Nextcloud on NixOS — Administration Guide

# Check Nextcloud status
nextcloud-occ status
curl -sk https://nextcloud.osisa.com:666/status.php

# Disable/enable maintenance mode
nextcloud-occ maintenance:mode --on
nextcloud-occ maintenance:mode --off

# Check SSL certificate
echo | openssl s_client -connect localhost:443 -servername nextcloud.osisa.com 2>/dev/null \
  | openssl x509 -noout -subject -dates

# Force SSL renewal
/opt/osisa-ssl/renew-cert.sh

# Check renewal timer
systemctl list-timers osisa-ssl-renew

# NixOS rebuild
nixos-rebuild switch

# Check NixOS version
nixos-version

# Nextcloud Nix Configuration Module
{self, config, lib, pkgs, ...}: let

  email = "info@osisa.com";
  #ncConfig = builtins.fromJSON (builtins.readFile ./nc.json);
  packageName = "nextcloud33";
  #ncConfig = import ./nc.nix;

in {
  # use sops-nix
  environment.etc = {
    "nextcloud-db-pass".text = "VXQgaW4gYWxpcXV5YW0gbnVsbGEgZG9sb3IganVzdG8gdm9sdXB0dWEgZHVvIGVhIGVsaXQgdGFraW1hdGEgZWlybW9kIGV0IGlwc3VtIG1hZ25hLg==";
    "nextcloud-admin-pass".text = "NixNext2024$.";
    "nextcloud-secrets.json".text = ''
    {
      "secret": "zjJL3HL0ONNBa4eU1tF93p3nqB5RWW",
      "instanceid": "a9H6YQXbj7h9EaqTsRHw9XBtJaMGRN"
    }
    '';
  };

  users.users.nextcloud.extraGroups = ["render" "users"];

  networking.firewall.allowedTCPPorts = [ 80 443 666 ];
  security.acme = {
    acceptTerms = true;
    defaults.email = email;
    #defaults.email = ncConfig.acmeEmail;
  };
  services = {
    nginx = {
      enable = true;

      # Use recommended settings
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;

      # Only allow PFS-enabled ciphers with AES256
      sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";

      # Setup Nextcloud virtual host to listen on ports
      virtualHosts = {
        "nextcloud.osisa.com" = {
          forceSSL = true;
          sslCertificate = "/opt/osisa-ssl/certs/fullchain.pem";
          sslCertificateKey = "/opt/osisa-ssl/certs/key.pem";
          listen = [
            { addr = "0.0.0.0"; port = 443; ssl = true; }
            { addr = "0.0.0.0"; port = 666; ssl = true; }
            { addr = "0.0.0.0"; port = 80; ssl = false; }
          ];
        };
      };
    };

    nextcloud = {
      # Always check these
      enable = true;
      package = pkgs.${packageName};
      hostName = "nextcloud.osisa.com";
      maxUploadSize = "8G";

      # Can leave as is
      https = true;
      home = "/var/lib/nextcloud";
      notify_push.enable = false;
      configureRedis = true;
      database.createLocally = false;
      autoUpdateApps = {
        enable = true;
        startAt = "05:00:00";
      };
      appstoreEnable = false; # should be false if apps are declared below
      extraAppsEnable = true;
      extraApps =
        # nc4nix removed - using built-in NixOS packages only
        with config.services.nextcloud.package.packages.apps;
      {
        inherit
        contacts
        notes
        calendar
        deck
        tasks
        spreed
        groupfolders
        mail
        unroundedcorners
        #richdocuments
        #richdocumentscode
        ; # intentional LEAVE IT
      };

      phpExtraExtensions = all: [ all.ldap ];

      config = {
        # Further forces Nextcloud to use HTTPS
        overwriteProtocol = "https";

        # Nextcloud PostegreSQL database configuration
        dbtype = "pgsql";
        dbuser = "nextcloud";
        dbhost = "/run/postgresql"; # nextcloud will add /.s.PGSQL.5432 by itself
        dbname = "nextcloud";
        dbpassFile = "/etc/nextcloud-db-pass";

        adminpassFile = "/etc/nextcloud-admin-pass";
        adminuser = "nextadmin";

        defaultPhoneRegion = "CH";
      };

      extraOptions = {
        enabledPreviewProviders = [
          "OC\\Preview\\BMP"
          "OC\\Preview\\GIF"
          "OC\\Preview\\JPEG"
          "OC\\Preview\\Krita"
          "OC\\Preview\\MarkDown"
          "OC\\Preview\\MP3"
          "OC\\Preview\\OpenDocument"
          "OC\\Preview\\PNG"
          "OC\\Preview\\TXT"
          "OC\\Preview\\XBitmap"
          "OC\\Preview\\HEIC"
        ];
      };

      phpOptions = {
        "opcache.interned_strings_buffer" = "16";
      };
    };

    postgresql = {
      enable = true;

      # Ensure the database, user, and permissions always exist
      ensureDatabases = [ "nextcloud" ];
      ensureUsers = [
        {
          name = "nextcloud";
          ensureDBOwnership = true;
        }
      ];
    };
  };

  systemd.services."nextcloud-setup" = {
    requires = ["postgresql.service"];
    after = ["postgresql.service"];
  };

  # osisa.SSL certificate renewal - runs monthly via HTTP-01
  systemd.services."osisa-ssl-renew" = {
    description = "Renew SSL certificate for nextcloud.osisa.com via osisa.SSL";
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "/opt/osisa-ssl/renew-cert.sh";
    };
    path = [ pkgs.cifs-utils pkgs.util-linux ];
  };

  systemd.timers."osisa-ssl-renew" = {
    description = "Monthly SSL certificate renewal timer";
    wantedBy = [ "timers.target" ];
    timerConfig = {
      OnCalendar = "monthly";
      Persistent = true;
      RandomizedDelaySec = "1h";
    };
  };
}