From 760b14b7959f806260bf2732a9da595eb4c8e4f8 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Tue, 28 Jul 2026 18:02:03 +0200 Subject: [PATCH 1/6] nextcloud: fix email conf --- hosts/vm/nextcloud/nextcloud.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index 0636726..c77cf3b 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -42,8 +42,12 @@ # hodaur "172.16.10.145" ]; - }; + mail_domain = "crans.org"; + mail_from_address = "root"; + mail_smtphost = "smtp.crans.org"; + mail_smtpport = 25; + }; appstoreEnable = true; extraAppsEnable = true; From 932e7ecc17d74b48cc7ae35c679d69a6fae3101f Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Mon, 3 Aug 2026 19:01:31 +0200 Subject: [PATCH 2/6] nextcloud: ajout CORS pour wiki --- hosts/vm/nextcloud/nextcloud.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index c77cf3b..ae17b0a 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -52,4 +52,17 @@ appstoreEnable = true; extraAppsEnable = true; }; + + # Activation CORS pour récuppérer les agendas depuis le wiki + services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig = + '' + add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + if ($request_method = 'OPTIONS') { + add_header 'Access-Control-Max-Age' 86400; + add_header 'Content-Type' 'text/plain; charset=utf-8'; + add_header 'Content-Length' 0; + return 204; + } + ''; } From eafe7b8e0ba1b6f20fe3dba154a7384ba04eefe2 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Mon, 3 Aug 2026 19:39:57 +0200 Subject: [PATCH 3/6] nextcloud: fix headers [add_header_redefinition] --- hosts/vm/nextcloud/nextcloud.nix | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index ae17b0a..11dba6e 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -54,11 +54,24 @@ }; # Activation CORS pour récuppérer les agendas depuis le wiki + # On est obligé de répéter les headers communs de sécurité car ils ne sont pas au même niveau + # https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig = + let + base_headers = '' + add_header X-Content-Type-Options nosniff; + add_header X-Robots-Tag noindex, nofollow; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options sameorigin; + add_header Referrer-Policy no-referrer; + add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + ''; + in '' - add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; - add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + ${base_headers} if ($request_method = 'OPTIONS') { + ${base_headers} add_header 'Access-Control-Max-Age' 86400; add_header 'Content-Type' 'text/plain; charset=utf-8'; add_header 'Content-Length' 0; From 1f96169d8cf217701a87f2e111f35ab7e43df074 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Tue, 4 Aug 2026 11:55:09 +0200 Subject: [PATCH 4/6] =?UTF-8?q?nextcloud:=20CORS=20(cette=20fois=20c?= =?UTF-8?q?=E2=80=99est=20la=20bonne)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hosts/vm/nextcloud/nextcloud.nix | 31 +++++++------------------------ 1 file changed, 7 insertions(+), 24 deletions(-) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index 11dba6e..b4d125d 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -54,28 +54,11 @@ }; # Activation CORS pour récuppérer les agendas depuis le wiki - # On est obligé de répéter les headers communs de sécurité car ils ne sont pas au même niveau - # https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md - services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig = - let - base_headers = '' - add_header X-Content-Type-Options nosniff; - add_header X-Robots-Tag noindex, nofollow; - add_header X-Permitted-Cross-Domain-Policies none; - add_header X-Frame-Options sameorigin; - add_header Referrer-Policy no-referrer; - add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; - add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; - ''; - in - '' - ${base_headers} - if ($request_method = 'OPTIONS') { - ${base_headers} - add_header 'Access-Control-Max-Age' 86400; - add_header 'Content-Type' 'text/plain; charset=utf-8'; - add_header 'Content-Length' 0; - return 204; - } - ''; + # TODO: à mettre que sur /remote.php/dav/public-calendars/ pour éviter des requêtes malveillantes depuis le wiki. + services.nginx.virtualHosts.${config.services.nextcloud.hostName}.extraConfig = '' + add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; + add_header 'Access-Control-Allow-Methods' 'GET' always; + add_header 'Access-Control-Allow-Credentials' 'false' always; + add_header 'Vary' 'Origin' always; + ''; } From 75603387c7e2953eb811d9394a9fe33d96bab900 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 9 Aug 2026 15:07:55 +0200 Subject: [PATCH 5/6] nextcloud: force https --- hosts/vm/nextcloud/nextcloud.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index b4d125d..e0e0bf1 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -20,7 +20,7 @@ configureRedis = true; hostName = "nextcloud.crans.org"; - https = false; + https = true; maxUploadSize = "4G"; From 935dce826d84eb38ca68a79600f39a3197bd63c2 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Wed, 19 Aug 2026 22:42:20 +0200 Subject: [PATCH 6/6] nginx: set real ip --- modules/services/nginx.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/modules/services/nginx.nix b/modules/services/nginx.nix index b15423d..ec78fdd 100644 --- a/modules/services/nginx.nix +++ b/modules/services/nginx.nix @@ -6,5 +6,13 @@ recommendedOptimisation = true; clientMaxBodySize = "512M"; + + # On trust nos ip internes pour bien indiquer le client au bout + # i.e. on considère pas le reverseproxy comme notre client + appendHttpConfig = '' + set_real_ip_from 172.16.0.0/16; + set_real_ip_from fd00::/56; + real_ip_header X-Real-Ip; + ''; }; }