new era nextcloud

configurations/server.nix

@@ -113,6 +113,9 @@ let
         hostName = "${xlib.device.hostname}";
         networkmanager.enable = true;
         firewall.enable = false;
+        # nameservers = [
+        #   "127.0.0.1"
+        # ];
       };
 
       system = {

modules/essentials/secrets/settings.yaml

@@ -0,0 +1,17 @@
+root-ca: ENC[AES256_GCM,data:5WxHCyp8sWl+XMpmMFQGfs+IhZx0r61JVFp7TJsn4pnCwV2KY/eyh6pEF+GF+P7eXALPEWGzdFYTzMJd6KJ+D+Ew0bLomIZ+KVhlxhgVzKG0xThrLpxSuyrrRFFfXzMz7C28v1HlBht6xtwKouPnxQcXDYTLyV52w7FrhWTXPuJ+TvaYDlHJcs3wHY5U+UiCoQZMcM8ddNkgbMqCu+/QC4G213EoJvjhQz+woXzIuqN8SYsOVmQ5su9Xy1sDMc8vIF+vl1Ax1E+T7ZqnE4E/7Y7HNzBQFpBGZjTb3JLUoyO4ALo0S36Yls12MWj/AZBmoBG8yL4wwA48FBHzGyH1aYtbWA/twJLDYzmu9saORW/TKIMrzeruxdufWU9sRs1f2BxpefAa2kZ8QTxhx2+3kUiOC1lipIjdMu9RSeq7q4HmKRTmuuXW087ere+IMhogh11RoshttB1W0/BU/dz6sYwAnCioSoOCd3n+WBGfuMNyeDjkpNJ4veg2HuU/K84rLFjNsxWnRfQML0BjUDHzFypA4dNIDo/FI0Z1cOrPojiqjwKt5Fb0XljTwfDQvkRtcZOQLVln7HfJlsU67YUCBMgJUJUTC3XKo82smZbz8JV1z8I9hVfnSfoEMiqNvDu3wKPGDpjWq0hAKD2R82keKe3Ji33Z2O4HK0e0Q7vSPP/Z5gIAay2S2aS2YLpqlvgzipqiLo2owzM2Mr4NrKRL9Vg36na7bLBPEoz+l9EK8EEiZaq+c8H2+dpmXpdmnUMQDF5yBxs4EU2M6Ga+X+2SYd1q9aZBT0yxykFkQrMUcA==,iv:Ee4tvSVLdk0Clh8vohbajEaKXJlQJjqOIu2lxfWueAI=,tag:oy99+HrMV1uGCdcAy7epug==,type:str]
+intermediate-ca: ENC[AES256_GCM,data:NUMdfNy+Opi/UypY1N2N8pZZK99m3VouzLxA7EKwC2sd2Q24uEflRfucjWupAASp7duncfSjmC1jQxCQpSzwV7Qbq3+PkKD+MnrceVzz40G97C5jEKEJG6ln5RdwGX5FeIF9tZpb/gBvkWcyrPQ6wDEpzd9rCDGJgvPzg/PaFuluO6UXKpppyC9Zzl2x/dms+2pV2aQcR0rEPEuXKK7NKxc+Zk3HFgcfhe26mbayZXZxdxs44vwPqPKr6xmWRiERBlCoMEfjLSWAiVjau/RXsW+/5Mtu80rbiRUHUesdZYIX4hqfoj914Mp1gsQ+bihnfBQ3xYyxtskBfHO8+oZNvOcDhx7zl8Vo+giD4435EYEFWNxjzRtbXoR0CHu50obmDDjpPcUpkRNzjpJK3VEJM45SEA2EZyupmf+Y8o4uHmOg/xTciVHLFqVOnchb6pm9WPbkyMT9K/+O9XvN3yVJzab6se6DdnEB/8PeA4s51M0ONk6PrFXSGdfwos84BmD8uaAqGhp64sXpTuunhfcmo02b1pZ2OqlGnjam5ZJOuyJ6vPeVYB/o60Dl/w5QtdeWc93EgsxNRAOyxOsrtSKdQPuZgp7+/I4S6kYaRJS8S7mvqSNdtCdrov1vYSEoHDXtu2XaDaJrStHJsP1FmTAAmXhzeyfGosB9JX7sdOGRkskesREqkzJ5V7+O0k3cpHFJvIZIFyj12rwpPSnrB66BELAQVxkqeol2dfPWn+G1aG9dmtq3T7+C3M5wW7VE41mmVgUrx9o4/8Z3wkHkBxZXiUkN4LfFHcZXmvuHFqRYYBOUpTzxRCkW6dl/gvP0qedMR3/zplhe51Gux7IFW7/s0wvTWHqWrpxirpW+c4l/IGf53Ox7kt3D,iv:atbEM7iZALuT1UipYmxlH0k0FOPJ7VKrfPrmCs3X9Mo=,tag:w6l49PKgjlzTZa1mIVpI4A==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSamN6dkxYalBZc25EYThR
+            NnV0YW5oQWgrQWNhSE9Gemt3VGljaE0rTGcwCnYyV2JpdW1GbEZTRElDNFk2Y213
+            bk1FY1grM2tuc0UzV21ROG5BanpjbFEKLS0tIG83dnpNQzEvYVZ1ODArRjlYSFRY
+            WHp0NktOQVF0UW1KajhYM3U5WkZCNmsKrN8T73fg7JoT+7WheveOC3Jlxa79EFjs
+            ePfVY07TKEHsycFhNyjcsFCWMF2ddE7q28A+Sjg+C3SA+/cHO8U9lw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
+    lastmodified: "2026-06-23T20:42:27Z"
+    mac: ENC[AES256_GCM,data:XftvodNnD0YXmd1GsNt2w820CWYY3v2pXOtlFYE0k25kuKNeKqqGDgN4geTA/xh6eYMrDut6mryNHOOoWXTuU9r/NvpXotwT5/vW2s4Nq+Cd9XySceJn/Ja6aN8R5ICbq3BhmpmC3SCVXDTce4+MwIHeBmp+Lrff+mXvZ5cT1A4=,iv:FqI/KdPJFHOMHykeZj0oEcuIZsCBWF1WCK4saz9Es7g=,tag:IZ1xHkB4eqkp04L2iAbkOw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

