Whether to enable selfhostblocks.nextcloud-server.

Type: boolean

Default: false

Example: true

Declared by:

Nextcloud admin password.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "nextcloud"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "phpfpm-nextcloud.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

Username of the initial admin user.

Type: string

Default: "root"

Declared by:

Run occ maintenance:repair --include-expensive on service start.

Larger instances should disable this and run the command at a convenient time but Self Host Blocks assumes that it will not be the case for most users.

Type: boolean

Default: true

Declared by:

Applications to enable in Nextcloud. Enabling an application here will also configure various services needed for this application.

Enabled apps will automatically be installed, enabled and configured, so no need to do that through the UI. You can still make changes but they will be overridden on next deploy. You can still install and configure other apps through the UI.

Type: submodule

Default: { }

Declared by:

External Storage App. Manual

Set userLocalMount to automatically add a local directory as an external storage. Use this option if you want to store user data in another folder or another hard drive altogether.

In the directory option, you can use either $user and/or $home which will be replaced by the user’s name and home directory.

Recommended use of this option is to have the Nextcloud’s dataDir on a SSD and the userLocalRooDirectory on a HDD. Indeed, a SSD is much quicker than a spinning hard drive, which is well suited for randomly accessing small files like thumbnails. On the other side, a spinning hard drive can store more data which is well suited for storing user data.

Type: submodule

Default: { }

Declared by:

Whether to enable Nextcloud External Storage App.

Type: boolean

Default: false

Example: true

Declared by:

If set, adds a local mount as external storage.

Type: null or (submodule)

Default: null

Declared by:

Local directory on the filesystem to mount. Use $user and/or $home which will be replaced by the user’s name and home directory.

Type: string

Example: "/srv/nextcloud/$user"

Declared by:

Path of the mount in Nextcloud. Use / to mount as the root.

Type: string

Default: ""

Example:

[
  "home"
  "/"
]

Declared by:

LDAP Integration App. Manual

Enabling this app will create a new LDAP configuration or update one that exists with the given host.

Type: null or (submodule)

Default: { }

Declared by:

Whether to enable LDAP app…

Type: boolean

Default: false

Example: true

Declared by:

Admin user of the LDAP server.

Type: string

Default: "admin"

Declared by:

LDAP server admin password.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "nextcloud"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "phpfpm-nextcloud.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

Multiple LDAP configs can co-exist with only one active at a time.This option sets the config ID used by Self Host Blocks.

Type: signed integer

Default: 50

Declared by:

dc domain for ldap.

Type: string

Example: "dc=mydomain,dc=com"

Declared by:

Host serving the LDAP server.

Type: string

Default: "127.0.0.1"

Declared by:

Port of the service serving the LDAP server.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 389

Declared by:

Group users must belong to to be able to login to Nextcloud.

Type: string

Default: "nextcloud_user"

Declared by:

Only Office App. Nextcloud App Store

Enabling this app will also start an OnlyOffice instance accessible at the given subdomain from the given network range.

Type: submodule

Default: { }

Declared by:

Whether to enable Nextcloud OnlyOffice App.

Type: boolean

Default: false

Example: true

Declared by:

File containing the JWT secret. This option is required.

Must be readable by the nextcloud system user.

Type: null or path

Default: null

Declared by:

Local network range, to restrict access to Open Office to only those IPs.

Type: string

Default: "192.168.1.1/24"

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which Only Office will be served.

Type: string

Default: "oo"

Declared by:

Preview Generator App. Nextcloud App Store

Enabling this app will create a cron job running every minute to generate thumbnails for new and updated files.

To generate thumbnails for already existing files, run:

nextcloud-occ -vvv preview:generate-all

Type: submodule

Default: { }

Declared by:

Whether to enable Nextcloud Preview Generator App.

Type: boolean

Default: false

Example: true

Declared by:

Enable more verbose logging.

Type: boolean

Default: false

Example: true

Declared by:

Better defaults than the defaults. Taken from this article.

Sets the following options:

nextcloud-occ config:app:set previewgenerator squareSizes --value="32 256"
nextcloud-occ config:app:set previewgenerator widthSizes  --value="256 384"
nextcloud-occ config:app:set previewgenerator heightSizes --value="256"
nextcloud-occ config:system:set preview_max_x --value 2048
nextcloud-occ config:system:set preview_max_y --value 2048
nextcloud-occ config:system:set jpeg_quality --value 60
nextcloud-occ config:app:set preview jpeg_quality --value="60"

Type: boolean

Default: true

Example: false

Declared by:

SSO Integration App. Manual

Enabling this app will create a new LDAP configuration or update one that exists with the given host.

Type: submodule

Default: { }

Declared by:

Whether to enable SSO app…

Type: boolean

Default: false

Example: true

Declared by:

Require one factor (password) or two factor (device) authentication.

Type: one of “one_factor”, “two_factor”

Default: "one_factor"

Declared by:

Client ID for the OIDC endpoint.

Type: string

Default: "nextcloud"

Declared by:

OIDC endpoint for SSO.

Type: string

Example: "https://authelia.example.com"

Declared by:

Fallback to normal Nextcloud auth if something goes wrong with the SSO app. Usually, you want to enable this to transfer existing users to LDAP and then you can disabled it.

Type: boolean

Default: false

Declared by:

If given, adds a port to the endpoint.

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: null

Declared by:

OIDC provider name, used for display.

Type: value “Authelia” (singular enum)

Default: "Authelia"

Declared by:

OIDC shared secret.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "nextcloud"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "phpfpm-nextcloud.service"
]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

OIDC shared secret. Content must be the same as secretFile option.

Type: submodule

Declared by:

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default: ""

Declared by:

Linux group owning the secret file.

