+    };
+  };
+}
--- a/hosts/stratus/containers/nspawn/nextcloud/secrets.yaml
+++ b/hosts/stratus/containers/nspawn/nextcloud/secrets.yaml
@ -0,0 +1,37 @@
+tailscale-auth-key: ENC[AES256_GCM,data:HLRjtK6MXLSlzEsu76mUye9V9gAD4Grxbd0UU1RySEGekG4StMeO3yo+wHYHNU2UcRdZEW4OKaZyLbRCHpg=,iv:Kbey9sU5tCqH9pnas30bns1HyTGYlAL0pR3WcVeVvrY=,tag:NiFLtMWJ1FCN+EYR/ZHrrg==,type:str]
+nextcloud:
+  admin-password: ENC[AES256_GCM,data:RaFNoEJj2flmwIu2Q/5UgRbITve7CzFg8udQclJO,iv:d95Vo9HMRzmoSU3gcQqO5uP7yW6n7PF6Nx3s6A9bgmc=,tag:ruIW8Ov+wQPOPBWV61MnWw==,type:str]
+  gmail-password: ENC[AES256_GCM,data:RJXg4KYYwjg2CyzQM9wovDSqB8M=,iv:Tf8egrzoG3rRbzufJGHCTr6W+nCEnJJaSe6hpvr1AmM=,tag:GjlgIEqQDUtjn3mm1QT1uw==,type:str]
+restic:
+  environment: ENC[AES256_GCM,data:bYC7JBKvOMUdqB3X/Z9Nh4g8mhSJpqo63vU3zIrdSO+zlRF+PT+n4yofZe8D47Wz46YGAfwnKXGvAy2WQwHsDcMfdWW85e/1ttV5eESWMotSBM7WzpyFRjNDg+vCy4nWkWI=,iv:RVBMlsOwJCehMuJ2Hzls+gnzUIJM8MjdLu5uMJczugw=,tag:hds43pJX/hpBLwXTujiJ8w==,type:str]
+  password: ENC[AES256_GCM,data:yMs1EG39X1+RYcgeM3SFi38ypOU=,iv:vsEl9jLR3DcqRxJmH5cpIe1+I2W49Hj12oOfwrymznI=,tag:uevinZPEfj0J4KFkTLsV5g==,type:str]
+healthchecks-ping-key: ENC[AES256_GCM,data:3bLMIixDXZpCWfkuf8UbCovRvbtlIw==,iv:0G7oIezhyNDl7U9EXw2auvTvdxng6CAbAViXQSbzo+c=,tag:u1QWKdszu9dDLb6LZdAShA==,type:str]
+sops:
+  kms: []
+  gcp_kms: []
+  azure_kv: []
+  hc_vault: []
+  age:
+    - recipient: age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKWFVKV0IzbVVTV1g1c3o1
+        ZnpwMTFyZ0RhcmhhNk8vd1dYWGdWZHZhNFVRCjE3MG9Wd0ZXNEtrRS84M3hMRVdk
+        T1BOczN0VmoybUs3dXJUR3FNc2swdlkKLS0tIEFXam96UGlJWnphVzVpRittSXNS
+        SDU0U0IwTTh6NHI2enZZTEwwd2lkQXMKsHAwayLHW3GfRc90sq0xhN1rF4RkvXSS
+        +WGyhmI0fik6NPyVN7DNaYhte2IoVJe3RTH2vJigpTLIIziMgTPgFQ==
+        -----END AGE ENCRYPTED FILE-----
+    - recipient: age1jutruntzdaqs26mpe68pafje23m9n4klm04fva05fcdyvyqnaamsvqf3jr
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSExmaW9CUGo0WWloZDha
+        c3ZUNy9xVXgvVkdzRHRjWFZERllycG41RENzCnZuazR2RW41VlJNWk9TZjcwcGpM
+        dnZQQTNSbDBieGhmOW5xU24xeVhpYjQKLS0tIHAzTDV2dHdDNnQ4ZC9ielM3Qyt1
+        aWFqYXYrMmJBbEQwQWxza1lrdmU4bmMKm0QbJP1QiNVOA7slpocaPxkq9orE8jrP
+        xxrDtRUZhvEOEZuCD61wWTfgdeI7SFWaSJkN6MgPlvRyuYQ+3TZh3Q==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2024-09-14T10:12:52Z"
+  mac: ENC[AES256_GCM,data:d+G+0m8WX9Fk3XmB+Hd4oSKgKYp6fGv9UIHhVIjy+XH0XNNZXFDCB2komQ/9K9EAuVDTfRspS2WJMT97o4CXEDiltz+iCfSGVL4TDpPjzOwEyyHJs9aD0cYoxLgL36H9OEDsf1tTAqy4tvRGJVWTNtXEh/og7pssH8hGXa2dqV4=,iv:aioBwBRPXVp/dLK536REJSi9tYFMTMqkKRHPfwmElXs=,tag:JZuaN4jAoybTLpZ9yX+khg==,type:str]
+  pgp: []
+  unencrypted_suffix: _unencrypted
+  version: 3.9.0