mirror of https://gitlab.crans.org/nounous/nixos
Pyjacpp
commit
39d4a9128b
|
|
@ -1,4 +1,4 @@
|
|||
{ pkgs, ... }:
|
||||
{ pkgs, config, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
|
|
@ -28,13 +28,80 @@
|
|||
resticClient.enable = false;
|
||||
};
|
||||
|
||||
services.autofs = {
|
||||
enable = true;
|
||||
services.autofs =
|
||||
let
|
||||
autoMaster = pkgs.writeScript "home-nextcloud" ''
|
||||
#!/usr/bin/env bash
|
||||
USER=$(echo $1 | sed "s/_[1-9]*$//")
|
||||
|
||||
autoMaster = ''
|
||||
/home-nextcloud /etc/auto.master.d/home-nextcloud.sh -t60
|
||||
'';
|
||||
};
|
||||
UHOME=/home-adh/$USER
|
||||
|
||||
USERID=$(ldapsearch -LLL -b "dc=crans,dc=org" -H ldap://172.16.10.157 -D "cn=admin,dc=crans,dc=org" -y ${config.age.secrets.nextcloud_ldap_pass.path} "uid=$USER" uidNumber | grep uidNumber | awk '{print $2}')
|
||||
UGROUP=$(ldapsearch -LLL -b "dc=crans,dc=org" -H ldap://172.16.10.157 -D "cn=admin,dc=crans,dc=org" -y ${config.age.secrets.nextcloud_ldap_pass.path} "uid=$USER" gidNumber | grep gidNumber | awk '{print $2}')
|
||||
|
||||
# On quitte si l'utilisateur $USER n'existe pas
|
||||
if [ -z "$USERID" ]; then
|
||||
logger -p local0.error -t autofs "user $USER n'existe pas"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Rafraîchi les stats du dossier
|
||||
ls ''\${UHOME}/NextCloud/ &>/dev/null || /bin/ls ''\${UHOME} &>/dev/null
|
||||
|
||||
# Création du lien symbolique Nextcloud s'il n'existe pas
|
||||
if [ ! -e "''\${UHOME}/NextCloud" ] || ! (
|
||||
find ''\${UHOME}/NextCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
|
||||
grep -q ''\${UHOME}/NextCloud/
|
||||
); then
|
||||
if [ ! -e "''\${UHOME}/NextCloud" ]; then
|
||||
ln -fs OwnCloud ''\${UHOME}/NextCloud
|
||||
fi
|
||||
|
||||
if [ ! -e "''\${UHOME}/NextCloud" ] || ! (
|
||||
find ''\${UHOME}/NextCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
|
||||
grep -q ''\${UHOME}/NextCloud/
|
||||
); then
|
||||
logger -p local0.error -t autofs "impossible de créer le lien symbolique ''\${UHOME}/NextCloud"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
logger -p local0.info -t autofs "Lien symbolique ''\${UHOME}/NextCloud -> ''\${UHOME}/OwnCloud créé"
|
||||
fi
|
||||
|
||||
# Création du dossier OwnCloud s'il n'existe pas ou n'appartient pas a l'utilisateur
|
||||
if [ ! -d "''\${UHOME}/OwnCloud" ] || ! (
|
||||
find ''\${UHOME}/OwnCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
|
||||
grep -q ''\${UHOME}/OwnCloud/
|
||||
); then
|
||||
if [ ! -d "''\${UHOME}/OwnCloud" ]; then
|
||||
mkdir ''\${UHOME}/OwnCloud
|
||||
fi
|
||||
chmod 700 ''\${UHOME}/OwnCloud &&
|
||||
chown $USERID:''\${UGROUP} ''\${UHOME}/OwnCloud
|
||||
|
||||
if [ ! -d "''\${UHOME}/OwnCloud" ] || ! (
|
||||
find ''\${UHOME}/OwnCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
|
||||
grep -q ''\${UHOME}/OwnCloud/
|
||||
); then
|
||||
logger -p local0.error -t autofs "impossible de créer le dossier ''\${UHOME}/OwnCloud"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
logger -p local0.info -t autofs "Dossier ''\${UHOME}/OwnCloud créé"
|
||||
fi
|
||||
|
||||
chmod 750 /home-nextcloud &&
|
||||
chown nextcloud:nextcloud /home-nextcloud &&
|
||||
echo "-fstype=fuse.bindfs,map=$USERID/nextcloud:@$UGROUP/@nextcloud,resolve-symlinks,allow_other :''\${UHOME}/NextCloud"
|
||||
'';
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
|
||||
autoMaster = ''
|
||||
/home-nextcloud ${autoMaster} -t60
|
||||
'';
|
||||
};
|
||||
|
||||
programs.fuse.userAllowOther = true;
|
||||
systemd.services.autofs = {
|
||||
|
|
|
|||
|
|
@ -12,6 +12,10 @@
|
|||
owner = "nextcloud";
|
||||
group = "nextcloud";
|
||||
};
