infrastructure/machines/public-cof/nextcloud.nix

{ config, ... }:
{
  services.nextcloud = {
    enable = true;
    hostName = "nuage.beta.rz.ens.wtf";
    https = true;

    config = {
      overwriteProtocol = "https";

      dbtype = "pgsql";
      dbhost = "/run/postgresql";

      dbpassFile = config.age.secrets.nextcloudDatabasePassword.path;
      adminpassFile = config.age.secrets.nextcloudAdminPassword.path;

      defaultPhoneRegion = "FR";
    };
  };

  services.nginx = {
    virtualHosts = {
      "nuage.beta.rz.ens.wtf" = {
        forceSSL = true;
        enableACME = true;
      };
    };
  };

  services.postgresql = {
    enable = true;

    ensureDatabases = [ "nextcloud" ];
    ensureUsers = [
      { name = "nextcloud";
        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
      }
    ];
  };

  systemd.services."nextcloud-setup" = {
    requires = [ "postgresql.service" ];
    after = [ "postgresql.service" ];
  };

  networking.firewall.allowedTCPPorts = [ 80 443 ];
}