nix/container/Office.nix

# NOTE: Imperative part:
# 1. You need to change PSQL tables owner from root to onlyoffice, too. They don't do that automatically for some reason.
# 2. TODO: Generate JWT secret at /var/lib/onlyoffice/jwt, i.e. 9wLfMGha1YrfvWpb5hyYjZf8pvJQ3swS
# See https://git.voronind.com/voronind/nixos/issues/74
{ container, pkgs, util, lib, config, ... }: with lib; let
	cfg = config.container.module.office;
in {
	options = {
		container.module.office = {
			enable = mkEnableOption "Office web suite.";
			address = mkOption {
				default = "10.1.0.21";
				type    = types.str;
			};
			port = mkOption {
				default = 8000;
				type    = types.int;
			};
			domain = mkOption {
				default = "office.${config.container.domain}";
				type    = types.str;
			};
			storage = mkOption {
				default = "${config.container.storage}/office";
				type    = types.str;
			};
		};
	};

	config = mkIf cfg.enable {
		systemd.tmpfiles.rules = container.mkContainerDir cfg [
			"data"
		];

		containers.office = container.mkContainer cfg {
			bindMounts = {
				"/var/lib/onlyoffice" = {
					hostPath   = "${cfg.storage}/data";
					isReadOnly = false;
				};
			};


			# HACK: Temporarely run in docker due to https://github.com/ONLYOFFICE/onlyoffice-nextcloud/issues/931
			config = { pkgs, ... }: container.mkContainerConfig cfg {
				virtualisation.oci-containers.backend = "docker";
				virtualisation.oci-containers.containers.office = {
					autoStart = true;
					image = "dockerhub.timeweb.cloud/onlyoffice/documentserver:latest";
					# ports = [ "${toString cfg.port}:8000" ];
					extraOptions = [ "--network=host" "--privileged" ];
					environment = {
						JWT_ENABLED = "true";
						JWT_SECRET = "8wLfKGha8YRfvwpB5hYYjZf8vtUQs3wS";
						AMQP_URI = "amqp://guest:guest@${config.container.module.rabbitmq.address}:${toString config.container.module.rabbitmq.port}";
						DB_HOST = config.container.module.postgres.address;
						DB_PORT = toString config.container.module.postgres.port;
						DB_NAME = "onlyoffice";
						DB_USER = "onlyoffice";
						DB_PWD  = "onlyoffice";
					};
				};
			};

			# config = { pkgs, ... }: container.mkContainerConfig cfg {
			# 	# HACK: For whatever reason it does not detect my global allowUnfree (I pass pkgs from host system in mkContainerConfig).
			# 	nixpkgs.overlays = [ (final: prev: {
			# 		corefonts = prev.corefonts.overrideAttrs (old: {
			# 			meta.license = mkForce licenses.mit;
			# 		});
			# 	})];

			# 	services.onlyoffice = let
			# 		dbName = "onlyoffice";
			# 	in {
			# 		enable   = true;
			# 		hostname = cfg.domain;

			# 		postgresName = dbName;
			# 		postgresHost = config.container.module.postgres.address;
			# 		postgresUser = dbName;
			# 		postgresPasswordFile = "${pkgs.writeText "OfficeDbPassword" dbName}";

			# 		jwtSecretFile = "/var/lib/onlyoffice/jwt";

			# 		rabbitmqUrl = "amqp://guest:guest@${config.container.module.rabbitmq.address}:${toString config.container.module.rabbitmq.port}";

			# 		examplePort = cfg.port;
			# 		enableExampleServer = true;
			# 	};
			# };
		};
	};
}