ConfigLMM 0.4.0 → 0.5.0

data/Plugins/Apps/Matrix/Matrix.lmm.rb

@@ -1,13 +1,15 @@
 
 module ConfigLMM
     module LMM
-        class Matrix < Framework::NginxApp
+        class Matrix < Framework::Plugin
 
             USER = 'matrix'
             HOME_DIR = '/var/lib/matrix'
 
             def actionMatrixBuild(id, target, state, context, options)
-                writeNginxConfig(__dir__, 'Matrix', id, target, state, context, options)
+                Nginx.withConnection(local) do |nginxConnection|
+                    nginxConnection.writeConfig(__dir__, 'Matrix', target, state, context, options)
+                end
             end
 
             def actionMatrixDiff(id, target, activeState, context, options)
@@ -19,87 +21,114 @@ module ConfigLMM
                 raise Framework::PluginProcessError.new('ServerName field must be set!') unless target['ServerName']
 
                 target['Database'] ||= {}
-                if target['Location'] && target['Location'] != '@me'
-                    uri = Addressable::URI.parse(target['Location'])
-                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
-
-                    self.class.sshStart(uri) do |ssh|
-
-                        dbPassword = self.configurePostgreSQL(target['Database'], ssh)
-                        distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
-
-                        Framework::LinuxApp.configurePodmanServiceOverSSH(USER, HOME_DIR, 'Matrix', distroInfo, ssh)
-                        self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mkdir -p ~/data'")
-
-                        path = Framework::LinuxApp::SYSTEMD_CONTAINERS_PATH.gsub('~', HOME_DIR)
-                        self.class.exec("touch #{path}/Matrix.env", ssh)
-
-                        self.class.exec("chown #{USER}:#{USER} #{path}/Matrix.env", ssh)
-                        self.class.exec("chmod 600 #{path}/Matrix.env", ssh)
-
-                        ssh.scp.upload!(__dir__ + '/homeserver.yaml', HOME_DIR + '/data/')
-                        ssh.scp.upload!(__dir__ + '/log.config', HOME_DIR + '/data/')
-                        ssh.scp.upload!(__dir__ + '/config.json', HOME_DIR + '/')
-                        self.class.exec("chown -R #{USER}:#{USER} #{HOME_DIR}/data", ssh)
-
-                        self.class.exec("sed -i 's|$SERVER_NAME|#{target['ServerName']}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                        self.class.exec("sed -i 's|$SYNAPSE_DOMAIN|#{target['SynapseDomain'].downcase}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                        self.class.exec("sed -i 's|$DB_PASSWORD|#{dbPassword}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                        self.class.exec("sed -i 's|$SECRET1|#{SecureRandom.urlsafe_base64(45)}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                        self.class.exec("sed -i 's|$SECRET2|#{SecureRandom.urlsafe_base64(45)}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                        self.class.exec("sed -i 's|$SECRET3|#{SecureRandom.urlsafe_base64(45)}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-
-                        self.class.exec("sed -i 's|$SYNAPSE_DOMAIN|#{target['SynapseDomain']}|' #{HOME_DIR}/config.json", ssh)
-                        self.class.exec("sed -i 's|$SERVER_NAME|#{target['ServerName']}|' #{HOME_DIR}/config.json", ssh)
-
-                        if target['SMTP']
-                            host = target['SMTP']['Host']
-                            host = HOST_IP if ['localhost', '127.0.0.1'].include?(host)
-                            self.class.exec("sed -i 's|smtp_host:.*|smtp_host: #{host}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                            self.class.exec("sed -i 's|smtp_port:.*|smtp_port: #{target['SMTP']['Port']}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                            self.class.exec("sed -i 's|smtp_user:.*|smtp_user: #{target['SMTP']['Username']}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                            self.class.exec("sed -i 's|smtp_pass:.*|smtp_pass: #{ENV['MATRIX_SMTP_PASSWORD']}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                            self.class.exec("sed -i 's|notif_from:.*|notif_from: #{target['SMTP']['From']}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-
-                            if target['SMTP']['Port'] == 465
-                                self.class.exec("sed -i 's|force_tls:.*|force_tls: true|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                            end
-                        else
-                            self.class.exec("sed -i 's|email:|ignore_email:|' #{HOME_DIR}/data/homeserver.yaml", ssh)
+
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        target['Database'] ||= {}
+                        dbPassword = self.configurePostgreSQL(target['Database'], linuxConnection, options)
+
+                        Podman.ensurePresent(linuxConnection, options)
+                        Podman.createUser(USER, HOME_DIR, 'Matrix', linuxConnection, options)
+                        linuxConnection.withUserShell(USER) do |shell|
+                            shell.createDirs(options, '~/data')
                         end
 
