69 lines
2.1 KiB
Nix
69 lines
2.1 KiB
Nix
{config, pkgs, ...}:
|
|
let
|
|
nextcloud = config.services.nextcloud;
|
|
secrets = config.sops.secrets;
|
|
sops = config.sops;
|
|
in {
|
|
sops.secrets = {
|
|
"nextcloud/admin_password" = {
|
|
owner = "nextcloud";
|
|
};
|
|
"nextcloud/oidc_client_secret" = {};
|
|
};
|
|
sops.templates = {
|
|
"nextcloud/secrets.json" = {
|
|
owner = "nextcloud";
|
|
content = builtins.toJSON {
|
|
oidc_login_client_secret = sops.placeholder."nextcloud/oidc_client_secret";
|
|
};
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [ ffmpeg ];
|
|
|
|
services.nextcloud = {
|
|
enable = true;
|
|
https = true;
|
|
configureRedis = true;
|
|
config = {
|
|
adminpassFile = secrets."nextcloud/admin_password".path;
|
|
};
|
|
secretFile = sops.templates."nextcloud/secrets.json".path;
|
|
settings = {
|
|
trusted_proxies = ["192.168.1.2"];
|
|
maintenance_window_start = 2;
|
|
default_phone_region = "GB";
|
|
# https://github.com/pulsejet/nextcloud-oidc-login
|
|
oidc_login_provider_url = "https://auth.tristans.cloud/application/o/nextcloud/";
|
|
oidc_login_client_id = "Fo0OMWCHBlJNw5DsEI0IzeCk0HpU1TIZpy3D5Tix";
|
|
oidc_login_button_text = "Log in with Authentik";
|
|
oidc_login_use_id_token = true;
|
|
oidc_login_attributes = {
|
|
id = "preferred_username";
|
|
name = "name";
|
|
mail = "email";
|
|
groups = "groups";
|
|
is_admin = "NextcloudAdmin";
|
|
login_filter = "groups";
|
|
};
|
|
oidc_login_filter_allowed_values = {
|
|
"0" = "Nextcloud users";
|
|
};
|
|
oidc_login_use_external_storage = false;
|
|
oidc_login_scope = "email openid profile NextcloudAdmin";
|
|
oidc_login_proxy_ldap = false;
|
|
oidc_login_disable_registration = false;
|
|
oidc_login_redir_fallback = false;
|
|
oidc_login_tls_verify = true;
|
|
oidc_create_groups = true;
|
|
oidc_login_webdav_enabled = true;
|
|
oidc_login_public_key_caching_time = 604800;
|
|
oidc_login_min_time_between_jwks_requests = 10;
|
|
oidc_login_well_known_caching_time = 86400;
|
|
};
|
|
};
|
|
services.nginx.virtualHosts.${nextcloud.hostName} = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
};
|
|
}
|