REWRITE

modules/services/nextcloud.nix

@@ -52,7 +52,7 @@ let
 in
 {
   options.homey.nextcloud = {
-    enable = lib.mkEnableOption "Nextcloud file server";
+    enable = lib.mkEnableOption "Nextcloud file server" // { default = true; };
 
     image = lib.mkOption {
       type    = lib.types.str;
@@ -166,6 +166,54 @@ in
       ];
     };
 
+    # -----------------------------------------------------------------------
+    # Caddy virtual host — no forward_auth; Nextcloud manages its own auth
+    # -----------------------------------------------------------------------
+    homey.caddy.virtualHosts = [{
+      subdomain = "nextcloud";
+      port      = cfg.port;
+      auth      = false;
+      extraConfig = ''
+        redir /.well-known/carddav /remote.php/dav/ 301
+        redir /.well-known/caldav  /remote.php/dav/ 301
+        request_body {
+          max_size 5GB
+        }
+        reverse_proxy localhost:${toString cfg.port} {
+          header_up X-Forwarded-For {remote_host}
+        }
+      '';
+      extraHttpConfig = ''
+        redir /.well-known/carddav /remote.php/dav/ 301
+        redir /.well-known/caldav  /remote.php/dav/ 301
+        request_body {
+          max_size 5GB
+        }
+        reverse_proxy localhost:${toString cfg.port} {
+          header_up X-Forwarded-Proto https
+          header_up X-Forwarded-For {remote_host}
+        }
+      '';
+    }];
+
+    # -----------------------------------------------------------------------
+    # Storage directories
+    # UID 33 = www-data in the Nextcloud container
+    # UID 999 = postgres — must own the db dir (creates files directly in it)
+    # -----------------------------------------------------------------------
+    homey.storage.extraDirs = [
+      { path = "nextcloud"; }
+      { path = "nextcloud/html";    user = "33";  group = "33"; }
+      { path = "nextcloud/db";      mode = "0700"; user = "999"; group = "999"; }
+      { path = "nextcloud/db-dump"; mode = "0700"; }
+    ];
+
+    # -----------------------------------------------------------------------
+    # Backup — exclude raw DB dir (pg_dump file in db-dump/ is used instead)
+    # -----------------------------------------------------------------------
+    homey.backup.extraPaths        = [ "${dataDir}/nextcloud" ];
+    homey.backup.extraExcludePaths = [ "${dataDir}/nextcloud/db" ];
+
     # -----------------------------------------------------------------------
     # Uptime Kuma monitor for this service
     # -----------------------------------------------------------------------