make .onion domains declarative, site updates, add helpers

services/nextcloud.nix

@@ -4,18 +4,21 @@
   lib,
   ...
 }: let
-  onionDomain = "znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion";
-  onionUrl = "http://${onionDomain}";
+  onionHostName = "znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion";
 in {
-  age.secrets."nextcloud-admin-pass".file = ../secrets/nextcloud-admin-pass;
+  age.secrets = {
+    "nextcloud-admin-pass".file = ../secrets/nextcloud-admin-pass;
+    "hidden_service/nextcloud".file = ../secrets/hidden_service/nextcloud;
+  };
 
   users.groups.nextcloud.members = ["nextcloud" "caddy"];
+
   services = {
     nextcloud = {
       enable = true;
       hostName = "cloud.distrust.network";
       settings = {
-        trusted_domains = [onionDomain];
+        trusted_domains = [onionHostName];
         trusted_proxies = ["127.0.0.1"];
         maintenance_window_start = 1;
       };
@@ -38,7 +41,15 @@ in {
       "listen.owner" = "caddy";
       "listen.group" = "caddy";
     };
-    caddy.virtualHosts."https://cloud.distrust.network ${onionUrl}".extraConfig = ''
+  };
+
+  distrust.services."nextcloud" = {
+    url = "https://cloud.distrust.network";
+    onion = {
+      url = "http://${onionHostName}";
+      secretKey = config.age.secrets."hidden_service/nextcloud".path;
+    };
+    virtualHostConfig = ''
       # encode zstd gzip
 
       root * ${config.services.nginx.virtualHosts."cloud.distrust.network".root}
@@ -64,7 +75,7 @@ in {
         X-Forwarded-For {remote_host}
         X-Forwarded-Proto {scheme}
         X-Forwarded-Host {host}
-        Onion-Loation ${onionUrl}
+        Onion-Loation http://${onionHostName}
       }
 
 
@@ -98,9 +109,5 @@ in {
 
       file_server
     '';
-
-    tor.relay.onionServices."nextcloud".map = [
-      80
-    ];
   };
 }