virtual/modules/websites/tools/cloud/nextcloud.nix

   1 { stdenv, fetchurl, checkEnv, writeText, lib, phpPackages, php }:
   2 let
   3   nextcloud = let
   4     # FIXME: initial sync
   5     # FIXME: backup
   6     buildApp = { appName, version, url, sha256, installPhase ? "mkdir -p $out && cp -R . $out/" }:
   7       stdenv.mkDerivation rec {
   8         name = "nextcloud-app-${appName}-${version}";
   9         inherit version;
  10         phases = "unpackPhase installPhase";
  11         inherit installPhase;
  12         src = fetchurl { inherit url sha256; };
  13       };
  14     apps = {
  15       # FIXME: nextcloud complains that he cannot write into config
  16       # directory when an app needs upgrade
  17       # /!\ Attention, just changing the version number is not
  18       # sufficient when the downloaded file doesn’t contain the version
  19       # number in it, sha256 needs to be recomputed
  20       audioplayer = buildApp rec {
  21         appName = "audioplayer";
  22         version = "2.5.0";
  23         url = "https://github.com/Rello/${appName}/releases/download/${version}/${appName}-${version}.tar.gz";
  24         sha256 = "1pg4y51cv3agy28n4gfc8i7x1ya1yijxrmhpblm1n846vhmwdcm8";
  25       };
  26       bookmarks = buildApp rec {
  27         appName = "bookmarks";
  28         version = "0.14.3";
  29         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}-${version}.tar.gz";
  30         sha256 = "0s7lkcl70izlkihnml1par0cac0wvckllyyga3jkb7k9vdg7d40c";
  31       };
  32       calendar = buildApp rec {
  33         appName = "calendar";
  34         version = "1.6.4";
  35         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  36         sha256 = "00dijvcvy7snsjslfbyzvpp9anhms22zp1f0zkj89ln33jmana63";
  37       };
  38       contacts = buildApp rec {
  39         appName = "contacts";
  40         version = "3.0.0";
  41         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  42         sha256 = "0fafy5kgzr5ldr3hxxxgmnw4y3qpjnv5ha1f1dlmqbc65s8frw7s";
  43       };
  44       deck = buildApp rec {
  45         appName = "deck";
  46         version = "0.5.2";
  47         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  48         sha256 = "1kygzixxdkp3dbma009p3pw0fj8wgcqcv39n7pay78lh6zi3nic7";
  49       };
  50       files_markdown = buildApp rec {
  51         appName = "files_markdown";
  52         version = "2.0.5";
  53         url = "https://github.com/icewind1991/${appName}/releases/download/v${version}/${appName}.tar.gz";
  54         sha256 = "1dzvy4c6vff2qmkwqw13dx92xdkafaxgnipswjw44mh0ncc2n9ym";
  55       };
  56       gpxedit = buildApp rec {
  57         appName = "gpxedit";
  58         version = "0.0.10";
  59         url = "https://gitlab.com/eneiluj/gpxedit-oc/wikis/uploads/33d187268c5f6f6a55350d656305701c/${appName}-${version}.tar.gz";
  60         sha256 = "0ynpaxm0xhvcj8xax6rm1w0p6j57wbqidhi7bhn268n483gwl2sw";
  61       };
  62       gpxpod = buildApp rec {
  63         appName = "gpxpod";
  64         version = "3.0.0";
  65         url = "https://gitlab.com/eneiluj/gpxpod-oc/-/archive/v${version}/${appName}-oc-v${version}.tar.gz";
  66         sha256 = "0smpi4r3z7zfl1612fb30cwm1xmpiq95c81zzqiwzjf288iys74k";
  67       };
  68       keeweb = buildApp rec {
  69         appName = "keeweb";
  70         version = "0.4.0";
  71         url = "https://github.com/jhass/nextcloud-keeweb/releases/download/v${version}/${appName}-${version}.tar.gz";
  72         sha256 = "0453kkb0a8vfivmibpwpx4bvhyn64jhns6cdfjacmnvbm6d75nj1";
  73       };
  74       notes = buildApp rec {
  75         appName = "notes";
  76         version = "2.5.1";
  77         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
  78         sha256 = "1albzqqsdirzyw8vhvs7r0qm2wqp8vm9vmxm4crhncd85bk01hmh";
  79       };
  80       ocsms = buildApp rec {
  81         appName = "ocsms";
