Use cacert in Nextcloud

[provokateurin]

Replaces #405873.

I tested this on my homelab test VM and the self-signed certificates are now happily accepted when set through security.pki.certificateFiles.
I also want to add a test for this, but don't have the time to do that right now, therefore I want to keep the PR in draft until that is done.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[Ma27]

I also want to add a test for this, but don't have the time to do that right now, therefore I want to keep the PR in draft until that is done.

Hmm, maybe it's sufficient to expose the minio (or whatever we use) in the object-store test behind TLS and use the test CA we have in nixos/tests? If this works with verification enabled and the CA added to the system-wide bundle of the Nextcloud server, that's it I think.

[Ma27]

I have an almost-working test btw ;-)

---

Paging cacert maintainers @fpletz @lukegb

[provokateurin]

I have an almost-working test

Feel free to push :)

I will do the other adjustments on the weekend or next week.

[Ma27]

Done!

I will do the other adjustments on the weekend or next week.

No worries.
We may miss the official branch-off, but IMHO this is perfectly reasonable to backport.

[provokateurin]

@Ma27 If you don't mind you can also do the changes from the review, I agree with all of them. Maybe we can merge it before the branch-off then :)

[provokateurin]

@Ma27 can you fix the formatting?

[Ma27]

@provokateurin I just realized that we can directly use the caBundle from the CA module by making this a parameter for the nextcloud package. We also need cacert, but this doesn't even get evaluated when using the module because laziness.

I like this even more because the option feels a little pointless given that the relevant path is already exposed. Wdyt?

[provokateurin]

Ah this solution is a lot cleaner, but the commit message was not adjusted and still mentions security.pki.cacertPackage.

[Ma27]

Good catch, fixed!

[provokateurin]

Cool, looks ready to merge to me!

[SuperSandro2000]

Someone knows how to use compressDrvWeb now?

The following fails since this PR:

services.nextcoud.package = pkgs.compressDrvWeb pkgs.nextcloud31 {
  extraFindOperands = ''-not -iregex ".*(\/apps\/.*\/l10n\/).*"'';
};

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: attribute 'override' missing
       at /nix/store/aj454c0f7biyfxzpinmw28y90377x9jv-source/nixos/modules/services/web-apps/nextcloud.nix:13:21:
           12|
           13|   overridePackage = cfg.package.override {
             |                     ^
           14|     inherit (config.security.pki) caBundle;