optimize nextcloud, move it to postgres

modules/gitea.nix

@@ -26,7 +26,7 @@ in {
       forceSSL = true;
       useACMEHost = root_host;
       locations."/" = {
-        proxyPass = "http://127.0.0.1:${builtins.toString gitea_port}";
+        proxyPass = "http://127.0.0.1:${builtins.toString config.services.gitea.settings.server.HTTP_PORT}";
       };
     };
   };

modules/matrix.nix

@@ -20,6 +20,7 @@ local   all             postgres                                peer
 local   all             all                                     peer
 host    all             all             127.0.0.1/32            md5
 host    synapse         matrix-synapse         ::1/128                 md5
+host    nextcloud       nextcloud       ::1/128                 md5
 host    all             all             ::1/128                 md5
 local   replication     all                                     peer
 host    replication     all             127.0.0.1/32            md5
@@ -29,6 +30,7 @@ host    replication     all             ::1/128                 md5
     # ArbitraryMapName systemUser DBUser
        superuser_map      root      postgres
        superuser_map      matrix-synapse synapse
+       superuser_map      nextcloud nextcloud
        superuser_map      postgres  postgres
        # Let other names login as themselves
        superuser_map      /^(.*)$   \1

modules/nextcloud.nix

@@ -4,25 +4,69 @@ let
   nextcloud_host = "cloud.${root_host}";
   nextcloud_port = 8083;
 in {
-  security.acme.certs."${root_host}".extraDomainNames = [ nextcloud_host ];
-  age.secrets.nextcloud_admin_pass = {
-    file = ../secrets/nextcloud_admin_pass.age;
-    owner = "nextcloud";
-    group = "nextcloud";
-    mode = "0600";
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [ "nextcloud" ];
+    ensureUsers = [
+      {
+        name = "nextcloud";
+        ensureDBOwnership = true;
+      }
+    ];
   };
 
+  security.acme.certs."${root_host}".extraDomainNames = [ nextcloud_host ];
+  age.secrets = {
+    nextcloud_admin_pass = {
+      file = ../secrets/nextcloud_admin_pass.age;
+      owner = "nextcloud";
+      group = "nextcloud";
+      mode = "0600";
+    };
+  };
+
+  services.redis.servers.nextcloud = {
+    enable = true;
+    bind = "::1";
+    port = 6379;
+  };
+
+  systemd.services.nextcloud-setup.serviceConfig.ExecStartPost = pkgs.writeScript "nextcloud-redis.sh" ''
+    #!${pkgs.runtimeShell}
+    nextcloud-occ config:system:set redis 'host' --value '::1' --type string
+    nextcloud-occ config:system:set redis 'port' --value 6379 --type integer
+    nextcloud-occ config:system:set memcache.local --value '\OC\Memcache\Redis' --type string
+    nextcloud-occ config:system:set memcache.locking --value '\OC\Memcache\Redis' --type string
+  '';  
 
   services.nextcloud = {
     enable = true;
     https = true;
     hostName = nextcloud_host;
     package = pkgs.nextcloud28;
+    caching.redis = true;
+
 #    extraApps = with config.services.nextcloud.package.packages.apps; [
 #      news contacts calendar tasks;
 #    ];
     config = {
+      overwriteProtocol = "https";
       adminpassFile = config.age.secrets.nextcloud_admin_pass.path;
+      dbport = config.services.postgresql.port;
+      dbuser = "nextcloud";
+      dbtype = "pgsql";
+      defaultPhoneRegion = "DE";
+    };
+    phpOptions = {
+      "opcache.interned_strings_buffer" = "12";
+    };
+    extraOptions = {
+      filelocking.enabled = true;
+      redis = {
+        host = "localhost";
+        port = 6379;
+        timeout = 0.0;
+      };
     };
   };
 

modules/puffer.nix

@@ -11,8 +11,8 @@ in {
       PUFFER_WEB_HOST = ":${builtins.toString puffer_port}";
       PUFFER_DAEMON_SFTP_HOST = ":${builtins.toString puffer_sftp_port}";
     };
-    extraPackages = with pkgs; [ jdk17_headless ];
-    extraGroups = [ "podman" "docker" ];
+    extraPackages = with pkgs; [];
+    extraGroups = [ "docker" ];
   };
 
   services.nginx = {
@@ -29,7 +29,7 @@ in {
   security.acme.certs."${root_host}".extraDomainNames = [ puffer_host ];
   networking.firewall.allowedTCPPorts = [ puffer_sftp_port 25565 ];
 
-  virtualisation.podman.enable = true;
+#  virtualisation.podman.enable = true;
   virtualisation.docker.enable = true;
 
 }

secrets/nextcloud_db_pass.age

@@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> ssh-rsa jWbwAg
+ULPpqCrbkoqF5Zx+YNl2igi962ho+4bJv4ZqkdUJWXKvwBCKBujUhTRubao3E1H7
+M6Qa1X/ENOjLRjaDGN/LHTKl+7yv7TyayHxWlPVylBHgs2m18Zr0+pcIl+771FSm
+E0QFs61ENZibrBubOv9sib0Drb/8hi393kLAuBIIblzVt8Td3eLz9oXBltkXDJ26
+ndY61jJbMcOkaS/AgcENSdwuDETxlceOBNuIRucjpcGFDrobngJyNbV8amH3Fc4D
+07iwIGFK5xF+Z3h1dH+oKPTqenDcBsq32LYNOUczap0ia4/CCw/by/VrTnudX9FC
+VGJ3MmJIXLaeCMMSsHEQNrNf6hq+rysuAeW3rUco8k9lWv4J08l2Z4wEfwIX3UdT
+LmyTe9FeKib8ul4FuAnAXWl5Mwik2xG87Ci375/qeZgIduH6UyelBErzGA5HwtV+
+Zhfo+moImBg5wkQAMqBEYo3llMU4S0uV3A7sxcFSGrKnW+qFt46+TzkAAZJCBaFC
+tXM44LI+JceJhlBnI83sayEf1kEQlsxGqqdOpRQaVI5xBX7rGduFOFsVFAOO60I9
+jIESQSoV36KVgm4w+v99jYiLI9mfHRNzC0KH5qeTW8tST6N1+TyP0uhzfIoNVfpg
+buHTgKaPO37VciLDT2qGz8VVcbg7wlFE2neNPqQQss4
+--- CWjL7M33VOuujkVFJG+zj8JwUwvA2ymMNvjIXvAxNxE
+âê`á
ßnœ÷\<5C>çU‘D…Ð`Až‚î?xM7ž½¤ReœNÓJÕïIëÒ}GŽøý=x“<78>@åÙ”“Ü4)ÉžR°f¯rwÄã¹	£}ºÍZ2

secrets/secrets.nix

@@ -8,4 +8,5 @@ in
   "synapse_db_pass_prepared.age".publicKeys = [ contabo_nix_pub ];
   "grafana_admin_pass.age".publicKeys = [ contabo_nix_pub ];
   "nextcloud_admin_pass.age".publicKeys = [ contabo_nix_pub ];
+  "nextcloud_db_pass.age".publicKeys = [ contabo_nix_pub ];
 }