|
||||
# Attention : sensible au retour à la ligne final (il n’en faut pas) !
|
||||
nextcloud_ldap_pass = {
|
||||
file = ../../../secrets/nextcloud/nextcloud_ldap_pass.age;
|
||||
};
|
||||
};
|
||||
|
||||
services.nextcloud = {
|
||||
|
|
@ -20,7 +24,7 @@
|
|||
|
||||
configureRedis = true;
|
||||
hostName = "nextcloud.crans.org";
|
||||
https = false;
|
||||
https = true;
|
||||
|
||||
maxUploadSize = "4G";
|
||||
|
||||
|
|
@ -41,11 +45,26 @@
|
|||
trusted_proxies = [
|
||||
# hodaur
|
||||
"172.16.10.145"
|
||||
# reverseproxy
|
||||
"172.16.10.151"
|
||||
];
|
||||
};
|
||||
|
||||
mail_domain = "crans.org";
|
||||
mail_from_address = "root";
|
||||
mail_smtphost = "smtp.crans.org";
|
||||
mail_smtpport = 25;
|
||||
};
|
||||
|
||||
appstoreEnable = true;
|
||||
extraAppsEnable = true;
|
||||
};
|
||||
|
||||
# Activation CORS pour récuppérer les agendas depuis le wiki
|
||||
# TODO: à mettre que sur /remote.php/dav/public-calendars/ pour éviter des requêtes malveillantes depuis le wiki.
|
||||
services.nginx.virtualHosts.${config.services.nextcloud.hostName}.extraConfig = ''
|
||||
add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always;
|
||||
add_header 'Access-Control-Allow-Methods' 'GET' always;
|
||||
add_header 'Access-Control-Allow-Credentials' 'false' always;
|
||||
add_header 'Vary' 'Origin' always;
|
||||
'';
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,5 +6,13 @@
|
|||
recommendedOptimisation = true;
|
||||
|
||||
clientMaxBodySize = "512M";
|
||||
|
||||
# On trust nos ip internes pour bien indiquer le client au bout
|
||||
# i.e. on considère pas le reverseproxy comme notre client
|
||||
appendHttpConfig = ''
|
||||
set_real_ip_from 172.16.0.0/16;
|
||||
set_real_ip_from fd00::/56;
|
||||
real_ip_header X-Real-Ip;
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,33 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 APVFfA Z+0daNofon4xgikMa0TUQjUgp9jPPrQkOZJuEJDUmzM
