infrastructure/machines/nixos/compute01/nextcloud.nix

{
  config,
  pkgs,
  nixpkgs,
  ...
}:

let
  host = "cloud.dgnum.eu";
  nextcloud-occ = "${config.services.nextcloud.occ}/bin/nextcloud-occ";

  port = 9980;
in
{

  services = {
    nextcloud = {
      enable = true;
      hostName = host;

      package = pkgs.nextcloud29;

      https = true;

      config = {
        dbtype = "pgsql";

        adminpassFile = config.age.secrets."nextcloud-adminpass_file".path;
        adminuser = "thubrecht";

        objectstore.s3 = {
          enable = true;

          hostname = "s3.dgnum.eu";
          region = "garage";
          usePathStyle = true;
          port = 443;

          bucket = "nextcloud-dgnum";
          key = "GKda5367c73ca607c349d83c35";
          verify_bucket_exists = false;
          secretFile = config.age.secrets."nextcloud-s3_secret_file".path;
        };
      };

      maxUploadSize = "4G";

      poolSettings = {
        pm = "dynamic";
        "pm.max_children" = 64;
        "pm.max_requests" = "500";
        "pm.max_spare_servers" = "8";
        "pm.min_spare_servers" = "4";
        "pm.start_servers" = "6";
      };

      phpOptions = {
        short_open_tag = "Off";
        expose_php = "Off";
        error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
        display_errors = "stderr";
        "opcache.enable_cli" = "1";
        "opcache.interned_strings_buffer" = "32";
        "opcache.max_accelerated_files" = "10000";
        "opcache.memory_consumption" = "128";
        "opcache.revalidate_freq" = "1";
        "opcache.fast_shutdown" = "0";
        "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
        catch_workers_output = "yes";
      };

      database.createLocally = true;
      configureRedis = true;

      autoUpdateApps.enable = true;

      settings = {
        overwriteprotocol = "https";

        overwritehost = host;
        "overwrite.cli.url" = "https://${host}";
        updatechecker = false;

        default_phone_region = "FR";

        trusted_proxies = [ "::1" ];

        allow_local_remote_servers = true;
        maintenance_window_start = 1;

        "memories.exiftool" = "${pkgs.lib.getExe pkgs.exiftool}";
        "memories.vod.ffmpeg" = "${pkgs.lib.getExe pkgs.ffmpeg-headless}";
        "memories.vod.ffprobe" = "${pkgs.ffmpeg-headless}/bin/ffprobe";
      };
    };

    collabora-online = {
      enable = true;

      inherit port;

      package = nixpkgs.nixos.unstable.collabora-online;

      settings = {
        server_name = "code.dgnum.eu";

        ssl = {
          enable = false;
          termination = true;
        };

        remote_font_config.url = "https://cloud.dgnum.eu/apps/richdocuments/settings/fonts.json";

        net.proto = "IPv4";
      };

      aliasGroups = [ { host = "https://cloud.dgnum.eu"; } ];
    };

    nginx.virtualHosts = {
      ${host} = {
        enableACME = true;
        forceSSL = true;

        extraConfig = ''
          proxy_max_temp_file_size 4096m;
        '';
      };

      "code.dgnum.eu" = {
        forceSSL = true;
        enableACME = true;

        extraConfig = ''
          # static files
          location ^~ /browser {
            proxy_pass http://127.0.0.1:${builtins.toString port};
            proxy_set_header Host $host;
          }

          # WOPI discovery URL
          location ^~ /hosting/discovery {
            proxy_pass http://127.0.0.1:${builtins.toString port};
            proxy_set_header Host $host;
          }

          # Capabilities
          location ^~ /hosting/capabilities {
            proxy_pass http://127.0.0.1:${builtins.toString port};
            proxy_set_header Host $host;
          }

          # main websocket
          location ~ ^/cool/(.*)/ws$ {
            proxy_pass http://127.0.0.1:${builtins.toString port};
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $host;
            proxy_read_timeout 36000s;
          }

          # download, presentation and image upload
          location ~ ^/(c|l)ool {
            proxy_pass http://127.0.0.1:${builtins.toString port};
            proxy_set_header Host $host;
          }

          # Admin Console websocket
          location ^~ /cool/adminws {
            proxy_pass http://127.0.0.1:${builtins.toString port};
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $host;
            proxy_read_timeout 36000s;
          }
        '';
      };
    };
  };

  dgn-web.internalPorts.collabora = port;

  systemd.services = {
    nextcloud-preview = {
      description = "Generate preview for nextcloud media.";
      script = "${nextcloud-occ} preview:pre-generate -vvv";
      startAt = "*-*-* 01:00:00 UTC";
      serviceConfig = {
        Restart = "on-failure";
      };
    };

    nextcloud-cron.path = [ pkgs.perl ];
  };

  environment.systemPackages = [ pkgs.ffmpeg_6-headless ];

  networking.hosts = {
    "129.199.146.148" = [ "s3.dgnum.eu" ];
    "129.199.146.147" = [
      "code.dgnum.eu"
      "cloud.dgnum.eu"
    ];
  };

  age-secrets.autoMatch = [ "nextcloud" ];

  system.activationScripts = {
    restart-nextcloud.text = ''
      if [ "$(${pkgs.systemd}/bin/systemctl is-active phpfpm-nextcloud)" == "active" ]; then
        ${pkgs.systemd}/bin/systemctl restart phpfpm-nextcloud
      fi
    '';
  };

  dgn-backups.jobs.nextcloud.settings.paths = [ "/var/lib/nextcloud" ];
  dgn-backups.postgresDatabases = [ "nextcloud" ];
}