-                        if target['OIDC']
-                            self.class.exec("sed -i 's|$OIDC_ISSUER|#{target['OIDC']['Issuer']}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                            self.class.exec("sed -i 's|$CLIENT_ID|#{ENV['MATRIX_OIDC_CLIENT_ID']}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                            self.class.exec("sed -i 's|$CLIENT_SECRET|#{ENV['MATRIX_OIDC_CLIENT_SECRET']}|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                            self.class.exec("sed -i 's|enabled: true|enabled: false|' #{HOME_DIR}/data/homeserver.yaml", ssh)
-                        else
-                            self.class.exec("sed -i 's|oidc_providers:|ignore_oidc_providers:|' #{HOME_DIR}/data/homeserver.yaml", ssh)
+                        path = Podman.containersPath(HOME_DIR)
+                        linuxConnection.ensureFile("#{path}/Matrix.env", options)
+
+                        linuxConnection.setUserGroup("#{path}/Matrix.env", USER, USER, options)
+                        linuxConnection.setPrivate("#{path}/Matrix.env", options)
+
+                        homeserver = YAML.load_file(__dir__ + '/homeserver.yaml')
+                        configureHomeserver(homeserver, dbPassword, target)
+                        homeserverFile = options['output'] + '/homeserver.yaml'
+                        File.write(homeserverFile, homeserver.to_yaml)
+
+                        linuxConnection.upload(homeserverFile, HOME_DIR + '/data/', options)
+
+                        linuxConnection.upload(__dir__ + '/log.config', HOME_DIR + '/data/', options)
+                        linuxConnection.upload(__dir__ + '/config.json', HOME_DIR + '/', options)
+                        linuxConnection.setUserGroup("#{HOME_DIR}/data", USER, USER, options)
+
+                        linuxConnection.fileReplace("#{HOME_DIR}/config.json", '\$SYNAPSE_DOMAIN', target['SynapseDomain'], options)
+                        linuxConnection.fileReplace("#{HOME_DIR}/config.json", '\$SERVER_NAME', target['ServerName'], options)
+
+                        linuxConnection.upload(__dir__ + '/Synapse.container', path, options)
+                        linuxConnection.upload(__dir__ + '/Element.container', path, options)
+
+                        linuxConnection.reloadUserServices(USER, options)
+                        linuxConnection.restartUserService(USER, 'Synapse', options)
+                        linuxConnection.restartUserService(USER, 'Element', options)
+
+                        Nginx.withConnection(linuxConnection) do |nginxConnection|
+                            nginxConnection.provision(__dir__, 'Matrix', target, activeState, context, options)
+                        end
+                    end
+                end
+            end
+
+            def configureHomeserver(homeserver, dbPassword, target)
+                homeserver['server_name'] = target['ServerName']
+                homeserver['public_baseurl'] = "https://#{target['SynapseDomain'].downcase}/"
+
+                homeserver['database']['args']['password'] = dbPassword
+
+                homeserver['registration_shared_secret'] = SecureRandom.urlsafe_base64(45)
+                homeserver['macaroon_secret_key'] = SecureRandom.urlsafe_base64(45)
+                homeserver['form_secret'] = SecureRandom.urlsafe_base64(45)
+
+                if target['SMTP']
+                    host = target['SMTP']['Host']
+                    host = Podman::HOST_IP if host.to_s.empty? || ['localhost', '127.0.0.1'].include?(host)
+
+                    homeserver['email']['smtp_host'] = host
+                    if target['SMTP']['Port']
+                        homeserver['email']['smtp_port'] = target['SMTP']['Port']
+                    end
+                    if target['SMTP']['Username']
+                        homeserver['email']['smtp_user'] = target['SMTP']['Username']
+                        smtpPassword = nil
+                        if target['SMTP']['SecretId']
+                            smtpPassword = context.secrets.load(target['SMTP']['SecretId'], target['SMTP']['Username'].upcase + '_PASSWORD')
                         end
+                        homeserver['email']['smtp_pass'] = smtpPassword if smtpPassword
+                    end
 
