Nextcloud sync, also zapzap

features/nextcloud/default.nix

@@ -4,17 +4,74 @@
     config,
     pkgs,
     ...
-  }: {
+  }: let
+    mountDir = "synced-docs";
+    remoteSubfolder = "synced-docs";
+    remoteName = "ncsynceddocs";
+    remoteNameEnv = lib.toUpper remoteName;
+    # rclone's webdav backend needs the account's Nextcloud *user ID*, not
+    # its login name, in the /dav/files/<uid>/ path -- the two differ on
+    # this server. The login name ("aner") still goes in the `user` field
+    # for Basic Auth. Both the uid and password come from `pass` at service
+    # start, same as mbsync in features/mail, so neither lands in the Nix
+    # store.
+    #
+    # Shares the azos-card-present silent presence check (overlays/default.nix)
+    # with the mail sync timer: loop quietly until the YubiKey is plugged in
+    # (no pinentry prompt either way), then exec rclone in the foreground.
+    # Restart=always means unplugging/replugging the key remounts naturally.
+    nextcloudMountSafe = pkgs.writeShellScript "nextcloud-mount-safe" ''
+      set -eu
+      mountpoint="$HOME/${mountDir}"
+      mkdir -p "$mountpoint"
+      while ! ${pkgs.azos-card-present}/bin/azos-card-present; do
+        sleep 10
+      done
+      password=$(${pkgs.pass}/bin/pass zakobar.com | head -1)
+      uid=$(${pkgs.pass}/bin/pass nextcloud-username/aner | head -1)
+      export RCLONE_CONFIG_${remoteNameEnv}_TYPE=webdav
+      export RCLONE_CONFIG_${remoteNameEnv}_URL="https://nextcloud.zakobar.com/remote.php/dav/files/$uid/"
+      export RCLONE_CONFIG_${remoteNameEnv}_VENDOR=nextcloud
+      export RCLONE_CONFIG_${remoteNameEnv}_USER=aner
+      export RCLONE_CONFIG_${remoteNameEnv}_PASS="$(${pkgs.rclone}/bin/rclone obscure "$password")"
+      exec ${pkgs.rclone}/bin/rclone mount ${remoteName}:${remoteSubfolder} "$mountpoint" \
+        --vfs-cache-mode writes
+    '';
+  in {
     options.azos.nextcloud-client.enable = lib.mkOption {
       default = true;
       type = lib.types.bool;
     };
-    config = lib.mkIf config.azos.nextcloud-client.enable {
-      home.packages = with pkgs; [nextcloud-client];
-      services.nextcloud-client = {
-        enable = true;
-        startInBackground = false;
-      };
+    options.azos.nextcloud-mount.enable = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
     };
+    config = lib.mkMerge [
+      (lib.mkIf config.azos.nextcloud-client.enable {
+        home.packages = with pkgs; [nextcloud-client];
+        services.nextcloud-client = {
+          enable = true;
+          startInBackground = false;
+        };
+      })
+      (lib.mkIf config.azos.nextcloud-mount.enable {
+        home.packages = with pkgs; [rclone];
+        # default.target, not graphical-session.target: the latter never
+        # activates under EXWM in this setup (nothing explicitly starts it),
+        # which is why nextcloud-client itself silently never autostarts.
+        systemd.user.services.nextcloud-mount = {
+          Unit.Description = "Mount Nextcloud ${remoteSubfolder} via rclone (waits silently for YubiKey)";
+          Service = {
+            Type = "simple";
+            Environment = "PATH=${pkgs.fuse3}/bin:${pkgs.fuse}/bin";
+            ExecStart = "${nextcloudMountSafe}";
+            ExecStop = "${pkgs.fuse3}/bin/fusermount3 -u %h/${mountDir}";
+            Restart = "always";
+            RestartSec = "10s";
+          };
+          Install.WantedBy = ["default.target"];
+        };
+      })
+    ];
   };
 }