[nextcloud module] add wrapper example

machines/.sops.yaml

@@ -10,7 +10,7 @@ keys:
   - &machine_lucia 3474196f3adf27cfb70f8f56bcd52d1ed55033db
   - &machine_durruti age1xu6kxpf8p0r8d6sgyl0m20p5hmw35nserl7rejuzm66eql0ur4mq03u0vp
   - &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
-  - &machine_fanny age1f53q3kkv0qsarlrkdaddjchdzckp5szkv4tu9kly7slkwd966sfs3vccce
+  - &machine_fanny age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
   - &machine_nextcloud age1w07s4y2uh0xd322ralyyh79545lvxzqncd0s65q9cx4ttlqv5u9s7y78gr
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng

machines/fanny/configuration.nix

@@ -51,7 +51,6 @@ in
       disk0 = "disk/by-id/ata-SAMSUNG_MZ7LN256HCHP-000L7_S20HNAAH200381";
     };
     storage = {
-      enable = true;
       disks = ["disk/by-id/wwn-0x50014ee265b53b60" "disk/by-id/wwn-0x50014ee2bb0a194a"];
       mirror = true;
     };
@@ -70,7 +69,8 @@ in
   };
 
   services.malobeo.microvm.enableHostBridge = true;
-  services.malobeo.microvm.deployHosts = [ "overwatch" "infradocs" "nextcloud" "durruti" ];
+  services.malobeo.microvm.deployHosts = [ "overwatch" "infradocs" "durruti" ];
+  services.malobeo.microvm.client.nextcloud.enable = true;
 