-                        ssh.scp.upload!(__dir__ + '/Synapse.container', path)
-                        ssh.scp.upload!(__dir__ + '/Element.container', path)
-                        self.class.exec("systemctl --user --machine=#{USER}@ daemon-reload", ssh)
-                        self.class.exec("systemctl --user --machine=#{USER}@ restart Synapse", ssh)
-                        self.class.exec("systemctl --user --machine=#{USER}@ restart Element", ssh)
+                    homeserver['email']['notif_from'] = target['SMTP']['From']
 
-                        Framework::LinuxApp.ensurePackages([NGINX_PACKAGE], ssh)
-                        Framework::LinuxApp.ensureServiceAutoStartOverSSH(NGINX_PACKAGE, ssh)
-                        self.class.prepareNginxConfig(target, ssh)
-                        self.writeNginxConfig(__dir__, 'Matrix', id, target, state, context, options)
-                        self.deployNginxConfig(id, target, activeState, context, options)
-                        Framework::LinuxApp.startServiceOverSSH(NGINX_PACKAGE, ssh)
+                    if target['SMTP']['Port'] == 465
+                        homeserver['email']['force_tls'] = true
+                    end
+                else
+                    homeserver.delete('email')
+                end
+
+                if target['OIDC']
+                    raise Framework::PluginProcessError.new('OIDC.SecretId must be set!') if target['OIDC']['SecretId'].to_s.empty?
+
+                    homeserver['oidc_providers'][0]['issuer'] = target['OIDC']['Issuer']
 
+                    clientId = context.secrets.load(target['OIDC']['SecretId'], 'MATRIX_CLIENT_ID')
+                    clientSecret = context.secrets.load(target['OIDC']['SecretId'], 'MATRIX_CLIENT_SECRET')
+
+                    if !clientId || !clientSecret
+                        prompt.say("Secrets #{context.secrets.getID(target['OIDC']['SecretId'], 'MATRIX_CLIENT_ID')} and #{context.secrets.getID(target['OIDC']['SecretId'], 'MATRIX_CLIENT_SECRET')} must be set!", :color => :magenta)
+                        raise 'Required secrets are missing!'
                     end
+
+                    homeserver['oidc_providers'][0]['client_id'] = clientId
+                    homeserver['oidc_providers'][0]['client_secret'] = clientSecret
+                    homeserver['password_config']['enabled'] = false
                 else
-                    deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
+                    homeserver.delete('oidc_providers')
                 end
             end
 
-            def configurePostgreSQL(settings, ssh)
+            def configurePostgreSQL(dbSettings, linuxConnection, options)
                 password = SecureRandom.alphanumeric(20)
-                PostgreSQL.createRemoteUserAndDBOverSSH(settings, USER, password, ssh)
+                PostgreSQL.withConnection(dbSettings, linuxConnection) do |postgresConnection|
+                    postgresConnection.createUserAndDB(USER, password, options)
+                end
                 password
             end
 

data/Plugins/Apps/Matrix/Synapse.container

@@ -5,13 +5,18 @@ Description=Matrix (Synapse) container
 After=local-fs.target
 
 [Container]
+ContainerName=Synapse
 Image=docker.io/matrixdotorg/synapse:latest
 EnvironmentFile=/var/lib/matrix/.config/containers/systemd/Matrix.env
 Network=slirp4netns:allow_host_loopback=true
 PublishPort=127.0.0.1:8008:8008
 UserNS=keep-id:uid=991,gid=991
 Volume=/var/lib/matrix/data:/data
+LogDriver=journald
 AutoUpdate=registry
 
