test: setting up opencloud and microvms

modules/config/instances/config/opencloud0.nix

@@ -0,0 +1,56 @@
+{ moduleFunctions }:
+let
+  inherit (moduleFunctions.instancesFunctions)
+    domain0
+    sslPath
+    varPath
+    mntPath
+    secretPath
+    ;
+  label = "OpenCloud";
+  name = "opencloud";
+  short = "cloud";
+  domain = "${short}.${domain0}";
+  secrets = "${secretPath}/${name}";
+  ssl = "${sslPath}/${domain}";
+in
+{
+  label = label;
+  name = name;
+  short = "Cloud";
+  domains = {
+    url0 = domain;
+  };
+  subdomain = short;
+  tags = [
+    name
+    "opencloud"
+    "cloud"
+  ];
+  ports = {
+    port0 = 9200;
+  };
+  interface = {
+    id = "vm-${short}";
+    mac = "02:00:00:00:56:09";
+    idUser = "vmuser-${short}";
+    macUser = "02:00:00:00:00:09";
+    ip = "192.168.50.119";
+    gate = "192.168.50.1";
+    ssh = 2209;
+  };
+  ssl = {
+    path = ssl;
+    cert = "${ssl}/fullchain.pem";
+    key = "${ssl}/key.pem";
+  };
+  varPaths = {
+    path0 = "${varPath}/${name}";
+  };
+  mntPaths = {
+    path0 = "${mntPath}/${name}";
+  };
+  secretPaths = {
+    path0 = secrets;
+  };
+}

modules/home/gui/apps/browsers/floorp/config/bookmarks/config/flake/selfHosted.nix

@@ -24,6 +24,7 @@ let
     instances.ollama.name
     instances.qbittorrent.name
     instances.vaultwarden.name
+    instances.opencloud0.name
   ];
   bookmarkConfigs = [
     {

modules/nixos/default.nix

@@ -46,7 +46,6 @@ in
         inherit (modules)
           acme
           caddy
-          ceresOpenCloud
           comfyui
           firefly-iii
           forgejo
@@ -56,6 +55,7 @@ in
           microvm
           minecraft
           ollama
+          opencloud1
           projectSite
           qbittorrent
           restic
@@ -74,6 +74,7 @@ in
           caddy
           impermanence
           microvm
+          opencloud0
           sambaEris
           ;
       };

modules/nixos/guests/opencloud/opencloud0/default.nix

@@ -7,22 +7,19 @@
 let
   inherit (flake.config.people) user0;
   inherit (flake.config.services) instances;
-  serviceCfg = instances.vaultwarden;
+  serviceCfg = instances.opencloud0;
   hostCfg = instances.web;
-  dns = instances.web.dns.provider1;
+  dns = instances.web.dns.provider0;
   localhost = instances.web.localhost.address1;
-  host = "${serviceCfg.subdomain}.${flake.inputs.linkpage.secrets.domains.projectsite}";
+  host = serviceCfg.domains.url0;
   dnsPath = "dns/${dns}";
 in
 {
   microvm.vms = {
-    projectcloud = {
+    opencloud = {
       autostart = true;
       restartIfChanged = true;
       config = {
-        environment.systemPackages = with pkgs; [
-          inotify-tools
-        ];
         system.stateVersion = "24.05";
         time.timeZone = "America/Winnipeg";
         users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
@@ -33,7 +30,7 @@ in
             port = serviceCfg.ports.port0;
             address = localhost;
             stateDir = "/var/lib/${serviceCfg.name}";
-            environmentFile = "/run/secrets/projectenv";
+            environmentFile = "/run/secrets/env";
           };
 
           openssh = {
@@ -52,10 +49,40 @@ in
         ];
 
         systemd = {
+          services = {
+            systemd-networkd.wantedBy = [ "multi-user.target" ];
+            opencloud = {
+              path = [ pkgs.inotify-tools ];
+            };
+            opencloud-fix-permissions = {
+              description = "Fix OpenCloud storage permissions on file changes";
+              after = [ "opencloud.service" ];
+              wantedBy = [ "multi-user.target" ];
+              serviceConfig = {
+                Type = "simple";
+                ExecStart = pkgs.writeShellScript "fix-perms-on-change" ''
+                  ${pkgs.inotify-tools}/bin/inotifywait -m -r -e create,moved_to /var/lib/opencloud/storage --format '%w%f' | while read filepath; do
+                    ${pkgs.coreutils}/bin/chown opencloud:opencloud "$filepath"
+                  done
+                '';
+                Restart = "always";
+                User = "root";
+              };
+            };
+          };
+          timers.opencloud-fix-permissions = {
+            description = "Periodically fix OpenCloud storage permissions";
+            wantedBy = [ "timers.target" ];
+            timerConfig = {
+              OnBootSec = "1min";
+              OnUnitActiveSec = "1min";
+              Unit = "opencloud-fix-permissions.service";
+            };
+          };
           network = {
             enable = true;
             networks."20-lan" = {
-              matchConfig.Name = "enp0s5";
+              matchConfig.Name = "enp0s6";
               addresses = [
                 { Address = "${serviceCfg.interface.ip}/24"; }
               ];
@@ -73,16 +100,15 @@ in
           };
 
           tmpfiles.rules = [
-            "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+            "d ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
+            "z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -"
           ];
 
         };
 
-        systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
-
         microvm = {
-          vcpu = 4;
-          mem = 4096;
+          vcpu = 1;
+          mem = 1024 * 1;
           hypervisor = "qemu";
           interfaces = [
             {
@@ -113,9 +139,15 @@ in
             {
               mountPoint = "/var/lib/${serviceCfg.name}";
               proto = "virtiofs";
-              source = serviceCfg.mntPaths.path0;
+              source = "${serviceCfg.mntPaths.path0}/data";
               tag = "${serviceCfg.name}_data";
             }
+            {
+              mountPoint = "/etc/opencloud";
+              proto = "virtiofs";
+              source = "${serviceCfg.mntPaths.path0}/config";
+              tag = "${serviceCfg.name}_config";
+            }
             {
               mountPoint = "/run/secrets";
               proto = "virtiofs";
@@ -124,6 +156,11 @@ in
             }
           ];
         };
+        environment.systemPackages = builtins.attrValues {
+          inherit (pkgs)
+            opencloud
+            ;
+        };
       };
     };
   };
@@ -138,23 +175,29 @@ in
     "${host}" = {
       extraConfig = ''
         reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
+          header_up X-Real-IP {remote_host}
+        }
 
         redir /.well-known/carddav /remote.php/dav/ 301
         redir /.well-known/caldav /remote.php/dav/ 301
 
-        tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
+        tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key} 
       '';
     };
   };
 
   users.users.caddy.extraGroups = [ "acme" ];
 
-  systemd.tmpfiles.rules = [
-    "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
-  ];
+  systemd = {
+    tmpfiles.rules = [
+      "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
+      "d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -"
+      "d ${serviceCfg.mntPaths.path0}/config 0751 microvm wheel - -"
+    ];
+  };
 
   sops.secrets = {
-    "${serviceCfg.name}/projectenv" = {
+    "${serviceCfg.name}/env" = {
       owner = "root";
       mode = "0600";
     };

modules/nixos/guests/opencloud/opencloud1/default.nix

@@ -7,7 +7,7 @@
 let
   inherit (flake.config.people) user0;
   inherit (flake.config.services) instances;
-  serviceCfg = instances.opencloud;
+  serviceCfg = instances.opencloud1;
   hostCfg = instances.web;
   dns = instances.web.dns.provider1;
   localhost = instances.web.localhost.address1;