Add collabora online and move nextcloud domain

common/server/nextcloud.nix

@@ -3,28 +3,39 @@
 
 let
   cfg = config.services.nextcloud;
+
+  nextcloudHostname = "runyan.org";
+  collaboraOnlineHostname = "docs.runyan.org";
 in
 {
   config = lib.mkIf cfg.enable {
     services.nextcloud = {
       https = true;
       package = pkgs.nextcloud31;
-      hostName = "neet.cloud";
+      hostName = nextcloudHostname;
       config.dbtype = "sqlite";
       config.adminuser = "jeremy";
       config.adminpassFile = "/run/agenix/nextcloud-pw";
+
+      # Apps
       autoUpdateApps.enable = true;
+      extraAppsEnable = true;
       extraApps = with config.services.nextcloud.package.packages.apps; {
         # Want
         inherit end_to_end_encryption mail spreed;
 
+        # For collabora-online
+        inherit richdocuments;
+
         # Might use
-        inherit bookmarks calendar cookbook deck memories onlyoffice qownnotesapi;
+        inherit bookmarks calendar cookbook deck memories qownnotesapi;
 
         # Try out
         # inherit maps music news notes phonetrack polls forms;
       };
-      extraAppsEnable = true;
+
+      # Allows installing Apps from the UI (might remove later)
+      appstoreEnable = true;
     };
     age.secrets.nextcloud-pw = {
       file = ../../secrets/nextcloud-pw.age;
@@ -40,5 +51,64 @@ in
       enableACME = true;
       forceSSL = true;
     };
+
+    # https://diogotc.com/blog/collabora-nextcloud-nixos/
+    services.collabora-online = {
+      enable = true;
+      port = 15972;
+      settings = {
+        # Rely on reverse proxy for SSL
+        ssl = {
+          enable = false;
+          termination = true;
+        };
+
+        # Listen on loopback interface only
+        net = {
+          listen = "loopback";
+          post_allow.host = [ "localhost" ];
+        };
+
+        # Restrict loading documents from WOPI Host
+        storage.wopi = {
+          "@allow" = true;
+          host = [ config.services.nextcloud.hostName ];
+        };
+
+        server_name = collaboraOnlineHostname;
+      };
+    };
+    services.nginx.virtualHosts.${config.services.collabora-online.settings.server_name} = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.collabora-online.port}";
+        proxyWebsockets = true;
+      };
+    };
+    systemd.services.nextcloud-config-collabora =
+      let
+        inherit (config.services.nextcloud) occ;
+
+        wopi_url = "http://localhost:${toString config.services.collabora-online.port}";
+        public_wopi_url = "https://${collaboraOnlineHostname}";
+        wopi_allowlist = lib.concatStringsSep "," [
+          "127.0.0.1"
+          "::1"
+        ];
+      in
+      {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "nextcloud-setup.service" ];
+        script = ''
+          ${occ}/bin/nextcloud-occ config:app:set richdocuments wopi_url --value ${lib.escapeShellArg wopi_url}
+          ${occ}/bin/nextcloud-occ config:app:set richdocuments public_wopi_url --value ${lib.escapeShellArg public_wopi_url}
+          ${occ}/bin/nextcloud-occ config:app:set richdocuments wopi_allowlist --value ${lib.escapeShellArg wopi_allowlist}
+          ${occ}/bin/nextcloud-occ richdocuments:setup
+        '';
+        serviceConfig = {
+          Type = "oneshot";
+        };
+      };
   };
 }

machines/ponyo/default.nix

@@ -66,7 +66,7 @@
       host = "chat.neet.space";
     };
     jitsi-meet = {
-      enable = false; # disabled until vulnerable libolm dependency is removed/fixed
+      enable = true;
       host = "meet.neet.space";
     };
     turn = {
@@ -95,12 +95,12 @@
     root = "/var/www/tmp";
   };
 
-  # redirect runyan.org to github
-  services.nginx.virtualHosts."runyan.org" = {
+  # redirect neet.cloud to nextcloud instance on runyan.org
+  services.nginx.virtualHosts."neet.cloud" = {
     enableACME = true;
     forceSSL = true;
     extraConfig = ''
-      rewrite ^/(.*)$ https://github.com/GoogleBot42 redirect;
+      return 302 https://runyan.org$request_uri;
     '';
   };