  82         version = "2.1.0";
  83         url = "https://github.com/nextcloud/${appName}/releases/download/${version}/${appName}-${version}.tar.gz";
  84         sha256 = "19xgs82js4sdf6j9478vg9li7za7csvcaa1hbq9nmrq441sbxk9c";
  85         installPhase = ''
  86           sed -i -e "/addScript.*devel/d" -e "s@//\(.*addScript.*app.min\)@\1@" templates/main.php
  87           mkdir -p $out
  88           cp -R . $out/
  89           '';
  90       };
  91       spreed = buildApp rec {
  92         appName = "spreed";
  93         version = "5.0.0";
  94         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}-${version}.tar.gz";
  95         sha256 = "1d48mak1fnf1b28r2687yqamm4pxfg3qyxcj9ny31a6xg2cm0xa7";
  96       };
  97       tasks = buildApp rec {
  98         appName = "tasks";
  99         version = "0.9.8";
 100         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
 101         sha256 = "089m124lfsfk09fqj50x9n7zndq97jp5afgb8s001rpmzym4g6ny";
 102       };
 103     };
 104   in rec {
 105     varDir = "/var/lib/nextcloud";
 106     config_php =
 107       assert checkEnv "NIXOPS_NEXTCLOUD_PASSWORD_SALT";
 108       assert checkEnv "NIXOPS_NEXTCLOUD_DB_USER";
 109       assert checkEnv "NIXOPS_NEXTCLOUD_DB_PASSWORD";
 110       assert checkEnv "NIXOPS_NEXTCLOUD_INSTANCE_ID";
 111       assert checkEnv "NIXOPS_NEXTCLOUD_SECRET";
 112       assert checkEnv "NIXOPS_NEXTCLOUD_REDIS_DB_INDEX";
 113       writeText "config.php" ''
 114       <?php
 115       $CONFIG = array (
 116         'instanceid' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_INSTANCE_ID"}',
 117         'datadirectory' => '/var/lib/nextcloud/',
 118         'passwordsalt' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_PASSWORD_SALT"}',
 119         'debug' => false,
 120         'dbtype' => 'pgsql',
 121         'version' => '15.0.0.10',
 122         'dbname' => 'webapps',
 123         'dbhost' => '/run/postgresql',
 124         'dbtableprefix' => 'oc_',
 125         'dbuser' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_DB_USER"}',
 126         'dbpassword' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_DB_PASSWORD"}',
 127         'installed' => true,
 128         'maxZipInputSize' => 0,
 129         'allowZipDownload' => true,
 130         'forcessl' => true,
 131         'theme' => ${"''"},
 132         'maintenance' => false,
 133         'trusted_domains' =>
 134         array (
 135           0 => 'cloud.immae.eu',
 136         ),
 137         'secret' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_SECRET"}',
 138         'appstoreenabled' => false,
 139         'appstore.experimental.enabled' => true,
 140         'loglevel' => 0,
 141         'trashbin_retention_obligation' => 'auto',
 142         'htaccess.RewriteBase' => '/',
 143         'mail_smtpmode' => 'smtp',
 144         'mail_smtphost' => 'mail.immae.eu',
 145         'mail_smtpname' => ${"''"},
 146         'mail_smtppassword' => ${"''"},
 147         'mail_from_address' => 'owncloud',
 148         'mail_smtpauth' => false,
 149         'mail_domain' => 'immae.eu',
 150         'memcache.local' => '\\OC\\Memcache\\APCu',
 151         'memcache.locking' => '\\OC\\Memcache\\Redis',
 152         'filelocking.enabled' => true,
 153         'redis' =>
 154         array (
 155           'host' => 'localhost',
 156           'port' => 6379,
 157           'dbindex' => ${builtins.getEnv "NIXOPS_NEXTCLOUD_REDIS_DB_INDEX"},
 158         ),
 159         'overwrite.cli.url' => 'https://cloud.immae.eu',
 160         'ldapIgnoreNamingRules' => false,
 161         'ldapProviderFactory' => '\\OCA\\User_LDAP\\LDAPProviderFactory',
 162         'config_is_read_only' => true,
 163       );
 164       '';
 165     config = stdenv.mkDerivation rec {
 166       name = "nextcloud-config";
 167       src = ./nextcloud-config;
 168       phases = "installPhase";
