add nextcloud my-service with sqlite

nixos/newton/configuration.nix

@@ -12,20 +12,15 @@
     ../modules/docker.nix
     ../modules/networkdecrypt.nix
     ../modules/nix.nix
-    ../modules/ssh.nix
     ../modules/users.nix
-    ../modules/webapps/gitea.nix
-    ../modules/webapps/hedgedoc.nix
-    ../modules/webapps/homer.nix
-    ../modules/webapps/navidrome.nix
-    ../modules/webapps/paperless.nix
-    ../modules/webapps/radicale.nix
+    #../modules/webapps/radicale.nix
   ];
+
   networking.hostName = "newton";
 
   sops = {
     defaultSopsFile = ./secrets.yaml;
-    gnupg.sshKeyPaths = [];
+    gnupg.sshKeyPaths = [ ];
   };
 
   #environment.noXlibs = true;

nixos/newton/secrets.yaml

@@ -11,6 +11,8 @@ paperless:
     password: ENC[AES256_GCM,data:GrH2MEFUGSoJEUnFUb5nTxHHnnSIohwEUVU+2Xpa,iv:U9tDsq5PsqFzzl1e1sYUL5XxUqGEmdiZoJtCh96+yEA=,tag:qVu2bulQ9wz+K0lmbMULzQ==,type:str]
 freshrss:
     password: ENC[AES256_GCM,data:dUOKeRxovwIHIchkwMFxsQYEKrU2muY=,iv:OA1zbIiV3NBWIoJLpxpLBEjR/I6m5vzVKvzMEZYYE7Q=,tag:r4PbEbEkSH3bsJMamDuuFw==,type:str]
+nextcloud:
+    password: ENC[AES256_GCM,data:uE507Ij34zJVYnd2YkNCGj8hpFpEM5w=,iv:x8BNCUaAas0poQ/Lo0izZApF6l52xal8DDrClIzWjvk=,tag:sA08dmcVQbKswX9hF/txag==,type:str]
 sso:
     auth-key: ENC[AES256_GCM,data:jFDeymziDiJMnoIGjYPMmnxTzKer1bFffGDaoHnbKlpMPslP/Bmtsc5kio2tbDBlxG0TCdf+ePirPPw2,iv:8wGHEp1gB/qgkSvqkqjb9zBnqkkl1+Ezm9tCFS8tL3w=,tag:tHIT9Iw29TUXJm2e7z3Z/A==,type:str]
     felix:
@@ -42,8 +44,8 @@ sops:
             NmNwT3N5UEVabFdLTDhseFRjeVZaWFkKL3HGFqfttU1tXY4OhnIr1ABFsHB0R0CX
             s6wxb0ilut32ijjtnGXMIIa9y6XsMTpYskTb9FdRP9VnQQGVrMfdew==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-10-02T21:20:32Z"
-    mac: ENC[AES256_GCM,data:TdxemiZ8xz3BuoBy8JB/J15Bikl6+LMR8QqVwWlo45kY1hFVKF7dJGOohGng1jX1GQ6Ec89iw1yRNtMtTpEcRzQgrcMtZQwtM7n/+YNcTVYifTGsRBt/VojB9QWRqy1xclLwWMzBL4q0PWAh1ljVtAhB2lL+QQ7aUiWeFrb969g=,iv:zjbdzkLn4YcenCcO+iP3H3RQ19Fq5eo1dai65QBahPY=,tag:ZNC27P3Jl4PlRZptxmgbAQ==,type:str]
+    lastmodified: "2022-11-13T15:50:14Z"
+    mac: ENC[AES256_GCM,data:RmNsaye+hanRtzO1BNj6Q/LKS4ACRufzs7TGGcQHfVbi8QyrBqltGoox9ukgaN5PqBNR+uz3+Grpzkjj33xtdJuSRoHNk7aa/q2FHFHmJs+qIggf3HRzgfmBPkP0K9kJdFeOYvy0XoZWMdmaZ9H3fC8kqbEkQPMTrwnKEiDOx6M=,iv:ntjiRk8UUbsnPaKW1AxEoa8RRejA9LCKYNGD6s8dKwI=,tag:hKi3HZoMuOwtAcd7oyUZgw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.7.3

nixos/newton/services.nix

@@ -4,11 +4,85 @@ let
   secrets = config.sops.secrets;
 in
 {
+  sops.secrets."acme/inwx" = { };
+  sops.secrets."sso/auth-key" = { };
+  sops.secrets."sso/felix/password-hash" = { };
+  sops.secrets."sso/felix/totp-secret" = { };
+  sops.secrets."paperless/password" = { };
+  sops.secrets."nextcloud/password" = { };
+  sops.secrets."nextcloud/password".owner = config.users.users.nextcloud.name;
+
   # List services that you want to enable:
   my.services = {
+    # My own personal homepage
+    homepage = {
+      enable = true;
+    };
+    # Dashboard
+    homer = {
+      enable = true;
+    };
     # RSS provider for websites that do not provide any feeds
-    rss-bridge.enable = true;
-    # Voice-chat server
-    mumble-server.enable = true;
+    rss-bridge = {
+      enable = true;
+    };
+    # voice-chat server
+    mumble-server = {
+      enable = true;
+    };
+    # sandbox video game
+    minecraft-server = {
+      enable = true;
+    };
+    # music streaming server
+    navidrome = {
+      enable = true;
+      musicFolder = "/srv/data/music";
+    };
+    # self-hosted cloud
+    nextcloud = {
+      enable = true;
+      passwordFile = secrets."nextcloud/password".path;
+    };
+    # document management system
+    paperless = {
+      enable = true;
+      passwordFile = secrets."paperless/password".path;
+      extraConfig.PAPERLESS_ADMIN_USER = "felix";
+    };
+    # self-hosted git service
+    gitea = {
+      enable = true;
+    };
+    # collaborative markdown editor
+    hedgedoc = {
+      enable = true;
+    };
+    # a password-generator using the marokov model
+    passworts = {
+      enable = true;
+    };
+    ssh-server = {
+      enable = true;
+    };
+    # Webserver
+    nginx = {
+      enable = true;
+      acme = {
+        credentialsFile = secrets."acme/inwx".path;
+      };
+      sso = {
+        authKeyFile = secrets."sso/auth-key".path;
+        users = {
+          felix = {
+            passwordHashFile = secrets."sso/felix/password-hash".path;
+            totpSecretFile = secrets."sso/felix/totp-secret".path;
+          };
+        };
+        groups = {
+          root = [ "felix" ];
+        };
+      };
+    };
   };
 }