|
||||
l/QeEQvggQtfgyrDcs9lRpvuFMEgn9i/wQFpuaVoAZ0
|
||||
-> piv-p256 ewCc3w AzbC2uqqhtetX1z1XlyVxexejzk8tvPNi/3rcGgOyMSZ
|
||||
cpl1dYYvqgkXbpvy0JcVabP7Ftb7cGY+IahV/yyDbhs
|
||||
-> piv-p256 6CL/Pw AixE5HedgCUVyin52g5YHUQFKaSr7hlF9LfsmbQPMf1l
|
||||
loUpO6pz/Qv+F0mSefpCP3IeDeJ/pq5hYlzacdAtlo4
|
||||
-> ssh-ed25519 eOAUSg b49cZWhT7+NLJlrH9EyWu6GPLkST9/T5BGU1azdQoBI
|
||||
dhzYN+L3k8CZRMbVgff1ofqlImyuD19PUGhhsxTHaMY
|
||||
-> ssh-rsa REaZBA
|
||||
CWiPTj/40DTjN2GWUsR92frMYiBP7tfSVADQ/+GCapOMNJD91MGxaiK0IocbJr0P
|
||||
KpOjfdjRDG8KIYszNgaS8XkHn/CUj2KsnRV2WBg3HWSrMdD4quoOxKWbFaU3b38C
|
||||
4mUK8gIkjbJFWFMSTOhAexHGYSRLl7fG/0VmRvc2ibs5CahbPsMbFDKuto7ApYhY
|
||||
e/t5SsYgIkbrNpeTLolO943YCIlU/JVP5XOuEDk1ZlKPRc+igpgqFjsD3LsV56Rr
|
||||
LFrjp4i5wJeA72HeH/S7nP96sAwxyLDHQrWhw3ntM0n2SRRVCVmLqNNOebUL59gy
|
||||
HRHHoZosepmHzMEOHQ+CrIxuYMiUQ/AyMkZmMTjxQsLniakJWI06G54f1+aaA0F9
|
||||
BhwFateWkLBNdkSdwqJpBAzh427yetzp/bac8dcTv45ylgsvCVSDpoew5NLoIuh5
|
||||
I/54NC6Pr5BF0LOW7b2fR9pzk7Rv6hnSxTbeyATeMhh7nTjdcFalUI3Bd1P3RL+i
|
||||
|
||||
-> ssh-ed25519 J/iReg wbkKYkdu/cxnZNEGXH0a5R5jV6cQlMpWFMdQiUpWTiQ
|
||||
cW3rZQMYrzhx93lsxoPhA8AVQLygKytSue3eEF/yxcc
|
||||
-> ssh-ed25519 GNhSGw Hd4AOis8kPKDKrOgRZNj9pG0bHFHgLfJwo6sd1/dSFg
|
||||
07UA5cZbEpf3pA7i04CDX6m9FZF5ahAorfp5GzXJSS4
|
||||
-> ssh-ed25519 eXMAtA hZ278rlg0u1Bp8rkEQGFagLYg3lkXK3uSolnUbIy0Bo
|
||||
k2sPaUhiCCaBUogPxrUk3Fm386DKuR7UBrGMAteykps
|
||||
-> ssh-ed25519 5hXocQ sYQmrGm4eQlgE4Lkn+ZFE4uI6czxM46SMpQHFRedtQU
|
||||
cIFA9Vk091Q5hFUUrjf6PRr/WS7XN1BfgpSOZN1m0xI
|
||||
-> ssh-ed25519 bRHVVA 2n976nXhvJzoFjP+JFe6L1rmCEmTr4YwhTR1rqyA1y4
|
||||
/X27rYKrHUB0Jltxc190yPXCiHlOXX3QEXM52BnON60
|
||||
-> ssh-ed25519 HgW9eA nNf/0O1vh6+uv5i1+HEy6MgF3VUImMru8BFCcJY7R1s
|
||||
fPSK5LcFR6WP25nFvJRs9RatiJ4t/LvIFYqdoOYxu/k
|
||||
--- QKKNQqbCPvtps4QlI3ric0JdAcdJ9g3QkTPj+RUGAis
|
||||
[xqZ†ÿ¥ªSD’ˆcO
ÌfkŠÖý ”N¹± ›;<3B>H]IòÉ£ÖùÎA‘€A
|
||||
Loading…
Reference in New Issue