virtual/modules/websites/tools/cloud/nextcloud.nix

   1 { stdenv, fetchurl, checkEnv, writeText, lib, phpPackages, php }:
   2 let
   3   nextcloud = let
   4     # FIXME: initial sync
   5     # FIXME: backup
   6     buildApp = { appName, version, url, sha256, installPhase ? "mkdir -p $out && cp -R . $out/" }:
   7       stdenv.mkDerivation rec {
   8         name = "nextcloud-app-${appName}-${version}";
   9         inherit version;
  10         phases = "unpackPhase installPhase";
  11         inherit installPhase;
  12         src = fetchurl { inherit url sha256; };
  13       };
  14     apps = {
  15       # FIXME: nextcloud complains that he cannot write into config
  16       # directory when an app needs upgrade
  17       # /!\ Attention, just changing the version number is not
  18       # sufficient when the downloaded file doesn’t contain the version
  19       # number in it, sha256 needs to be recomputed
  20       audioplayer = buildApp rec {
  21         appName = "audioplayer";
  22         version = "2.5.0";
  23         url = "https://github.com/Rello/${appName}/releases/download/${version}/${appName}-${version}.tar.gz";
  24         sha256 = "1pg4y51cv3agy28n4gfc8i7x1ya1yijxrmhpblm1n846vhmwdcm8";
  25       };
  26       bookmarks = buildApp rec {
  27         appName = "bookmarks";
  28         version = "0.14.3";
  29         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}-${version}.tar.gz";
  30         sha256 = "0s7lkcl70izlkihnml1par0cac0wvckllyyga3jkb7k9vdg7d40c";
  31       };
  32       calendar = buildApp rec {
  33         appName = "calendar";
  34         version = "1.6.4";
  35         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  36         sha256 = "00dijvcvy7snsjslfbyzvpp9anhms22zp1f0zkj89ln33jmana63";
  37       };
  38       contacts = buildApp rec {
  39         appName = "contacts";
  40         version = "3.0.0";
  41         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  42         sha256 = "0fafy5kgzr5ldr3hxxxgmnw4y3qpjnv5ha1f1dlmqbc65s8frw7s";
  43       };
  44       deck = buildApp rec {
  45         appName = "deck";
  46         version = "0.5.2";
  47         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  48         sha256 = "1kygzixxdkp3dbma009p3pw0fj8wgcqcv39n7pay78lh6zi3nic7";
  49       };
  50       files_markdown = buildApp rec {
  51         appName = "files_markdown";
  52         version = "2.0.5";
  53         url = "https://github.com/icewind1991/${appName}/releases/download/v${version}/${appName}.tar.gz";
  54         sha256 = "1dzvy4c6vff2qmkwqw13dx92xdkafaxgnipswjw44mh0ncc2n9ym";
  55       };
  56       gpxedit = buildApp rec {
  57         appName = "gpxedit";
  58         version = "0.0.10";
  59         url = "https://gitlab.com/eneiluj/gpxedit-oc/wikis/uploads/33d187268c5f6f6a55350d656305701c/${appName}-${version}.tar.gz";
  60         sha256 = "0ynpaxm0xhvcj8xax6rm1w0p6j57wbqidhi7bhn268n483gwl2sw";
  61       };
  62       gpxpod = buildApp rec {
  63         appName = "gpxpod";
  64         version = "3.0.0";
  65         url = "https://gitlab.com/eneiluj/gpxpod-oc/-/archive/v${version}/${appName}-oc-v${version}.tar.gz";
  66         sha256 = "0smpi4r3z7zfl1612fb30cwm1xmpiq95c81zzqiwzjf288iys74k";
  67       };
  68       keeweb = buildApp rec {
  69         appName = "keeweb";
  70         version = "0.4.0";
  71         url = "https://github.com/jhass/nextcloud-keeweb/releases/download/v${version}/${appName}-${version}.tar.gz";
  72         sha256 = "0453kkb0a8vfivmibpwpx4bvhyn64jhns6cdfjacmnvbm6d75nj1";
  73       };
  74       notes = buildApp rec {
  75         appName = "notes";
  76         version = "2.5.1";
  77         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  78         sha256 = "1albzqqsdirzyw8vhvs7r0qm2wqp8vm9vmxm4crhncd85bk01hmh";
