nginx: force SSL everywhere

https://github.com/nextcloud/calendar/issues/6788
iso8601

common.nix

@@ -31,8 +31,8 @@
   services.resolved = {
     enable = true;
     dnssec = "true";
-    domains = [ "~." ];
+    domains = ["~."];
-    fallbackDns = [ "1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one" ];
+    fallbackDns = ["1.1.1.1#one.one.one.one" "1.0.0.1#one.one.one.one"];
     dnsovertls = "true";
   };
 
@@ -68,6 +68,9 @@
   # does this add river to sddm menu?
   programs.river.enable = true;
 
+  # needed to set here to have correct permissions
+  programs.k3b.enable = true;
+
   # Configure keymap in X11
   services.xserver = {
     xkb = {
@@ -116,7 +119,12 @@
   users.groups.music = {};
 
   # Install firefox.
-  programs.firefox.enable = true;
+  programs.firefox = {
+    enable = true;
+    # fix wrong locale in calendar for nextcloud
+    # https://github.com/nextcloud/calendar/issues/6788
+    preferences."intl.regional_prefs.use_os_locales" = true;
+  };
 
   # chroot jail
   programs.firejail.enable = true;
@@ -334,8 +342,8 @@
   # bluetooth mpris play-pause media control
   systemd.user.services.mpris-proxy = {
     description = "Mpris proxy";
-    after = [ "network.target" "sound.target" ];
+    after = ["network.target" "sound.target"];
-    wantedBy = [ "default.target" ];
+    wantedBy = ["default.target"];
     serviceConfig.ExecStart = "${pkgs.bluez}/bin/mpris-proxy";
   };
 