Type: string

Default: "root"

Declared by:

Mode of the secret file.

Type: string

Default: "0400"

Declared by:

Linux user owning the secret file.

Type: string

Default: "authelia"

Declared by:

Systemd units to restart after the secret is updated.

Type: list of string

Default: [ ]

Declared by:

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: path

Default: "/run/secrets/secret"

Declared by:

Upon starting the service, disable maintenance mode if set.

This is useful if a deploy failed and you try to redeploy.

Type: boolean

Default: true

Declared by:

Backup configuration. This is an output option.

Use it to initialize a block implementing the “backup” contract. For example, with the restic block:

shb.restic.instances."nextcloud" = {
  request = config.shb.nextcloud.backup;
  settings = {
    enable = true;
  };
};

Type: submodule (read only)

Default:

{
  excludePatterns = [
    ".rnd"
  ];
  sourceDirectories = [
    "/var/lib/nextcloud"
  ];
  user = "nextcloud";
}

Declared by:

File patterns to exclude.

Type: list of string

Default: [ ]

Declared by:

Hooks to run around the backup.

Type: submodule

Default: { }

Declared by:

Hooks to run after backup.

Type: list of string

Default: [ ]

Declared by:

Hooks to run before backup.

Type: list of string

Default: [ ]

Declared by:

Directories to backup.

Type: non-empty (list of string)

Declared by:

Unix user doing the backups.

Type: string

Declared by:

Folder where Nextcloud will store all its data.

Type: string

Default: "/var/lib/nextcloud"

Declared by:

Enable more verbose logging.

Type: boolean

Default: false

Example: true

Declared by:

Two letters region defining default region.

Type: string

Example: "US"

Declared by:

Domain under which Nextcloud is served.

<subdomain>.<domain>[:<port>]

Type: string

Example: "domain.com"

Declared by:

External fqdn used to access Nextcloud. Defaults to <subdomain>.<domain>. This should only be set if you include the port when accessing Nextcloud.

Type: null or string

Default: null

Example: "nextcloud.domain.com:8080"

Declared by:

Extra apps to install.

Should be a function returning an attrSet of appid as keys to packages as values, like generated by fetchNextcloudApp. The appid must be identical to the id value in the apps’ appinfo/info.xml. Search in nixpkgs for the NN.json files for existing apps.

You can still install apps through the appstore.

Type: raw value

Default: null

Example:

apps: {
  inherit (apps) mail calendar contact;
  phonetrack = pkgs.fetchNextcloudApp {
    name = "phonetrack";
    sha256 = "0qf366vbahyl27p9mshfma1as4nvql6w75zy2zk5xwwbp343vsbc";
    url = "https://gitlab.com/eneiluj/phonetrack-oc/-/wikis/uploads/931aaaf8dca24bf31a7e169a83c17235/phonetrack-0.6.9.tar.gz";
    version = "0.6.9";
  };
}

Declared by:

The upload limit for files. This changes the relevant options in php.ini and nginx if enabled.

Type: string

Default: "4G"

Declared by:

If given, all the systemd services and timers will depend on the specified mount point systemd services.

Type: list of string

Default: [ ]

Example: ["var.mount"]

Declared by:

Settings for PHPFPM.

Type: null or (attribute set of anything)

Default: null

Example:

{
  "pm" = "dynamic";
  "pm.max_children" = 50;
  "pm.start_servers" = 25;
  "pm.min_spare_servers" = 10;
  "pm.max_spare_servers" = 20;
  "pm.max_spawn_rate" = 50;
  "pm.max_requests" = 50;
  "pm.process_idle_timeout" = "20s";
}

Declared by:

Port under which Nextcloud will be served. If null is given, then the port is omitted.

<subdomain>.<domain>[:<port>]

Type: null or 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: null

Declared by:

Settings for the PostgreSQL database.

Go to https://pgtune.leopard.in.ua/ and copy the generated configuration here.

Type: null or (attribute set of string)

Default: null

Example:

{
  # From https://pgtune.leopard.in.ua/ with:

  # DB Version: 14
  # OS Type: linux
  # DB Type: dw
  # Total Memory (RAM): 7 GB
  # CPUs num: 4
  # Connections num: 100
  # Data Storage: ssd

  max_connections = "100";
  shared_buffers = "1792MB";
  effective_cache_size = "5376MB";
  maintenance_work_mem = "896MB";
  checkpoint_completion_target = "0.9";
  wal_buffers = "16MB";
  default_statistics_target = "500";
  random_page_cost = "1.1";
  effective_io_concurrency = "200";
  work_mem = "4587kB";
  huge_pages = "off";
  min_wal_size = "4GB";
  max_wal_size = "16GB";
  max_worker_processes = "4";
  max_parallel_workers_per_gather = "2";
  max_parallel_workers = "4";
  max_parallel_maintenance_workers = "2";
}

Declared by:

Path to SSL files

Type: null or (anything)

Default: null

Declared by:

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: anything

Declared by:

Path to the cert file.

Type: path

Declared by:

Path to the key file.

Type: path

Declared by:

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example: "cert-generator.service"

Declared by:

Subdomain under which Nextcloud will be served.

<subdomain>.<domain>[:<port>]

Type: string

Example: "nextcloud"

Declared by:

Enable xdebug tracing.

To trigger writing a trace to /var/log/xdebug, add a the following header:

XDEBUG_TRACE <shb.nextcloud.tracing value>

The response will contain the following header:

x-xdebug-profile-filename /var/log/xdebug/cachegrind.out.63484

Type: null or string

Default: null

Example: "debug_me"

Declared by:

Nextcloud version to choose from.

Type: one of 28, 29

Default: 28

Declared by: