chore: removed services for now

modules/nixos/services/nextcloud/default.nix

@@ -10,6 +10,7 @@ let
   inherit (flake.config.services.instances)
     nextcloud
     nginx
+    caddy
     smtp
     web
     ;
@@ -63,33 +64,54 @@ in
         overwriteprotocol = "https";
         trusted_proxies = [
           localhost
+          web.localhost.address1
         ];
+        security.headers = {
+          Strict-Transport-Security = "max-age=15552000; includeSubDomains";
+          X-XSS-Protection = "1; mode=block";
+          X-Content-Type-Options = "nosniff";
+          X-Frame-Options = "SAMEORIGIN";
+          Referrer-Policy = "strict-origin-when-cross-origin";
+        };
       };
-    };
 
+    };
     nginx = {
       enable = true;
-      virtualHosts.${host}.listen = [
-        {
-          addr = localhost;
-          port = nginx.ports.port0;
-        }
-      ];
+      virtualHosts.${host} = {
+        listen = [
+          {
+            addr = localhost;
+            port = nginx.ports.port0;
+          }
+        ];
+        forceSSL = false;
+        onlySSL = false;
+        addSSL = false;
+      };
     };
-
     caddy = {
       virtualHosts = {
-        "${host}" = {
-          listenAddresses = [ web.localhost.address1 ];
+        ":${toString caddy.ports.port3}" = {
           extraConfig = ''
-            reverse_proxy ${localhost}:${toString nginx.ports.port0}
-            tls ${service.ssl.cert} ${service.ssl.key}
+            header {
+              # Enable XSS protection and block instead of sanitizing
+              X-XSS-Protection "1; mode=block"
+              # Enable HSTS with 6 month duration
+              Strict-Transport-Security "max-age=15552000; includeSubDomains"
+              # Additional security headers
+              X-Content-Type-Options "nosniff"
+              X-Frame-Options "SAMEORIGIN"
+              Referrer-Policy "strict-origin-when-cross-origin"
+              # Remove server identification
+              -Server
+            }
+            reverse_proxy http://${localhost}:${toString nginx.ports.port0}
           '';
         };
       };
     };
   };
-
   sops =
     let
       sopsPath = secret: {
@@ -112,17 +134,29 @@ in
       );
     };
 
-  users.users.${service.name}.extraGroups = [
-    "caddy"
-    "nginx"
-    "postgres"
-  ];
+  systemd = {
+    tmpfiles.rules = [
+      "Z ${service.sops.path0} 755 ${service.name} ${service.name} -"
+    ];
+  };
+
+  users.users.${service.name} = {
+    packages = with pkgs; [
+      php
+    ];
+    extraGroups = [
+      "caddy"
+      "nginx"
+      "postgres"
+    ];
+  };
 
   networking = {
     firewall = {
       allowedTCPPorts = [
         nginx.ports.port0
         service.ports.port0
+        caddy.ports.port3
       ];
     };
   };