 169       installPhase = ''
 170         mkdir -p $out
 171         cp -r $src/* $out
 172         cp ${config_php} $out/config.php
 173       '';
 174     };
 175     webRoot = stdenv.mkDerivation rec {
 176       name = "nextcloud-${version}";
 177       version = "15.0.0";
 178
 179       src = fetchurl {
 180         url = "https://download.nextcloud.com/server/releases/${name}.tar.bz2";
 181         sha256 = "0y7bk1588n5rmmranmmrkajh50074460hr4v052ahg9mf60wbc2v";
 182       };
 183
 184       installPhase = ''
 185         mkdir -p $out/
 186         cp -R . $out/
 187         rm -r $out/config
 188         ln -sf ${config} $out/config
 189         ${builtins.concatStringsSep "\n" (
 190           lib.attrsets.mapAttrsToList (name: value: "ln -sf ${value} $out/apps/${name}") apps
 191         )}
 192       '';
 193
 194       meta = {
 195         description = "Sharing solution for files, calendars, contacts and more";
 196         homepage = https://nextcloud.com;
 197         maintainers = with lib.maintainers; [ schneefux bachp globin fpletz ];
 198         license = lib.licenses.agpl3Plus;
 199         platforms = with lib.platforms; unix;
 200       };
 201     };
 202     activationScript = {
 203       deps = [ ];
 204       text = ''
 205         install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir}
 206         install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
 207       '';
 208     };
 209     apache = {
 210       user = "wwwrun";
 211       group = "wwwrun";
 212       modules = [ "proxy_fcgi" ];
 213       vhostConf = ''
 214         SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
 215         <Directory ${webRoot}>
 216           AcceptPathInfo On
 217           DirectoryIndex index.php
 218           Options FollowSymlinks
 219           Require all granted
 220           AllowOverride all
 221
 222           <IfModule mod_headers.c>
 223             Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
 224           </IfModule>
 225           <FilesMatch "\.php$">
 226             CGIPassAuth on
 227             SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
 228           </FilesMatch>
 229
 230         </Directory>
 231
 232         '';
 233     };
 234     phpFpm = rec {
 235       basedir = builtins.concatStringsSep ":" (
 236         [ webRoot varDir config ]
 237         ++ lib.attrsets.mapAttrsToList (name: value: value) apps);
 238       socket = "/var/run/phpfpm/nextcloud.sock";
 239       phpConfig = ''
 240         extension=${phpPackages.redis}/lib/php/extensions/redis.so
 241         extension=${phpPackages.apcu}/lib/php/extensions/apcu.so
 242         zend_extension=${php}/lib/php/extensions/opcache.so
 243         '';
 244       pool = ''
 245         listen = ${socket}
 246         user = ${apache.user}
 247         group = ${apache.group}
 248         listen.owner = ${apache.user}
 249         listen.group = ${apache.group}
 250         pm = ondemand
 251         pm.max_children = 60
 252         pm.process_idle_timeout = 60
 253
 254         php_admin_value[output_buffering] = 0
 255         php_admin_value[max_execution_time] = 1800
 256         php_admin_value[zend_extension] = "opcache"
 257         php_value[opcache.enable] = 1
 258         php_value[opcache.enable_cli] = 1
 259         php_value[opcache.interned_strings_buffer] = 8
 260         php_value[opcache.max_accelerated_files] = 10000
 261         php_value[opcache.memory_consumption] = 128
 262         php_value[opcache.save_comments] = 1
 263         php_value[opcache.revalidate_freq] = 1
 264         php_admin_value[memory_limit] = 512M
 265
 266         php_admin_value[open_basedir] = "${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp"
 267         php_admin_value[session.save_path] = "${varDir}/phpSessions"
 268         '';
 269     };
 270   };
 271 in
 272   nextcloud