+[Service]
+Restart=on-failure
+
 [Install]
 WantedBy=multi-user.target default.target

data/Plugins/Apps/Netdata/Netdata.conf.erb

@@ -16,9 +16,6 @@ server {
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/netdata.access.log;
-    error_log   /var/log/nginx/netdata.error.log;
-
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
 

data/Plugins/Apps/Netdata/Netdata.lmm.rb

@@ -14,7 +14,6 @@ module ConfigLMM
             def actionNetdataDeploy(id, target, activeState, context, options)
                 if !target['Location'] || target['Location'] == '@me'
                     deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
             end
 

data/Plugins/Apps/Nextcloud/Nextcloud.conf.erb

@@ -31,10 +31,7 @@ server
 
     server_name <%= config['Domain'] %>;
 
-    access_log  /var/log/nginx/nextcloud.access.log;
-    error_log   /var/log/nginx/nextcloud.error.log;
-
-    root /usr/share/webapps/nextcloud;
+    root <%= config['Root'] %>;
 
     include config-lmm/private.conf;
     include config-lmm/errors.conf;
@@ -142,6 +139,8 @@ server
         fastcgi_request_buffering off;
 
         fastcgi_max_temp_file_size 0;
+
+        fastcgi_hide_header X-Powered-By;
     }
 
     # Rule borrowed from `.htaccess`

data/Plugins/Apps/Nextcloud/Nextcloud.lmm.rb

@@ -1,14 +1,16 @@
 
 module ConfigLMM
     module LMM
-        class Nextcloud < Framework::NginxApp
+        class Nextcloud < Framework::Plugin
 
             USER = 'nextcloud'
             HOME_DIR = '/var/lib/nextcloud'
             PACKAGE_NAME = 'Nextcloud'
 
             def actionNextcloudBuild(id, target, state, context, options)
-                writeNginxConfig(__dir__, 'Nextcloud', id, target, state, context, options)
+                Nginx.withConnection(local) do |nginxConnection|
+                    nginxConnection.writeConfig(__dir__, 'Nextcloud', target, state, context, options)
+                end
             end
 
             def actionNextcloudDiff(id, target, activeState, context, options)
@@ -16,86 +18,166 @@ module ConfigLMM
             end
 
