Merge branch 'nextcloud' into 'main'

Nextcloud

See merge request nounous/nixos!80

hosts/vm/nextcloud/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 
 {
   imports = [
@@ -28,11 +28,78 @@
     resticClient.enable = false;
   };
 
-  services.autofs = {
+  services.autofs =
+    let
+      autoMaster = pkgs.writeScript "home-nextcloud" ''
+        #!/usr/bin/env bash
+        USER=$(echo $1 | sed "s/_[1-9]*$//")
+
+        UHOME=/home-adh/$USER
+
+        USERID=$(ldapsearch -LLL -b "dc=crans,dc=org" -H ldap://172.16.10.157 -D "cn=admin,dc=crans,dc=org" -y ${config.age.secrets.nextcloud_ldap_pass.path} "uid=$USER" uidNumber | grep uidNumber | awk '{print $2}')
+        UGROUP=$(ldapsearch -LLL -b "dc=crans,dc=org" -H ldap://172.16.10.157 -D "cn=admin,dc=crans,dc=org" -y ${config.age.secrets.nextcloud_ldap_pass.path} "uid=$USER" gidNumber | grep gidNumber | awk '{print $2}')
+
+        # On quitte si l'utilisateur $USER n'existe pas
+        if [ -z "$USERID" ]; then
+            logger -p local0.error -t autofs "user $USER n'existe pas"
+            exit 1
+        fi
+
+        # Rafraîchi les stats du dossier
+        ls ''\${UHOME}/NextCloud/ &>/dev/null || /bin/ls ''\${UHOME} &>/dev/null
+
+        # Création du lien symbolique Nextcloud s'il n'existe pas
+        if [ ! -e "''\${UHOME}/NextCloud" ] || ! (
+            find ''\${UHOME}/NextCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
+            grep -q ''\${UHOME}/NextCloud/
+        ); then
+            if [ ! -e "''\${UHOME}/NextCloud" ]; then
+                ln -fs OwnCloud ''\${UHOME}/NextCloud
+            fi
+
+            if [ ! -e "''\${UHOME}/NextCloud" ] || ! (
+                find ''\${UHOME}/NextCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
+                grep -q ''\${UHOME}/NextCloud/
+            ); then
+                logger -p local0.error -t autofs "impossible de créer le lien symbolique ''\${UHOME}/NextCloud"
+                exit 1
+            fi
+
+            logger -p local0.info -t autofs "Lien symbolique ''\${UHOME}/NextCloud -> ''\${UHOME}/OwnCloud créé"
+        fi
+
+        # Création du dossier OwnCloud s'il n'existe pas ou n'appartient pas a l'utilisateur
+        if [ ! -d "''\${UHOME}/OwnCloud" ] || ! (
+            find ''\${UHOME}/OwnCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
+            grep -q ''\${UHOME}/OwnCloud/
+        ); then
+            if [ ! -d "''\${UHOME}/OwnCloud" ]; then
+                mkdir ''\${UHOME}/OwnCloud
+            fi
+            chmod 700 ''\${UHOME}/OwnCloud &&
+            chown $USERID:''\${UGROUP} ''\${UHOME}/OwnCloud
+
+            if [ ! -d "''\${UHOME}/OwnCloud" ] || ! (
+                find ''\${UHOME}/OwnCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
+                grep -q ''\${UHOME}/OwnCloud/
+            ); then
+                logger -p local0.error -t autofs "impossible de créer le dossier ''\${UHOME}/OwnCloud"
+                exit 1
+            fi
+
+            logger -p local0.info -t autofs "Dossier ''\${UHOME}/OwnCloud créé"
+        fi
+
+        chmod 750 /home-nextcloud &&
+        chown nextcloud:nextcloud /home-nextcloud &&
+        echo "-fstype=fuse.bindfs,map=$USERID/nextcloud:@$UGROUP/@nextcloud,resolve-symlinks,allow_other :''\${UHOME}/NextCloud"
+      '';
+    in
+    {
       enable = true;
 
       autoMaster = ''
-      /home-nextcloud /etc/auto.master.d/home-nextcloud.sh -t60
+        /home-nextcloud ${autoMaster} -t60
       '';
     };
 

hosts/vm/nextcloud/nextcloud.nix

@@ -12,6 +12,10 @@
       owner = "nextcloud";
       group = "nextcloud";
     };
+    # Attention : sensible au retour à la ligne final (il n’en faut pas) !
+    nextcloud_ldap_pass = {
+      file = ../../../secrets/nextcloud/nextcloud_ldap_pass.age;
+    };
   };
 
   services.nextcloud = {
@@ -20,7 +24,7 @@
 
     configureRedis = true;
     hostName = "nextcloud.crans.org";
-    https = false;
+    https = true;
 
     maxUploadSize = "4G";
 
@@ -41,11 +45,26 @@
       trusted_proxies = [
         # hodaur
         "172.16.10.145"
+        # reverseproxy
+        "172.16.10.151"
       ];
-    };
 
