lament/pantheon

nextcloud, taken for an honest spin: drive.lament.gay lands on minerva #121

Merged

lament merged 1 commit from nextcloud-minerva into main

2026-08-01 22:57:45 -05:00

lament commented

2026-08-01 22:29:51 -05:00

Owner

drive.lament.gay - Nextcloud on minerva, VPN-only, OIDC-only login.

nextcloud's own module hardcodes an nginx vhost + php-fpm socket owned by nginx:nginx - not swappable to caddy without hand-rolling its whole rewrite/security recipe. so a second, purely local caddy instance runs on minerva fronting php-fpm over the unix socket (upstream's own Caddyfile recipe, unmodified), and athena's edge caddy reverse_proxys to it like any other backend - directory.services.drive stays a plain entry, caddy.nix's generator needs no nextcloud-specific branch
- caddy needs nginx's group as a SupplementaryGroups grant to dial the phpfpm socket at all (same idiom as keycloak.nix's keytab access)
- hit a real bug getting there: a bracketed IP as a Caddyfile site address is a Host-header match, not a bind address - every request silently fell through to an empty 200/Content-Length: 0 until switched to the real hostname + listenAddresses for the actual bind
postgres tenant of postgres.apps (minerva), same split as wiki-js - ensureDatabases/ensureUsers, no createLocally
keycloak's lament realm gets a nextcloud OIDC client; user_oidc registers via occ user_oidc:provider (upserts by identifier, no create/update split needed unlike forgejo's auth-source oneshot) and allow_multiple_user_backends gets forced off, so login is SSO-only with ?direct=1 as the break-glass path to the local admin account - no separate local-account carve-out needed
VPN-only by default (no public on the directory entry) - never default a new service to public

left for later: birthdate (and other profile fields) can't be edited on the OIDC-federated account - Nextcloud enforces federation-managed scope on user_oidc backends regardless of whether a claim is mapped. Real fix is LDAP-as-source-of-truth (schema extension + Keycloak mapper), parked as not worth it for one cosmetic field right now.

`drive.lament.gay` - Nextcloud on minerva, VPN-only, OIDC-only login. - nextcloud's own module hardcodes an nginx vhost + php-fpm socket owned by `nginx:nginx` - not swappable to caddy without hand-rolling its whole rewrite/security recipe. so a *second*, purely local caddy instance runs on minerva fronting php-fpm over the unix socket (upstream's own Caddyfile recipe, unmodified), and athena's edge caddy `reverse_proxy`s to it like any other backend - `directory.services.drive` stays a plain entry, `caddy.nix`'s generator needs no nextcloud-specific branch - caddy needs nginx's group as a `SupplementaryGroups` grant to dial the phpfpm socket at all (same idiom as keycloak.nix's keytab access) - hit a real bug getting there: a bracketed IP as a Caddyfile site address is a Host-header *match*, not a bind address - every request silently fell through to an empty `200`/`Content-Length: 0` until switched to the real hostname + `listenAddresses` for the actual bind - postgres tenant of `postgres.apps` (minerva), same split as wiki-js - `ensureDatabases`/`ensureUsers`, no `createLocally` - keycloak's `lament` realm gets a `nextcloud` OIDC client; `user_oidc` registers via `occ user_oidc:provider` (upserts by identifier, no create/update split needed unlike forgejo's auth-source oneshot) and `allow_multiple_user_backends` gets forced off, so login is SSO-only with `?direct=1` as the break-glass path to the local admin account - no separate local-account carve-out needed - VPN-only by default (no `public` on the directory entry) - never default a new service to public left for later: birthdate (and other profile fields) can't be edited on the OIDC-federated account - Nextcloud enforces federation-managed scope on `user_oidc` backends regardless of whether a claim is mapped. Real fix is LDAP-as-source-of-truth (schema extension + Keycloak mapper), parked as not worth it for one cosmetic field right now.

lament added 1 commit

2026-08-01 22:29:51 -05:00

nextcloud: stand up on minerva behind a local caddy, OIDC-only

CI / check (pull_request) Successful in 51s

Details

CI / deploy (pull_request) Has been skipped

Details

CI / build (pull_request) Successful in 2m39s

Details

CI / dry-activate (pull_request) Successful in 34s

Details

CI / check (push) Has been skipped