             def actionNextcloudDeploy(id, target, activeState, context, options)
-                if target['Location'] && target['Location'] != '@me'
-                    uri = Addressable::URI.parse(target['Location'])
-                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
-                    self.class.sshStart(uri) do |ssh|
-                        Framework::LinuxApp.ensurePackages([PHP_FPM::PHPFPM_PACKAGE], ssh)
-                        Framework::LinuxApp.ensureServiceAutoStartOverSSH(PHP_FPM::PHPFPM_SERVICE, ssh)
-                        distroInfo = Framework::LinuxApp.ensurePackages([PACKAGE_NAME], ssh)
-                        addUserCmd = "#{distroInfo['CreateServiceUser']} --home-dir '#{HOME_DIR}' --create-home --comment 'Nextcloud' #{USER}"
-                        self.class.sshExec!(ssh, addUserCmd, true)
-                        self.class.sshExec!(ssh, "mkdir -p /var/log/php/ /var/lib/nextcloud/apps/ /var/lib/nextcloud/data/")
-                        self.class.sshExec!(ssh, "touch /var/log/php/nextcloud.errors.log")
-                        self.class.sshExec!(ssh, "touch /var/log/php/nextcloud.mail.log")
-                        self.class.sshExec!(ssh, "chown #{USER}:#{USER} /var/log/php/nextcloud.errors.log")
-                        self.class.sshExec!(ssh, "chown #{USER}:#{USER} /var/log/php/nextcloud.mail.log")
-                        PHP_FPM::fixConfigFileOverSSH(distroInfo, ssh)
-
-                        webappsDir = PHP_FPM::webappsDir(distroInfo)
-                        configDir = webappsDir + 'nextcloud/config/'
-                        if !self.class.remoteFilePresent?(configDir + 'config.php', ssh)
-                            self.class.uploadNotPresent(__dir__ + '/config.php', configDir, ssh)
-                            self.class.sshExec!(ssh, "sed -i \"s|'instanceid' .*|'instanceid' => '#{SecureRandom.alphanumeric(10)}',|\" #{configDir}config.php")
-                            self.class.sshExec!(ssh, "touch #{configDir}CAN_INSTALL")
-                            self.class.sshExec!(ssh, "sed -i 's|/usr/share/webapps/|#{webappsDir}|' #{configDir}config.php")
+                self.withConnection(target['Location'], target) do |connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        PHP_FPM::deploy(linuxConnection, options)
+                        linuxConnection.ensurePackage(PACKAGE_NAME, options)
+
+                        Podman.createUser(USER, HOME_DIR, 'Nextcloud', linuxConnection, options)
+                        linuxConnection.withUserShell(USER) do |shell|
+                            shell.createDirs(options, '~/apps', '~/data')
                         end
-                        self.class.sshExec!(ssh, "chown -R nextcloud:nextcloud #{configDir}")
-                        self.class.sshExec!(ssh, "chown -R nextcloud:nextcloud /var/lib/nextcloud/")
+                        linuxConnection.createDirs(options, '/var/log/php')
+                        linuxConnection.makeAccessible(HOME_DIR, options)
 
-                        target['Database'] ||= {}
-                        if !target['Database']['Type'] || target['Database']['Type'] == 'pgsql'
-                            PostgreSQL.createRemoteUserAndDBOverSSH(target['Database'], USER, nil, ssh)
+                        webappsDir = nil
+                        PHP_FPM.withConnection(linuxConnection) do |phpConnection|
+                            webappsDir = phpConnection.webappsDir
+                            phpConnection.enableExtension('imagick', options)
                         end
 
