NixOS

Rebuild

sudo nixos-rebuild switch --flake .#$(hostname)

Forgejo

Adding SSH key for git push

1. Generate an SSH key on the new PC: ssh-keygen -t ed25519 -C "s4mxdhid@zurimail.org"
2. Add the public key to Forgejo at <https://forgejo.home.arpa/user/settings/keys>
3. Then clone with: git clone ssh://forgejo@minerva.lan/s4mxdhid/nixos-config.git

1. Add your SSH key to Forgejo: <https://forgejo.home.arpa/user/settings/keys>
2. Switch remote to SSH:

   ```bash
   git remote set-url origin ssh://forgejo@minerva.lan/s4mxdhid/nixos-config.git

nix-shell -p openssl --run 'echo "NEXTAUTH_SECRET=$(openssl rand -base64 36)" | sudo tee /var/lib/karakeep/secrets.env'

Nextcloud Docker Setup

Initial Installation

Nextcloud is run as a Docker container managed by NixOS virtualisation.oci-containers. PostgreSQL runs as a separate container on the same Docker network (nextcloud-net).

Docker Network

The nextcloud-net network must exist before containers start. It is created by init-nextcloud-network.service on boot. To create it manually:

sudo docker network create nextcloud-net

First Boot / Fresh Install

The Docker entrypoint only runs auto-install if config/config.php does not exist. If installation did not complete cleanly, remove the partial config and reinstall manually:

sudo docker stop nextcloud
sudo rm -f /var/lib/nextcloud/config/config.php
sudo systemctl start docker-nextcloud.service

sudo docker exec -u 33 nextcloud php /var/www/html/occ maintenance:install \
  --database pgsql \
  --database-name nextcloud \
  --database-host postgres-nextcloud \
  --database-user nextcloud \
  --database-pass <POSTGRES_PASSWORD> \
  --admin-user admin \
  --admin-pass <ADMIN_PASSWORD> \
  --data-dir /var/www/html/data

Post-Install Configuration

After install, set trusted domains, proxy settings and overwrite protocol:

sudo docker exec -u 33 nextcloud php occ config:system:set trusted_domains 0 --value localhost
sudo docker exec -u 33 nextcloud php occ config:system:set trusted_domains 1 --value nextcloud.home.arpa
sudo docker exec -u 33 nextcloud php occ config:system:set trusted_domains 2 --value minerva.lan
sudo docker exec -u 33 nextcloud php occ config:system:set trusted_domains 3 --value 100.118.90.26
sudo docker exec -u 33 nextcloud php occ config:system:set trusted_domains 4 --value cloud.minerva.netbird.selfhosted
sudo docker exec -u 33 nextcloud php occ config:system:set trusted_domains 5 --value nextcloud
sudo docker exec -u 33 nextcloud php occ config:system:set overwriteprotocol --value https
sudo docker exec -u 33 nextcloud php occ config:system:set overwrite.cli.url --value https://nextcloud.home.arpa
sudo docker exec -u 33 nextcloud php occ config:system:set trusted_proxies 0 --value 127.0.0.1
sudo docker exec -u 33 nextcloud php occ config:system:set trusted_proxies 1 --value 172.19.0.0/16

Changing Admin Password

The NEXTCLOUD_ADMIN_PASSWORD env var is only read on first install. To change the password on a running instance:

sudo docker exec -u 33 nextcloud php occ user:resetpassword admin

Known Issues & Fixes

Ownership of mounted directories

The Nextcloud container runs as www-data (UID 33). If Docker creates host directories as root, the container can't write to them. systemd.tmpfiles.rules in nextcloud.nix ensures correct ownership on every boot. To fix manually:

sudo chown -R 33:33 /var/lib/nextcloud/
sudo systemd-tmpfiles --create

PostgreSQL permissions

If the database was partially initialized, tables may be owned by the wrong user. To reset cleanly:

sudo docker stop nextcloud
sudo docker exec postgres-nextcloud psql -U nextcloud -d postgres -c "DROP DATABASE nextcloud WITH (FORCE);"
sudo docker exec postgres-nextcloud psql -U nextcloud -d postgres -c "CREATE DATABASE nextcloud OWNER nextcloud;"
sudo docker exec postgres-nextcloud psql -U nextcloud -d nextcloud -c "GRANT ALL ON SCHEMA public TO nextcloud; ALTER SCHEMA public OWNER TO nextcloud;"

NixOS native module conflict