  79       };
  80       ocsms = buildApp rec {
  81         appName = "ocsms";
  82         version = "2.1.0";
  83         url = "https://github.com/nextcloud/${appName}/releases/download/${version}/${appName}-${version}.tar.gz";
  84         sha256 = "19xgs82js4sdf6j9478vg9li7za7csvcaa1hbq9nmrq441sbxk9c";
  85       };
  86       spreed = buildApp rec {
  87         appName = "spreed";
  88         version = "5.0.0";
  89         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}-${version}.tar.gz";
  90         sha256 = "1d48mak1fnf1b28r2687yqamm4pxfg3qyxcj9ny31a6xg2cm0xa7";
  91       };
  92       tasks = buildApp rec {
  93         appName = "tasks";
  94         version = "0.9.8";
  95         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  96         sha256 = "089m124lfsfk09fqj50x9n7zndq97jp5afgb8s001rpmzym4g6ny";
  97       };
  98     };
  99   in rec {
 100     varDir = "/var/lib/nextcloud";
 101     config_php =
 102       assert checkEnv "NIXOPS_NEXTCLOUD_PASSWORD_SALT";
 103       assert checkEnv "NIXOPS_NEXTCLOUD_DB_USER";
 104       assert checkEnv "NIXOPS_NEXTCLOUD_DB_PASSWORD";
 105       assert checkEnv "NIXOPS_NEXTCLOUD_INSTANCE_ID";
 106       assert checkEnv "NIXOPS_NEXTCLOUD_SECRET";
 107       assert checkEnv "NIXOPS_NEXTCLOUD_REDIS_DB_INDEX";
 108       writeText "config.php" ''
 109       <?php
 110       $CONFIG = array (
 111         'instanceid' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_INSTANCE_ID"}',
 112         'datadirectory' => '/var/lib/nextcloud/',
 113         'passwordsalt' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_PASSWORD_SALT"}',
 114         'debug' => false,
 115         'dbtype' => 'pgsql',
 116         'version' => '15.0.0.10',
 117         'dbname' => 'webapps',
 118         'dbhost' => '/run/postgresql',
 119         'dbtableprefix' => 'oc_',
 120         'dbuser' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_DB_USER"}',
 121         'dbpassword' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_DB_PASSWORD"}',
 122         'installed' => true,
 123         'maxZipInputSize' => 0,
 124         'allowZipDownload' => true,
 125         'forcessl' => true,
 126         'theme' => ${"''"},
 127         'maintenance' => false,
 128         'trusted_domains' =>
 129         array (
 130           0 => 'cloud.immae.eu',
 131         ),
 132         'secret' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_SECRET"}',
 133         'appstoreenabled' => false,
 134         'appstore.experimental.enabled' => true,
 135         'loglevel' => 0,
 136         'trashbin_retention_obligation' => 'auto',
 137         'htaccess.RewriteBase' => '/',
 138         'mail_smtpmode' => 'smtp',
 139         'mail_smtphost' => 'mail.immae.eu',
 140         'mail_smtpname' => ${"''"},
 141         'mail_smtppassword' => ${"''"},
 142         'mail_from_address' => 'owncloud',
 143         'mail_smtpauth' => false,
 144         'mail_domain' => 'immae.eu',
 145         'memcache.local' => '\\OC\\Memcache\\APCu',
 146         'memcache.locking' => '\\OC\\Memcache\\Redis',
 147         'filelocking.enabled' => true,
 148         'redis' =>
 149         array (
 150           'host' => 'localhost',
 151           'port' => 6379,
 152           'dbindex' => ${builtins.getEnv "NIXOPS_NEXTCLOUD_REDIS_DB_INDEX"},
 153         ),
 154         'overwrite.cli.url' => 'https://cloud.immae.eu',
 155         'ldapIgnoreNamingRules' => false,
 156         'ldapProviderFactory' => '\\OCA\\User_LDAP\\LDAPProviderFactory',
 157         'config_is_read_only' => true,
 158       );
 159       '';
 160     config = stdenv.mkDerivation rec {
 161       name = "nextcloud-config";
 162       src = ./nextcloud-config;
 163       phases = "installPhase";
 164       installPhase = ''
 165         mkdir -p $out
