Change:
Describe the bug When deploying a nextcloud service, if nginx is not enabled, the unit scripts of php-fpm and nextcloud-setup systemd services fail. This makes it more difficult than necessary to use nextcloud with a different web server. For both services, the issue is caused by hardcoding the nginx user and/or group in the unit scripts. For the php-fpm service, we see nginx hardcoded in a . For nextcloud-setup, the failure is related to , where the nginx group is hardcoded into this chown command. The resulting error message: To Reproduce Steps to reproduce the behavior: the service, and add the systemd service as described in the , but with the option set to false. Expected behavior Not enabling nginx should still allow nextcloud to be deployed, and the user should be able to override the webserver group. It seems to me like there should be an additional option for the name of the webserver's user and group, that would default to nginx, but could changed by the user to something else. Additional context Running using nixops on DigitalOcean. Metadata Please run and paste the result.
Thank you for your contributions. This has been automatically marked as stale because it has had no activity for 180 days. If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity. Here are suggestions that might help resolve this more quickly: for maintainers and people that previously touched the related code and @ mention them in a comment. on the . 3. Ask on the on .
Because of this, running nextcloud on nixos is unnecessary difficult. There is No documentation or hint telling one has to enable the nginx server. Why is it not enabled by default? I think the module should either have working defaults or raise an error if some mandatory field is missing.
after comments earlier today about and I think you probably agree this should be enabled by default. Correct? Maybe the option doesn't even have any value at all...
Tbh I'm slightly confused that the isn't enabled by default, we should definitely alter the default to here. AFAICS this can be fixed by using a different user/group if is disabled (currently, the group is used for pretty much everything in the Nextcloud module) this is not entirely true though, see

Discussion:
inherit (config.system) stateVersion; in { <ins> imports = [ ( mkRemovedOptionModule [ "services" "nextcloud" "nginx" "enable" ] "The nextcloud module dropped support for other webservers than nginx.") ]; </ins> options.services.nextcloud = { enable = mkEnableOption "nextcloud"; hostName = mkOption {

''; }; <del> nginx.enable = mkOption { type = types.bool; default = false; description = '' Whether to enable nginx virtual host management. Further nginx configuration can be done by adapting <literal>services.nginx.virtualHosts.&lt;name&gt;</literal>. See <xref linkend="opt-services.nginx.virtualHosts"/> for further information. ''; }; </del> webfinger = mkOption { type = types.bool; default = false;

script = '' chmod og+x ${cfg.home} ln -sf ${cfg.package}/apps ${cfg.home}/ <del> mkdir -p ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps ln -sf ${overrideConfig} ${cfg.home}/config/override.config.php chown -R nextcloud:nginx ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps </del> <ins> # create nextcloud directories. # if the directories exist already with wrong permissions, we fix that for dir in ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps; do if [ ! -e $dir ]; then install -o nextcloud -g nextcloud -d $dir elif [ $(stat -c "%G" $dir) != "nextcloud" ]; then chgrp -R nextcloud $dir fi done ln -sf ${overrideConfig} ${cfg.home}/config/override.config.php </ins> # Do not install if already installed if [[ ! -e ${cfg.home}/config/config.php ]]; then

${occSetTrustedDomainsCmd} ''; serviceConfig.Type = "oneshot"; <ins> serviceConfig.User = "nextcloud"; </ins> }; nextcloud-cron = { environment.NEXTCLOUD_CONFIG_DIR = "${cfg.home}/config";

services.phpfpm = { pools.nextcloud = { user = "nextcloud"; <del> group = "nginx"; </del> <ins> group = "nextcloud"; </ins> phpOptions = phpOptionsStr; phpPackage = phpPackage; phpEnv = {

