My nix-darwin and NixOS config
3
fork

Configure Feed

Select the types of activity you want to include in your feed.

server/nextcloud: add legal and privacy notices served at /.meta/

Adds legal.txt and privacy.txt under modules/server/nextcloud-meta/,
served by Caddy at /.meta/ via a linkFarm. Whitelists both files in
.gitignore so they're tracked despite the *.txt blanket rule.

+154
+3
.gitignore
··· 33 33 34 34 # 3. Explicitly block sensitive patterns everywhere just in case 35 35 *.txt 36 + # Nextcloud meta files are plain text with no secrets — safe to track 37 + !/modules/server/nextcloud-meta/privacy.txt 38 + !/modules/server/nextcloud-meta/legal.txt 36 39 *.key 37 40 *.pem 38 41 *_rsa
+54
modules/server/nextcloud-meta/legal.txt
··· 1 + LEGAL NOTICE 2 + ============ 3 + 4 + Last updated: March 2025 5 + 6 + Who runs this 7 + ------------- 8 + This Nextcloud instance is operated by Ewan Croft, based in the United Kingdom. 9 + If you need to get in touch for any reason: contact@ewancroft.uk 10 + 11 + What this is 12 + ------------ 13 + This is a private, non-commercial file storage service. It exists primarily 14 + for my own personal use, with occasional access extended to close family. It 15 + isn't open to the public and isn't trying to be. Access is restricted to a 16 + private Tailscale network (tailnet) and is not reachable from the public 17 + internet. 18 + 19 + Governing law 20 + ------------- 21 + This service is governed by the laws of England and Wales. Any disputes arising 22 + from its use fall under the exclusive jurisdiction of the courts of England and 23 + Wales. 24 + 25 + Data protection matters are governed by the retained Regulation (EU) 2016/679 26 + (UK GDPR), as incorporated into domestic law by the European Union (Withdrawal) 27 + Act 2018, and the Data Protection Act 2018 (c.12). The supervisory authority 28 + for data protection in the United Kingdom is the Information Commissioner's 29 + Office (ICO): https://ico.org.uk 30 + 31 + No warranties 32 + ------------- 33 + This service is provided as-is. I make no promises about uptime, data 34 + durability, or fitness for any particular purpose. Use it at your own risk. 35 + 36 + Limitation of liability 37 + ----------------------- 38 + To the fullest extent permitted by applicable law, I am not liable for any loss 39 + or damage — including loss of data — arising from use of or inability to use 40 + this service. 41 + 42 + Acceptable use 43 + -------------- 44 + Anyone with access is responsible for ensuring that anything they store here 45 + complies with applicable law. Don't upload or share anything unlawful. 46 + 47 + Your content is yours 48 + --------------------- 49 + Anyone with access retains full ownership of everything they upload. I claim 50 + no intellectual property rights over that content. 51 + 52 + Contact 53 + ------- 54 + For legal enquiries: contact@ewancroft.uk
+81
modules/server/nextcloud-meta/privacy.txt
··· 1 + PRIVACY NOTICE 2 + ============== 3 + 4 + Last updated: March 2025 5 + 6 + Who runs this 7 + ------------- 8 + This Nextcloud instance is operated by Ewan Croft, based in the United Kingdom. 9 + Contact: contact@ewancroft.uk 10 + 11 + What this is 12 + ------------ 13 + This is a private, non-commercial Nextcloud instance, used primarily by me 14 + and occasionally by close family. Access is restricted to a private Tailscale 15 + network (tailnet). It is not accessible from the public internet. 16 + 17 + What data is collected 18 + ---------------------- 19 + Only what is put there: files, calendars, contacts, and anything else 20 + explicitly uploaded or created. No analytics, no telemetry, no third-party 21 + tracking. 22 + 23 + How that data is used 24 + --------------------- 25 + Solely for the personal purposes of whoever stored it. It is not processed 26 + for advertising, profiling, or anything commercial. 27 + 28 + To be direct about it: I have no interest in what anyone else stores here. 29 + Other users' files are their business. Privacy between users is the default 30 + behaviour, not a feature I had to consciously implement. The only circumstance 31 + in which I would access another user's data is for maintenance or migration 32 + purposes — and even then, only as much as the task actually requires. 33 + 34 + With that said: I'd recommend keeping original copies of anything important 35 + elsewhere. To quote myself: "it's running on a fucking laptop over wifi." I do 36 + my best to keep it reliable, but it shouldn't be anyone's only copy of 37 + something they care about. iCloud is a reasonable secondary option if you're 38 + already in the Apple ecosystem. 39 + 40 + Sharing 41 + ------- 42 + Nothing stored here is sold, licensed, or disclosed to any third party. Data 43 + isn't shared with external services unless explicitly configured by the person 44 + who owns that data (e.g. an external calendar sync). 45 + 46 + Where data is stored 47 + -------------------- 48 + On self-hosted hardware located in the United Kingdom. Nothing goes to 49 + third-party cloud storage. 50 + 51 + How long data is kept 52 + --------------------- 53 + For as long as the instance is running, or until it is deleted. Files and data 54 + can be removed at any time through the Nextcloud interface. 55 + 56 + Legal basis 57 + ----------- 58 + This instance is operated exclusively for personal and household purposes by a 59 + private individual. As such, it falls under the household exemption in Article 60 + 2(2)(c) of the retained Regulation (EU) 2016/679 (UK GDPR, as incorporated 61 + into domestic law by the European Union (Withdrawal) Act 2018), which excludes 62 + from the regulation any processing carried out by a natural person in the course 63 + of a purely personal or household activity. In plain terms: this is a family 64 + file server, not a data controller. 65 + 66 + The Data Protection Act 2018 (c.12) applies insofar as it governs processing 67 + outside that exemption. 68 + 69 + That said, I voluntarily apply the principles of lawfulness, fairness, 70 + transparency, and data minimisation set out in Article 5 of the UK GDPR — not 71 + because I'm required to, but because it's the right approach. 72 + 73 + Your rights 74 + ----------- 75 + Anyone whose personal data is held here has the right to access, correct, or 76 + erase it. To exercise any of these rights, contact me at contact@ewancroft.uk. 77 + 78 + Changes 79 + ------- 80 + This notice may be updated from time to time. The current version is always 81 + available at https://cloud.ewancroft.uk/.meta/privacy.txt
+16
modules/server/nextcloud.nix
··· 30 30 { 31 31 config, 32 32 lib, 33 + pkgs, 33 34 ... 34 35 }: 35 36 let ··· 37 38 nc = cfg.nextcloud; 38 39 ncPort = toString nc.port; 39 40 caddyPort = toString nc.caddyPort; 41 + metaFiles = pkgs.linkFarm "nextcloud-meta" [ 42 + { 43 + name = "privacy.txt"; 44 + path = ./nextcloud-meta/privacy.txt; 45 + } 46 + { 47 + name = "legal.txt"; 48 + path = ./nextcloud-meta/legal.txt; 49 + } 50 + ]; 40 51 in 41 52 lib.mkIf cfg.services.nextcloud.enable { 42 53 ··· 183 194 extraConfig = '' 184 195 bind ${cfg.server.tailscaleIP} 185 196 tls ${cfg.server.acmeCertDir}/fullchain.pem ${cfg.server.acmeCertDir}/key.pem 197 + handle /.meta/* { 198 + uri strip_prefix /.meta 199 + root * ${metaFiles} 200 + file_server 201 + } 186 202 handle { 187 203 reverse_proxy http://127.0.0.1:${ncPort} { 188 204 transport http {