flake.lock

@@ -37,11 +37,11 @@
     "base16-helix": {
       "flake": false,
       "locked": {
-        "lastModified": 1736852337,
+        "lastModified": 1748408240,
-        "narHash": "sha256-esD42YdgLlEh7koBrSqcT7p2fsMctPAcGl/+2sYJa2o=",
+        "narHash": "sha256-9M2b1rMyMzJK0eusea0x3lyh3mu5nMeEDSc4RZkGm+g=",
         "owner": "tinted-theming",
         "repo": "base16-helix",
-        "rev": "03860521c40b0b9c04818f2218d9cc9efc21e7a5",
+        "rev": "6c711ab1a9db6f51e2f6887cc3345530b33e152e",
         "type": "github"
       },
       "original": {
@@ -132,11 +132,11 @@
     "doomemacs": {
       "flake": false,
       "locked": {
-        "lastModified": 1751746896,
+        "lastModified": 1752438514,
-        "narHash": "sha256-2KFT9v/PGb2K8Vd2eLAhDFQW6ORQapmQmBXipObpkoo=",
+        "narHash": "sha256-nU/UmyYQAcPHGJEC1mVm40LY3LlA7df9khckbvMB5x8=",
         "owner": "doomemacs",
         "repo": "doomemacs",
-        "rev": "5b5b170f7902e81826fd8efbec88eb38e23e2807",
+        "rev": "ed9190ef005829c7a2331e12fb36207794c5ad75",
         "type": "github"
       },
       "original": {
@@ -155,11 +155,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752200768,
+        "lastModified": 1752460302,
-        "narHash": "sha256-3zda4tTZ7eB5nxBFdWmcOrD6wiX4IIqXleXnbfNYdhY=",
+        "narHash": "sha256-/mdSXzHxi6ceep2mrH0UlUUO2enfPLQqRojbM+ZlPA4=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "d797bda1908ae40e437d51a4fcd15b6dc2956195",
+        "rev": "1741446afec9d812af576df394a2304f90e22257",
         "type": "github"
       },
       "original": {
@@ -171,11 +171,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1743774811,
+        "lastModified": 1748383148,
-        "narHash": "sha256-oiHLDHXq7ymsMVYSg92dD1OLnKLQoU/Gf2F1GoONLCE=",
+        "narHash": "sha256-pGvD/RGuuPf/4oogsfeRaeMm6ipUIznI2QSILKjKzeA=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "df53a7a31872faf5ca53dd0730038a62ec63ca9e",
+        "rev": "4eb2714fbed2b80e234312611a947d6cb7d70caf",
         "type": "github"
       },
       "original": {
@@ -262,11 +262,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751413152,
+        "lastModified": 1749398372,
-        "narHash": "sha256-Tyw1RjYEsp5scoigs1384gIg6e0GoBVjms4aXFfRssQ=",
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "77826244401ea9de6e3bac47c2db46005e1f30b5",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
         "type": "github"
       },
       "original": {
@@ -422,11 +422,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1752208517,
+        "lastModified": 1752391422,
-        "narHash": "sha256-aRY1cYOdVdXdNjcL/Twpa27CknO7pVHxooPsBizDraE=",
+        "narHash": "sha256-ReX0NG6nIAEtQQjLqeu1vUU2jjZuMlpymNtb4VQYeus=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c6a01e54af81b381695db796a43360bf6db5702f",
+        "rev": "c26266790678863cce8e7460fdbf0d80991b1906",
         "type": "github"
       },
       "original": {
@@ -547,11 +547,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1752223507,
+        "lastModified": 1752482949,
-        "narHash": "sha256-wKiNIWiwH6Fkl2lveostkTR80io+AGy2Cv+kZs+iEos=",
+        "narHash": "sha256-1SLpL5sKEWYMIAB+PHgvI9Z3i90KIz5jxzxOAea4JtE=",
         "owner": "marienz",
         "repo": "nix-doom-emacs-unstraightened",
-        "rev": "edc26fad8332a0dabb343223b2e4c63d6d14a6df",
+        "rev": "a7cd62f35fd18f79f43772bccf3b6495f8845030",
         "type": "github"
       },
       "original": {
@@ -671,11 +671,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1751943650,
+        "lastModified": 1752308619,
-        "narHash": "sha256-7orTnNqkGGru8Je6Un6mq1T8YVVU/O5kyW4+f9C1mZQ=",
+        "narHash": "sha256-pzrVLKRQNPrii06Rm09Q0i0dq3wt2t2pciT/GNq5EZQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "88983d4b665fb491861005137ce2b11a9f89f203",
+        "rev": "650e572363c091045cdbc5b36b0f4c1f614d3058",
         "type": "github"
       },
       "original": {
@@ -759,14 +759,15 @@
         "nixpkgs": [
           "stylix",
           "nixpkgs"
-        ]
+        ],
+        "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1752261888,
+        "lastModified": 1751320053,
-        "narHash": "sha256-II7C38TeOfCCyPTOaCGg0AazhxaV4oTpD1oCtSCn9Zw=",
+        "narHash": "sha256-3m6RMw0FbbaUUa01PNaMLoO7D99aBClmY5ed9V3vz+0=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "980983629098b8a3a426d0542d30d3104cffccb8",
+        "rev": "cbde1735782f9c2bb2c63d5e05fba171a14a4670",
         "type": "github"
       },
       "original": {
@@ -876,11 +877,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1752251601,
+        "lastModified": 1752450546,
-        "narHash": "sha256-QnhCeqR9DTYWu5ZN+WfVJcfDy8efeVODjUreRldj4oU=",
+        "narHash": "sha256-LDZ5+izyjRnctLcxAOul7CVpSTV58NTpUdhYkj0Pq1c=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "4d5e38f041f70725b1ef47b704f7a1944783001f",
+        "rev": "752b31495507d3a693ad8fdfd0df6f4044fab6a3",
         "type": "github"
       },
       "original": {
@@ -1002,11 +1003,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1743296873,
+        "lastModified": 1751159871,
-        "narHash": "sha256-8IQulrb1OBSxMwdKijO9fB70ON//V32dpK9Uioy7FzY=",
+        "narHash": "sha256-UOHBN1fgHIEzvPmdNMHaDvdRMgLmEJh2hNmDrp3d3LE=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "af5152c8d7546dfb4ff6df94080bf5ff54f64e3a",
+        "rev": "bded5e24407cec9d01bd47a317d15b9223a1546c",
         "type": "github"
       },
       "original": {
@@ -1052,6 +1053,28 @@
         "repo": "treefmt-nix",
         "type": "github"
       }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "stylix",
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733222881,
+        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
     }
   },
   "root": "root",

void.nix

@@ -281,6 +281,21 @@
   '';
   users.users.immich.extraGroups = ["video" "render"];
 