+      mail_domain = "crans.org";
+      mail_from_address = "root";
+      mail_smtphost = "smtp.crans.org";
+      mail_smtpport = 25;
+    };
 
     appstoreEnable = true;
     extraAppsEnable = true;
   };
+
+  # Activation CORS pour récuppérer les agendas depuis le wiki
+  # TODO: à mettre que sur /remote.php/dav/public-calendars/ pour éviter des requêtes malveillantes depuis le wiki.
+  services.nginx.virtualHosts.${config.services.nextcloud.hostName}.extraConfig = ''
+    add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always;
+    add_header 'Access-Control-Allow-Methods' 'GET' always;
+    add_header 'Access-Control-Allow-Credentials' 'false' always;
+    add_header 'Vary' 'Origin' always;
+  '';
 }

modules/services/nginx.nix

@@ -6,5 +6,13 @@
     recommendedOptimisation = true;
 
     clientMaxBodySize = "512M";
+
+    # On trust nos ip internes pour bien indiquer le client au bout
+    # i.e. on considère pas le reverseproxy comme notre client
+    appendHttpConfig = ''
+      set_real_ip_from 172.16.0.0/16;
+      set_real_ip_from fd00::/56;
+      real_ip_header X-Real-Ip;
+    '';
   };
 }

secrets/nextcloud/nextcloud_ldap_pass.age

@@ -0,0 +1,33 @@
+age-encryption.org/v1
+-> ssh-ed25519 APVFfA Z+0daNofon4xgikMa0TUQjUgp9jPPrQkOZJuEJDUmzM
+l/QeEQvggQtfgyrDcs9lRpvuFMEgn9i/wQFpuaVoAZ0
+-> piv-p256 ewCc3w AzbC2uqqhtetX1z1XlyVxexejzk8tvPNi/3rcGgOyMSZ
+cpl1dYYvqgkXbpvy0JcVabP7Ftb7cGY+IahV/yyDbhs
+-> piv-p256 6CL/Pw AixE5HedgCUVyin52g5YHUQFKaSr7hlF9LfsmbQPMf1l
+loUpO6pz/Qv+F0mSefpCP3IeDeJ/pq5hYlzacdAtlo4
+-> ssh-ed25519 eOAUSg b49cZWhT7+NLJlrH9EyWu6GPLkST9/T5BGU1azdQoBI
+dhzYN+L3k8CZRMbVgff1ofqlImyuD19PUGhhsxTHaMY
+-> ssh-rsa REaZBA
+CWiPTj/40DTjN2GWUsR92frMYiBP7tfSVADQ/+GCapOMNJD91MGxaiK0IocbJr0P
+KpOjfdjRDG8KIYszNgaS8XkHn/CUj2KsnRV2WBg3HWSrMdD4quoOxKWbFaU3b38C
+4mUK8gIkjbJFWFMSTOhAexHGYSRLl7fG/0VmRvc2ibs5CahbPsMbFDKuto7ApYhY
+e/t5SsYgIkbrNpeTLolO943YCIlU/JVP5XOuEDk1ZlKPRc+igpgqFjsD3LsV56Rr
+LFrjp4i5wJeA72HeH/S7nP96sAwxyLDHQrWhw3ntM0n2SRRVCVmLqNNOebUL59gy
+HRHHoZosepmHzMEOHQ+CrIxuYMiUQ/AyMkZmMTjxQsLniakJWI06G54f1+aaA0F9
+BhwFateWkLBNdkSdwqJpBAzh427yetzp/bac8dcTv45ylgsvCVSDpoew5NLoIuh5
+I/54NC6Pr5BF0LOW7b2fR9pzk7Rv6hnSxTbeyATeMhh7nTjdcFalUI3Bd1P3RL+i
+
+-> ssh-ed25519 J/iReg wbkKYkdu/cxnZNEGXH0a5R5jV6cQlMpWFMdQiUpWTiQ
+cW3rZQMYrzhx93lsxoPhA8AVQLygKytSue3eEF/yxcc
+-> ssh-ed25519 GNhSGw Hd4AOis8kPKDKrOgRZNj9pG0bHFHgLfJwo6sd1/dSFg
+07UA5cZbEpf3pA7i04CDX6m9FZF5ahAorfp5GzXJSS4
+-> ssh-ed25519 eXMAtA hZ278rlg0u1Bp8rkEQGFagLYg3lkXK3uSolnUbIy0Bo
+k2sPaUhiCCaBUogPxrUk3Fm386DKuR7UBrGMAteykps
+-> ssh-ed25519 5hXocQ sYQmrGm4eQlgE4Lkn+ZFE4uI6czxM46SMpQHFRedtQU
+cIFA9Vk091Q5hFUUrjf6PRr/WS7XN1BfgpSOZN1m0xI
+-> ssh-ed25519 bRHVVA 2n976nXhvJzoFjP+JFe6L1rmCEmTr4YwhTR1rqyA1y4
+/X27rYKrHUB0Jltxc190yPXCiHlOXX3QEXM52BnON60
+-> ssh-ed25519 HgW9eA nNf/0O1vh6+uv5i1+HEy6MgF3VUImMru8BFCcJY7R1s
+fPSK5LcFR6WP25nFvJRs9RatiJ4t/LvIFYqdoOYxu/k
+--- QKKNQqbCPvtps4QlI3ric0JdAcdJ9g3QkTPj+RUGAis
+[xqZ†ÿ¥ªSD’ˆcO
ÌfkŠÖý”N¹±›;<3B>H]IòÉ£ÖùÎA‘€A