isengard: separated nextcloud data

hosts/isengard.nix

@@ -48,6 +48,7 @@
     virtualisation.oci-containers.backend = "podman";
     systemd.tmpfiles.rules = [
         "d /srv/containers 0775 root admin"
+        "d /srv/data 0775 root admin"
     ];
 
     # Security

modules/containers/nextcloud.nix

@@ -2,11 +2,13 @@
 
 let
     workDir = "/srv/containers/nextcloud";
+    dataDir = "/srv/data/nextcloud";
 in
 {
     systemd.tmpfiles.rules = [
         "d ${workDir}/html 2700 33 33"
         "d ${workDir}/db 2700 999 999"
+        "d ${dataDir} 2700 victor admin"
     ];
 
     virtualisation.oci-containers.containers = {
@@ -20,6 +22,7 @@ in
 
             volumes = [
                 "${workDir}/html:/var/www/html"
+                "${dataDir}:/var/www/html/data"
             ];
         
             environmentFiles = [
@@ -30,6 +33,10 @@ in
                 "nextcloud-db"
                 "nextcloud-redis"
             ];
+
+            extraOptions = [
+                "--group-add=10000" # admin group
+            ];
         };
 
         nextcloud-db = {