nextcloud: restrict web server support to nginx; stop sharing nginx user/group; improve setup service #93584

DavHau · 2020-07-21T08:39:48Z

Things done

(This description is heavily outdated. Plans changed a lot due to the discussions. See below)

user and group used by all nextcloud related services are now unified and configurable. If nginx is enabled, the group will be forced to nginx and an error is raised if group is set manually.
nginx is enabled by default now. (In favor of having a working default configuration)
phpfpm also uses configured nextcloud user + group
In the setup service instead of mkdir + chown now install is used to setup the directories.
This has the disadvantage that the group of nextcloud cannot be changed anymore on an existing installation without having to fix the ownership of files manually. But it think chowning all files on every single startup is bad since it's a very intense operation and can take very long depending on the amount of files stored. Also the chown operation itself might not be allowed depending on the filesystem. I for example use a sshfs mount for my nextcloud files where this fails

fixes #69261
fixes #48881

aanderse

Here are some initial thoughts I had which might be a starting point for further discussion.

nixos/modules/services/web-apps/nextcloud.nix

aanderse · 2020-07-21T21:41:18Z

nixos/modules/services/web-apps/nextcloud.nix

+      default = "nextcloud";
+      description = "User of the nextcloud service";
+    };
+    group = mkOption {


Another possibility here would be to keep running nextcloud services (including php-fpm) as a non web server user (like the current nextcloud user) and instead add the nextcloud group to your web servers extraGroups option, like so:

mkIf cfg.nginx.enable { users.users.nginx.extraGroups = [ cfg.group ]; # in other words "nextcloud" }

The reason for this is that the nginx user (and group) likely has access to very sensitive files, such as certificates. If nginx can read nextcloud files (which you want) that is much less of a risk than having nextcloud able to read nginx files - a serious security concern. This obviously requires that your nextcloud files are g+r.

Sounds like a good idea. The files created by nextcloud seem to be g+r, so this shouldn't be an issue.

I wonder how to best change the user/group of nextcloud without breaking existing installations. It would require a one time service run as root which changes the ownership. And I would need to have some state file to save that this setup has been completed.
Alternatively I could leave the default user.group to be nginx if system.stateVersion <= 20.03, but i don't really like that approach.

Forget about it. Since it looks like the user will still be nextcloud, only the group needs to be changed from nginx to nextcloud which is easy to do in the current setup. Also no state needs to be stored.

Ma27 · 2020-07-21T21:46:44Z

Did anyone of you test what happens when deploying this configuration to an existing Nextcloud instance? Also, what's supposed to happen if cfg.user changes (or someone switches e.g. from nginx to httpd?).

- remove optons cfg.user, cfg.groups - add option `serverUser` which is required when not using nginx - add `serverUser` to nextcloud group - set user/group to "nextcloud" for nextcloud services - make setup-service non-root

DavHau · 2020-07-26T09:03:40Z

please check 6ee3004.

removed optons cfg.user, cfg.groups
add option serverUser which is required when not using nginx
add serverUser to nextcloud group
set user/group to "nextcloud" for nextcloud services
make setup-service non-root

Did not yet implement a solution for fixing group ownership of files for existing installations. Your suggestions are welcome.

aanderse · 2020-07-26T10:58:54Z

@DavHau for context how are you trying to run nextcloud? caddy?

DavHau · 2020-07-26T13:06:36Z

Sorry my description of what I changed was not very precise.

All nextcloud services now use the user and group "nextcloud" (hard-coded). The web server user must therefore be part of the the nextcloud group.

The webserver user can be configured via cfg.serverUser.
This user will be automatically added to the nextcloud group and it will be used for listen.owner of phpfpm. Also its group will automatically be used for listen.group

cfg.serverUserdefaults to the nginx user if nginx is enabled. Otherwise it must be specified manually.

An example configuration using nginx would be:
(if nothing specified nginx will be enabled and its user added to the nextcloud group)

{ pkgs, ... }:
{
  networking.firewall.allowedTCPPorts = [80];
  services.nextcloud = {
    enable = true;
    hostName = "10.233.1.2";
    config.adminpass = "test";
    package = pkgs.nextcloud19;
  };
}

A configuration for an alternative webserver could look like this:

{ pkgs, ... }:
{
  networking.firewall.allowedTCPPorts = [80];
  services.nextcloud = {
    enable = true;
    hostName = "10.233.1.2";
    config.adminpass = "test";
    package = pkgs.nextcloud19;
    
    # disable nginx and set serverUser
    nginx.enable = false;
    serverUser = "caddy";

    # caddy config
    ...
  };
}

aanderse · 2020-07-26T23:05:32Z

@DavHau by having a configurable web server user in this module it seems we're just circling back around to #93070.

@Ma27 I suggest we remove the nginx.enable option entirely and just take it as a given: this module is for nginx only.