                         target['User'] = USER unless target['User']
+                        target['Root'] = webappsDir + 'nextcloud'
+                        dbPassword = configureDatabase(target, linuxConnection, context, options)
+
+                        configDir = webappsDir + 'nextcloud/config/'
+                        if !linuxConnection.filePresent?(configDir + 'config.php', options)
+                            linuxConnection.fileWrite('/var/log/php/nextcloud.access.json', '', options)
+                            linuxConnection.fileWrite('/var/log/php/nextcloud.errors.log', '', options)
+                            linuxConnection.fileWrite('/var/log/php/nextcloud.mail.log', '', options)
+
+                            linuxConnection.setUserGroup('/var/log/php/nextcloud.access.json', USER, USER, options)
+                            linuxConnection.setUserGroup('/var/log/php/nextcloud.errors.log', USER, USER, options)
+                            linuxConnection.setUserGroup('/var/log/php/nextcloud.mail.log', USER, USER, options)
+
+                            linuxConnection.exec("chmod o-r /var/log/php/nextcloud.access.json /var/log/php/nextcloud.errors.log /var/log/php/nextcloud.mail.log", false, options)
+
+                            linuxConnection.upload(__dir__ + '/autoconfig.php', configDir, options)
+
+                            linuxConnection.fileReplace("#{configDir}autoconfig.php", "'dbuser' .*", "'dbuser' => '#{target['User']}',", options)
+                            linuxConnection.fileReplace("#{configDir}autoconfig.php", "'dbpass' .*", "'dbpass' => '#{dbPassword}',", { **options, hide: true })
+
+                            if target['Database']['HostName'] != 'localhost'
+                                linuxConnection.fileReplace("#{configDir}autoconfig.php", "'dbhost' .*", "'dbhost' => '#{target['Database']['HostName']}',", options)
+                            end
+
+                            if target['Admin'].to_h.empty?
+                                linuxConnection.fileReplace("#{configDir}autoconfig.php", "'adminlogin'", "//'adminlogin'", options)
+                                linuxConnection.fileReplace("#{configDir}autoconfig.php", "'adminpass'", "//'adminpass'", options)
+                            else
+                                raise 'Admin.Name missing!' unless target['Admin']['Name']
+                                linuxConnection.fileReplace("#{configDir}autoconfig.php", "'adminlogin' .*", "'adminlogin' => '#{target['Admin']['Name']}',", options)
+
+                                adminPassword = context.secrets.load(target['SecretId'], 'ADMIN_PASSWORD')
+                                if adminPassword.nil?
+                                    adminPassword = SecureRandom.alphanumeric(20)
+                                    context.secrets.store(target['SecretId'], 'ADMIN_PASSWORD', adminPassword)
+                                    context.secrets.print("Nextcloud Admin '#{target['Admin']['Name']}' password", adminPassword)
+                                end
+
+                                linuxConnection.fileReplace("#{configDir}autoconfig.php", "'adminpass' .*", "'adminpass' => '#{adminPassword}',", { **options, hide: true })
+                            end
+
+                            linuxConnection.upload(__dir__ + '/config.php', configDir, options)
+                            linuxConnection.fileReplace("#{configDir}config.php", "'instanceid' .*", "'instanceid' => '#{SecureRandom.alphanumeric(10)}',", options)
+
+                            if target['Valkey'].to_h.empty?
+                                linuxConnection.fileReplace("#{configDir}config.php", "'memcache.distributed'", "//'memcache.distributed'", options)
+                                linuxConnection.fileReplace("#{configDir}config.php", "'memcache.locking'", "//'memcache.locking'", options)
+                            else
+                                if target['Valkey']['Host']
+                                    linuxConnection.fileReplace("#{configDir}config.php", "'host' .*", "'host' => '#{target['Valkey']['Host']}',", options)
+                                end
+                                if target['Valkey']['SecretId']
+                                    valkeyPassword = context.secrets.load(target['Valkey']['SecretId'], 'VALKEY_PASSWORD')
+                                    linuxConnection.fileReplace("#{configDir}config.php", "'password' .*", "'password' => '#{valkeyPassword}',", { **options, hide: true })
+                                end
+                            end
+
+                            linuxConnection.fileWrite("#{configDir}CAN_INSTALL", '', options)
+                            linuxConnection.fileReplace("#{configDir}config.php", '/usr/share/webapps/', webappsDir, options)
+                        end
+                        linuxConnection.setUserGroup(configDir, USER, USER, options)
+                        linuxConnection.setUserGroup('/var/lib/nextcloud', USER, USER, options)
+
                         name = 'nextcloud'
-                        self.updateRemoteFile(ssh, PHP_FPM.configDir(distroInfo) + name + '.conf', options, false, ';') do |configLines|
-                            PHP_FPM.writeConfig(name, target, distroInfo, configLines)
+                        PHP_FPM.withConnection(linuxConnection) do |phpConnection|
+                            linuxConnection.updateFile(phpConnection.configDir + name + '.conf', options, false, ';') do |configLines|
+                                phpConnection.writeConfig(name, target, configLines)
+                            end
+                        end
+
+                        linuxConnection.upload(__dir__ + '/nextcloudcron.service', '/etc/systemd/system/', options)
+                        linuxConnection.upload(__dir__ + '/nextcloudcron.timer', '/etc/systemd/system/', options)
+                        linuxConnection.fileReplace('/etc/systemd/system/nextcloudcron.service', '\$WEBAPPS/', webappsDir, options)
+
+                        linuxConnection.reloadServiceManager(options)
+                        linuxConnection.startService(PHP_FPM::PHPFPM_SERVICE, options)
+                        linuxConnection.ensureServiceAutoStart('nextcloudcron.timer', options)
+                        linuxConnection.startService('nextcloudcron.timer', options)
+
+                        Nginx.withConnection(linuxConnection) do |nginxConnection|
+                            nginxConnection.provision(__dir__, 'Nextcloud', target, activeState, context, options)
                         end
+                    end
+                end
+            end
 
