NixOS Wiki

Nextcloud: Difference between revisions

← Older edit
Visual
imported>Onny
Update Nextcloud version
→Change default listening port: switch localhost to yourHostName to warn that they should use the configured nextcloud hostname
 
(42 intermediate revisions by 19 users not shown)
Line 1: Line 1:
[https://nextcloud.com/ {{PAGENAME}}] ([[wikipedia:en:{{PAGENAME}}]]) is a self-hosted web groupware and cloud software, offering collaboration on files, managing calendar events, contacts and tasks.
[https://nextcloud.com/ {{PAGENAME}}] ([[wikipedia:en:{{PAGENAME}}]]) is a self-hosted web groupware and cloud software, offering collaboration on files, managing calendar events, contacts and tasks.


== Installation ==
This article extends the documentation in the [https://nixos.org/manual/nixos/stable/#module-services-nextcloud NixOS manual].


A minimal example to get a Nextcloud running on localhost should look like this
== Setup ==
 
A minimal example to get the latest Nextcloud version (for your specific NixOS release) running on localhost should look like this, replacing  <code>PWD</code> with a 10+ char password that meets [https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_password_policy.html Nextcloud's default password policy].


{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
environment.etc."nextcloud-admin-pass".text = "test123";
environment.etc."nextcloud-admin-pass".text = "PWD";
services.nextcloud = {
services.nextcloud = {
   enable = true;
   enable = true;
  package = pkgs.nextcloud28;
   hostName = "localhost";
   hostName = "localhost";
   config.adminpassFile = "/etc/nextcloud-admin-pass";
   config.adminpassFile = "/etc/nextcloud-admin-pass";
Line 15: Line 16:
</nowiki>}}
</nowiki>}}


After that you will be able to login into your Nextcloud instance at http://localhost with user <code>root</code> and password <code>test123</code> as configured above.  
After that you will be able to login into your Nextcloud instance at <code><nowiki>http://localhost</nowiki></code> with user <code>root</code> and password <code>PWD</code> as configured above.


== Configuration ==
== Configuration ==
Line 23: Line 24:
=== Apps ===
=== Apps ===


[https://github.com/NixOS/nixpkgs/blob/c931a329076796d3644a6bc5b7cc41afc7b3381e/pkgs/servers/nextcloud/packages/nextcloud-apps.json Some apps] which are already packaged on NixOS can be installed directly with the following example configuration
[https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/nextcloud/packages/nextcloud-apps.json Some apps] which are already packaged on NixOS can be installed directly with the following example configuration


{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
Line 29: Line 30:
   enable = true;                   
   enable = true;                   
   [...]
   [...]
  package = pkgs.nextcloud28;
   # Instead of using pkgs.nextcloud29Packages.apps or similar,
   # Instead of using pkgs.nextcloud28Packages.apps,
   # we'll reference the package version specified in services.nextcloud.package
   # we'll reference the package version specified above
   extraApps = {
   extraApps = with config.services.nextcloud.package.packages.apps; {
    inherit (config.services.nextcloud.package.packages.apps) news contacts calendar tasks;
    inherit news contacts calendar tasks;
   };
   };
   extraAppsEnable = true;
   extraAppsEnable = true;
Line 39: Line 39:
</nowiki>}}
</nowiki>}}


The apps mail, news and contacts will be installed and enabled in your instance automatically. Note that the Nextcloud version specified in <code>package</code> and <code>extraApps</code> need to match on of the stable Nextcloud versions available in the NixOS repository.
The apps mail, news and contacts will be installed and enabled in your instance automatically. Note that the Nextcloud version specified in <code>package</code> and <code>extraApps</code> need to match one of the stable Nextcloud versions available in the NixOS repository.


To manually fetch and install packages, you need to add them via the helper script <code>fetchNextcloudApp</code> by specifing the release tarball as url and the correct checksum. Both are available for example in the official [https://apps.nextcloud.com Nextcloud app store]. Note that in this case the app package version and checksum has to be updated manually in case there is a new release.
To manually fetch and install packages, you need to add them via the helper script <code>fetchNextcloudApp</code> by specifing the release tarball as url, the correct checksum and the license. Additional apps can be found via [https://apps.nextcloud.com Nextcloud app store], while the [https://github.com/helsinki-systems/nc4nix nc4nix] provides an easy reference for the required variables. Note that the declarative specification of apps via this approach requires manual updating of package version (url) and checksum for a new release.


{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
Line 48: Line 48:
   [...]
   [...]
   extraApps = {
   extraApps = {
     mail = pkgs.fetchNextcloudApp rec {
     inherit (config.services.nextcloud.package.packages.apps) news contacts calendar tasks;
      url = "https://github.com/nextcloud-releases/mail/releases/download/v1.14.1/mail-v1.14.1.tar.gz";
     memories = pkgs.fetchNextcloudApp {
      sha256 = "sha256-sQUsYC3cco6fj9pF2l1NrCEhA3KJoOvJRhXvBlVpNqo=";
       url = "https://github.com/pulsejet/memories/releases/download/v6.2.2/memories.tar.gz";
    };
       hash = "sha256-Xr1SRSmXo2r8yOGuoMyoXhD0oPVm/0/ISHlmNZpJYsg=";
     contacts = pkgs.fetchNextcloudApp rec {
      license = "agpl3Only";
       url = "https://github.com/nextcloud-releases/contacts/releases/download/v4.2.2/contacts-v4.2.2.tar.gz";
       sha256 = "sha256-eTc51pkg3OdHJB7X4/hD39Ce+9vKzw1nlJ7BhPOzdy0=";
     };
     };
   };
   };
   extraAppsEnable = true;
   extraAppsEnable = true;
Line 91: Line 90:
Alternatively apps can be manually installed via the app store integrated in your Nextcloud instance by navigating in the profile menu to the site "Apps".
Alternatively apps can be manually installed via the app store integrated in your Nextcloud instance by navigating in the profile menu to the site "Apps".


=== SSL ===
=== TLS ===


If you would like to setup Nextcloud with Let's Encrypt TLS certificates (or certs from any other certificate authority) make sure to set <code>services.nextcloud.https = true;</code> and to enable it in the nginx-vHost.
If you would like to setup Nextcloud with Let's Encrypt TLS certificates (or certs from any other certificate authority) make sure to set <code>services.nextcloud.https = true;</code> and to enable it in the nginx-VirtualHost.


{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
Line 99: Line 98:
   enable = true;                   
   enable = true;                   
   [...]
   [...]
   hostName = "example.org";
   hostName = "nextcloud.example.org";
   https = true;
   https = true;
};
};
Line 107: Line 106:
   enableACME = true;
   enableACME = true;
};
};
security.acme = {
  acceptTerms = true; 
  certs = {
    ${config.services.nextcloud.hostName}.email = "your-letsencrypt-email@example.com";
  };
};
</nowiki>}}
</nowiki>}}


Line 116: Line 122:
services.nextcloud = {                 
services.nextcloud = {                 
   enable = true;         
   enable = true;         
  # New option since NixOS 23.05
   configureRedis = true;
   configureRedis = true;
   [...]
   [...]
Line 123: Line 128:


