Migrate Nextcloud to hcloud

modules/nextcloud.nix

@@ -0,0 +1,64 @@
+{ config, lib, pkgs, ... }:
+let
+  uidFile = pkgs.writeText "uidfile" ''
+    nextcloud:33
+  '';
+  gidFile = pkgs.writeText "gidfile" ''
+    nextcloud:33
+  '';
+  sshfsOptions = [
+    "nofail"
+    "identityfile=/var/keys/sshfs-ssh-key"
+    "ServerAliveInterval=15"
+    "idmap=file"
+    "uidfile=${uidFile}"
+    "gidfile=${gidFile}"
+    "allow_other"
+    "default_permissions"
+    "nomap=ignore"
+  ];
+in
+{
+  environment.systemPackages = with pkgs; [
+    sshfs
+  ];
+
+  fileSystems."/var/lib/nextcloud/data" =
+    {
+      device = " www-data@10.0.2.2:/var/lib/nextcloud/data";
+      fsType = "fuse.sshfs";
+      options = sshfsOptions;
+    };
+
+  fileSystems."/run/mount/media" =
+    {
+      device = " www-data@10.0.2.2:/data";
+      fsType = "fuse.sshfs";
+      options = sshfsOptions;
+    };
+
+  services.nginx = {
+    virtualHosts = {
+      "${config.services.nextcloud.hostName}" = {
+        enableACME = true;
+        forceSSL = true;
+      };
+    };
+  };
+
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud21;
+    hostName = "cloud.${config.networking.domain}";
+    config = {
+      dbtype = "pgsql";
+      dbuser = "nextcloud";
+      dbhost = "10.0.1.11";
+      dbname = "nextcloud";
+      dbpassFile = "/var/keys/nextcloud-db-pass";
+      adminpassFile = "/var/keys/nextcloud-admin-pass";
+      adminuser = "root";
+    };
+  };
+  users.users.nextcloud.extraGroups = [ "keys" ];
+}

modules/nginx.nix

@@ -0,0 +1,14 @@
+{ pkgs, lib, config, ... }:
+{
+  security.acme.email = "letsencrypt.account@banditlair.com";
+  security.acme.acceptTerms = true;
+
+  services.nginx = {
+    enable = true;
+
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedProxySettings = true;
+  };
+}

modules/postgresql.nix

@@ -6,7 +6,9 @@
     initialScript = "/var/keys/postgres-init.sql";
     enableTCPIP = true;
     identMap = ''
+      root_as_others         root                  postgres
       root_as_others         root                  synapse
+      root_as_others         root                  nextcloud
     '';
     authentication = ''
       local  all     postgres               peer

modules/synapse.nix

@@ -11,14 +11,6 @@ in
   security.acme.acceptTerms = true;
 
   services.nginx = {
-    enable = true;
-    # only recommendedProxySettings and recommendedGzipSettings are strictly required,
-    # but the rest make sense as well
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    recommendedProxySettings = true;
-
     virtualHosts = {
       # This host section can be placed on a different host than the rest,
       # i.e. to delegate from the host being accessible as ${config.networking.domain}