fruitbasket/modules/nextcloud.nix

{ config, pkgs, lib, ... }:
let
  domain = "nc.${config.fsr.domain}";
in
{
  sops.secrets = {
    nextcloud_adminpass.owner = "nextcloud";
    nextcloud_ldap_search = {
      key = "portunus/search-password";
      owner = "nextcloud";
    };
  };

  services = {
    postgresql = {
      enable = true;
      ensureUsers = [{
        name = "nextcloud";
        ensurePermissions = {
          "DATABASE nextcloud" = "ALL PRIVILEGES";
        };
      }];
      ensureDatabases = [ "nextcloud" ];
    };

    nextcloud = {
      enable = true;
      package = pkgs.nextcloud26; # Use current latest nextcloud package
      enableBrokenCiphersForSSE = false; # disable the openssl warning
      hostName = domain;
      https = true; # Use https for all urls
      phpExtraExtensions = all: [
        all.ldap # Enable ldap php extension
      ];
      config = {
        dbtype = "pgsql";
        dbuser = "nextcloud";
        dbhost = "/run/postgresql";
        dbname = "nextcloud";
        adminpassFile = config.sops.secrets.nextcloud_adminpass.path;
        adminuser = "root";
      };
    };

    # Enable ACME and force SSL
    nginx.virtualHosts.${domain} = {
      enableACME = true;
      forceSSL = true;
    };
  };

  # ensure that postgres is running *before* running the setup
  systemd.services."nextcloud-setup" = {
    requires = [ "postgresql.service" ];
    after = [ "postgresql.service" ];
  };

  # configure some settings automatically
  systemd.services."phpfpm-nextcloud" =
    let
      occ = lib.getExe config.services.nextcloud.occ;
      ldapConfig = rec {
        ldapAgentName = "uid=search,ou=users,${ldapBase}";
        ldapBase = config.services.portunus.ldap.suffix;
        ldapBaseGroups = "ou=groups,${ldapBase}";
        ldapBaseUsers = "ou=users,${ldapBase}";
        ldapConfigurationActive = "1";
        ldapEmailAttribute = "mail";
        ldapGroupFilterObjectclass = "groupOfNames";
        ldapGroupMemberAssocAttr = "member";
        ldapHost = "localhost";
        ldapPort = "389";
        ldapUserDisplayName = "cn";
        ldapUserFilterObjectclass = "inetOrgPerson";
        # generated by nextcloud
        ldapGroupFilter = "(&(|(objectclass=groupOfNames)))";
        ldapUserFilter = "(|(objectclass=inetOrgPerson))";
        ldapLoginFilter = "(&(|(objectclass=inetOrgPerson))(uid=%uid))";
      };
    in
    {
      preStart = ''
        # enable included LDAP app
        ${occ} app:enable user_ldap

        # set up new LDAP config if it does not exist
        if ! ${occ} ldap:show-config s01 > /dev/null; then
          ${occ} ldap:create-empty-config
        fi

        # update LDAP config
        ${lib.concatLines (lib.mapAttrsToList (name: value: "${occ} ldap:set-config s01 '${name}' '${value}'") ldapConfig)}
        ${occ} ldap:set-config s01 'ldapAgentPassword' $(cat ${config.sops.secrets.nextcloud_ldap_search.path})
      '';
    };
}