-                        Framework::LinuxApp.startServiceOverSSH(PHP_FPM::PHPFPM_SERVICE, ssh)
-
-                        self.class.ensurePackage(ssh)
-                        self.class.prepareNginxConfig(target, ssh)
-                        self.writeNginxConfig(__dir__, 'Nextcloud', id, target, state, context, options)
-                        distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
-                        webappsDir = PHP_FPM::webappsDir(distroInfo)
-                        nginxFile = options['output'] + '/nginx/servers-lmm/Nextcloud.conf'
-                        `sed -i 's|root .*|root #{webappsDir}nextcloud;|' #{nginxFile}`
-                        deployNginxConfig(id, target, activeState, context, options)
-                        Framework::LinuxApp.startService(NGINX_PACKAGE, ssh)
-                        self.class.reload(ssh)
+            def configureDatabase(target, linuxConnection, context, options)
+                target['Database'] ||= {}
+
+                password = context.secrets.load(target['SecretId'], 'DB_PASSWORD')
+                if password.nil?
+                    password = SecureRandom.alphanumeric(20)
+                    context.secrets.store(target['SecretId'], 'DB_PASSWORD', password)
+                end
+
+                if !target['Database']['Type'] || target['Database']['Type'] == 'pgsql'
+                    PostgreSQL.defaults(target['Database'])
+                    PostgreSQL.withConnection(target['Database'], linuxConnection) do |postgresConnection|
+                        postgresConnection.createUserAndDB(target['User'], password, options)
                     end
-                else
-                    deployNginxConfig(id, target, activeState, context, options)
-                    activeState['Location'] = '@me'
                 end
-                activeState['Status'] = State::STATUS_DEPLOYED
+                password
             end
 
