Let's try this found config

nixos/queen/configuration.nix

@@ -53,9 +53,7 @@
   #Set up sops config, and configure where the keyfile is, then set the mode for the unencrypted keys
   sops.defaultSopsFile = ../../secrets/queen-Lillian.yaml;
   sops.age.keyFile = ./keys.txt;
-  sops.secrets."nextcloudadmin".mode = "0400";
+  sops.secrets."nextclouddb".mode = "0440";
-  sops.secrets."nextcloudadmin".owner = config.users.users.nextcloud.name;
-  sops.secrets."nextclouddb".mode = "0400";
   sops.secrets."nextclouddb".owner = config.users.users.nextcloud.name;
 
   nix = {

nixos/queen/nextcloud.nix

@@ -1,123 +1,108 @@
+# Nextcloud
 {
-  inputs,
-  outputs,
-  lib,
   config,
+  lib,
   pkgs,
+  sops,
   ...
 }: {
-  #this came from https://jacobneplokh.com/how-to-setup-nextcloud-on-nixos/
+  sops.secrets.nextcloudadmin = {
-  services.nginx = {
+    mode = "0440";
-    enable = true;
+    owner = config.users.users.nextcloud.name;
-
+    group = config.users.users.nextcloud.group;
-    # Use recommended settings
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-
-    # Only allow PFS-enabled ciphers with AES256
-    sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
-
-    # Setup Nextcloud virtual host to listen on ports
-    virtualHosts = {
-      "nextcloud.gladtherescake.eu" = {
-        ## Force HTTP redirect to HTTPS
-        forceSSL = true;
-        ## LetsEncrypt
-        enableACME = true;
-      };
   };
+
+  users.users.nextcloud.extraGroups = ["render" "users"];
+
+  environment.systemPackages = with pkgs; [
+    unstable.exiftool
+    ffmpeg
+    nodejs_18
+  ];
+
+  # Allow using /dev/dri for Memories
+  systemd.services.phpfpm-nextcloud.serviceConfig = {
+    PrivateDevices = lib.mkForce false;
   };
 
+  services.nginx.virtualHosts."nextcloud.gladtherescake.eu".listen = [
+    {
+      addr = "127.0.0.1";
+      port = 8180;
+    }
+  ];
+
   services.nextcloud = {
     enable = true;
-    hostName = "nextcloud.gladtherescake.eu";
-
-    # Use HTTPS for links
-    https = true;
-
-    # Auto-update Nextcloud Apps
-    autoUpdateApps.enable = true;
-    # Set what time makes sense for you
-    autoUpdateApps.startAt = "05:00:00";
-
-    configureRedis = true;
-
     package = pkgs.nextcloud27;
-
+    hostName = "nextcloud.gladtherescake.eu";
-    #Directory for the data is /var/lib/nextcloud
+    database.createLocally = true;
-
+    configureRedis = true;
+    appstoreEnable = true;
     config = {
-      # Further forces Nextcloud to use HTTPS
+      adminuser = "nextcloud";
-      overwriteProtocol = "https";
+      adminpassFile = "${config.sops.secrets.nextcloudadmin.path}";
-
-      # Nextcloud PostegreSQL database configuration, recommended over using SQLite
       dbtype = "mysql";
-      dbuser = "nextcloud";
+      defaultPhoneRegion = "US";
-      dbhost = "mysql";
+      trustedProxies = ["127.0.0.1"];
-      dbname = "NC";
+    };
-      #dbpassFile = config.sops.secrets."nextclouddb".path;
 
-      adminpassFile = config.sops.secrets."nextcloudadmin".path;
+    extraOptions = {
-      adminuser = "gladtherescake";
+      mail_smtpmode = "sendmail";
+      mail_sendmailmode = "pipe";
+      mysql.utf8mb4 = true;
+    };
+
+    phpOptions = {
+      "opcache.interned_strings_buffer" = "16";
+      "upload_max_filesize" = "10G";
+      "post_max_size" = "10G";
+      "memory_limit" = "8G";
     };
   };
 
-  services.mysql = {
+  services.traefik.dynamicConfigOptions.http.routers.nextcloud = {
-    settings = {
+    rule = "Host(`nextcloud.gladtherescake.eu`)";
-      server = {
+    service = "nextcloud";
-        skip_name_resolve = 1;
+    middlewares = ["headers"];
-        innodb_buffer_pool_size = "128M";
+    entrypoints = ["websecure"];
-        innodb_buffer_pool_instances = 1;
+    tls = {
-        innodb_flush_log_at_trx_commit = 2;
+      certResolver = "le";
-        innodb_log_buffer_size = "32M";
-        innodb_max_dirty_pages_pct = 90;
-        query_cache_type = 1;
-        query_cache_limit = "2M";
-        query_cache_min_res_unit = "2k";
-        query_cache_size = "64M";
-        tmp_table_size = "64M";
-        max_heap_table_size = "64M";
-        slow_query_log = 1;
-        long_query_time = 1;
-      };
-      mysqld = {
-        port = 3306;
-        character_set_server = "utf8mb4";
-        collation_server = "utf8mb4_general_ci";
-        transaction_isolation = "READ-COMMITTED";
-        binlog_format = "ROW";
-        innodb_large_prefix = "on";
-        innodb_file_format = "barracuda";
-        innodb_file_per_table = 1;
     };
   };
 
-    enable = true;
+  services.traefik.dynamicConfigOptions.http.services.nextcloud = {
-
+    loadBalancer = {
-    package = pkgs.mariadb_110;
+      servers = [
-
-    #Directory for the database is /var/lib/mysql
-
-    # Ensure the database, user, and permissions always exist
-    ensureDatabases = ["NC"];
-    ensureUsers = [
         {
-        name = "nextcloud";
+          url = "http://localhost:8180";
-        ensurePermissions = {
-          "NC.*" = "ALL PRIVILEGES";
-        };
         }
       ];
     };
-
-  systemd.services."sops-nix.service" = {
-    before = ["nextcloud-setup.service" "mysql.service"];
   };
 
-  systemd.services."nextcloud-setup" = {
+  systemd.timers."nextcloud-files-update" = {
-    requires = ["mysql.service"];
+    wantedBy = ["timers.target"];
-    after = ["mysql.service"];
+    timerConfig = {
+      OnBootSec = "2m";
+      OnUnitActiveSec = "15m";
+      Unit = "nextcloud-files-update.service";
+    };
+  };
+
+  systemd.services."nextcloud-files-update" = {
+    bindsTo = ["mysql.service" "phpfpm-nextcloud.service"];
+    after = ["mysql.service" "phpfpm-nextcloud.service"];
+    script = ''
+
+      ${config.services.nextcloud.occ}/bin/nextcloud-occ files:scan -q --all
+      ${config.services.nextcloud.occ}/bin/nextcloud-occ preview:pre-generate
+    '';
+
+    serviceConfig = {
+      User = "nextcloud";
+    };
+
+    path = ["config.services.nextcloud" pkgs.perl];
   };
 }