Note that APCu will still be used for local caching, as recommended by Nextcloud upstream.
Note that APCu will still be used for local caching, as recommended by Nextcloud upstream.
=== Object store ===
In this example we'll configure a local S3-compatible object store using Minio and connect it to Nextcloud
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{ ... } let
  accessKey = "nextcloud";
  secretKey = "test12345";
  rootCredentialsFile = pkgs.writeText "minio-credentials-full" ''
    MINIO_ROOT_USER=nextcloud
    MINIO_ROOT_PASSWORD=test12345
  '';
in {
  services.nextcloud = {               
    [...]
    config.objectstore.s3 = {
      enable = true;
      bucket = "nextcloud";
      autocreate = true;
      key = accessKey;
      secretFile = "${pkgs.writeText "secret" "test12345"}";
      hostname = "localhost";
      useSsl = false;
      port = 9000;
      usePathStyle = true;
      region = "us-east-1";
    };
  };
  services.minio = {
    enable = true;
    listenAddress = "127.0.0.1:9000";
    consoleAddress = "127.0.0.1:9001";
    inherit rootCredentialsFile;
  };
  environment.systemPackages = [ pkgs.minio-client ];
};
</nowiki>}}
We'll need to run two commands to create the bucket <code>nextcloud</code> by using the access key <code>nextcloud</code> and the secret key <code>test12345</code>.
<syntaxhighlight lang="bash">
mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4
mc mb minio/nextcloud
</syntaxhighlight>


=== Mail delivery ===
=== Mail delivery ===
Line 150: Line 206:
=== Secrets management ===
=== Secrets management ===


Do not suply passwords, hashes or keys via <code>extraOptions</code> option, since they will be copied into the world-readable Nix store. Instead reference a JSON file containing secrets using the <code>secretFile</code> option.
Do not suply passwords, hashes or keys via the settings option, since they will be copied into the world-readable Nix store. Instead reference a JSON file containing secrets using the <code>secretFile</code> option.


<syntaxHighlight lang="nix">
<syntaxHighlight lang="nix">
Line 171: Line 227:


Consider using a  [[Comparison of secret managing schemes|secret management tool]] instead of referencing an unencrypted local secrets file.
Consider using a  [[Comparison of secret managing schemes|secret management tool]] instead of referencing an unencrypted local secrets file.
=== Dynamic configuration ===
Unfortunately, some options can only be set 'interactively' in the database (either through the nextcloud-occ command line tool or the web UI), and not via the configuration file. One way to manage them "semi-declaratively" is to register a systemd script to reset the options on each redeploy:
<syntaxHighlight lang="nix">
  systemd.services.nextcloud-custom-config = {
    path = [
      config.services.nextcloud.occ
    ];
    script = ''
      nextcloud-occ theming:config name "My Cloud"
      nextcloud-occ theming:config url "https://cloud.mine.com";
      nextcloud-occ theming:config privacyUrl "https://www.mine.com/privacy";
      nextcloud-occ theming:config color "#3253a5";
      nextcloud-occ theming:config logo ${./logo.png}
    '';
    after = [ "nextcloud-setup.service" ];
    wantedBy = [ "multi-user.target" ];
  };
</syntaxHighlight>Of course this is not ideal: changes through the web interface or occ client are still possible but will be overwritten the next redeploy, and removing a line from the script will not remove it from the configuration.


== Maintenance ==
== Maintenance ==
Line 189: Line 265:
You can access the mysql database, for backup/restore, etc. like this:
You can access the mysql database, for backup/restore, etc. like this:


<code>sudo runuser -u nextcloud -- mysql -u nextcloud <options></code>
<code>sudo -u nextcloud -- mysql -u nextcloud <options></code>


No password is required.
No password is required.
Line 197: Line 273:
=== Nextcloudcmd ===
=== Nextcloudcmd ===


''nextcloudcmd'' is a terminal client performing only a single sync run and then exits. The following example command will synchronize the local folder <code>/home/myuser/music</code> with the remote folder <code>/music</code> of the Nextcloud server <code>https://nextcloud.example.org</code>.
''nextcloudcmd'' is a terminal client performing only a single sync run and then exits. The following example command will synchronize the local folder <code>/home/myuser/music</code> with the remote folder <code>/music</code> of the Nextcloud server <code><nowiki>https://nextcloud.example.org</nowiki></code>.
   