             def cleanup(configs, state, context, options)
-                cleanupType(:Nextcloud, configs, state, context, options) do |item, id, state, context, options, ssh|
-                    self.cleanupNginxConfig('Nextcloud', id, state, context, options, ssh)
-                    self.class.reload(ssh, options[:dry])
-                    distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
-                    rm(PHP_FPM.configDir(distroInfo) + 'nextcloud.conf', options[:dry], ssh)
-                    Framework::LinuxApp.reloadService(PHP_FPM::PHPFPM_SERVICE, ssh, options[:dry])
-                    Framework::LinuxApp.removePackage(PACKAGE_NAME, ssh, options[:dry])
-                    state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
-                    if options[:destroy]
-                        rm(PHP_FPM::webappsDir(distroInfo) + 'nextcloud', options[:dry], ssh)
-                        item['Database'] ||= {}
-                        if !item['Database']['Type'] || item['Database']['Type'] == 'pgsql'
-                            PostgreSQL.dropUserAndDB(item['Database'], USER, ssh, options[:dry])
+                cleanupType(:Nextcloud, configs, state, context, options) do |item, id, state, context, options, connection|
+                    Linux.withConnection(connection) do |linuxConnection|
+                        Nginx.withConnection(linuxConnection) do |nginxConnection|
+                            nginxConnection.cleanupConfig('Nextcloud', context, options)
+                            nginxConnection.reload(options)
+                        end
+                        linuxConnection.stopService('nextcloudcron.timer', options)
+
+                        configDir = nil
+                        webappsDir = nil
+                        PHP_FPM.withConnection(linuxConnection) do |phpConnection|
+                            configDir = phpConnection.configDir
+                            webappsDir = phpConnection.webappsDir
+                        end
+
+                        linuxConnection.rm(configDir + 'nextcloud.conf', options[:dry])
+                        linuxConnection.rm('/etc/systemd/system/nextcloudcron.service', options[:dry])
+                        linuxConnection.rm('/etc/systemd/system/nextcloudcron.timer', options[:dry])
+                        linuxConnection.reloadService(PHP_FPM::PHPFPM_SERVICE, options)
+                        linuxConnection.removePackage(PACKAGE_NAME, options)
+                        state.item(id)['Status'] = State::STATUS_DELETED unless options[:dry]
+
+                        if options[:destroy]
+                            linuxConnection.rm(webappsDir + 'nextcloud', options[:dry])
+                            item['Config']['Database'] ||= {}
+                            if !item['Config']['Database']['Type'] || item['Config']['Database']['Type'] == 'pgsql'
+                                PostgreSQL.withConnection(item['Config']['Database'], linuxConnection) do |postgresConnection|
+                                    postgresConnection.dropUserAndDB(USER, options)
+                                end
+                            end
+                            linuxConnection.deleteUserAndGroup(USER, options)
+                            linuxConnection.rm('/var/log/php/nextcloud.access.json', options[:dry])
+                            linuxConnection.rm('/var/log/php/nextcloud.errors.log', options[:dry])
+                            linuxConnection.rm('/var/log/php/nextcloud.mail.log', options[:dry])
+                            state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
                         end
-                        Framework::LinuxApp.deleteUserAndGroup(USER, ssh, options[:dry])
-                        rm('/var/log/php/nextcloud.access.log', options[:dry], ssh)
-                        rm('/var/log/php/nextcloud.errors.log', options[:dry], ssh)
-                        rm('/var/log/php/nextcloud.mail.log', options[:dry], ssh)
-                        rm('/var/log/nginx/nextcloud.access.log', options[:dry], ssh)
-                        rm('/var/log/nginx/nextcloud.error.log', options[:dry], ssh)
-                        state.item(id)['Status'] = State::STATUS_DESTROYED unless options[:dry]
                     end
                 end
             end

data/Plugins/Apps/Nextcloud/autoconfig.php

@@ -0,0 +1,13 @@
+<?php
+
+$AUTOCONFIG = [
+    'directory'     => '/var/lib/nextcloud/data/',
+    'dbtype'        => 'pgsql',
+    'dbname'        => 'nextcloud',
+    'dbuser'        => 'nextcloud',
+    'dbpass'        => '',
+    'dbhost'        => '127.0.0.1',
+    'dbtableprefix' => 'oc_',
+    'adminlogin'    => '',
+    'adminpass'     => '',
+];

data/Plugins/Apps/Nextcloud/config.php

@@ -14,5 +14,14 @@ $CONFIG = [
             'url' => '/wapps',
             'writable' => true,
         ],
-    ]
+    ],
+    'maintenance_window_start' => 2,
+    //'memcache.local' => '\OC\Memcache\APCu',
+    'memcache.distributed' => '\OC\Memcache\Redis',
+    'memcache.locking' => '\OC\Memcache\Redis',
+    'redis' => [
+        'host' => '127.0.0.1',
+        'port' => 6379,
+        'password' => '',
+    ],
 ];

data/Plugins/Apps/Nextcloud/nextcloudcron.service

@@ -0,0 +1,8 @@
+[Unit]
+Description=Nextcloud cron.php job
+
+[Service]
+User=nextcloud
+ExecCondition=php -f $WEBAPPS/nextcloud/occ status -e
+ExecStart=/usr/bin/php -f $WEBAPPS/nextcloud/cron.php
+KillMode=process

data/Plugins/Apps/Nextcloud/nextcloudcron.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run Nextcloud cron.php
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=5min
+Unit=nextcloudcron.service
+
+[Install]
+WantedBy=timers.target