feat(nextcloud): Deploy collabora without docker

machines/nixos/compute01/nextcloud.nix

@@ -1,4 +1,9 @@
-{ config, pkgs, ... }:
+{
+  config,
+  pkgs,
+  nixpkgs,
+  ...
+}:
 
 let
   host = "cloud.dgnum.eu";
@@ -7,182 +12,174 @@ let
   port = 9980;
 in
 {
-  services.nextcloud = {
-    enable = true;
-    hostName = host;
 
-    package = pkgs.nextcloud29;
+  services = {
+    nextcloud = {
+      enable = true;
+      hostName = host;
 
-    https = true;
+      package = pkgs.nextcloud29;
 
-    config = {
+      https = true;
-      dbtype = "pgsql";
 
-      adminpassFile = config.age.secrets."nextcloud-adminpass_file".path;
+      config = {
-      adminuser = "thubrecht";
+        dbtype = "pgsql";
 
-      objectstore.s3 = {
+        adminpassFile = config.age.secrets."nextcloud-adminpass_file".path;
-        enable = true;
+        adminuser = "thubrecht";
 
-        hostname = "s3.dgnum.eu";
+        objectstore.s3 = {
-        region = "garage";
+          enable = true;
-        usePathStyle = true;
-        port = 443;
 
-        bucket = "nextcloud-dgnum";
+          hostname = "s3.dgnum.eu";
-        key = "GKda5367c73ca607c349d83c35";
+          region = "garage";
-        verify_bucket_exists = false;
+          usePathStyle = true;
-        secretFile = config.age.secrets."nextcloud-s3_secret_file".path;
+          port = 443;
+
+          bucket = "nextcloud-dgnum";
+          key = "GKda5367c73ca607c349d83c35";
+          verify_bucket_exists = false;
+          secretFile = config.age.secrets."nextcloud-s3_secret_file".path;
+        };
+      };
+
+      maxUploadSize = "4G";
+
+      poolSettings = {
+        pm = "dynamic";
+        "pm.max_children" = 64;
+        "pm.max_requests" = "500";
+        "pm.max_spare_servers" = "8";
+        "pm.min_spare_servers" = "4";
+        "pm.start_servers" = "6";
+      };
+
+      phpOptions = {
+        short_open_tag = "Off";
+        expose_php = "Off";
+        error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
+        display_errors = "stderr";
+        "opcache.enable_cli" = "1";
+        "opcache.interned_strings_buffer" = "32";
+        "opcache.max_accelerated_files" = "10000";
+        "opcache.memory_consumption" = "128";
+        "opcache.revalidate_freq" = "1";
+        "opcache.fast_shutdown" = "0";
+        "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
+        catch_workers_output = "yes";
+      };
+
+      database.createLocally = true;
+      configureRedis = true;
+
+      autoUpdateApps.enable = true;
+
+      settings = {
+        overwriteprotocol = "https";
+
+        overwritehost = host;
+        "overwrite.cli.url" = "https://${host}";
+        updatechecker = false;
+
+        default_phone_region = "FR";
+
+        trusted_proxies = [ "::1" ];
+
+        allow_local_remote_servers = true;
+        maintenance_window_start = 1;
+
+        "memories.exiftool" = "${pkgs.lib.getExe pkgs.exiftool}";
+        "memories.vod.ffmpeg" = "${pkgs.lib.getExe pkgs.ffmpeg-headless}";
+        "memories.vod.ffprobe" = "${pkgs.ffmpeg-headless}/bin/ffprobe";
       };
     };
 
-    maxUploadSize = "4G";
+    collabora-online = {
-
-    poolSettings = {
-      pm = "dynamic";
-      "pm.max_children" = 64;
-      "pm.max_requests" = "500";
-      "pm.max_spare_servers" = "8";
-      "pm.min_spare_servers" = "4";
-      "pm.start_servers" = "6";
-    };
-
-    phpOptions = {
-      short_open_tag = "Off";
-      expose_php = "Off";
-      error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
-      display_errors = "stderr";
-      "opcache.enable_cli" = "1";
-      "opcache.interned_strings_buffer" = "32";
-      "opcache.max_accelerated_files" = "10000";
-      "opcache.memory_consumption" = "128";
-      "opcache.revalidate_freq" = "1";
-      "opcache.fast_shutdown" = "0";
-      "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
-      catch_workers_output = "yes";
-    };
-
-    database.createLocally = true;
-    configureRedis = true;
-
-    autoUpdateApps.enable = true;
-
-    settings = {
-      overwriteprotocol = "https";
-
-      overwritehost = host;
-      "overwrite.cli.url" = "https://${host}";
-      updatechecker = false;
-
-      default_phone_region = "FR";
-
-      trusted_proxies = [ "::1" ];
-
-      allow_local_remote_servers = true;
-      maintenance_window_start = 1;
-
-      "memories.exiftool" = "${pkgs.lib.getExe pkgs.exiftool}";
-      "memories.vod.ffmpeg" = "${pkgs.lib.getExe pkgs.ffmpeg-headless}";
-      "memories.vod.ffprobe" = "${pkgs.ffmpeg-headless}/bin/ffprobe";
-    };
-  };
-
-  virtualisation = {
-    podman = {
       enable = true;
 
-      defaultNetwork.settings = {
+      inherit port;
-        dns_enable = true;
-        ipv6_enabled = true;
-      };
-    };
-  };
 