modules/essentials/settings.nix

@@ -64,6 +64,34 @@
         });
       '';
     };
+    pki.certificates = [
+      ''
+        -----BEGIN CERTIFICATE-----
+        MIIBlDCCATmgAwIBAgIQUR+DM/LKIbokKxYPGZbCCjAKBggqhkjOPQQDAjAoMQ4w
+        DAYDVQQKEwVaZXJvUTEWMBQGA1UEAxMNWmVyb1EgUm9vdCBDQTAeFw0yNjA2MTMy
+        MjU2MDZaFw0zNjA2MTAyMjU2MDZaMCgxDjAMBgNVBAoTBVplcm9RMRYwFAYDVQQD
+        Ew1aZXJvUSBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgbhGtnlm
+        qd2Uv1B1VBSeg6NlXFMj4BG/k5gVu9bVFBK4cw9HVx21aHw9HhFW94P2KaySR6bu
+        K8tLDtzvs0xkyqNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
+        AQEwHQYDVR0OBBYEFH07/1blaqp0MVuSZIUHS9W3SjIrMAoGCCqGSM49BAMCA0kA
+        MEYCIQD1coTa7hqU1PAdnamAIgq1ApadDWpWfNaXPGiLCrkxTwIhAJhj/YSzqTJR
+        HvurdJ9m2glxV3rQHIUiVqKbQRcibObd
+        -----END CERTIFICATE-----
+        -----BEGIN CERTIFICATE-----
+        MIIBvjCCAWOgAwIBAgIRAMiJigRk8xbvHhCWN6a7D68wCgYIKoZIzj0EAwIwKDEO
+        MAwGA1UEChMFWmVyb1ExFjAUBgNVBAMTDVplcm9RIFJvb3QgQ0EwHhcNMjYwNjEz
+        MjI1NjA3WhcNMzYwNjEwMjI1NjA3WjAwMQ4wDAYDVQQKEwVaZXJvUTEeMBwGA1UE
+        AxMVWmVyb1EgSW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
+        QgAE2gUlKZ/z9kt5RrdYZHnGE1TVVegn+aDmGpZk5uvF04O9k/sfjD6QE7VtjwNH
+        ervZKu3iBXGRg92ba0k369VJpKNmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB
+        /wQIMAYBAf8CAQAwHQYDVR0OBBYEFCtYg4LEAHPIMrDPO7lrxKuFvw4PMB8GA1Ud
+        IwQYMBaAFH07/1blaqp0MVuSZIUHS9W3SjIrMAoGCCqGSM49BAMCA0kAMEYCIQD2
+        nNNHqs9/mIstOxetObgg8eqbrPWHXEVQ9CDucNFmQAIhANXAz2z1Rc7hxc6er23W
+        I8TU6UQc8dledPvalDJLyGym
+        -----END CERTIFICATE-----
+
+      ''
+    ];
   };
   systemd.network.wait-online.enable = false;
 