DavHau · 2020-07-27T05:50:55Z

removed option nextcloud.nginx.enable. Nginx is now the only supported web server.
modified nextcloud-setup service to fix group ownership of nextcloud files if they don't match.
All installations prior to this PR will be fixed by this. (changed from nginx -> nextcloud).

aanderse

Looking good 👍

nixos/modules/services/web-apps/nextcloud.nix

Co-authored-by: Aaron Andersen <aaron@fosslib.net>

nixos/modules/services/web-apps/nextcloud.nix

Ma27

The implementation seems fine: nginx is in most of the services in our tree that serve HTTP the default choice and now it's possible here to opt-out by disabling it.
Also did a brief test of the altered functionality and it appears fine to me.

However there are a few things I'd like to get resolved before merging this:

We should mention this in our release-notes. When having a big library in your nextcloud, the chown will take some time, so admins should be aware of this before deploying the new config.
Removed options must be documented with mkRemovedOptionModule.
The nextcloud-specific tests don't evaluate because of the removed nginx.enable option.

nixos/modules/services/web-apps/nextcloud.nix

DavHau · 2020-08-03T07:16:10Z

Things done:

deprecated services.nextcloud.nginx.enable option via mkRemovedOptionModule
replaced chown with chgrp
fixed tests by removing use of option services.nextcloud.nginx.enable
use mkDefault for services.nginx.enable

We should mention this in our release-notes. When having a big library in your nextcloud, the chown will take some time, so admins should be aware of this before deploying the new config.

I don't think this will be necessary. Up until this point the setup service always did a chown an all nextcloud files on each startup. Therefore the new implementation doesn't bring any performance drawbacks compared to the old one.

aanderse

In general, LGTM 👍 I have not tested and don't use this module, though, so need someone like @Ma27 to approve as well.

Ma27

LGTM 👍

Did anyone test this with live data yet? I just checked whether the "migration" to the new config works fine in a temporary VM network.
We should mention this in the release notes. The rollout of the new config can take quite long due to the recursive chgrp.

nixos/modules/services/web-apps/nextcloud.nix

ajs124 · 2020-08-06T23:01:10Z

This broke then manual: log. Plz fix, kthxbye. Or wait for a 10-12h, then I'll probably get around to it myself.

aszlig · 2020-08-07T01:36:23Z

@ajs124: Fixed in 1365b9a.

DavHau · 2020-08-07T08:46:06Z

Thanks @ajs124 .
@Ma27 I thought we still wanted to improve the phrase The nextcloud module dropped support for other webservers than nginx..
But now the PR has already been merged. Should I make another commit ontop of this PR and repopen it?

Ma27 · 2020-08-08T20:21:25Z

@aszlig @ajs124 sorry for that!
@DavHau yeah feel free to do that :) Otherwise I'll take care of this next week.

Follow-up for NixOS#93584[1]. This change adds a simple example how to use `Nextcloud` with `httpd`. [1] NixOS#93584 (comment)

Ma27 · 2020-08-12T17:04:57Z

Just for the record, this PR caused another regression in #95259 which got fixed in fddeb7c.

I'm fully aware that I merged this too early which is why I want to openly apologize to everyone who went into trouble because of the (now fixed) regressions I caused with the merge!

Follow-up for NixOS#93584[1]. This change adds a simple example how to use `Nextcloud` with `httpd`. [1] NixOS#93584 (comment)

The web server for the nextcloud module is now restricted to nginx. For more information, see: NixOS/nixpkgs#93584

GaetanLepage · 2022-08-01T09:46:35Z

Hello,

I have read the manual on how to use a different webserver for nextcloud.
However, I don't really get why, to prevent nginx being configured for nextcloud, it is now necessary to completely disable nginx.
What if, I want to have the nginx service enabled for something else while still wanting to use, let's say httpd, as the web server for nextcloud ?

Thank you in advance for the clarification :)

nextcloud: configurable user and group, enabled nginx, improve setup

07076e9

ofborg bot added 6.topic: nixos 8.has: module (update) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 10.rebuild-linux: 1 labels Jul 21, 2020

aanderse reviewed Jul 21, 2020

View reviewed changes

aanderse requested a review from Ma27 July 21, 2020 21:42

nextcloud improve user/group handling

6ee3004

- remove optons cfg.user, cfg.groups - add option `serverUser` which is required when not using nginx - add `serverUser` to nextcloud group - set user/group to "nextcloud" for nextcloud services - make setup-service non-root

DavHau added 2 commits July 27, 2020 12:06

nextcloud: restrict web server support to nginx only

fd9eb16

nextcloud: fix group permissions on startup

5823ed7

aanderse requested changes Jul 27, 2020

View reviewed changes

nixos/modules/services/web-apps/nextcloud.nix Outdated Show resolved Hide resolved

nextcloud: shorten nginx group reference

b90a70d

Co-authored-by: Aaron Andersen <aaron@fosslib.net>

DavHau changed the title ~~nextcloud: configurable user and group, enable nginx, improve setup service~~ nextcloud: restrict web server support to nginx; stop sharing nginx user/group; improve setup service Jul 27, 2020

