nixos-conf/services/nextcloud.nix

{
  config,
  pkgs,
  lib,
  ...
}:
{
  imports = [ ./cert-store-client.nix ];

  options.custom = {
    nextcloud_domain = lib.mkOption {
      type = lib.types.str;
      description = "Domain used by Nextcloud";
    };

    collabora_domain = lib.mkOption {
      type = with lib.types; nullOr str;
      default = null;
      description = "Domain used by Collabora Online";
    };
  };

  config = lib.mkMerge [
    {
      networking.firewall.allowedTCPPorts = [ 443 ];

      services = {
        nextcloud = {
          package = pkgs.nextcloud31;
          enable = true;
          hostName = config.custom.nextcloud_domain;
          autoUpdateApps.enable = true;
          https = true;
          maxUploadSize = "512M"; # Default
          config = {
            dbtype = "sqlite";
            adminpassFile = "/var/lib/nextcloud/adminpass";
          };
          settings = {
            overwriteprotocol = "https";
            default_phone_region = "FI";
            maintenance_window_start = 1;
          };
          phpOptions = {
            "opcache.interned_strings_buffer" = 32;
          };
        };

        nginx = {
          recommendedGzipSettings = true;
          recommendedOptimisation = true;
          recommendedTlsSettings = true;
          recommendedProxySettings = true;

          virtualHosts.${config.services.nextcloud.hostName} = {
            forceSSL = true;
            kTLS = true;
            sslCertificate = "/mnt/acme/fullchain.pem";
            sslCertificateKey = "/mnt/acme/key.pem";
          };
        };
      };
    }
    (
      # Optional Collabora Client
      lib.mkIf (config.custom.collabora_domain != null) {
        services = {
          collabora-online = {
            enable = true;
            port = 9980; # default
            settings = {
              ssl = {
                enable = false;
                termination = true;
              };

              net = {
                listen = "loopback";
                post_allow.host = [ "::1" ];
              };

              storage.wopi = {
                "@allow" = true;
                host = [ config.services.nextcloud.hostName ] ++ config.services.nextcloud.settings.trusted_domains;
              };

              server_name = config.custom.collabora_domain;
            };
          };

          nginx.virtualHosts.${config.services.collabora-online.settings.server_name} = {
            forceSSL = true;
            kTLS = true;
            sslCertificate = "/mnt/acme/fullchain.pem";
            sslCertificateKey = "/mnt/acme/key.pem";
            locations."/" = {
              proxyPass = "http://[::1]:${toString config.services.collabora-online.port}";
              proxyWebsockets = true; # collabora uses websockets
            };
          };

          nextcloud = {
            appstoreEnable = true;
            extraAppsEnable = true;
            extraApps = with config.services.nextcloud.package.packages.apps; {
              inherit
                richdocuments
                ;
            };
          };
        };
      }
    )
  ];
}