@@ -75,4 +103,23 @@
       "ru_RU.UTF-8/UTF-8"
     ];
   };
+
+  # sops.secrets = {
+  #   intermediate-ca = {
+  #     format = "yaml";
+  #     key = "intermediate-ca";
+  #     sopsFile = ./secrets/settings.yaml;
+  #     # owner = "nobody";
+  #     # group = "nogroup";
+  #     mode = "0700";
+  #   };
+  #   root-ca = {
+  #     format = "yaml";
+  #     key = "root-ca";
+  #     sopsFile = ./secrets/settings.yaml;
+  #     # owner = "nobody";
+  #     # group = "nogroup";
+  #     mode = "0700";
+  #   };
+  # };
 }

modules/server/bentopdf.nix

@@ -9,8 +9,14 @@
 {
   services.bentopdf = {
     enable = true;
-    domain = "bentopdf.local";
-    nginx.enable = true;
+    domain = "pdf.home.arpa";
+    nginx = {
+      enable = true;
+      # virtualHost = {
+      #   forceSSL = true;
+      #   enableACME = true;
+      # };
+    };
     # package = pkgs-stable.bentopdf;
   };
 }

modules/server/coredns.nix

@@ -9,19 +9,16 @@
     config = ''
       zeroq.su:53 {
           hosts {
-              192.168.1.20 agent.zeroq.su
-              192.168.1.20 bentopdf.zeroq.su
-              192.168.1.20 calibre.zeroq.su
-              192.168.1.20 dns.zeroq.su
-              192.168.1.20 flux.zeroq.su
-              192.168.1.20 gitea.zeroq.su
-              192.168.1.20 health.zeroq.su
-              192.168.1.20 immich.zeroq.su
-              192.168.1.20 kuma.zeroq.su
-              192.168.1.20 n8n.zeroq.su
-              192.168.1.20 nextcloud.zeroq.su
-              192.168.1.20 office.zeroq.su
               109.248.161.5 x.zeroq.su
+              192.168.1.20 calibre.home.arpa
+              192.168.1.20 dns.home.arpa
+              192.168.1.20 flux.home.arpa
+              192.168.1.20 git.home.arpa
+              192.168.1.20 immich.home.arpa
+              192.168.1.20 kuma.home.arpa
+              192.168.1.20 nextcloud.home.arpa
+              192.168.1.20 office.home.arpa
+              192.168.1.20 pdf.home.arpa
               fallthrough
           }
           cache 300

