Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260{ config, lib, pkgs, ...}:
let inherit (lib) types; cfg = config.services.opencloud;
defaultUser = "opencloud"; defaultGroup = defaultUser;
settingsFormat = pkgs.formats.yaml { };in{ options = { services.opencloud = { enable = lib.mkEnableOption "OpenCloud";
package = lib.mkPackageOption pkgs "opencloud" { }; webPackage = lib.mkPackageOption pkgs [ "opencloud" "web" ] { }; idpWebPackage = lib.mkPackageOption pkgs [ "opencloud" "idp-web" ] { };
user = lib.mkOption { type = types.str; default = defaultUser; example = "mycloud"; description = '' The user to run OpenCloud as. By default, a user named `${defaultUser}` will be created whose home directory is [](#opt-services.opencloud.stateDir). ''; };
group = lib.mkOption { type = types.str; default = defaultGroup; example = "mycloud"; description = '' The group to run OpenCloud under. By default, a group named `${defaultGroup}` will be created. ''; };
address = lib.mkOption { type = types.str; default = "127.0.0.1"; description = "Web server bind address."; };
port = lib.mkOption { type = types.port; default = 9200; description = "Web server port."; };
url = lib.mkOption { type = types.str; default = "https://localhost:9200"; example = "https://cloud.example.com"; description = "Web interface root public URL, including scheme and port (if non-default)."; };
stateDir = lib.mkOption { default = "/var/lib/opencloud"; type = types.str; description = "OpenCloud data directory."; };
settings = lib.mkOption { type = lib.types.attrsOf settingsFormat.type; default = { }; description = '' Additional YAML configuration for OpenCloud services.
Every item in this attrset will be mapped to a .yaml file in /etc/opencloud.
The possible config options are currently not well documented, see source code: https://github.com/opencloud-eu/opencloud/blob/main/pkg/config/config.go '';
example = { proxy = { auto_provision_accounts = true; oidc.rewrite_well_known = true; role_assignment = { driver = "oidc"; oidc_role_mapper.role_claim = "opencloud_roles"; }; }; web.web.config.oidc.scope = "openid profile email opencloud_roles"; }; };
environmentFile = lib.mkOption { type = types.nullOr types.path; default = null; example = "/run/keys/opencloud.env"; description = '' An environment file as defined in {manpage}`systemd.exec(5)`.
Use this to inject secrets, e.g. database or auth credentials out of band.
Configuration provided here will override `settings` and `environment`. ''; };
environment = lib.mkOption { type = types.attrsOf types.str; default = { OC_INSECURE = "true"; }; description = '' Extra environment variables to set for the service.
Use this to set configuration that may affect multiple microservices.
Set `OC_INSECURE = "false"` if you want OpenCloud to terminate TLS.
Configuration provided here will override `settings`. ''; example = { OC_INSECURE = "false"; OC_LOG_LEVEL = "error"; }; }; }; };
config = lib.mkIf cfg.enable { users.users.${defaultUser} = lib.mkIf (cfg.user == defaultUser) { group = cfg.group; home = cfg.stateDir; isSystemUser = true; createHome = true; description = "OpenCloud daemon user"; };
users.groups = lib.mkIf (cfg.group == defaultGroup) { ${defaultGroup} = { }; };
systemd = { services = let environment = { PROXY_HTTP_ADDR = "${cfg.address}:${toString cfg.port}"; OC_URL = cfg.url; OC_BASE_DATA_PATH = cfg.stateDir; WEB_ASSET_CORE_PATH = "${cfg.webPackage}"; IDP_ASSET_PATH = "${cfg.idpWebPackage}/assets"; OC_CONFIG_DIR = "/etc/opencloud"; } // cfg.environment; commonServiceConfig = { EnvironmentFile = lib.optional (cfg.environmentFile != null) cfg.environmentFile; MemoryDenyWriteExecute = true; NoNewPrivileges = true; PrivateTmp = true; PrivateDevices = true; ProtectSystem = "strict"; ProtectHome = true; ProtectControlGroups = true; ProtectKernelModules = true; ProtectKernelTunables = true; ProtectKernelLogs = true; RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; RestrictNamespaces = true; RestrictRealtime = true; RestrictSUIDSGID = true; LockPersonality = true; SystemCallArchitectures = "native"; }; in { opencloud-init-config = lib.mkIf (cfg.settings.opencloud or { } == { }) { description = "Provision initial OpenCloud config"; before = [ "opencloud.service" ]; wantedBy = [ "multi-user.target" ];
inherit environment;
serviceConfig = { Type = "oneshot"; ReadWritePaths = [ "/etc/opencloud" ]; } // commonServiceConfig;
path = [ cfg.package ]; script = '' set -x config="''${OC_CONFIG_DIR}/opencloud.yaml" if [ ! -e "$config" ]; then echo "Provisioning initial OpenCloud config..." opencloud init --insecure "''${OC_INSECURE:false}" --config-path "''${OC_CONFIG_DIR}" chown ${cfg.user}:${cfg.group} "$config" fi ''; };
opencloud = { description = "OpenCloud - a secure and private way to store, access, and share your files"; after = [ "network.target" ]; wantedBy = [ "multi-user.target" ];
inherit environment;
serviceConfig = { Type = "simple"; ExecStart = "${lib.getExe cfg.package} server"; WorkingDirectory = cfg.stateDir; User = cfg.user; Group = cfg.group; Restart = "always"; ReadWritePaths = [ cfg.stateDir ]; } // commonServiceConfig;
restartTriggers = lib.mapAttrsToList ( name: _: config.environment.etc."opencloud/${name}.yaml".source ) cfg.settings; }; }; };
systemd.tmpfiles.settings."10-opencloud" = { ${cfg.stateDir}.d = { inherit (cfg) user group; mode = "0750"; }; "${cfg.stateDir}/idm".d = { inherit (cfg) user group; mode = "0750"; }; };
environment.etc = (lib.mapAttrs' (name: value: { name = "opencloud/${name}.yaml"; value.source = settingsFormat.generate "${name}.yaml" value; }) cfg.settings) // { # ensure /etc/opencloud gets created, so we can provision the config "opencloud/.keep".text = ""; }; };
meta = { doc = ./opencloud.md; maintainers = with lib.maintainers; [ christoph-heiss k900 ]; };}