nextcloud: init

flake.nix

@@ -50,6 +50,22 @@
           microvm.nixosModules.host
           ./hosts/dishwasher
           ./modules/basic-tools.nix
+          ./modules/binary-caches.nix
+
+          {
+            microvm.vms.nextcloud = {
+              flake = self;
+              updateFlake = "git+file:///etc/nixos";
+            };
+          }
+        ];
+      };
+      nextcloud = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          sops-nix.nixosModules.sops
+          microvm.nixosModules.microvm
+          ./microvms/nextcloud
         ];
       };
     };

hosts/dishwasher/configuration.nix

@@ -61,6 +61,7 @@
   # List services that you want to enable:
 
   # Enable the OpenSSH daemon.
+  programs.mosh.enable = true;
   services.openssh = {
     enable = true;
     permitRootLogin = "prohibit-password";

hosts/dishwasher/default.nix

@@ -4,5 +4,6 @@
     ./hardware-configuration.nix
     ./secrets.nix
     ./oxalab.nix
+    ./mcvm-network.nix
   ];
 }

hosts/dishwasher/hardware-configuration.nix

@@ -31,6 +31,12 @@
       options = [ "subvol=var-log" "compress=zstd" "noatime" ];
     };
 
+  fileSystems."/var/microvms" =
+    { device = "/dev/disk/by-uuid/2971597a-b364-405d-8bb2-287556e819e1";
+      fsType = "btrfs";
+      options = [ "subvol=microvms" "compress=zstd" "noatime" ];
+    };
+
   fileSystems."/nix" =
     { device = "/dev/disk/by-uuid/2971597a-b364-405d-8bb2-287556e819e1";
       fsType = "btrfs";

hosts/dishwasher/mcvm-network.nix

@@ -0,0 +1,51 @@
+{ config, pkgs, ... }: {
+  systemd.network = {
+    netdevs."microvm-bridge".netdevConfig = {
+      Kind = "bridge";
+      Name = "microvm-bridge";
+    };
+
+    networks."0-microvm-bridge" = {
+      matchConfig.Name = "microvm-bridge";
+      networkConfig = {
+        DHCPServer = false;
+        IPv6SendRA = true;
+      };
+      addresses = [ {
+        addressConfig.Address = "10.99.99.1/24";
+        } {
+        addressConfig.Address = "fd12:3456:789a::1/64";
+        } ];
+        ipv6Prefixes = [ {
+        ipv6PrefixConfig.Prefix = "fd12:3456:789a::/64";
+        } ];
+      # networkConfig = {
+      #   Address = "10.99.99.1/24";
+      #   IPForward = "ipv4";
+      # };
+      # routes = [{
+      #   routeConfig = {
+      #   GatewayOnLink = true;
+      # };}];
+        # IPForward = "ipv4";
+        # DHCPServer = true;
+        # IPv6SendRA = true;
+      # addresses = [{
+      #   addressConfig.Address = "10.99.99.1/24";
+      # }];
+    };
+
+    networks."1-microvm-bridge" = {
+      matchConfig.Name = "vm-*";
+      networkConfig.Bridge = "microvm-bridge";
+    };
+  };
+
+  networking.nat = {
+    enable = true;
+    enableIPv6 = true;
+    externalInterface = "enp1s0";
+    internalInterfaces = [ "microvm-bridge" ];
+  };
+
+}