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud31;
+    hostName = "nextcloud.005540.xyz";
+    https = true;
+    secretFile = "/etc/nixos/secrets/nextcloud/secrets.json";
+    config.adminpassFile = "/etc/nixos/secrets/nextcloud/adminpass";
+    config.dbtype = "pgsql";
+    settings.default_locale = "fr";
+    settings.default_phone_region = "+33";
+    database.createLocally = true;
+    configureRedis = true;
+    maxUploadSize = "64G";
+  };
+
   # dynamic dns
   services.ddclient = {
     enable = true;
@@ -311,10 +326,6 @@
     };
   };
 
-  services.audiobookshelf = {
-    enable = true;
-  };
-
   services.victorialogs = {
     enable = true;
     extraOptions = ["-memory.allowedBytes=100MB"];
@@ -352,22 +363,22 @@
       "jellyfin.005540.xyz" = {
         locations."/".proxyPass = "http://localhost:8096";
         enableACME = true;
-        addSSL = true;
+        forceSSL = true;
       };
       "forgejo.005540.xyz" = {
         locations."/".proxyPass = "http://localhost:3000";
         enableACME = true;
-        addSSL = true;
+        forceSSL = true;
       };
       "miniflux.005540.xyz" = {
         locations."/".proxyPass = "http://localhost:8700";
         enableACME = true;
-        addSSL = true;
+        forceSSL = true;
       };
       "paperless.005540.xyz" = {
         locations."/".proxyPass = "http://localhost:28981";
         enableACME = true;
-        addSSL = true;
+        forceSSL = true;
       };
       "immich.005540.xyz" = {
         locations."/".proxyPass = "http://localhost:2283";
@@ -379,19 +390,23 @@
           send_timeout         600s;
         '';
         enableACME = true;
-        addSSL = true;
+        forceSSL = true;
       };
       "audiobookshelf.005540.xyz" = {
         locations."/".proxyPass = "http://localhost:8000";
         locations."/".proxyWebsockets = true;
         enableACME = true;
-        addSSL = true;
+        forceSSL = true;
       };
       "victorialogs.005540.xyz" = {
         locations."/".proxyPass = "http://localhost:9428";
         locations."/".basicAuthFile = "/etc/nixos/secrets/victorialogs/basicauth";
         enableACME = true;
-        addSSL = true;
+        forceSSL = true;
+      };
+      "nextcloud.005540.xyz" = {
+        enableACME = true;
+        forceSSL = true;
       };
     };
   };

warnings.log

@@ -0,0 +1,15 @@
+warning: In a derivation named 'neovim-unwrapped-0.10.1', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedRequisites'; use 'outputChecks.<output>.disallowedRequisites' instead
+evaluation warning: `programs.zsh.initExtra` is deprecated, use `programs.zsh.initContent` instead.
+
+                    Example: programs.zsh.initContent = "your content here";
+evaluation warning: khais profile: stylix: qt: `config.stylix.targets.qt.platform` other than 'qtct' are currently unsupported: kde6. Support may be added in the future.
+evaluation warning: khais profile: You have set either `nixpkgs.config` or `nixpkgs.overlays` while using `home-manager.useGlobalPkgs`.
+                    This will soon not be possible. Please remove all `nixpkgs` options when using `home-manager.useGlobalPkgs`.
+evaluation warning: khais profile: Setting programs.eza.icons to a Boolean is deprecated.
+                    Please update your configuration so that
+
+                      programs.eza.icons = "auto"
+evaluation warning: The option `services.samba.shares' defined in `/nix/store/lrqd613pks074ddplc7jypr39fqnz5h0-source/void.nix' has been renamed to `services.samba.settings'.
+evaluation warning: The option `services.samba.securityType' defined in `/nix/store/lrqd613pks074ddplc7jypr39fqnz5h0-source/void.nix' has been renamed to `services.samba.settings.global.security'.
+evaluation warning: The option `hardware.pulseaudio' defined in `/nix/store/lrqd613pks074ddplc7jypr39fqnz5h0-source/common.nix' has been renamed to `services.pulseaudio'.
+evaluation warning: Setting `use` is deprecated, ddclient now supports `usev4` and `usev6` for separate IPv4/IPv6 configuration.