   
<syntaxhighlight lang="console">
<syntaxhighlight lang="console">
Line 209: Line 285:
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
home-manager.users.myuser = {
home-manager.users.myuser = {
 
  home.file.".netrc".text = ''default
    login example
    password test123
  '';
   systemd.user = {
   systemd.user = {
     services.nextcloud-autosync = {
     services.nextcloud-autosync = {
Line 238: Line 308:
     startServices = true;
     startServices = true;
   };
   };
};
};
</nowiki>}}
</nowiki>}}
Line 247: Line 316:


"nextcloud-client" is a nextcloud themed desktop client.
"nextcloud-client" is a nextcloud themed desktop client.
It requires a keyring to store its login token. Without an active keyring, the user will be asked for to login on every application startup.
It requires a keyring to store its login token. Without an active keyring, the user will be asked to login on every application startup.


== Tips and tricks ==
== Tips and tricks ==
Line 256: Line 325:


{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
services.nginx.virtualHosts."localhost".listen = [ { addr = "127.0.0.1"; port = 8080; } ];
services.nginx.virtualHosts."yourHostName".listen = [ { addr = "127.0.0.1"; port = 8080; } ];
</nowiki>}}
</nowiki>}}


=== Enable HEIC image preview ===
=== Enable HEIC image preview ===


HEIC image preview needs to be explicitly enabled. This is done by adjusting the <code>enabledPreviewProviders</code> option. Beside the default list of supported formats, add an additional line <code>"OC\\Preview\\HEIC"</code> for HEIC image support.
HEIC image preview needs to be explicitly enabled. This is done by adjusting the <code>enabledPreviewProviders</code> option. Beside the default list of supported formats, add an additional line <code>"OC\\Preview\\HEIC"</code> for HEIC image support. See also [https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/config_sample_php_parameters.html#enabledpreviewproviders this list of preview providers] for additional file types.


