From 296f55f9054e6107d0a467e58941e9929fdde8c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Victor=20I=C8=99an?= <victor@isan.ro>
Date: Sun, 10 May 2026 15:09:10 +0200
Subject: [PATCH] isengard: separated nextcloud data

---
 hosts/isengard.nix               | 1 +
 modules/containers/nextcloud.nix | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/hosts/isengard.nix b/hosts/isengard.nix
index a606cdb..8f119c6 100644
--- a/hosts/isengard.nix
+++ b/hosts/isengard.nix
@@ -48,6 +48,7 @@
     virtualisation.oci-containers.backend = "podman";
     systemd.tmpfiles.rules = [
         "d /srv/containers 0775 root admin"
+        "d /srv/data 0775 root admin"
     ];
 
     # Security
diff --git a/modules/containers/nextcloud.nix b/modules/containers/nextcloud.nix
index c220f14..2ea92a9 100644
--- a/modules/containers/nextcloud.nix
+++ b/modules/containers/nextcloud.nix
@@ -2,11 +2,13 @@
 
 let
     workDir = "/srv/containers/nextcloud";
+    dataDir = "/srv/data/nextcloud";
 in
 {
     systemd.tmpfiles.rules = [
         "d ${workDir}/html 2700 33 33"
         "d ${workDir}/db 2700 999 999"
+        "d ${dataDir} 2700 victor admin"
     ];
 
     virtualisation.oci-containers.containers = {
@@ -20,6 +22,7 @@ in
 
             volumes = [
                 "${workDir}/html:/var/www/html"
+                "${dataDir}:/var/www/html/data"
             ];
         
             environmentFiles = [
@@ -30,6 +33,10 @@ in
                 "nextcloud-db"
                 "nextcloud-redis"
             ];
+
+            extraOptions = [
+                "--group-add=10000" # admin group
+            ];
         };
 
         nextcloud-db = {