PATH = "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin"; }; settings = mapAttrs (name: mkDefault) { <del> "listen.owner" = "nginx"; "listen.group" = "nginx"; </del> <ins> "listen.owner" = config.services.nginx.user; "listen.group" = config.services.nginx.group; </ins> } // cfg.poolSettings; extraConfig = cfg.poolConfig; }; }; <del> users.extraUsers.nextcloud = { </del> <ins> users.users.nextcloud = { </ins> home = "${cfg.home}"; <del> group = "nginx"; </del> <ins> group = "nextcloud"; </ins> createHome = true; }; <ins> users.groups.nextcloud.members = [ "nextcloud" config.services.nginx.user ]; </ins> environment.systemPackages = [ occ ]; <del> } (mkIf cfg.nginx.enable { services.nginx = { </del> <ins> services.nginx = mkDefault { </ins> enable = true; <del> virtualHosts = { ${cfg.hostName} = { root = cfg.package; locations = { "= /robots.txt" = { priority = 100; extraConfig = '' allow all; log_not_found off; access_log off; ''; }; "/" = { priority = 200; extraConfig = "rewrite ^ /index.php;"; }; "~ ^/store-apps" = { priority = 201; extraConfig = "root ${cfg.home};"; }; "= /.well-known/carddav" = { priority = 210; extraConfig = "return 301 $scheme://$host/remote.php/dav;"; }; "= /.well-known/caldav" = { priority = 210; extraConfig = "return 301 $scheme://$host/remote.php/dav;"; }; "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/" = { priority = 300; extraConfig = "deny all;"; }; "~ ^/(?:.|autotest|occ|issue|indie|db_|console)" = { priority = 300; extraConfig = "deny all;"; }; "~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|ocm-provider/.+).php(?:$|/)" = { priority = 500; extraConfig = '' include ${config.services.nginx.package}/conf/fastcgi.conf; fastcgi_split_path_info ^(.+.php)(/.*)$; try_files $fastcgi_script_name =404; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param HTTPS ${if cfg.https then "on" else "off"}; fastcgi_param modHeadersAvailable true; fastcgi_param front_controller_active true; fastcgi_pass unix:${fpm.socket}; fastcgi_intercept_errors on; fastcgi_request_buffering off; fastcgi_read_timeout 120s; ''; }; "~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|/)".extraConfig = '' try_files $uri/ =404; index index.php; ''; "~ .(?:css|js|woff2?|svg|gif)$".extraConfig = '' try_files $uri /index.php$request_uri; add_header Cache-Control "public, max-age=15778463"; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; add_header X-Frame-Options sameorigin; add_header Referrer-Policy no-referrer; </del> <ins> virtualHosts.${cfg.hostName} = { root = cfg.package; locations = { "= /robots.txt" = { priority = 100; extraConfig = '' allow all; log_not_found off; </ins> access_log off; ''; <del> "~ .(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = '' try_files $uri /index.php$request_uri; access_log off; </del> <ins> }; "/" = { priority = 200; extraConfig = "rewrite ^ /index.php;"; }; "~ ^/store-apps" = { priority = 201; extraConfig = "root ${cfg.home};"; }; "= /.well-known/carddav" = { priority = 210; extraConfig = "return 301 $scheme://$host/remote.php/dav;"; }; "= /.well-known/caldav" = { priority = 210; extraConfig = "return 301 $scheme://$host/remote.php/dav;"; }; "~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/" = { priority = 300; extraConfig = "deny all;"; }; "~ ^/(?:.|autotest|occ|issue|indie|db_|console)" = { priority = 300; extraConfig = "deny all;"; }; "~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|ocm-provider/.+).php(?:$|/)" = { priority = 500; extraConfig = '' include ${config.services.nginx.package}/conf/fastcgi.conf; fastcgi_split_path_info ^(.+.php)(/.*)$; try_files $fastcgi_script_name =404; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param HTTPS ${if cfg.https then "on" else "off"}; fastcgi_param modHeadersAvailable true; fastcgi_param front_controller_active true; fastcgi_pass unix:${fpm.socket}; fastcgi_intercept_errors on; fastcgi_request_buffering off; fastcgi_read_timeout 120s; </ins> ''; }; <del> extraConfig = '' </del> <ins> "~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|/)".extraConfig = '' try_files $uri/ =404; index index.php; ''; "~ .(?:css|js|woff2?|svg|gif)$".extraConfig = '' try_files $uri /index.php$request_uri; add_header Cache-Control "public, max-age=15778463"; </ins> add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none;

add_header X-Permitted-Cross-Domain-Policies none; add_header X-Frame-Options sameorigin; add_header Referrer-Policy no-referrer; <del> add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; error_page 403 /core/templates/403.php; error_page 404 /core/templates/404.php; client_max_body_size ${cfg.maxUploadSize}; fastcgi_buffers 64 4K; fastcgi_hide_header X-Powered-By; gzip on; gzip_vary on; gzip_comp_level 4; gzip_min_length 256; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; ${optionalString cfg.webfinger '' rewrite ^/.well-known/host-meta /public.php?service=host-meta last; rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last; ''} </del> <ins> access_log off; ''; "~ .(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = '' try_files $uri /index.php$request_uri; access_log off; </ins> ''; }; <ins> extraConfig = '' add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header X-Robots-Tag none; add_header X-Download-Options noopen; add_header X-Permitted-Cross-Domain-Policies none; add_header X-Frame-Options sameorigin; add_header Referrer-Policy no-referrer; add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; error_page 403 /core/templates/403.php; error_page 404 /core/templates/404.php; client_max_body_size ${cfg.maxUploadSize}; fastcgi_buffers 64 4K; fastcgi_hide_header X-Powered-By; gzip on; gzip_vary on; gzip_comp_level 4; gzip_min_length 256; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; ${optionalString cfg.webfinger '' rewrite ^/.well-known/host-meta /public.php?service=host-meta last; rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last; ''} ''; </ins> }; }; <del> }) </del> <ins> } </ins> ]); meta.doc = ./nextcloud.xml;

services.nextcloud = { enable = true; <del> nginx.enable = true; </del> hostName = "nextcloud"; config = { # Don't inherit adminuser since "root" is supposed to be the default

services.nextcloud = { enable = true; hostName = "nextcloud"; <del> nginx.enable = true; </del> https = true; caching = { apcu = true;

services.nextcloud = { enable = true; hostName = "nextcloud"; <del> nginx.enable = true; </del> caching = { apcu = false; redis = true;