{{file|/etc/nixos/configuration.nix|nix|<nowiki>
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
services.nextcloud = {
services.nextcloud = {
   extraOptions.enabledPreviewProviders = [
   settings.enabledPreviewProviders = [
     "OC\\Preview\\BMP"
     "OC\\Preview\\BMP"
     "OC\\Preview\\GIF"
     "OC\\Preview\\GIF"
Line 278: Line 347:
     "OC\\Preview\\HEIC"
     "OC\\Preview\\HEIC"
   ];
   ];
};
</nowiki>}}
=== Run Nextcloud in a sub-directory ===
Say, you don't want to run nextcloud at <code>your.site/</code> but in a sub-directory <code>your.site/nextcloud/</code>. To do so, we are going to add more configurations to nextcloud and to nginx to [[Nginx#TLS_reverse_proxy|make]] it a [https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/ reverse-proxy].
First, define some overwritings. Nextcloud uses them to write out all URLs as if it runs in a sub-directory (which it is not.)
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
services.nextcloud = {
  settings = let
    prot = "http"; # or https
    host = "127.0.0.1";
    dir = "/nextcloud";
  in {
    overwriteprotocol = prot;
    overwritehost = host;
    overwritewebroot = dir;
    overwrite.cli.url = "${prot}://${host}${dir}/";
    htaccess.RewriteBase = dir;
  };
};
</nowiki>}}
Make sure your nginx doesn't host nextcloud on your exposed port:
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
services.nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [ {
  addr = "127.0.0.1";
  port = 8080; # NOT an exposed port
} ];
</nowiki>}}
Redirect some well-known URLs which have to be found at your.site/.well-known towards your new nextcloud URL:
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
services.nginx.virtualHosts."localhost" = {
  "^~ /.well-known" = {
            priority = 9000;
            extraConfig = ''
              absolute_redirect off;
              location ~ ^/\\.well-known/(?:carddav|caldav)$ {
                return 301 /nextcloud/remote.php/dav;
              }
              location ~ ^/\\.well-known/host-meta(?:\\.json)?$ {
                return 301 /nextcloud/public.php?service=host-meta-json;
              }
              location ~ ^/\\.well-known/(?!acme-challenge|pki-validation) {
                return 301 /nextcloud/index.php$request_uri;
              }
              try_files $uri $uri/ =404;
            '';
          };
};
</nowiki>}}
Finally, forward <code>your.site/nextcloud/</code> (exposed port 80 or 443) to your unexposed nextcloud port 8080 (defined earlier):
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
services.nginx.virtualHosts."localhost" = {
  "/nextcloud/" = {
        priority = 9999;
        extraConfig = ''
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-NginX-Proxy true;
          proxy_set_header X-Forwarded-Proto http;
          proxy_pass http://127.0.0.1:8080/; # tailing / is important!
          proxy_set_header Host $host;
          proxy_cache_bypass $http_upgrade;
          proxy_redirect off;
        '';
      };
}
</nowiki>}}
Note: If you have TLS (https) enabled, make sure nginx forwards to the correct port and nextcloud overwrites for the correct protocol.
=== Use Caddy as webserver ===
Using a third-party module extension, the webserver [[Caddy]] can be used as an alternative by adding following options
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
imports = [
  "${fetchTarball {
    url = "https://github.com/onny/nixos-nextcloud-testumgebung/archive/fa6f062830b4bc3cedb9694c1dbf01d5fdf775ac.tar.gz";
    sha256 = "0gzd0276b8da3ykapgqks2zhsqdv4jjvbv97dsxg0hgrhb74z0fs";}}/nextcloud-extras.nix"
];
services.nextcloud = {
  webserver = "caddy";
};
</nowiki>}}
=== Add users declaratively ===
Using a third-party module extension, additional users can be automatically configured using the <code>ensureUsers</code> option
{{file|/etc/nixos/configuration.nix|nix|<nowiki>
imports = [
  "${fetchTarball {
    url = "https://github.com/onny/nixos-nextcloud-testumgebung/archive/fa6f062830b4bc3cedb9694c1dbf01d5fdf775ac.tar.gz";
    sha256 = "0gzd0276b8da3ykapgqks2zhsqdv4jjvbv97dsxg0hgrhb74z0fs";}}/nextcloud-extras.nix"
];
environment.etc."nextcloud-user-pass".text = "PWD";
services.nextcloud = {
  ensureUsers = {
    user1 = {
      email = "user1@localhost";
      passwordFile = "/etc/nextcloud-user-pass";
    };
    user2 = {
      email = "user2@localhost";
      passwordFile = "/etc/nextcloud-user-pass";
    };
  };
};
};
</nowiki>}}
</nowiki>}}
Line 291: Line 475:
</syntaxhighlight>
</syntaxhighlight>


=== Nextcloud-setup error: Nextcloud is not installed ===
== App specific configuration ==


You get the message
=== Whiteboard ===
The [https://github.com/nextcloud/whiteboard Whiteboard app] requires a running backend server which is also packaged in NixOS.<syntaxhighlight lang="nix">
environment.etc."nextcloud-whiteboard-secret".text = ''
  JWT_SECRET_KEY=test123
'';