   networking = {
     nat = {

machines/fanny/secrets.yaml

@@ -5,63 +5,63 @@ sops:
     azure_kv: []
     hc_vault: []
     age:
-        - recipient: age1f53q3kkv0qsarlrkdaddjchdzckp5szkv4tu9kly7slkwd966sfs3vccce
+        - recipient: age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzTmFmVEd0cjY1QkJNRXRQ
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTmdrV1IyM2hldloxM3Zh
-            NytpanU0UzF5aXlhRklJbW5yOExrbVFoREFjClRlVGVhOHZ2OW56Z21NU1FjaVFh
+            cGVIZmtCZ0FLTEQxcFBLaVh0VXUwNWVGR1hBCnJ6SHpzckh5VVduM0Z2dkh2WHdy
-            ZnJHZk5mV3ZKQm84M0Z6em14akc4Rk0KLS0tIHRMQTdOZTVvNUNoM29tZ2Nockp6
+            WGxRV0JFZTdqcWgzUFlSZkowZElJd2MKLS0tIGxYL0orSVdmZzJBSEIvRUNDUVlK
-            VUJFMEpxb0Y4WlJhZGZPTk54ZXhIMEkKPwkXj7gRlIZ9aYGNlX+PdZa9BcaHt1G6
+            RWFLOWp4TVJBM3llS0lmQlBUQ2ZQNkUKEz/dXR0tkVeyC9Oxai5gZEAhRImdL1FL
-            DVNxfuYvecprnQWQ+pjVGzm8j78p7HpAcmJ/Aue3FTYo6S/vyEmK6A==
+            2LdVRiCt3MqR9wtfw1/pR7166Bx8nLIN42uWh2YU5j0/0rXNq+I6Qg==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxbzF1WW82MlB3N2tmVjVa
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQW5OU2FiNStkazFRRHBK
-            UGlLaThRUFNQOVV0d1ZxK2hJTE1pSGVoV2hVCis0UW41cXRVaC8yWGdCUEVaZjFM
+            U2kzNkpWRDVQTDBkTFFNWnREcjh6NlhmRnhZCkxMYlZhcUlGUnN3QWFzbVkyYlpX
-            MmViQXJrV3pTNzN4aDNpVCtYNmdXUjQKLS0tIGZsYTRwUDI2YWlMNjBJY2ZNREVu
+            eWZaOUxsUCtZYmx0U29ZckFaMjNLTFEKLS0tIExxV0REL3MwUTZpMkgxYlZMc0JS
-            ZzI3MWRLZ3lseitrQ0YrZ1BuM3BacmsK1gbJH+Qs6sTLrSZSUJtnvUNmbLNnPWVT
+            cTNEYTBGT3VRaDI1eUhucnd5d2JhTWMKNZlkUjxX2QTFoiCWPzz62jz4kK8d5rW/
-            WOs8Pxf6ROYmstcF8yEGHxbVesWn0jMbC4aIAZOIyglh+6glxsbnpw==
+            MJ1w69Qve7lsUAg74YlFF7i/yYSZZkHoRMs92lRmq3lHlbK6aaUMTw==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2025-01-14T12:41:07Z"
     mac: ENC[AES256_GCM,data:RJ4Fa8MmX8u8S3zrD/SaywTC3d2IfHQPBDy3C9u4GuXJ/ruEChAB1kN8rqMPvkmET8UUgHIEp7RpbzMtg/FOmKYKYTTx5t//3/VozvAEZurhG/4mnN3r6uaZ0R9+wSjym8IyOKsJ7p4XrfE5tRdzNyU4EqfkEiyf+jO751uSnYI=,iv:eiTdmbcrpUvyDPFmGawxJs/ehmD7KqulaoB+nfpC6ko=,tag:+TKr53cFS3wbLXNgcbZfJQ==,type:str]
     pgp:
-        - created_at: "2025-02-05T15:31:49Z"
+        - created_at: "2025-01-14T12:32:13Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQGMA5HdvEwzh/H7AQv9FdyMi1hVqhXAHEIjv5hiCw+l+OU+WomhmQTNue3pfgLi
+            hQGMA5HdvEwzh/H7AQv/YM4JBfaFngZt0SmMP3fBCodQXWnWMjy5VYoTOKKaOfG8
-            eP15nIqjOg4H+akley0alE5ZL7AU/x5catwmd+JqG3p+j4v3z4GGgpgob6srxhRR
+            5GRTf+o1stsru3EKImh5PTqniRO6UH+/DOKBY8zHsy9lXojGka3uPJRKv7JUD5YO
-            jcSZZZpOi5kMdvayX90Mm1zbzTSdxgHcI7tOtnr00kuUfkvTNyYP8ofvb19OZ3sS
+            8NjlHwwg+jcQN/qtrWc+1D69zR1aO/6yxfgujL3r/fJ4reqtSNfkVYVy2lEcw2ZN
-            ednM9E6h+qfCI+R2iv0WcyF0UXS8vExCl5djL4kV/gzc8iQz5qm1f67xem7kiN8M
+            zhlN+fBxZCyHyUTKLcXrG7Fg8BRudjwBnIsBTLAVFkWg0bnlq38vicGpF5CHsRjA
-            dJZMmAkGSbSzCx/czqZ7pIB5LCmnGmLeYNBoMXdnj970dJrJ6/1DZqQNq4mkE8PG
+            cTPq2D9ev888WKHcjFcXYqxeKkXkqBuOOMlCHQyJCv8HHfA/GY+pBQfiVmvSt77O
-            odn7U4dq37pfpp8LJR9XZuCuQ2TbW8WqczQ3l2u4hqQNhHNRGDB/FGJrkn31BirN
+            /MA8hVYl8G4tRFsbUdZzqtPbAsLy30w1e9dpsD2M6tD55V2RNUCrznB2lo0uXZ24
