almost ready. now to harden

services/nextcloud.nix

@@ -1,17 +1,23 @@
 {
   pkgs,
   config,
+  lib,
   ...
 }: let
-  nextcloudPort = 8081;
+  onionUrl = "http://znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion";
 in {
-  environment.etc."nextcloud-admin-pass".text = "PWD";
+  age.secrets."nextcloud-admin-pass".file = ../secrets/nextcloud-admin-pass;
+  
   services.nextcloud = {
     enable = true;
     hostName = "cloud.distrust.network";
-    settings.trusted_domains = ["znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion"];
+    settings = {
+      trusted_domains = ["znfdxs4e3rqvzxtkksiidomupgm2x44wtrzyxtpomczto3xg5qxpcbqd.onion"];
+      trusted_proxies = ["127.0.0.1"];
+      maintenance_window_start = 1;
+    };
     config = {
-      adminpassFile = "/etc/nextcloud-admin-pass";
+      adminpassFile = config.age.secrets."nextcloud-admin-pass".path;
       dbtype = "pgsql";
     };
     package = pkgs.nextcloud32;
@@ -21,14 +27,77 @@ in {
     database.createLocally = true;
   };
 
-  services.nginx.virtualHosts."${config.services.nextcloud.hostName}".listen = [
-    {
-      addr = "127.0.0.1";
-      port = nextcloudPort;
-    }
-  ];
+  users.groups.nextcloud.members = [ "nextcloud" "caddy" ];
+  services.nginx.enable = lib.mkForce false;
+  services.phpfpm.pools.nextcloud.settings = {
+    "listen.owner" = "caddy";
+    "listen.group" = "caddy";
+  };
+  services.caddy.virtualHosts."https://cloud.distrust.network ${onionUrl}".extraConfig = ''
+    # encode zstd gzip
+    
+    root * ${config.services.nginx.virtualHosts."cloud.distrust.network".root}
 
-  services.caddy.virtualHosts."https://cloud.distrust.network".extraConfig = ''
-    reverse_proxy localhost:${toString nextcloudPort}
+    redir /.well-known/carddav /remote.php/dav 301
+    redir /.well-known/caldav /remote.php/dav 301
+    redir /.well-known/* /index.php{uri} 301
+    redir /remote/* /remote.php{uri} 301
+
+
+    header {
+      Strict-Transport-Security max-age=31536000
+      Permissions-Policy interest-cohort=()
+      X-Content-Type-Options nosniff
+      X-Frame-Options SAMEORIGIN
+      Referrer-Policy no-referrer
+      X-XSS-Protection "1; mode=block"
+      X-Permitted-Cross-Domain-Policies none
+      X-Robots-Tag "noindex, nofollow"
+      -X-Powered-By
+      Host {host}
+      X-Real-IP {remote_host}
+      X-Forwarded-For {remote_host}
+      X-Forwarded-Proto {scheme}
+      X-Forwarded-Host {host}
+    }
+
+    
+    php_fastcgi unix/${config.services.phpfpm.pools.nextcloud.socket} {
+      root ${config.services.nginx.virtualHosts."cloud.distrust.network".root}
+      env front_controller_active true
+      env modHeadersAvailable true
+    }
+
+    @forbidden {
+      path /build/* /tests/* /config/* /lib/* /3rdparty/* /templates/* /data/*
+      path /.* /autotest* /occ* /issue* /indie* /db_* /console*
+      not path /.well-known/*
+    }
+    error @forbidden 404
+
+    @immutable {
+      path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite
+      query v=*
+    }
+    header @immutable Cache-Control "max-age=15778463, immutable"
+
+    @static {
+      path *.css *.js *.mjs *.svg *.gif *.png *.jpg *.ico *.wasm *.tflite
+      not query v=*
+    }
+    header @static Cache-Control "max-age=15778463"
+
+    @woff2 path *.woff2
+    header @woff2 Cache-Control "max-age=604800"
+
+    file_server
   '';
+
+  services.nextcloud.phpOptions = {
+    "opcache.interned_strings_buffer" = 64;
+  };
+
+  services.tor.relay.onionServices."nextcloud".map = [
+    80
+  ];
 }