nixops/modules/websites/tools/cloud/nextcloud.nix

   1 { stdenv, fetchurl, env, writeText, lib, phpPackages, php }:
   2 let
   3   nextcloud = let
   4     buildApp = { appName, version, url, sha256, installPhase ? "mkdir -p $out && cp -R . $out/" }:
   5       stdenv.mkDerivation rec {
   6         name = "nextcloud-app-${appName}-${version}";
   7         inherit version;
   8         phases = "unpackPhase installPhase";
   9         inherit installPhase;
  10         src = fetchurl { inherit url sha256; };
  11       };
  12     apps = {
  13       audioplayer = buildApp rec {
  14         appName = "audioplayer";
  15         version = "2.5.0";
  16         url = "https://github.com/Rello/${appName}/releases/download/${version}/${appName}-${version}.tar.gz";
  17         sha256 = "1pg4y51cv3agy28n4gfc8i7x1ya1yijxrmhpblm1n846vhmwdcm8";
  18       };
  19       bookmarks = buildApp rec {
  20         appName = "bookmarks";
  21         version = "0.14.3";
  22         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}-${version}.tar.gz";
  23         sha256 = "0s7lkcl70izlkihnml1par0cac0wvckllyyga3jkb7k9vdg7d40c";
  24       };
  25       calendar = buildApp rec {
  26         appName = "calendar";
  27         version = "1.6.4";
  28         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  29         sha256 = "00dijvcvy7snsjslfbyzvpp9anhms22zp1f0zkj89ln33jmana63";
  30       };
  31       contacts = buildApp rec {
  32         appName = "contacts";
  33         version = "3.0.0";
  34         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  35         sha256 = "0fafy5kgzr5ldr3hxxxgmnw4y3qpjnv5ha1f1dlmqbc65s8frw7s";
  36       };
  37       deck = buildApp rec {
  38         appName = "deck";
  39         version = "0.5.2";
  40         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  41         sha256 = "1kygzixxdkp3dbma009p3pw0fj8wgcqcv39n7pay78lh6zi3nic7";
  42       };
  43       files_markdown = buildApp rec {
  44         appName = "files_markdown";
  45         version = "2.0.5";
  46         url = "https://github.com/icewind1991/${appName}/releases/download/v${version}/${appName}.tar.gz";
  47         sha256 = "1dzvy4c6vff2qmkwqw13dx92xdkafaxgnipswjw44mh0ncc2n9ym";
  48       };
  49       gpxedit = buildApp rec {
  50         appName = "gpxedit";
  51         version = "0.0.10";
  52         url = "https://gitlab.com/eneiluj/gpxedit-oc/wikis/uploads/33d187268c5f6f6a55350d656305701c/${appName}-${version}.tar.gz";
  53         sha256 = "0ynpaxm0xhvcj8xax6rm1w0p6j57wbqidhi7bhn268n483gwl2sw";
  54       };
  55       gpxpod = buildApp rec {
  56         appName = "gpxpod";
  57         version = "3.0.0";
  58         url = "https://gitlab.com/eneiluj/gpxpod-oc/-/archive/v${version}/${appName}-oc-v${version}.tar.gz";
  59         sha256 = "0smpi4r3z7zfl1612fb30cwm1xmpiq95c81zzqiwzjf288iys74k";
  60       };
  61       keeweb = buildApp rec {
  62         appName = "keeweb";
  63         version = "0.4.0";
  64         url = "https://github.com/jhass/nextcloud-keeweb/releases/download/v${version}/${appName}-${version}.tar.gz";
  65         sha256 = "0453kkb0a8vfivmibpwpx4bvhyn64jhns6cdfjacmnvbm6d75nj1";
  66       };
  67       notes = buildApp rec {
  68         appName = "notes";
  69         version = "2.5.1";
  70         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  71         sha256 = "1albzqqsdirzyw8vhvs7r0qm2wqp8vm9vmxm4crhncd85bk01hmh";
  72       };
  73       ocsms = buildApp rec {
  74         appName = "ocsms";
  75         version = "2.1.0";
  76         url = "https://github.com/nextcloud/${appName}/releases/download/${version}/${appName}-${version}.tar.gz";
  77         sha256 = "19xgs82js4sdf6j9478vg9li7za7csvcaa1hbq9nmrq441sbxk9c";
  78         installPhase = ''
  79           sed -i -e "/addScript.*devel/d" -e "s@//\(.*addScript.*app.min\)@\1@" templates/main.php
  80           mkdir -p $out
  81           cp -R . $out/
  82           '';
  83       };
  84       spreed = buildApp rec {
  85         appName = "spreed";
  86         version = "5.0.0";
  87         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}-${version}.tar.gz";
  88         sha256 = "1d48mak1fnf1b28r2687yqamm4pxfg3qyxcj9ny31a6xg2cm0xa7";
  89       };
  90       tasks = buildApp rec {
  91         appName = "tasks";
  92         version = "0.9.8";
  93         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  94         sha256 = "089m124lfsfk09fqj50x9n7zndq97jp5afgb8s001rpmzym4g6ny";
  95       };
  96     };
  97   in rec {
  98     varDir = "/var/lib/nextcloud";
  99     config_php = writeText "config.php" ''
 100       <?php
 101       $CONFIG = array (
 102         // FIXME: change this value when nextcloud starts getting slow
 103         'instanceid' => '${env.instance_id}1',
 104         'datadirectory' => '/var/lib/nextcloud/',
 105         'passwordsalt' => '${env.password_salt}',
 106         'debug' => false,
 107         'dbtype' => 'pgsql',
 108         'version' => '15.0.0.10',
 109         'dbname' => '${env.postgresql.database}',
 110         'dbhost' => '${env.postgresql.socket}',
 111         'dbtableprefix' => 'oc_',
 112         'dbuser' => '${env.postgresql.user}',
 113         'dbpassword' => '${env.postgresql.password}',
 114         'installed' => true,
 115         'maxZipInputSize' => 0,
 116         'allowZipDownload' => true,
