Lillian-Violet/NixOS-Config
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Let's try this found config

Browse source
This commit is contained in:
Lillian-Violet 2023-11-23 14:35:01 +01:00
parent fdc9d967c8
commit cfd200ca2f
2 changed files with 89 additions and 106 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
nixos/queen/configuration.nix
View file

@ -53,9 +53,7 @@
#Set up sops config, and configure where the keyfile is, then set the mode for the unencrypted keys #Set up sops config, and configure where the keyfile is, then set the mode for the unencrypted keys
sops.defaultSopsFile = ../../secrets/queen-Lillian.yaml; sops.defaultSopsFile = ../../secrets/queen-Lillian.yaml;
sops.age.keyFile = ./keys.txt; sops.age.keyFile = ./keys.txt;
sops.secrets."nextcloudadmin".mode = "0400"; sops.secrets."nextclouddb".mode = "0440";
sops.secrets."nextcloudadmin".owner = config.users.users.nextcloud.name;
sops.secrets."nextclouddb".mode = "0400";
sops.secrets."nextclouddb".owner = config.users.users.nextcloud.name; sops.secrets."nextclouddb".owner = config.users.users.nextcloud.name;
nix = { nix = {

191
nixos/queen/nextcloud.nix
View file

@ -1,123 +1,108 @@
# Nextcloud
{ {
inputs,
outputs,
lib,
config, config,
lib,
pkgs, pkgs,
sops,
... ...
}: { }: {
#this came from https://jacobneplokh.com/how-to-setup-nextcloud-on-nixos/ sops.secrets.nextcloudadmin = {
services.nginx = { mode = "0440";
enable = true; owner = config.users.users.nextcloud.name;
group = config.users.users.nextcloud.group;
# Use recommended settings
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
# Only allow PFS-enabled ciphers with AES256
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
# Setup Nextcloud virtual host to listen on ports
virtualHosts = {
"nextcloud.gladtherescake.eu" = {
## Force HTTP redirect to HTTPS
forceSSL = true;
## LetsEncrypt
enableACME = true;
};
};
}; };
users.users.nextcloud.extraGroups = ["render" "users"];
environment.systemPackages = with pkgs; [
unstable.exiftool
ffmpeg
nodejs_18
];
# Allow using /dev/dri for Memories
systemd.services.phpfpm-nextcloud.serviceConfig = {
PrivateDevices = lib.mkForce false;
};
services.nginx.virtualHosts."nextcloud.gladtherescake.eu".listen = [
{
addr = "127.0.0.1";
port = 8180;
}
];
services.nextcloud = { services.nextcloud = {
enable = true; enable = true;
hostName = "nextcloud.gladtherescake.eu";
# Use HTTPS for links
https = true;
# Auto-update Nextcloud Apps
autoUpdateApps.enable = true;
# Set what time makes sense for you
autoUpdateApps.startAt = "05:00:00";
configureRedis = true;
package = pkgs.nextcloud27; package = pkgs.nextcloud27;
hostName = "nextcloud.gladtherescake.eu";
#Directory for the data is /var/lib/nextcloud database.createLocally = true;
configureRedis = true;
appstoreEnable = true;
config = { config = {
# Further forces Nextcloud to use HTTPS adminuser = "nextcloud";
overwriteProtocol = "https"; adminpassFile = "${config.sops.secrets.nextcloudadmin.path}";
# Nextcloud PostegreSQL database configuration, recommended over using SQLite
dbtype = "mysql"; dbtype = "mysql";
dbuser = "nextcloud"; defaultPhoneRegion = "US";
dbhost = "mysql"; trustedProxies = ["127.0.0.1"];
dbname = "NC"; };
#dbpassFile = config.sops.secrets."nextclouddb".path;
adminpassFile = config.sops.secrets."nextcloudadmin".path; extraOptions = {
adminuser = "gladtherescake"; mail_smtpmode = "sendmail";
mail_sendmailmode = "pipe";
mysql.utf8mb4 = true;
};
phpOptions = {
"opcache.interned_strings_buffer" = "16";
"upload_max_filesize" = "10G";
"post_max_size" = "10G";
"memory_limit" = "8G";
}; };
}; };
services.mysql = { services.traefik.dynamicConfigOptions.http.routers.nextcloud = {
settings = { rule = "Host(`nextcloud.gladtherescake.eu`)";
server = { service = "nextcloud";
skip_name_resolve = 1; middlewares = ["headers"];
innodb_buffer_pool_size = "128M"; entrypoints = ["websecure"];
innodb_buffer_pool_instances = 1; tls = {
innodb_flush_log_at_trx_commit = 2; certResolver = "le";
innodb_log_buffer_size = "32M"; };
innodb_max_dirty_pages_pct = 90; };
query_cache_type = 1;
query_cache_limit = "2M"; services.traefik.dynamicConfigOptions.http.services.nextcloud = {
query_cache_min_res_unit = "2k"; loadBalancer = {
query_cache_size = "64M"; servers = [
tmp_table_size = "64M"; {
max_heap_table_size = "64M"; url = "http://localhost:8180";
slow_query_log = 1; }
long_query_time = 1; ];
}; };
mysqld = { };
port = 3306;
character_set_server = "utf8mb4"; systemd.timers."nextcloud-files-update" = {
collation_server = "utf8mb4_general_ci"; wantedBy = ["timers.target"];
transaction_isolation = "READ-COMMITTED"; timerConfig = {
binlog_format = "ROW"; OnBootSec = "2m";
innodb_large_prefix = "on"; OnUnitActiveSec = "15m";
innodb_file_format = "barracuda"; Unit = "nextcloud-files-update.service";
innodb_file_per_table = 1; };
}; };
systemd.services."nextcloud-files-update" = {
bindsTo = ["mysql.service" "phpfpm-nextcloud.service"];
after = ["mysql.service" "phpfpm-nextcloud.service"];
script = ''
${config.services.nextcloud.occ}/bin/nextcloud-occ files:scan -q --all
${config.services.nextcloud.occ}/bin/nextcloud-occ preview:pre-generate
'';
serviceConfig = {
User = "nextcloud";
}; };
enable = true; path = ["config.services.nextcloud" pkgs.perl];
package = pkgs.mariadb_110;
#Directory for the database is /var/lib/mysql
# Ensure the database, user, and permissions always exist
ensureDatabases = ["NC"];
ensureUsers = [
{
name = "nextcloud";
ensurePermissions = {
"NC.*" = "ALL PRIVILEGES";
};
}
];
};
systemd.services."sops-nix.service" = {
before = ["nextcloud-setup.service" "mysql.service"];
};
systemd.services."nextcloud-setup" = {
requires = ["mysql.service"];
after = ["mysql.service"];
}; };
} }