-            Mwbb7UJQYQR5OzGwHTigpXDJnrf9j1CyAxbx3TrSHBrh63eVgUs1+mD9SUj6vVN7
+            9MUnad+NQdntbe5B2OBUF/MNKZ9/tC+B9pBm7Tx3rxSELytGuQF11x4EyLwn+Ict
-            aBb8Y1M/cPiDyo2dpsa5lG6hzDQzlpBuJI4a8kN9JVTbcwYuWECx2kTGnZDBW+xf
+            iBBV5P3RiulxLW6MbDs+7JPILfcMfg6e8q+GY1dnIPZrs8Qf5W60FxbOYYiMvJ9k
-            KPNPrNzZmhIyZXMjPuK/0lgBuskgYg3sLqGgwUMisKCV56yRJr0zCoje3XWY6X2y
+            UtnZAixVdlpkAsQz/t630lgBX9DLYjEVgaxC+zqtRjfHkoyvGIac6cgHDX/fBs7p
-            J7F0+/R3ESt98Za/qs4PG+U5oOXsUVlDZK0D+zVvnunJLOP/fT2yu4YoCZxy9Y6I
+            Woud0RbwffhOhaIF47Z2W4UPfn5Mtcu63fQpjCM9urk9asaRPeNDTeEYVjqSZD6N
-            HbJzEdNC98ow
+            J+o9dahBHvIF
-            =nYXr
+            =GKm4
             -----END PGP MESSAGE-----
           fp: c4639370c41133a738f643a591ddbc4c3387f1fb
-        - created_at: "2025-02-05T15:31:49Z"
+        - created_at: "2025-01-14T12:32:13Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA98TrrsQEbXUAQ//b/vbXzTW+NgmpAfTEkrha0OeU3w4UEwejZVYJeFcTHrS
+            hQIMA98TrrsQEbXUARAAmD4PfLpRVUXTo5yyS9LSs5vmEvnCmNc0ad4Oiv7YAxhs
-            nOh1W/a4pMNJ0n/xabGkwJs1o1CPEcV8ctta6OgwiXLFmfuVDYiT4YZw2zUML8kd
+            W7SCKHq2zOfGIeZZHP0wjRnJELwMCVLy4dVo/slDHCiy8T4MZXaYR04ZaJJ+OHrF
-            umCgGFcCq5xjxIVbY7GXz/Grv+cJa6JfdQirNRoaDFvhgZxinAcuOhlb01pmf4o2
+            e5xxAA6FjipufvxgRZvLhDj+g+RaX2TuxdL9gFSVS81rvEpSRDnydt2O/6G4SGBR
-            frGrbCvkbDU/OLjMkfakUT87tZh6wfhlT14FABpZNrDHl7mpEvNH/prUMzj87ZME
+            GO5b176eMerrqOqRLL5Ou4b6oitagvRwZzOXQ+YonKZz3STlyXRMgWxeFTDK9T/q
-            g1OkwdjC7sBXngPQjstgMeZmLfsXVhDlhPIPi2kh6LUCdDFkadOZG9+dMf5HpTPW
+            yYOwPVAOU1jhYzUjHNAYCp3CH4ERScrO7AwomAWH+Fe48WRbg2ebdqRnuv/Vl4PM
-            v69CKJyzK8WcH5RoksYgYuACIMRO1VXfIpm6sJqHn2gXc/6CsiST7ofvGtBUhaW+
+            wc5DQcCIIIIENMGIYOzUo1KrfQlevzXF/mbgAgo/uVuRl3Y3lCRAcZBQOtUCF5Ap
-            B342tjWJiRhcU96KCP91NAo4aiNeQ/UjW6EAbJ9BaPWwAod6f3nxBEVvg8pMlLOR
+            FhsO87EMXlZWj3bv08f21t3hQztfuaHIqFpCbSIGgmiE9cAY0cOtCYpJfCYdV7iT
-            pdW6p/Bz4HmvNW+xXLyxUER+ynkOouCMVrb7/eSvzV1Lf2Yz6K8hVe2ehgyVz++v
+            cOElJgYRbAsAbFC9wTQWEvwIxrgnCIrkCg1bzP5KNLG1K+ae5J7qN77qeTQw2/ul
-            sXl6KqMGu5FNJS9j07hXYgWzwk6M+IBBC/YcjQdZQys4IadS1QbtuQOuP3KJ3wwk
+            QDDUUNnzjes562t+/xFLQa/bust1Y8pAYn1s1LEBol1hLX4Igonlkw303UPjZOI2
-            qa4wyHRxb7/3svBP+2vi7HvjizwiEdk7r4CRnrdUm0C7Qozy8UdFMFWMdPMIdL2L
+            MyH5hOh0hNUReuOpHpre/pYquE8Dd27XKAHfJsSd3ZLJG5+1Msw23lIsptgovNrB
-            tI2n71HASMmc7ekU4J45/d9MHqLUahO0wuTd7L4IvAsepZqY+uWuYBVoZW/vHc7S
+            5VRvPj8WPojiDHqN27kt/IuayN3TeoJFjmAjkoFjlyKTcs+b6cDkxUw3LcP+6NjS
-            WAGwfJ7/D8i3lbRP91TslhrCMdzrdzgAb/TLWAyKwSwPPzzf1dCLNp6yF4QRICwJ
+            WAHQI0pWTa5zD8UPow4DHxteP4jW/6ddBfJ1Vz1scqKMXYvxFkRqZvn3uAJOtcuw
-            d/yxpSHBVgShCN3qIsiryx4FtUCPRwzgY96delesewJOIzxwjByIvTY=
+            CgQ4CXE43n4G7g5gvWl6ZFW8tdXR7Sw+USnHR/9oS9fV0rHcxxDFEfE=
-            =vEEz
+            =9FN4
             -----END PGP MESSAGE-----
           fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
     unencrypted_suffix: _unencrypted

