mirror of https://gitlab.crans.org/nounous/nixos
82 lines
2.3 KiB
Nix
82 lines
2.3 KiB
Nix
{ pkgs, config, ... }:
|
|
|
|
{
|
|
age.secrets = {
|
|
nextcloud_db_pass = {
|
|
file = ../../../secrets/nextcloud/nextcloud_db_pass.age;
|
|
owner = "nextcloud";
|
|
group = "nextcloud";
|
|
};
|
|
nextcloud_admin_pass = {
|
|
file = ../../../secrets/nextcloud/nextcloud_admin_pass.age;
|
|
owner = "nextcloud";
|
|
group = "nextcloud";
|
|
};
|
|
};
|
|
|
|
services.nextcloud = {
|
|
enable = true;
|
|
package = pkgs.nextcloud33;
|
|
|
|
configureRedis = true;
|
|
hostName = "nextcloud.crans.org";
|
|
https = false;
|
|
|
|
maxUploadSize = "4G";
|
|
|
|
config = {
|
|
dbtype = "pgsql";
|
|
dbhost = "tealc.adm.crans.org";
|
|
dbuser = "nextcloud";
|
|
dbpassFile = config.age.secrets.nextcloud_db_pass.path;
|
|
adminpassFile = config.age.secrets.nextcloud_admin_pass.path;
|
|
};
|
|
|
|
phpOptions = {
|
|
"opcache.interned_strings_buffer" = "32";
|
|
"opcache.memory_consumption" = "512";
|
|
};
|
|
|
|
settings = {
|
|
trusted_proxies = [
|
|
# hodaur
|
|
"172.16.10.145"
|
|
];
|
|
|
|
mail_domain = "crans.org";
|
|
mail_from_address = "root";
|
|
mail_smtphost = "smtp.crans.org";
|
|
mail_smtpport = 25;
|
|
};
|
|
|
|
appstoreEnable = true;
|
|
extraAppsEnable = true;
|
|
};
|
|
|
|
# Activation CORS pour récuppérer les agendas depuis le wiki
|
|
# On est obligé de répéter les headers communs de sécurité car ils ne sont pas au même niveau
|
|
# https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
|
|
services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig =
|
|
let
|
|
base_headers = ''
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header X-Robots-Tag noindex, nofollow;
|
|
add_header X-Permitted-Cross-Domain-Policies none;
|
|
add_header X-Frame-Options sameorigin;
|
|
add_header Referrer-Policy no-referrer;
|
|
add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always;
|
|
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
|
|
'';
|
|
in
|
|
''
|
|
${base_headers}
|
|
if ($request_method = 'OPTIONS') {
|
|
${base_headers}
|
|
add_header 'Access-Control-Max-Age' 86400;
|
|
add_header 'Content-Type' 'text/plain; charset=utf-8';
|
|
add_header 'Content-Length' 0;
|
|
return 204;
|
|
}
|
|
'';
|
|
}
|