Add quatresaisons server

[perso/Immae/Config/Nix.git] / modules / private / system / quatresaisons / nextcloud.nix

diff --git a/modules/private/system/quatresaisons/nextcloud.nix b/modules/private/system/quatresaisons/nextcloud.nix
new file mode 100644 (file)
index 0000000..047d17e
--- /dev/null
+++ b/modules/private/system/quatresaisons/nextcloud.nix
@@ -0,0 +1,141 @@
+{ lib, pkgs, config,  ... }:
+let
+  nextcloud = pkgs.webapps.nextcloud.withApps (a: [
+    a.apporder a.audioplayer a.bookmarks a.calendar a.carnet a.circles
+    a.contacts a.cookbook a.deck a.extract a.files_markdown
+    a.files_readmemd a.flowupload a.gpxedit a.gpxpod a.keeweb a.maps
+    a.metadata a.music a.notes a.ocsms a.passman a.polls a.spreed
+    a.social a.tasks
+  ]);
+  varDir = "/var/lib/nextcloud";
+  phpFpm = rec {
+    basedir = builtins.concatStringsSep ":" ([ nextcloud varDir ] ++ nextcloud.apps);
+    pool = {
+      "listen.owner" = "wwwrun";
+      "listen.group" = "wwwrun";
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
+
+      "php_admin_value[output_buffering]" = "0";
+      "php_admin_value[max_execution_time]" = "1800";
+      "php_admin_value[zend_extension]" = "opcache";
+      #already enabled by default?
+      #"php_value[opcache.enable]" = "1";
+      "php_value[opcache.enable_cli]" = "1";
+      "php_value[opcache.interned_strings_buffer]" = "8";
+      "php_value[opcache.max_accelerated_files]" = "10000";
+      "php_value[opcache.memory_consumption]" = "128";
+      "php_value[opcache.save_comments]" = "1";
+      "php_value[opcache.revalidate_freq]" = "1";
+      "php_admin_value[memory_limit]" = "512M";
+
+      "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
+  };
+in {
+  config = {
+    services.postgresql.ensureDatabases = [ "nextcloud" ];
+    services.postgresql.ensureUsers = [
+      { name = "nextcloud"; ensurePermissions = { "DATABASE nextcloud" = "ALL PRIVILEGES"; }; }
+    ];
+    services.websites.env.production.modules = [ "proxy_fcgi" ];
+
+    services.websites.env.production.vhostConfs.cloud = {
+      certName    = "quatresaisons";
+      addToCerts  = true;
+      hosts       = ["nextcloud.4c.salle-s.org" ];
+      root        = nextcloud;
+      extraConfig = 
+        [
+        ''
+          SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
+          <Directory ${nextcloud}>
+            AcceptPathInfo On
+            DirectoryIndex index.php
+            Options FollowSymlinks
+            Require all granted
+            AllowOverride all
+
+            <IfModule mod_headers.c>
+              Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
+            </IfModule>
+            <FilesMatch "\.php$">
+              CGIPassAuth on
+              SetHandler "proxy:unix:${config.services.phpfpm.pools.nextcloud.socket}|fcgi://localhost"
+            </FilesMatch>
+
+          </Directory>
+        ''
+      ];
+    };
+    services.websites.env.production.vhostConfs.cloud_wait = let
+      content = pkgs.writeText "contenu" ''
+        nextcloud est un service qui a besoin de pérennité du nom
+        "nextcloud.salle-s.org", on va peut-etre y arriver, c'est une
+        question de jours, voir le message informatique.internet:8017
+      '';
+    in {
+      certName    = "quatresaisons";
+      addToCerts  = true;
+      hosts       = ["nextcloud.salle-s.org" ];
+      root        = content;
+      extraConfig =
+        [
+        ''
+          Alias / ${content}
+        ''
+      ];
+    };
+
+    users.users.root.packages = let
+      occ = pkgs.writeScriptBin "nextcloud-occ" ''
+        #! ${pkgs.stdenv.shell}
+        cd ${nextcloud}
+        NEXTCLOUD_CONFIG_DIR="${nextcloud}/config" \
+          exec \
+          sudo -u wwwrun ${pkgs.php74}/bin/php \
+          -c ${pkgs.php74}/etc/php.ini \
+          occ $*
+        '';
+    in [ occ ];
+
+    system.activationScripts.nextcloud = {
+      deps = [ "users" ];
+      text = let
+        confs = lib.attrsets.mapAttrs (n: v: pkgs.writeText "${n}.json" (builtins.toJSON v)) nextcloud.otherConfig;
+      in
+        ''
+        install -m 0755 -o wwwrun -g wwwrun -d ${varDir}
+        install -m 0755 -o wwwrun -g wwwrun -d ${varDir}/config
+        install -m 0750 -o wwwrun -g wwwrun -d ${varDir}/phpSessions
+        ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (n: v:
+          "install -D -m 0644 -o wwwrun -g wwwrun -T ${v} ${varDir}/config/${n}.json"
+          ) confs)}
+      '';
+    };
+    services.phpfpm.pools.nextcloud = {
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = phpFpm.pool;
+      phpPackage = pkgs.php74.withExtensions({ enabled, all }: enabled ++ [ all.redis all.apcu all.opcache all.imagick ]);
+    };
+
+    services.cron = {
+      enable = true;
+      systemCronJobs = let
+        script = pkgs.writeScriptBin "nextcloud-cron" ''
+          #! ${pkgs.stdenv.shell}
+          export LOCALE_ARCHIVE=/run/current-system/sw/lib/locale/locale-archive
+          export PATH=/run/wrappers/bin:$PATH
+          ${pkgs.php74}/bin/php -d memory_limit=512M -f ${nextcloud}/cron.php
+          '';
+      in [
+        ''
+          */15 * * * * wwwrun ${script}/bin/nextcloud-cron
+        ''
+      ];
+    };
+  };
+}