machines/modules/malobeo/microvm_client.nix

@@ -0,0 +1,28 @@
+{config, lib, pkgs, ...}:
+let
+  cfg = config.services.malobeo.microvm.client;
+in
+{
+  options.services.malobeo.microvm.client = {
+    nextcloud = {
+      enable = lib.mkEnableOption "enable the nextcloud microvm wrapper";
+      datadir = lib.mkOption {
+        type = lib.types.string;
+        default = "/data/services/nextcloud/";
+        description = "set a custom datadir";
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.nextcloud.enable { #add check for run-vm?
+      services.malobeo.microvm.deployHosts = ["nextcloud"];
+      microvm.vms.nextcloud.config.microvm.shares = lib.mkAfter [{
+        source = cfg.datadir;
+        mountPoint = "/datadir";
+        tag = "nc-datadir";
+        proto = "virtiofs";
+      }];
+    })
+  ];
+}

machines/modules/malobeo/peers.nix

@@ -30,13 +30,6 @@
     publicKey = "TrJ4UAF//zXdaLwZudI78L+rTC36zEDodTDOWNS4Y1Y=";
   };
 
-  "hetzner" = {
-    role = "client";
-    address = [ "10.100.0.6/24" ];
-    allowedIPs = [ "10.100.0.6/32" ];
-    publicKey = "csRzgwtnzmSLeLkSwTwEOrdKq55UOxZacR5D3GopCTQ=";
-  };
-
   "fanny" = {
     role = "client";
     address = [ "10.100.0.101/24" ];

machines/nextcloud/configuration.nix

@@ -37,6 +37,7 @@ with lib;
     hostName = "cloud.malobeo.org";
     config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
     #https = true; #disable for testing
+    datadir = "/datadir";
     database.createLocally = true;
     config.dbtype = "pgsql";
     configureRedis = true;
@@ -55,6 +56,12 @@ with lib;
     };
     settings = {
       trusted_domains = ["10.0.0.13"];
+      "maintenance_window_start" = "1";
+      "default_phone_region" = "DE";
+    };
+    phpOptions = {
+      "realpath_cache_size" = "0";
+      "opcache.interned_strings_buffer" = "23";
     };
   };
 

outputs.nix

@@ -108,7 +108,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
 
     nixosModules.malobeo = {
       host.imports = [ ./machines/durruti/host_config.nix ];
-      microvm.imports = [ ./machines/modules/malobeo/microvm_host.nix ];
+      microvm.imports = [ ./machines/modules/malobeo/microvm_host.nix ./machines/modules/malobeo/microvm_client.nix];
       vpn.imports = [ ./machines/modules/malobeo/wireguard.nix ];
       initssh.imports = [ ./machines/modules/malobeo/initssh.nix ];
       metrics.imports = [ ./machines/modules/malobeo/metrics.nix ];