 117         'forcessl' => true,
 118         'theme' => ${"''"},
 119         'maintenance' => false,
 120         'trusted_domains' =>
 121         array (
 122           0 => 'cloud.immae.eu',
 123         ),
 124         'secret' => '${env.secret}',
 125         'appstoreenabled' => false,
 126         'appstore.experimental.enabled' => true,
 127         'loglevel' => 2,
 128         'trashbin_retention_obligation' => 'auto',
 129         'htaccess.RewriteBase' => '/',
 130         'mail_smtpmode' => 'sendmail',
 131         'mail_smtphost' => '127.0.0.1',
 132         'mail_smtpname' => ''',
 133         'mail_smtppassword' => ''',
 134         'mail_from_address' => 'owncloud',
 135         'mail_smtpauth' => false,
 136         'mail_domain' => 'immae.eu',
 137         'memcache.local' => '\\OC\\Memcache\\APCu',
 138         'memcache.locking' => '\\OC\\Memcache\\Redis',
 139         'filelocking.enabled' => true,
 140         'redis' =>
 141         array (
 142           'host' => '${env.redis.socket}',
 143           'port' => 0,
 144           'dbindex' => ${env.redis.db_index},
 145         ),
 146         'overwrite.cli.url' => 'https://cloud.immae.eu',
 147         'ldapIgnoreNamingRules' => false,
 148         'ldapProviderFactory' => '\\OCA\\User_LDAP\\LDAPProviderFactory',
 149         'config_is_read_only' => true,
 150       );
 151       '';
 152     config = stdenv.mkDerivation rec {
 153       name = "nextcloud-config";
 154       src = ./nextcloud-config;
 155       phases = "installPhase";
 156       installPhase = ''
 157         mkdir -p $out
 158         cp -r $src/* $out
 159         cp ${config_php} $out/config.php
 160       '';
 161     };
 162     webRoot = stdenv.mkDerivation rec {
 163       name = "nextcloud-${version}";
 164       version = "15.0.0";
 165
 166       src = fetchurl {
 167         url = "https://download.nextcloud.com/server/releases/${name}.tar.bz2";
 168         sha256 = "0y7bk1588n5rmmranmmrkajh50074460hr4v052ahg9mf60wbc2v";
 169       };
 170
 171       installPhase = ''
 172         mkdir -p $out/
 173         cp -R . $out/
 174         rm -r $out/config
 175         ln -sf ${config} $out/config
 176         ${builtins.concatStringsSep "\n" (
 177           lib.attrsets.mapAttrsToList (name: value: "ln -sf ${value} $out/apps/${name}") apps
 178         )}
 179       '';
 180
 181       meta = {
 182         description = "Sharing solution for files, calendars, contacts and more";
 183         homepage = https://nextcloud.com;
 184         maintainers = with lib.maintainers; [ schneefux bachp globin fpletz ];
 185         license = lib.licenses.agpl3Plus;
 186         platforms = with lib.platforms; unix;
 187       };
 188     };
 189     activationScript = {
 190       deps = [ ];
 191       text = ''
 192         install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir}
 193         install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
 194       '';
 195     };
 196     apache = {
 197       user = "wwwrun";
 198       group = "wwwrun";
 199       modules = [ "proxy_fcgi" ];
 200       vhostConf = ''
 201         SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
 202         <Directory ${webRoot}>
 203           AcceptPathInfo On
 204           DirectoryIndex index.php
 205           Options FollowSymlinks
 206           Require all granted
 207           AllowOverride all
 208
 209           <IfModule mod_headers.c>
 210             Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
 211           </IfModule>
 212           <FilesMatch "\.php$">
 213             CGIPassAuth on
 214             SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
 215           </FilesMatch>
 216
 217         </Directory>
 218
 219         '';
 220     };
 221     phpFpm = rec {
 222       basedir = builtins.concatStringsSep ":" (
 223         [ webRoot varDir config ]
 224         ++ lib.attrsets.mapAttrsToList (name: value: value) apps);
 225       socket = "/var/run/phpfpm/nextcloud.sock";
 226       phpConfig = ''
 227         extension=${phpPackages.redis}/lib/php/extensions/redis.so
 228         extension=${phpPackages.apcu}/lib/php/extensions/apcu.so
 229         zend_extension=${php}/lib/php/extensions/opcache.so
 230         '';
 231       pool = ''
 232         listen = ${socket}
 233         user = ${apache.user}
 234         group = ${apache.group}
 235         listen.owner = ${apache.user}
 236         listen.group = ${apache.group}
 237         pm = ondemand
 238         pm.max_children = 60
 239         pm.process_idle_timeout = 60
 240
 241         php_admin_value[output_buffering] = 0
 242         php_admin_value[max_execution_time] = 1800
 243         php_admin_value[zend_extension] = "opcache"
 244         php_value[opcache.enable] = 1
 245         php_value[opcache.enable_cli] = 1
 246         php_value[opcache.interned_strings_buffer] = 8
 247         php_value[opcache.max_accelerated_files] = 10000
 248         php_value[opcache.memory_consumption] = 128
 249         php_value[opcache.save_comments] = 1
 250         php_value[opcache.revalidate_freq] = 1
 251         php_admin_value[memory_limit] = 512M
 252
 253         php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp"
 254         php_admin_value[session.save_path] = "${varDir}/phpSessions"
 255         '';
 256     };
 257   };
 258 in
 259   nextcloud