modules/server/nextcloud.nix

@@ -18,7 +18,7 @@ in
     nextcloud-whiteboard-server = {
       enable = true;
       settings = {
-        NEXTCLOUD_URL = "http://nextcloud.private";
+        NEXTCLOUD_URL = "https://nextcloud.home.arpa";
       };
       secrets = [ config.sops.secrets.nextcloud-whiteboard-jwt.path ];
     };
@@ -29,6 +29,7 @@ in
       database.createLocally = true;
       home = "${xlib.dirs.services-mnt-folder}/nextcloud";
       configureRedis = true;
+      https = true;
       caching = {
         redis = true;
         memcached = true;
@@ -47,23 +48,25 @@ in
           "100.64.0.0"
           "192.168.1.20"
           "localhost"
-          "nextcloud.local"
           "nextcloud.private"
           "nextcloud.zeroq.su"
-          "office.local"
           "office.zeroq.su"
+          "office.home.arpa"
+          "nextcloud.home.arpa"
         ];
         trusted_proxies = [
           "100.64.1.0"
+          "192.168.1.20"
           "109.248.161.5"
         ];
-        overwriteprotocol = ""; # maybe no
+        overwriteprotocol = "https"; # maybe no
       };
       extraAppsEnable = true;
       appstoreEnable = false;
       notify_push = {
-        enable = false;
+        enable = true;
         bendDomainToLocalhost = true;
+        nextcloudUrl = "https://nextcloud.home.arpa";
       };
       # phpPackage = pkgs.php85;
       extraApps = {
@@ -137,7 +140,7 @@ in
     # };
     onlyoffice = {
       enable = true;
-      hostname = "office.local";
+      hostname = "office.home.arpa";
       port = 8090;
       allowLocalConnections = true;
       wopi = true;

modules/server/nginx.nix

@@ -31,11 +31,11 @@ in
             }
           ];
         };
-        "office.local" = {
-          forceSSL = false;
-          enableACME = false;
+        "office.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
         };
-        "bentopdf.local" = {
+        "pdf.home.arpa" = {
           forceSSL = false;
           enableACME = false;
           listen = [
@@ -56,9 +56,9 @@ in
             client_max_body_size 5G;
           '';
         };
-        "nextcloud.local" = {
-          forceSSL = false;
-          enableACME = false;
+        "nextcloud.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
           locations = {
             "/" = {
               proxyPass = "http://${server}:10000";
@@ -73,9 +73,20 @@ in
             client_max_body_size 5G;
           '';
         };
-        "gitea.local" = {
+        "ca.home.arpa" = {
           forceSSL = false;
           enableACME = false;
+          locations."/" = {
+            proxyPass = "http://${server}:9000";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        "git.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
           locations."/" = {
             proxyPass = "http://${server}:3000";
             proxyWebsockets = true;
@@ -84,69 +95,36 @@ in
             client_max_body_size 5G;
           '';
         };
-        "nextcloud.zeroq.su" = {
-          forceSSL = false;
-          enableACME = false;
-          locations = {
-            "/" = {
-              proxyPass = "http://${server}:10000";
-              proxyWebsockets = true;
-            };
-            "/whiteboard" = {
-              proxyPass = "http://${server}:3002";
-              proxyWebsockets = true;
-            };
-          };
-          extraConfig = ''
-            client_max_body_size 5G;
-          '';
-        };
-        "n8n.local" = {
-          forceSSL = false;
-          enableACME = false;
-          locations."/" = {
-            proxyPass = "http://${server}:5678";
-            proxyWebsockets = true;
-          };
-          extraConfig = ''
-            client_max_body_size 5G;
-          '';
-        };
-        "kuma.local" = {
-          forceSSL = false;
-          enableACME = false;
+        # "n8n.home.arpa" = {
+        #   forceSSL = true;
+        #   enableACME = true;
+        #   locations."/" = {
+        #     proxyPass = "http://${server}:5678";
+        #     proxyWebsockets = true;
+        #   };
+        #   extraConfig = ''
+        #     client_max_body_size 5G;
+        #   '';
+        # };
+        "kuma.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
           locations."/" = {
             proxyPass = "http://${server}:4001";
             proxyWebsockets = true;
           };
         };
-        "health.local" = {
-          forceSSL = false;
-          enableACME = false;
-          locations."/" = {
-            proxyPass = "http://${server}:19999";
-            proxyWebsockets = true;
-          };
-        };
-        "agent.local" = {
-          forceSSL = false;
-          enableACME = false;
-          locations."/" = {
-            proxyPass = "http://${server}:3000";
-            proxyWebsockets = true;
-          };
-        };
-        "flux.local" = {
-          forceSSL = false;
-          enableACME = false;
+        "flux.home.arpa" = {
+          addSSL = true;
+          enableACME = true;
           locations."/" = {
             proxyPass = "http://${server}:6061";
             proxyWebsockets = true;
           };
         };
-        "immich.local" = {
-          forceSSL = false;
-          enableACME = false;
+        "immich.home.arpa" = {
+          addSSL = true;
+          enableACME = true;
           locations."/" = {
             proxyPass = "http://${server}:2283";
             proxyWebsockets = true;
@@ -155,9 +133,9 @@ in
             client_max_body_size 5G;
           '';
         };
-        "calibre.local" = {
-          forceSSL = false;
-          enableACME = false;
+        "calibre.home.arpa" = {
+          forceSSL = true;
+          enableACME = true;
           locations."/" = {
             proxyPass = "http://${server}:8083";
             proxyWebsockets = true;
@@ -166,7 +144,7 @@ in
             client_max_body_size 5G;
           '';
         };
-        # "zeroq.local" = {
+        # "zeroq.home.arpa" = {
         #   forceSSL = false;
         #   enableACME = false;
         #   root = pkgs.writeTextDir "index.html" ''
@@ -191,4 +169,14 @@ in
       };
     };
   };
+  security = {
+    acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "oqyude@zeroq.su";
+        server = "https://localhost:9000/acme/acme/directory";
+        dnsProvider = null;
+      };
+    };
+  };
 }

