aner
b880a194ba
Mirrors the azos-core change: drops the now-fully-migrated
features/{git-config,encryption,printing}, rewrites features/homey-alert
down to just the azos-homey-ntfy-alert overlay package (the ntfy-specific
remote-notification command plugged into azos.send-alert.remoteCommand),
and sets every real personal value (name/email/signing key, GPG key id,
YubiKey/browserpass/gpg-ssh toggles and keygrip/pubkey, printing username)
directly in home-manager/home.nix and nixos/configuration.nix, same place
the other personal values (azos.name, azos.headphones.devices) already
live.
78 lines
3.2 KiB
Nix
78 lines
3.2 KiB
Nix
{...}: {
|
|
config.flake.modules.homeManager.nextcloud = {
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
mountDir = "synced-docs";
|
|
remoteSubfolder = "synced-docs";
|
|
remoteName = "ncsynceddocs";
|
|
remoteNameEnv = lib.toUpper remoteName;
|
|
# rclone's webdav backend needs the account's Nextcloud *user ID*, not
|
|
# its login name, in the /dav/files/<uid>/ path -- the two differ on
|
|
# this server. The login name ("aner") still goes in the `user` field
|
|
# for Basic Auth. Both the uid and password come from `pass` at service
|
|
# start, same as mbsync in features/mail, so neither lands in the Nix
|
|
# store.
|
|
#
|
|
# Shares the azos-card-present silent presence check (overlays/default.nix)
|
|
# with the mail sync timer: loop quietly until the YubiKey is plugged in
|
|
# (no pinentry prompt either way), then exec rclone in the foreground.
|
|
# Restart=always means unplugging/replugging the key remounts naturally.
|
|
nextcloudMountSafe = pkgs.writeShellScript "nextcloud-mount-safe" ''
|
|
set -eu
|
|
mountpoint="$HOME/${mountDir}"
|
|
${pkgs.coreutils}/bin/mkdir -p "$mountpoint"
|
|
while ! ${pkgs.azos-card-present}/bin/azos-card-present; do
|
|
${pkgs.coreutils}/bin/sleep 10
|
|
done
|
|
password=$(${pkgs.pass}/bin/pass zakobar.com | ${pkgs.coreutils}/bin/head -1)
|
|
uid=$(${pkgs.pass}/bin/pass nextcloud-username/aner | ${pkgs.coreutils}/bin/head -1)
|
|
export RCLONE_CONFIG_${remoteNameEnv}_TYPE=webdav
|
|
export RCLONE_CONFIG_${remoteNameEnv}_URL="https://nextcloud.zakobar.com/remote.php/dav/files/$uid/"
|
|
export RCLONE_CONFIG_${remoteNameEnv}_VENDOR=nextcloud
|
|
export RCLONE_CONFIG_${remoteNameEnv}_USER=aner
|
|
export RCLONE_CONFIG_${remoteNameEnv}_PASS="$(${pkgs.rclone}/bin/rclone obscure "$password")"
|
|
exec ${pkgs.rclone}/bin/rclone mount ${remoteName}:${remoteSubfolder} "$mountpoint" \
|
|
--vfs-cache-mode writes
|
|
'';
|
|
in {
|
|
options.azos.nextcloud-client.enable = lib.mkOption {
|
|
default = true;
|
|
type = lib.types.bool;
|
|
};
|
|
options.azos.nextcloud-mount.enable = lib.mkOption {
|
|
default = true;
|
|
type = lib.types.bool;
|
|
};
|
|
config = lib.mkMerge [
|
|
(lib.mkIf config.azos.nextcloud-client.enable {
|
|
home.packages = with pkgs; [nextcloud-client];
|
|
services.nextcloud-client = {
|
|
enable = true;
|
|
startInBackground = false;
|
|
};
|
|
})
|
|
(lib.mkIf config.azos.nextcloud-mount.enable {
|
|
home.packages = with pkgs; [rclone];
|
|
# default.target, not graphical-session.target: the latter never
|
|
# activates under EXWM in this setup (nothing explicitly starts it),
|
|
# which is why nextcloud-client itself silently never autostarts.
|
|
systemd.user.services.nextcloud-mount = {
|
|
Unit.Description = "Mount Nextcloud ${remoteSubfolder} via rclone (waits silently for YubiKey)";
|
|
Service = {
|
|
Type = "simple";
|
|
Environment = "PATH=/run/wrappers/bin:${pkgs.fuse3}/bin:${pkgs.fuse}/bin";
|
|
ExecStart = "${nextcloudMountSafe}";
|
|
ExecStop = "/run/wrappers/bin/fusermount3 -u %h/${mountDir}";
|
|
Restart = "always";
|
|
RestartSec = "10s";
|
|
};
|
|
Install.WantedBy = ["default.target"];
|
|
};
|
|
})
|
|
];
|
|
};
|
|
}
|