If services.nextcloud was previously enabled, it leaves behind config files in /var/lib/nextcloud/config/ including an override.config.php symlink pointing to the nix store. These must be removed before the Docker container can initialize:

sudo rm /var/lib/nextcloud/config/override.config.php
sudo find /var/lib/nextcloud/config/ -name "*.php" -delete

Firewall / PostgreSQL connectivity

PostgreSQL is not exposed to the host — both containers communicate via nextcloud-net. Use container names (postgres-nextcloud) not host IPs (172.17.0.1) in config.

---

OnlyOffice Docker Setup

OnlyOffice runs as a Docker container connected to nextcloud-net so it can communicate with Nextcloud by container name.

Nextcloud Integration

sudo docker exec -u 33 nextcloud php occ app:enable onlyoffice
sudo docker exec -u 33 nextcloud php occ config:app:set onlyoffice DocumentServerUrl --value="https://onlyoffice.home.arpa/"
sudo docker exec -u 33 nextcloud php occ config:app:set onlyoffice DocumentServerInternalUrl --value="http://onlyoffice:80/"
sudo docker exec -u 33 nextcloud php occ config:app:set onlyoffice StorageUrl --value="http://nextcloud:80/"
sudo docker exec -u 33 nextcloud php occ config:app:set onlyoffice jwt_secret --value="<JWT_SECRET>"
sudo docker exec -u 33 nextcloud php occ config:app:set onlyoffice jwt_header --value="Authorization"

Add nextcloud and onlyoffice as trusted domains so containers can reach each other:

sudo docker exec -u 33 nextcloud php occ config:system:set trusted_domains 5 --value="nextcloud"
sudo docker exec -u 33 nextcloud php occ config:system:set trusted_domains 6 --value="onlyoffice"

Troubleshooting

Files downloading instead of opening

If Nextcloud shows "no plugin available" or downloads files instead of opening them, check for a cached connection error:

sudo docker exec -u 33 nextcloud php occ config:list onlyoffice | grep settings_error

If present, clear it:

sudo docker exec -u 33 nextcloud php occ config:app:delete onlyoffice settings_error
sudo docker exec -u 33 nextcloud php occ config:app:delete onlyoffice demo

Then verify the internal connection works:

sudo docker exec nextcloud curl -sk http://onlyoffice:80/healthcheck  # should return: true
sudo docker exec onlyoffice curl -sk http://nextcloud:80/status.php   # should return JSON

OnlyOffice not on nextcloud-net

If the above curl commands fail, connect OnlyOffice to the network:

sudo docker network connect nextcloud-net onlyoffice

This is handled automatically via extraOptions = [ "--network=nextcloud-net" ] in onlyoffice.nix on rebuild.

---

OpenCloud Native Module

OpenCloud uses the NixOS services.opencloud module (available from NixOS 25.11+).

Known Issues & Fixes

500 error on login / IDM not initialized

If IDM fails to initialize on first boot (often caused by the search service crashing and interrupting startup), wipe IDM and IDP state and restart:

sudo systemctl stop opencloud
sudo rm -rf /var/lib/opencloud/idm
sudo rm -rf /var/lib/opencloud/idp
sudo systemctl start opencloud
sudo journalctl -u opencloud -f

TLS certificate errors in internal services

Add OC_INSECURE = "true" to the environment in opencloud.nix to allow internal services to skip TLS verification when communicating over loopback.

search service crashes on startup

The search service has a known bleve index corruption issue. Exclude it:

OC_EXCLUDE_RUN_SERVICES = "search";

---

Trust Caddy Internal CA (macOS)

The Caddy internal root CA is stored on the NixOS host at /var/lib/caddy/.local/share/caddy/pki/authorities/ (restricted to the caddy user). The openssl approach only extracts the intermediate CA, not the self-signed root — the root CA is never sent in the TLS handshake.

# On the NixOS host: find and export the root CA
sudo ls -la /var/lib/caddy/.local/share/caddy/pki/authorities/
sudo cat /var/lib/caddy/.local/share/caddy/pki/authorities/local/root.crt > /tmp/caddy_root.crt

# On macOS: download the root CA from the NixOS host
scp minerva@192.168.1.20:/tmp/caddy_root.crt ~/Downloads/caddy_root.crt

# Import into system keychain
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/Downloads/caddy_root.crt