modules/server/secrets/step-ca.yaml

@@ -10,7 +10,7 @@ sops:
             IUYmiWPlPd1IDV1NeMtlSYtO8exzB22XL9DqW4x/tJ7DeSZaBsjcOw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
-    lastmodified: "2026-06-13T22:59:34Z"
-    mac: ENC[AES256_GCM,data:72E73xauS1Xrfw6tcyN/PHSJZ4ZZnIeKp8JVUPFGPBvIzaD6ZThYZwQ10FDD4JF+YOwn3QhCEh3t0ozcSNNnJFkyBgSqFtRMkym0ede12VAOPu2wQFoNvMdkT7+n14lJ/9OOz6KDyMf0BQDJKlSfDBkt+mLi61zte5iUxPsWsp4=,iv:xuOwFBEnlRgbaVdMq4O6w9T2edpS6uEPh9yhNbYBJIk=,tag:Y+dtcU17Q83o/9Nt1LGCcg==,type:str]
+    lastmodified: "2026-06-23T20:42:29Z"
+    mac: ENC[AES256_GCM,data:pyayAQOBIBKwfpTCykHtVELGKmhrpS9Mu18wwl3aYyvEwdqqhfSbzt2fXURgWAbrsax6KzrTfi2bgixy8NxRibI+o5/magGAXdk0N5RUP68/FPe1cSL6ZRry+00WjJp8x75wbSp64GU0xY7uUuq+oUKfckGCsY/m4AODbZWU1Ic=,iv:jEpnTyllRd46vPiGG2VlZkFOgwcKQNSov1W813uLQEM=,tag:B7BNlVvhgm9HI/zUQneVQw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1

modules/server/step-ca.nix

@@ -22,7 +22,9 @@ in
       key = "${varDir}/secrets/intermediate_ca_key";
       # address = "0.0.0.0:9000";
       dnsNames = [
-        "ca.zeroq.su"
+        "*.zeroq.su"
+        "*.home.arpa"
+        "localhost"
       ];
       db = {
         type = "badgerv2";
@@ -30,6 +32,10 @@ in
       };
       authority = {
         provisioners = [
+          {
+            type = "ACME";
+            name = "acme";
+          }
           {
             type = "JWK";
             name = "oqyude@zeroq.su";