Add cloud and nextcloud install.

.gitmodules

@@ -7,3 +7,6 @@
 [submodule "states/dmarc_reports/dmarcts-report-viewer"]
 	path = states/dmarc_reports/dmarcts-report-viewer
 	url = https://github.com/techsneeze/dmarcts-report-viewer.git
+[submodule "formulas/nextcloud-formula"]
+	path = formulas/nextcloud-formula
+	url = https://github.com/saltstack-formulas/nextcloud-formula.git

pillar/hostinfo/cloud.sls

@@ -0,0 +1,3 @@
+hostinfo:
+  hostname: cloud
+  hostname_fqdn: cloud.lunch.org.uk

pillar/nextcloud/cloud.sls

@@ -0,0 +1,103 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+---
+nextcloud:
+  lookup:
+    # Just for testing purposes
+    winner: lookup
+    added_in_lookup: lookup_value
+
+  php_executable: /usr/bin/php
+  rootgroup: root
+
+  # Default: webroot + '/data'
+  # datadir: /var/www/nextcloud/data
+  webuser: www-data
+  webroot: /srv/nextcloud
+  # nextcloud/ in some installations
+  websubdir: false
+
+  # Installation
+  # archive or pkg
+  install_mode: archive
+  archive:
+    name: latest-32
+  pkg:
+    name: nextcloud
+
+  # The defaults from 'occ maintenance:install'
+  database:
+    driver: mysql
+    name: nextcloud
+    host: localhost
+    port: 3306
+    user: nextcloud@localhost
+    pass: prayer-monkey-breeze
+    # driver: sqlite
+    # name: nextcloud
+    # Not relevant for sqlite
+    # host: localhost
+    # port: 5432
+    # user: nextcloud
+    # pass: password
+    # table-prefix: oc_
+    # table-space:
+  initial_admin_credentials:
+    user: admin
+    pass: mystic-pizza-antartic-sledge
+    # pass: password
+    email: webmaster@lunch.org.uk
+
+  salt_managed_config:
+    'htaccess.RewriteBase': '/'
+    appcodechecker: true
+    updatechecker: true
+    'memcache.local': '\OC\Memcache\APCu'
+
+  tofs:
+    # The files_switch key serves as a selector for alternative
+    # directories under the formula files directory. See TOFS pattern
+    # doc for more info.
+    # Note: Any value not evaluated by `config.get` will be used literally.
+    # This can be used to set custom paths, as many levels deep as required.
+    files_switch:
+      - any/path/can/be/used/here
+      - id
+      - roles
+      - osfinger
+      - os
+      - os_family
+    # All aspects of path/file resolution are customisable using the options below.
+    # This is unnecessary in most cases; there are sensible defaults.
+    # Default path: salt://< path_prefix >/< dirs.files >/< dirs.default >
+    #         I.e.: salt://nextcloud/files/default
+    # path_prefix: template_alt
+    # dirs:
+    #   files: files_alt
+    #   default: default_alt
+    # The entries under `source_files` are prepended to the default source files
+    # given for the state
+    # source_files:
+    #   nextcloud-config-file-file-managed:
+    #     - 'example_alt.tmpl'
+    #     - 'example_alt.tmpl.jinja'
+
+    # For testing purposes
+    source_files:
+      nextcloud-config-file-file-managed:
+        - 'example.tmpl.jinja'
+      nextcloud-subcomponent-config-file-file-managed:
+        - 'subcomponent-example.tmpl.jinja'
+
+  ##
+  # nextcloud.apache
+  # Apache config snippet
+  #apache:
+  #  config_snippet: /etc/apache2/nextcloud-snippet.conf
+    # Assumes you're using apache-formula
+    # defaults to true
+  #  trigger_reload: false
+
+  # Just for testing purposes
+  #winner: pillar
+  #added_in_pillar: pillar_value

pillar/top.sls

@@ -20,3 +20,8 @@ base:
     - hostinfo/social
     - secrets/certificates
     - secrets/restic
+  'cloud.hollowfurlong.lunch.org.uk':
+    - hostinfo/cloud
+    - secrets/certificates
+    - secrets/mariadb
+    - nextcloud/cloud

