nix-infra/config/hosts/nextcloud/nextcloud.nix

{ pkgs, config, ... }:
{
  services.nextcloud = {
    enable = true;
    package = pkgs.nextcloud30;
    hostName = "cloud.nekover.se";
    https = true;
    config = {
      dbtype = "pgsql";
      adminpassFile = "/secrets/nextcloud-adminpass.secret";
    };
    database.createLocally = true;
    configureRedis = true;
    extraAppsEnable = true;
    extraApps = with config.services.nextcloud.package.packages.apps; {
      inherit bookmarks contacts calendar tasks twofactor_webauthn user_oidc;
    };
    maxUploadSize = "16G";
    settings = {
      mail_smtpmode = "smtp";
      mail_sendmailmode = "smtp";
      mail_smtpsecure = "ssl";
      mail_from_address = "cloud";
      mail_domain = "nekover.se";
      mail_smtpauthtype = "LOGIN";
      mail_smtpauth = 1;
      mail_smtphost = "mail-1.grzb.de";
      mail_smtpport = 465;
      mail_smtpname = "cloud@nekover.se";
      default_phone_region = "DE";
    };
    # Only contains mail_smtppassword
    secretFile = "/secrets/nextcloud-secretfile.secret";
    phpOptions = {
      # The amount of memory for interned strings in Mbytes
      "opcache.interned_strings_buffer" = "64";
    };
  };

  services.nginx = {
    virtualHosts.${config.services.nextcloud.hostName} = {
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
        listen 0.0.0.0:8443 http2 ssl proxy_protocol;

        set_real_ip_from 10.202.41.100;
        real_ip_header proxy_protocol;
      '';
    };
  };
}