-  virtualisation.oci-containers = {
+      package = nixpkgs.nixos.unstable.collabora-online;
-    containers.collabora = {
+
-      image = "collabora/code";
+      settings = {
-      imageFile = pkgs.dockerTools.pullImage {
+        server_name = "code.dgnum.eu";
-        imageName = "collabora/code";
+
-        imageDigest = "sha256:07da8a191b37058514dfdf921ea8c2270c6634fa659acee774cf8594f86950e4";
+        ssl = {
-        sha256 = "sha256-5oaz07NQScHUVN/HznzZGQ2bGrU/V1GhI+9btXHz0GM=";
+          enable = false;
+          termination = true;
+        };
+
+        remote_font_config.url = "https://cloud.dgnum.eu/apps/richdocuments/settings/fonts.json";
+
+        net.proto = "IPv4";
       };
-      ports = [ "${builtins.toString port}:${builtins.toString port}" ];
+
-      environment = {
+      aliasGroups = [ { host = "https://cloud.dgnum.eu"; } ];
-        domain = "cloud.dgnum.eu";
+    };
-        extra_params = "--o:ssl.enable=false --o:ssl.termination=true --o:remote_font_config.url=https://cloud.dgnum.eu/apps/richdocuments/settings/fonts.json";
+
+    nginx.virtualHosts = {
+      ${host} = {
+        enableACME = true;
+        forceSSL = true;
+
+        extraConfig = ''
+          proxy_max_temp_file_size 4096m;
+        '';
+      };
+
+      "code.dgnum.eu" = {
+        forceSSL = true;
+        enableACME = true;
+
+        extraConfig = ''
+          # static files
+          location ^~ /browser {
+            proxy_pass http://127.0.0.1:${builtins.toString port};
+            proxy_set_header Host $host;
+          }
+
+          # WOPI discovery URL
+          location ^~ /hosting/discovery {
+            proxy_pass http://127.0.0.1:${builtins.toString port};
+            proxy_set_header Host $host;
+          }
+
+          # Capabilities
+          location ^~ /hosting/capabilities {
+            proxy_pass http://127.0.0.1:${builtins.toString port};
+            proxy_set_header Host $host;
+          }
+
+          # main websocket
+          location ~ ^/cool/(.*)/ws$ {
+            proxy_pass http://127.0.0.1:${builtins.toString port};
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "Upgrade";
+            proxy_set_header Host $host;
+            proxy_read_timeout 36000s;
+          }
+
+          # download, presentation and image upload
+          location ~ ^/(c|l)ool {
+            proxy_pass http://127.0.0.1:${builtins.toString port};
+            proxy_set_header Host $host;
+          }
+
+          # Admin Console websocket
+          location ^~ /cool/adminws {
+            proxy_pass http://127.0.0.1:${builtins.toString port};
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "Upgrade";
+            proxy_set_header Host $host;
+            proxy_read_timeout 36000s;
+          }
+        '';
       };
-      extraOptions = [
-        "--network=host"
-        "--cap-add"
-        "MKNOD"
-        "--cap-add"
-        "SYS_ADMIN"
-      ];
     };
   };
 
   dgn-web.internalPorts.collabora = port;
 
-  services.nginx.virtualHosts = {
-    ${host} = {
-      enableACME = true;
-      forceSSL = true;
-
-      extraConfig = ''
-        proxy_max_temp_file_size 4096m;
-      '';
-    };
-
-    "code.dgnum.eu" = {
-      forceSSL = true;
-      enableACME = true;
-
-      extraConfig = ''
-        # static files
-        location ^~ /browser {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
-          proxy_set_header Host $host;
-        }
-
-        # WOPI discovery URL
-        location ^~ /hosting/discovery {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
-          proxy_set_header Host $host;
-        }
-
-        # Capabilities
-        location ^~ /hosting/capabilities {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
-          proxy_set_header Host $host;
-        }
-
-        # main websocket
-        location ~ ^/cool/(.*)/ws$ {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
-          proxy_set_header Upgrade $http_upgrade;
-          proxy_set_header Connection "Upgrade";
-          proxy_set_header Host $host;
-          proxy_read_timeout 36000s;
-        }
-
-        # download, presentation and image upload
-        location ~ ^/(c|l)ool {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
-          proxy_set_header Host $host;
-        }
-
-        # Admin Console websocket
-        location ^~ /cool/adminws {
-          proxy_pass http://127.0.0.1:${builtins.toString port};
-          proxy_set_header Upgrade $http_upgrade;
-          proxy_set_header Connection "Upgrade";
-          proxy_set_header Host $host;
-          proxy_read_timeout 36000s;
-        }
-      '';
-    };
-  };
-
   systemd.services = {
     nextcloud-preview = {
       description = "Generate preview for nextcloud media.";
@@ -200,6 +197,10 @@ in
 
   networking.hosts = {
     "129.199.146.148" = [ "s3.dgnum.eu" ];
+    "129.199.146.147" = [
+      "code.dgnum.eu"
+      "cloud.dgnum.eu"
+    ];
   };
 
   age-secrets.autoMatch = [ "nextcloud" ];

patches/default.nix

@@ -48,6 +48,12 @@ in
       excludes = [ ".git-blame-ignore-revs" ];
       hash = "sha256-ca7CsPuWJqucC77ejsvoDAt+wxWLUP30IdXtZQVQrko=";
     }
+
+    # Add Collabora Online
+    {
+      id = 330708;
+      hash = "sha256-655zkmch5VLXEUzhT6+b7QpywslDoIMZ8mY0II55Wlw=";
+    }
   ];
 
   "nixos-unstable" = [