states/cloud/cloud.lunch.org.uk.conf

@@ -0,0 +1,64 @@
+<IfModule mod_ssl.c>
+
+<VirtualHost *:443>
+        ServerName cloud.lunch.org.uk
+
+        ErrorLog /var/log/apache2/cloud-error.log
+        CustomLog /var/log/apache2/cloud-access.log combined
+
+        RemoteIPProxyProtocol On
+
+	ProxyFCGIBackendType FPM
+
+	DocumentRoot /srv/nextcloud
+
+        <Directory /srv/nextcloud>
+            Options +FollowSymLinks
+            AllowOverride All
+            Order allow,deny
+            Allow from all
+            Require all granted
+
+            <IfModule mod_dav.c>
+                Dav off
+            </IfModule>
+
+            SetEnv HOME /srv/nextcloud
+            SetEnv HTTP_HOME /srv/nextcloud
+        </Directory>
+
+        <FilesMatch remote.php>
+            SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
+        </FilesMatch>
+
+        <IfModule headers_module>
+            # HSTS (mod_headers is required) (15768000 seconds = 6 months)
+            Header always set Strict-Transport-Security "max-age=15768000"
+            #  No embedding the site. Anti-clickjacking credentials.
+            Header set Content-Security-Policy "frame-ancestors 'none';"
+        </IfModule>
+
+	SSLEngine on
+	SSLCertificateFile /var/local/certificates/cloud.lunch.org.uk/fullchain.pem
+	SSLCertificateKeyFile /var/local/certificates/cloud.lunch.org.uk/privkey.pem
+</VirtualHost>
+
+</IfModule>
+
+<VirtualHost *:80>
+        ServerName cloud.lunch.org.uk
+
+        ErrorLog /var/log/apache2/cloud-error.log
+        CustomLog /var/log/apache2/cloud-access.log combined
+
+        RemoteIPProxyProtocol On
+
+        <IfModule rewrite_module>
+                #
+                # This redirects all accesses to the HTTPS version of the site.
+                #
+                RewriteEngine On
+
+                RewriteRule ^/?(.*) https://cloud.lunch.org.uk/$1 [R=301,L]
+        </IfModule>
+</VirtualHost>

states/cloud/init.sls

@@ -0,0 +1,49 @@
+cloud_pkgs:
+  pkg.installed:
+  - pkgs:
+    - memcached
+    - php-apcu
+    - php-memcached
+    - php-mysql
+    - php-gd
+    - php-json
+    - php-curl
+    - php-mbstring
+    - php-intl
+    - php-imagick
+    - php-xml
+    - php-zip
+
+cloud_mysql_user:
+  mysql_user.present:
+    - name: '{{ salt['pillar.get']('nextcloud:database:user', '') }}'
+    - password: '{{ salt['pillar.get']('nextcloud:database:pass', '') }}'
+  mysql_database.present:
+    - name: '{{ salt['pillar.get']('nextcloud:database:name', '') }}'
+  mysql_grants.present:
+    - grant: all privileges
+    - database: '{{ salt['pillar.get']('nextcloud:database:name', '') }}.*'
+    - user: '{{ salt['pillar.get']('nextcloud:database:user', '') }}'
+
+include:
+  - nextcloud
+
+cloud_web:
+  file.managed:
+    - require:
+      - sls: apache
+      - sls: certificates/client
+      - sls: php_fpm/trixie
+      - sls: nextcloud
+    - names:
+      - /etc/apache2/sites-available/cloud.lunch.org.uk.conf:
+        - source: salt://cloud/cloud.lunch.org.uk.conf
+  apache_site.enabled:
+    - require:
+      - file: /etc/apache2/sites-available/cloud.lunch.org.uk.conf
+    - name: cloud.lunch.org.uk
+  service.running:
+    - name: apache2
+    - reload: true
+    - watch:
+      - file: /etc/apache2/sites-available/cloud.lunch.org.uk.conf

states/firewalls/cloud.sls

@@ -0,0 +1,13 @@
+social_public:
+  firewalld.present:
+    - name: public
+    - default: False
+    - services:
+      - dhcpv6-client
+      - ssh
+      - http
+      - https
+    - prune_services: True
+    - require:
+      - firewalld
+

states/php_fpm/trixie.sls

@@ -0,0 +1,18 @@
+php-fpm:
+  pkg.installed
+
+apache_php_module:
+  apache_module.disabled:
+    - name: php8.4
+
+apache_fcgi_module:
+  apache_module.enabled:
+    - name: proxy_fcgi
+
+apache_setenvif_module:
+  apache_module.enabled:
+    - name: setenvif
+
+apache_php8.4_conf:
+  apache_conf.enabled:
+    - name: php8.4-fpm

states/top.sls

@@ -48,3 +48,15 @@ base:
     - firewalls/social
     - backup/restic
     - activitypub
+
+  'cloud.hollowfurlong.lunch.org.uk':
+    - debian/trixie
+    - certificates/client
+    - email-satellite
+    - fail2ban
+    - firewalls/cloud
+    - mariadb
+    - apache
+    - php_fpm/trixie
+    - cloud
+