rclone-webdav begins

modules/rclone-webdav.nix

@@ -0,0 +1,267 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.rclone-webdav;
+
+  parseUserFile =
+    userFile:
+    let
+      content = builtins.readFile userFile;
+      lines = filter (line: line != "" && !hasPrefix "#" line) (splitString "\n" content);
+      parseUser =
+        line:
+        let
+          parts = splitString ":" line;
+        in
+        {
+          username = elemAt parts 0;
+          password = elemAt parts 1;
+        };
+    in
+    map parseUser lines;
+
+  users = if cfg.authFile != null then parseUserFile cfg.authFile else [ ];
+  usernames = map (u: u.username) users;
+
+  socketDirectory = "/var/lib/webdav";
+
+  # Generate rclone service for each user
+  mkRcloneService =
+    user:
+    nameValuePair "rclone-webdav-${user.username}" {
+      description = "rclone WebDAV service for ${user.username}";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        Restart = "always";
+        RestartSec = "5s";
+
+        # Ensure directories exist
+        ExecStartPre = [
+          "${pkgs.coreutils}/bin/mkdir -p ${cfg.dataDirectory}/${user.username}"
+          "${pkgs.coreutils}/bin/mkdir -p ${socketDirectory}"
+          "${pkgs.coreutils}/bin/chown ${cfg.user}:${cfg.group} ${cfg.dataDirectory}/${user.username}"
+          "${pkgs.coreutils}/bin/chown ${cfg.user}:${cfg.group} ${socketDirectory}"
+        ];
+
+        ExecStart = ''
+          ${pkgs.rclone}/bin/rclone serve webdav ${cfg.dataDirectory}/${user.username} \
+            --addr unix:${socketDirectory}/rclone-${user.username}.sock \
+            --user ${user.username} \
+            --pass ${user.password} \
+            --log-level INFO
+        '';
+
+        # Security settings
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ReadWritePaths = [
+          cfg.dataDirectory
+          socketDirectory
+        ];
+      };
+    };
+
+  # Generate nginx upstream for each user
+  mkNginxUpstream = user: {
+    name = "rclone-${user.username}";
+    value = {
+      servers = {
+        "unix:${socketDirectory}/rclone-${user.username}.sock" = { };
+      };
+    };
+  };
+
+  # Generate nginx location for each user
+  mkNginxLocation = user: {
+    name = "/${user.username}/";
+    value = {
+      proxyPass = "http://rclone-${user.username}";
+      extraConfig = ''
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Remove the username prefix from the path
+        rewrite ^/${user.username}/(.*) /$1 break;
+
+        # WebDAV specific headers
+        proxy_set_header Destination $http_destination;
+        proxy_set_header Depth $http_depth;
+        proxy_set_header Overwrite $http_overwrite;
+        proxy_set_header Lock-Token $http_lock_token;
+        proxy_set_header If $http_if;
+
+        # Allow WebDAV methods
+        proxy_method $request_method;
+
+        # Increase timeouts for large file uploads
+        proxy_connect_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+
+        # Set maximum file size for this location
+        client_max_body_size ${cfg.maxFileSize};
+      '';
+    };
+  };
+
+in
+{
+  options.services.rclone-webdav = {
+    enable = mkEnableOption "rclone WebDAV multi-user service";
+
+    authFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = "Path to file containing username:password pairs, one per line";
+      example = "/etc/rclone-webdav-users";
+    };
+
+    dataDirectory = mkOption {
+      type = types.str;
+      default = "/srv/webdav";
+      description = "Base directory where user subdirectories will be created";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "webdav";
+      description = "User to run rclone services as";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "webdav";
+      description = "Group to run rclone services as";
+    };
+
+    listenAddresses = mkOption {
+      type = types.listOf types.str;
+      default = [ "localhost" ];
+      description = "List of addresses for nginx to listen on";
+      example = [
+        "localhost"
+        "127.0.0.1"
+        "::1"
+      ];
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8000;
+      description = "Port for nginx to listen on";
+    };
+
+    maxFileSize = mkOption {
+      type = types.str;
+      default = "0";
+      description = "Maximum file size for uploads (nginx client_max_body_size). Use '0' for unlimited.";
+      example = "100M";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.authFile != null;
+        message = "services.rclone-webdav.authFile must be specified";
+      }
+      {
+        assertion = users != [ ];
+        message = "Auth file must contain at least one user";
+      }
+    ];
+
+    # Create user and group
+    users.users = mkIf (cfg.user == "webdav") {
+      webdav = {
+        isSystemUser = true;
+        group = cfg.group;
+        description = "rclone WebDAV service user";
+        home = cfg.dataDirectory;
+        createHome = true;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "webdav") {
+      webdav = {
+        gid = null;
+      };
+    };
+
+    # Create systemd services for each user
+    systemd.services = listToAttrs (map mkRcloneService users);
+
+    # Configure nginx
+    services.nginx = {
+      enable = true;
+
+      upstreams = listToAttrs (map mkNginxUpstream users);
+
+      virtualHosts."rclone-webdav" = {
+        listen = map (addr: {
+          addr = addr;
+          port = cfg.port;
+        }) cfg.listenAddresses;
+
+        locations = listToAttrs (map mkNginxLocation users) // {
+          "/" = {
+            return = "200 'rclone WebDAV Multi-user Server'";
+            extraConfig = ''
+              add_header Content-Type text/plain;
+            '';
+          };
+
+          # Catch-all location for non-existent users - return 400
+          "~* ^/([^/]+)/" = {
+            extraConfig = ''
+              # Check if the requested user exists
+              set $user_exists 0;
+              ${concatStringsSep "\n" (
+                map (username: "if ($1 = \"${username}\") { set $user_exists 1; }") usernames
+              )}
+
+              # If user doesn't exist, return 400
+              if ($user_exists = 0) {
+                return 400 "User not found";
+              }
+
+              # This should not be reached for valid users
+              return 404;
+            '';
+          };
+        };
+
+        extraConfig = ''
+          # Enable WebDAV methods
+          dav_methods PUT DELETE MKCOL COPY MOVE;
+          dav_ext_methods PROPFIND PROPPATCH LOCK UNLOCK;
+
+          # Set default maximum file size
+          client_max_body_size ${cfg.maxFileSize};
+        '';
+      };
+    };
+
+    # Ensure directories exist
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDirectory} 0755 ${cfg.user} ${cfg.group} -"
+      "d ${socketDirectory} 0755 ${cfg.user} ${cfg.group} -"
+    ] ++ map (user: "d ${cfg.dataDirectory}/${user.username} 0755 ${cfg.user} ${cfg.group} -") users;
+  };
+}