nixos ool

nextcloud.nix

{ config, pkgs, lib, ... }:
let
  # versions from: https://www.collaboraoffice.com/downloads/Collabora-Office-AppImage-Release/
  version = "24.4.702";
  hash = "sha256-2+roFXqKd8zXte/Gp5uBiK6eRp3wtslgW8htWKS3plQ=";

  code = pkgs.appimageTools.wrapType2 {
    name = "Collabora";
    src = pkgs.fetchurl {
      url = "https://www.collaboraoffice.com/downloads/Collabora-Office-AppImage-Release/collabora-online-${version}.AppImage";
      sha256 = hash;
    };
    # unsharePid is blocked inside a systemd container, set to false when run inside container
    unsharePid = !boot.isContainer;
  };
in
{

  systemd.services.code = {
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      DynamicUser = true;
      ExecStart = "${code}/bin/Collabora --o:ssl.termination=true --o:ssl.enable=false";
    };
  };

  services.nginx.virtualHosts."ool.example.org" = {
    enableACME = false;
    onlySSL = true;
    useACMEHost = "wildcard.example.org";

    locations."/" = {
      extraConfig = ''
        return 444;
      '';
    };

    locations."^~ /browser".proxyPass = "http://127.0.0.1:9983"; # static files
    locations."^~ /hosting/discovery".proxyPass = "http://127.0.0.1:9983"; # WOPI discovery URL
    locations."^~ /hosting/capabilities".proxyPass = "http://127.0.0.1:9983"; # Capabilities
    locations."~ ^/cool/(.*)/ws$" = {
      # main websocket
      proxyPass = "http://127.0.0.1:9983";
      proxyWebsockets = true;
      extraConfig = ''
        proxy_set_header           Upgrade $http_upgrade;
        proxy_set_header           Connection "upgrade";
        client_max_body_size       0;
        proxy_read_timeout 36000s;
      '';
    };
    locations."~ ^/(c|l)ool" = {
      proxyPass = "http://127.0.0.1:9983"; # download, presentation and image upload
      proxyWebsockets = true;
      extraConfig = ''
        proxy_set_header           Upgrade $http_upgrade;
        proxy_set_header           Connection "upgrade";
        client_max_body_size       0;
        proxy_read_timeout 36000s;
      '';
    };
  };

  services.nextcloud.settings = {
    richdocuments = {
      wopi_url = "https://ool.example.org:443";
    };
  };
}