 166         cp -r $src/* $out
 167         cp ${config_php} $out/config.php
 168       '';
 169     };
 170     webRoot = stdenv.mkDerivation rec {
 171       name = "nextcloud-${version}";
 172       version = "15.0.0";
 173
 174       src = fetchurl {
 175         url = "https://download.nextcloud.com/server/releases/${name}.tar.bz2";
 176         sha256 = "0y7bk1588n5rmmranmmrkajh50074460hr4v052ahg9mf60wbc2v";
 177       };
 178
 179       installPhase = ''
 180         mkdir -p $out/
 181         cp -R . $out/
 182         rm -r $out/config
 183         ln -sf ${config} $out/config
 184         ${builtins.concatStringsSep "\n" (
 185           lib.attrsets.mapAttrsToList (name: value: "ln -sf ${value} $out/apps/${name}") apps
 186         )}
 187       '';
 188
 189       meta = {
 190         description = "Sharing solution for files, calendars, contacts and more";
 191         homepage = https://nextcloud.com;
 192         maintainers = with lib.maintainers; [ schneefux bachp globin fpletz ];
 193         license = lib.licenses.agpl3Plus;
 194         platforms = with lib.platforms; unix;
 195       };
 196     };
 197     activationScript = {
 198       deps = [ ];
 199       text = ''
 200         install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir}
 201         install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
 202       '';
 203     };
 204     apache = {
 205       user = "wwwrun";
 206       group = "wwwrun";
 207       modules = [ "proxy_fcgi" ];
 208       vhostConf = ''
 209         SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
 210         <Directory ${webRoot}>
 211           AcceptPathInfo On
 212           DirectoryIndex index.php
 213           Options FollowSymlinks
 214           Require all granted
 215           AllowOverride all
 216
 217           <IfModule mod_headers.c>
 218             Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
 219           </IfModule>
 220           <FilesMatch "\.php$">
 221             CGIPassAuth on
 222             SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
 223           </FilesMatch>
 224
 225         </Directory>
 226
 227         '';
 228     };
 229     phpFpm = rec {
 230       basedir = builtins.concatStringsSep ":" (
 231         [ webRoot varDir config ]
 232         ++ lib.attrsets.mapAttrsToList (name: value: value) apps);
 233       socket = "/var/run/phpfpm/nextcloud.sock";
 234       phpConfig = ''
 235         extension=${phpPackages.redis}/lib/php/extensions/redis.so
 236         extension=${phpPackages.apcu}/lib/php/extensions/apcu.so
 237         zend_extension=${php}/lib/php/extensions/opcache.so
 238         '';
 239       pool = ''
 240         listen = ${socket}
 241         user = ${apache.user}
 242         group = ${apache.group}
 243         listen.owner = ${apache.user}
 244         listen.group = ${apache.group}
 245         pm = ondemand
 246         pm.max_children = 60
 247         pm.process_idle_timeout = 60
 248
 249         php_admin_value[output_buffering] = 0
 250         php_admin_value[max_execution_time] = 1800
 251         php_admin_value[zend_extension] = "opcache"
 252         php_value[opcache.enable] = 1
 253         php_value[opcache.enable_cli] = 1
 254         php_value[opcache.interned_strings_buffer] = 8
 255         php_value[opcache.max_accelerated_files] = 10000
 256         php_value[opcache.memory_consumption] = 128
 257         php_value[opcache.save_comments] = 1
 258         php_value[opcache.revalidate_freq] = 1
 259         php_admin_value[memory_limit] = 512M
 260
 261         php_admin_value[open_basedir] = "${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp"
 262         php_admin_value[session.save_path] = "${varDir}/phpSessions"
 263         '';
 264     };
 265   };
 266 in
 267   nextcloud