<syntaxhighlight lang="console">
services.nextcloud-whiteboard-server = {
   U Wed Jul  3 06:15:06 2019 p3 nextcloud-cron.service Nextcloud[9374]: {cron} {"Exception":"Exception","Message":"Not installed","Code":0,"Trace":[{"file":"\/nix\/store\/9c58nxa9mzzg93ppwq2jlynpf4vsbd30-nextcloud-15.0.8\/lib\/base.php","line":660,"function":"checkInstalled","class":"OC","type":"::","args":[]},{"file":"\/nix\/store\/9c58nxa9mzzg93ppwq2jlynpf4vsbd30-nextcloud-15.0.8\/lib\/base.php","line":1068,"function":"init","class":"OC","type":"::","args":[]},{"file":"\/nix\/store\/9c58nxa9mzzg93ppwq2jlynpf4vsbd30-nextcloud-15.0.8\/cron.php","line":41,"args":["\/nix\/store\/9c58nxa9mzzg93ppwq2jlynpf4vsbd30-nextcloud-15.0.8\/lib\/base.php"],"function":"require_once"}],"File":"\/nix\/store\/9c58nxa9mzzg93ppwq2jlynpf4vsbd30-nextcloud-15.0.8\/lib\/base.php","Line":277,"CustomMessage":"--"}
  enable = true;
   settings.NEXTCLOUD_URL = "http://localhost";
  secrets = [ /etc/nextcloud-whiteboard-secret ];
};
</syntaxhighlight>After applying the configuration configure the Nextcloud app to use it<syntaxhighlight lang="bash">
nextcloud-occ config:app:set whiteboard collabBackendUrl --value="http://localhost:3002"
nextcloud-occ config:app:set whiteboard jwt_secret_key --value="test123"
</syntaxhighlight>
 
=== NextCloud Office ===
The [https://nextcloud.com/office/ NextCloud Office app] provides a Google Docs like online office suite integrated into NextCloud. For this to work it requires a document server that provides the editing functionality as a [[wikipedia:Web_Application_Open_Platform_Interface|WOPI]] client.
 
The main options to use as WOPI client are [https://www.onlyoffice.com/ ONLYOFFICE] and [https://www.collaboraonline.com Collabora Online]. Although the documentation makes it look like Collabora Online is the only option, any document server with WOPI capabilities can be used.
 
To enable the NextCloud Office app, add the following to your configuration:<syntaxhighlight lang="nixos">
services.nextcloud = {
  enable = true;
  extraApps = {
    inherit (config.services.nextcloud.package.packages.apps) richdocuments;
  };
}
</syntaxhighlight>
</syntaxhighlight>


Then you run into [https://github.com/NixOS/nixpkgs/issues/48045 known issue].
=== ONLYOFFICE ===
You need to install both a document server and the [https://apps.nextcloud.com/apps/onlyoffice ONLYOFFICE Nextcloud plug-in]. There are several ways to install onlyoffice:
 
===== services.onlyoffice =====
Due to https://github.com/ONLYOFFICE/onlyoffice-nextcloud/issues/931 you need to apply the workaround from https://github.com/NixOS/nixpkgs/pull/338794.
 
Then point the app to the document server from within the Nextcloud UI ("Administration Settings" -> Administration -> ONLYOFFICE), and make sure the 'services.onlyoffice.jwtSecretFile points to a file containing the same key as entered in the configuration of the Nextcloud app.
 
===== the documentserver_community Nextcloud app =====
(not tested)
 
===== in a docker/podman container =====
(not tested)
 
==== Collabora Online ====
Collabora comes in two flavors:
 
* Collabora Online For Business / For Enterprise
* Collabora Online Development Edition (aka CODE)
 
As the name indicates the former two require a license, while the latter is free for evaluation and personal use.


For easy deployment, there's the [https://apps.nextcloud.com/apps/richdocumentscode richdocumentscode app] which bundles the CODE server. While being less performant than a standalone deployment of the CODE server, this solution does not require an additional service to be deployed and managed externally from NextCloud. Unfortunately the richdocumentscode app bundles the CODE server as an AppImage and therefore does not work out of the box on NixOS. Follow https://github.com/NixOS/nixpkgs/issues/339798 if you want to get informed about packaging progress. Also CODE standalone is currently not packaged in nixpkgs (https://github.com/NixOS/nixpkgs/issues/218878).
[[Category:Server]]
[[Category:Server]]
[[Category:Applications]]
[[Category:Applications]]
[[Category:Web Applications]]
[[Category:Web Applications]]
[[Category:NixOS Manual]]
Retrieved from "https://wiki.nixos.org/wiki/Nextcloud"