DavHau requested a review from aanderse July 29, 2020 11:45

aanderse reviewed Jul 29, 2020

View reviewed changes

nixos/modules/services/web-apps/nextcloud.nix Outdated Show resolved Hide resolved

Mic92 reviewed Jul 30, 2020

View reviewed changes

nixos/modules/services/web-apps/nextcloud.nix Show resolved Hide resolved

Ma27 reviewed Jul 30, 2020

View reviewed changes

nixos/modules/services/web-apps/nextcloud.nix Outdated Show resolved Hide resolved

DavHau force-pushed the nextcloud-improvements branch from 753d8a9 to 8516f4f Compare August 3, 2020 07:11

nextcloud: deprecate nginx, use chgrp, mkDefault for nginx, fix tests

ca916e8

DavHau force-pushed the nextcloud-improvements branch from 8516f4f to ca916e8 Compare August 3, 2020 07:21

DavHau requested a review from aanderse August 4, 2020 05:56

aanderse approved these changes Aug 4, 2020

View reviewed changes

Ma27 reviewed Aug 4, 2020

View reviewed changes

nixos/modules/services/web-apps/nextcloud.nix Show resolved Hide resolved

nextcloud: use mkDefault for whole nginx config

128dbb3

Ma27 approved these changes Aug 6, 2020

View reviewed changes

Ma27 merged commit 50d8cdb into NixOS:master Aug 6, 2020

Ma27 added a commit to Ma27/nixpkgs that referenced this pull request Aug 10, 2020

nixos/nextcloud: add documentation for alternative reverse-proxies

dd957c2

Follow-up for NixOS#93584[1]. This change adds a simple example how to use `Nextcloud` with `httpd`. [1] NixOS#93584 (comment)

Ma27 mentioned this pull request Aug 10, 2020

nixos/nextcloud: add documentation for alternative reverse-proxies #95109

Merged

10 tasks

wchresta pushed a commit to wchresta/nixpkgs that referenced this pull request Aug 17, 2020

nixos/nextcloud: add documentation for alternative reverse-proxies

9dfe935

Follow-up for NixOS#93584[1]. This change adds a simple example how to use `Nextcloud` with `httpd`. [1] NixOS#93584 (comment)

evanjs added a commit to evanjs/nixos_cfg that referenced this pull request Aug 19, 2020

nextcloud: remove nginx.enable

4bfc757

The web server for the nextcloud module is now restricted to nginx. For more information, see: NixOS/nixpkgs#93584

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nextcloud: restrict web server support to nginx; stop sharing nginx user/group; improve setup service #93584

nextcloud: restrict web server support to nginx; stop sharing nginx user/group; improve setup service #93584

DavHau commented Jul 21, 2020 •

edited

aanderse left a comment

aanderse Jul 21, 2020

DavHau Jul 22, 2020

DavHau Jul 26, 2020

DavHau Jul 27, 2020

Ma27 commented Jul 21, 2020

DavHau commented Jul 26, 2020

aanderse commented Jul 26, 2020 •

edited

DavHau commented Jul 26, 2020

aanderse commented Jul 26, 2020

DavHau commented Jul 27, 2020

aanderse left a comment

Ma27 left a comment

DavHau commented Aug 3, 2020

aanderse left a comment

Ma27 left a comment

ajs124 commented Aug 6, 2020

aszlig commented Aug 7, 2020

DavHau commented Aug 7, 2020

Ma27 commented Aug 8, 2020

Ma27 commented Aug 12, 2020

GaetanLepage commented Aug 1, 2022

nextcloud: restrict web server support to nginx; stop sharing nginx user/group; improve setup service #93584

nextcloud: restrict web server support to nginx; stop sharing nginx user/group; improve setup service #93584

Conversation

DavHau commented Jul 21, 2020 • edited

Things done

aanderse left a comment

Choose a reason for hiding this comment

aanderse Jul 21, 2020

Choose a reason for hiding this comment

DavHau Jul 22, 2020

Choose a reason for hiding this comment

DavHau Jul 26, 2020

Choose a reason for hiding this comment

DavHau Jul 27, 2020

Choose a reason for hiding this comment

Ma27 commented Jul 21, 2020

DavHau commented Jul 26, 2020

aanderse commented Jul 26, 2020 • edited

DavHau commented Jul 26, 2020

aanderse commented Jul 26, 2020

DavHau commented Jul 27, 2020

aanderse left a comment

Choose a reason for hiding this comment

Ma27 left a comment

Choose a reason for hiding this comment

DavHau commented Aug 3, 2020

aanderse left a comment

Choose a reason for hiding this comment

Ma27 left a comment

Choose a reason for hiding this comment

ajs124 commented Aug 6, 2020

aszlig commented Aug 7, 2020

DavHau commented Aug 7, 2020

Ma27 commented Aug 8, 2020

Ma27 commented Aug 12, 2020

GaetanLepage commented Aug 1, 2022

DavHau commented Jul 21, 2020 •

edited

aanderse commented Jul 26, 2020 •

edited