microvms/nextcloud/default.nix

@@ -0,0 +1,122 @@
+{ config, pkgs, ... }: {
+
+  imports = [
+    ./oxaproxy.nix
+    ./secrets.nix
+  ];
+
+  # nextcloud goes here
+  networking.firewall.interfaces.oxaproxy.allowedTCPPorts = [ 8080 ];
+
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_14;
+    ensureDatabases = [ "nextcloud" ];
+    ensureUsers = [{
+      name = "nextcloud";
+      ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
+    }];
+  };
+
+  services.redis.enable = true;
+
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    virtualHosts."nc.oxapentane.com" = {
+      extraConfig = ''
+          # HTTP response headers borrowed from Nextcloud .htaccess
+          add_header Referrer-Policy                      "no-referrer"   always;
+          #add_header X-Content-Type-Options               "nosniff"       always;
+          add_header X-Download-Options                   "noopen"        always;
+          #add_header X-Frame-Options                      "SAMEORIGIN"    always;
+          add_header X-Permitted-Cross-Domain-Policies    "none"          always;
+          add_header X-Robots-Tag                         "none"          always;
+          add_header X-XSS-Protection                     "1; mode=block" always;
+
+          # Remove X-Powered-By, which is an information leak
+          fastcgi_hide_header X-Powered-By;
+      '';
+      listen = [{
+            # We are listening on wireguard interface only
+            addr = "10.34.45.100";
+            port = 8080;
+            ssl = false;
+          }];
+        };
+      };
+
+      services.nextcloud = {
+        enable = true;
+        hostName = "nc.oxapentane.com";
+        home = "/var/lib/nextcloud-oxa";
+        package = pkgs.nextcloud24;
+        maxUploadSize = "5000M";
+        caching.redis = true;
+        autoUpdateApps = {
+          enable = true;
+          startAt = "07:00:00";
+        };
+        config = {
+          overwriteProtocol = "https";
+          trustedProxies = [ "10.34.45.1" ];
+
+          dbtype = "pgsql";
+          dbuser = "nextcloud";
+          dbhost = "/run/postgresql";
+          dbname = "nextcloud";
+          adminuser = "admin";
+          adminpassFile = config.sops.secrets."nextcloud/adminpass".path;
+        };
+      };
+
+      systemd.services."nextcloud-setup" = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];
+      };
+
+
+
+
+      microvm = {
+        hypervisor = "qemu";
+        mem = 4 * 1024;
+
+        shares = [{
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+          tag = "store";
+          proto = "virtiofs";
+          socket = "store.socket";
+        }] ++ map (dir: {
+          source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
+          mountPoint = "/${dir}";
+          tag = dir;
+          proto = "virtiofs";
+          socket = "${dir}.socket";
+        }) [ "etc" "var" "home" ];
+
+        interfaces = [{
+          type = "tap";
+          id = "vm-nextcloud";
+          mac = "EA:40:E8:60:C5:36";
+        }];
+      };
+
+      networking = {
+        hostName = "nextcloud";
+        };
+
+        services.openssh = {
+          enable = true;
+          permitRootLogin = "prohibit-password";
+          };
+
+          networking.firewall.allowedTCPPorts = [ 22 ];
+          users.users.root.openssh.authorizedKeys.keys = [
+            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDP6xE2ey0C8XXfvniiiHiqXsCC277jKI9RXEA+s2LQLUI5zl7v350i3Oa8H3NCcPj39lfMreqE6ncxcOhqYyzahPrrMkOqgbPAoRvq8H3ophLK+56O3xdHoKwLBwRD1yoGACjqG4UTiTrmnN2ateENgYcnTEY1e4vDw1qMj1drUXCsZ/6mkBBmHJiFfCaR4yCMt1r4gGi/dAC7ifnBP3oSyV/lJEwPxYYkGlbOBIvX/7Ar98pJS6xYPB3jHs9gwyNNON63d0fNYrwBojXPPCnGGaRZNOkBTzex3zZYp12ThINQ2xl8tRp9D8qpZ7vrLjhTD6AXkOBRzmDj+NsCeEaeTuWajqUM93iKncYUI+JxR1t7q8gA2pBMFzLesMXnx7R+5Kw7QDtSJM7a4GMIfsocPwf64BH6rzxEz68rXFE3P+J77PPM9CuaYw90JXHo3z220zYw2nMQ/1qjATVZw/hiVrLmQMVfmFJIufnGjTBs2sy3IoNyzvYm/oDeNNg1cdSV9gyyRKZhK08fxjXN5GSf9vZkfZa9tHtqaZ99HI40GQBHUVx1K2/NQJY8TVTSA+v16SFnJK8BIbmp/WFCuvDcMkgLIbqiYtDASe7P2mKIib86uOENT+P820egeLiTQ06kFw/gfUa8t69d5qEcjiQZ+lxCeYIs/E9KrEXHvRUWew== cardno:16 811 348"
+          ];
+
+          system.stateVersion = "22.05";
+        }

microvms/nextcloud/oxaproxy.nix

@@ -0,0 +1,58 @@
+{ config, ... }: {
+  networking.wireguard.enable = true;
+  networking.useNetworkd = true;
+  systemd.network = {
+    enable = true;
+    netdevs."10-oxaproxy" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "oxaproxy";
+        Description = "oxa's enterprise reverse-proxy network";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
+        #own pubkey: KCYoGx7TGei4X79EZo2NONCcmQjPzBUN1Ds6I9lQbz0=
+        };
+        wireguardPeers = [
+          {
+          # cirrus
+          wireguardPeerConfig = {
+            PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
+            AllowedIPs = [ "10.34.45.0/24" ];
+            Endpoint = [ "95.216.166.21:51821" ];
+            PersistentKeepalive = 25;
+          };
+        }
+      ];
+    };
+    networks."10-oxaproxy" = {
+      matchConfig.Name = "oxaproxy";
+      networkConfig = {
+        Address = "10.34.45.100/24";
+      };
+    };
+
+    networks."111-host" = {
+      matchConfig.Name = "enp0s8";
+      networkConfig = {
+        Address = "10.99.99.100/24";
+      };
+      routes = [
+        {
+          routeConfig = {
+            Gateway="10.99.99.1";
+            Destination="0.0.0.0/0";
+            Metric=1024;
+          };
+        }
+        {
+          routeConfig = {
+            Gateway="10.99.99.1";
+            Destination="10.99.99.0/24";
+            Metric=1024;
+          };
+        }
+      ];
+    };
+  };
+}

microvms/nextcloud/secrets.nix

@@ -0,0 +1,11 @@
+{ config, ... }: {
+  sops.defaultSopsFile = ../../secrets/nextcloud/secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets."wg/oxaproxy-seckey" = {
+    owner = config.users.users.systemd-network.name;
+  };
+  sops.secrets."nextcloud/adminpass" = {
+    owner = config.users.users.nextcloud.name;
+  };
+}