grimm-nix-server/configuration.nix

{ lib, config, inputs, pkgs, ... }:
let
  root_host = "grimmauld.de";

  # git add --intent-to-add email.txt ; git update-index --assume-unchanged email.txt
  root_email = (builtins.elemAt (lib.strings.match "[[:space:]]*([^[:space:]]+)[[:space:]]*" (builtins.readFile ./email.txt)) 0);

  puffer_port = 8080;
  puffer_sftp_port = 5657;
  puffer_host = "puffer.${root_host}";

  gitea_host = "git.${root_host}";
  gitea_port = 8081;

  matrix_host = "matrix.${root_host}";
in {
  imports = [
    ./hardware-configuration.nix    
  ];

  services.postgresql = {
    enable = true;
    # CREATE DATABASE synapse ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0 OWNER synapse;
    ensureDatabases = [ "synapse" ];
    package = pkgs.postgresql_15;
    ensureUsers = [
      {
        name = "synapse";
        ensureDBOwnership = true;
      }
    ];
    authentication = pkgs.lib.mkOverride 10 ''
      #type database  DBuser  auth-method
local   all             postgres                                peer
local   all             all                                     peer
host    all             all             127.0.0.1/32            md5
host    synapse         matrix-synapse         ::1/128                 md5
host    all             all             ::1/128                 md5
local   replication     all                                     peer
host    replication     all             127.0.0.1/32            md5
host    replication     all             ::1/128                 md5
    '';
    identMap = ''
    # ArbitraryMapName systemUser DBUser
       superuser_map      root      postgres
       superuser_map      matrix-synapse synapse
       superuser_map      postgres  postgres
       # Let other names login as themselves
       superuser_map      /^(.*)$   \1
  '';
  };

  systemd.services.postgresql.postStart = let
    password_file_path = config.age.secrets.synapse_db_pass.path;
  in ''
    $PSQL -tA <<'EOF'
      DO $$
      DECLARE password TEXT;
      BEGIN
        password := trim(both from replace(pg_read_file('${password_file_path}'), E'\n', '''));
        EXECUTE format('ALTER ROLE synapse WITH PASSWORD '''%s''';', password);
      END $$;
    EOF
  '';

  services.matrix-synapse-next = {
    enable = true;

    workers.federationSenders = 1;
    workers.federationReceivers = 1;
    workers.initialSyncers = 1;
    workers.normalSyncers = 1;
    workers.eventPersisters = 2;
    workers.useUserDirectoryWorker = true;

    enableNginx = true;
    enableSlidingSync = false;

    settings = {
      server_name = root_host;
      public_baseurl = "https://${root_host}";
      enable_registration = false;
      enable_registration_without_verification = true;

#      registrations_require_3pid = [ "email" ];
      database = {
        name = "psycopg2";
        args = {
          host = "localhost";
          port = 5432;
          dbname = "synapse";
          user = "synapse";
          cp_min = 5;
          cp_max = 10;
          client_encoding = "auto";
          passfile = config.age.secrets.synapse_db_pass_prepared.path;
        };
      };
    };  
  };
  services.redis.servers."".enable = true;

  services.gitea = {
    enable = true;
    settings = {
      service.DISABLE_REGISTRATION = true;
      server = {
        HTTP_PORT = gitea_port;
        ROOT_URL = "https://${gitea_host}/";
        DISABLE_SSH = true;
      };
#      log.LEVEL = "Debug";
    };
    lfs.enable = true;
  };

  age.secrets = {
    synapse_db_pass = {
      file = ./secrets/synapse_db_pass.age;
      owner = "postgres";
      group = "postgres";
    };
    synapse_db_pass_prepared = {
      file = ./secrets/synapse_db_pass_prepared.age;
      owner = "matrix-synapse";
      group = "matrix-synapse";
      mode = "0600";
    };
  };

  users.users.grimmauld = {
    isNormalUser = true;
    description = "grimmauld";
    extraGroups = [ "wheel" "docker" ];
    shell = pkgs.xonsh;
    packages = with pkgs; [
      hyfetch
    ];
    openssh.authorizedKeys.keys = (import ./authorizedKeys.nix);
  };

  programs.xonsh.enable = true;
  environment.systemPackages = with pkgs; [
    wget
    tree
    vim
    git
    file
    git-lfs
    util-linux
    btop
    cached-nix-shell
    cloud-utils
    parted
    visualvm
    linuxPackages.perf
    lshw
    pciutils
    gitea
#    ffmpeg-full

    pufferpanel
    (writeShellScriptBin "pufferpanel-nix" "pufferpanel --workDir /var/lib/pufferpanel $@")
    pypy3
  ];

  security.acme = {
    acceptTerms = true;
    defaults.email = root_email;
    certs."${root_host}" = {
      webroot = "/var/lib/acme/acme-challenge/";
      extraDomainNames = [ puffer_host gitea_host];
    };
  };

  environment.sessionVariables = {
    NIXPKGS_ALLOW_UNFREE="1";
    OMP_NUM_THREADS = "4";
  };

  users.users.nginx.extraGroups = [ "acme" ];

  networking.firewall = {
    enable = true;
    allowedTCPPorts = [ 80 443 puffer_sftp_port 25565 8448 8008 ];
    allowPing = true;
    allowedUDPPortRanges = [
#      { from = 4000; to = 4007; }
    ];
  };
  
  services.pufferpanel = {
    enable = true;
    environment = {
      PUFFER_WEB_HOST = ":${builtins.toString puffer_port}";
      PUFFER_DAEMON_SFTP_HOST = ":${builtins.toString puffer_sftp_port}";
    };
    extraPackages = with pkgs; [ jdk17_headless ];
    extraGroups = [ "podman" "docker" ];
  };

  virtualisation.podman.enable = true;
  virtualisation.docker.enable = true;

  services.nginx.package = pkgs.nginxStable.override { openssl = pkgs.libressl; };
  services.nginx = {
    enable = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;


    sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";

    virtualHosts."${root_host}" = {
      forceSSL = true;
      enableACME = lib.mkForce false; # use the cert above, not some weird one that matrix-synapse module supplies
      useACMEHost = root_host;
      locations."/" = {
          root = "/var/www/grimmauld.duckdns.org"; 
      };
      locations."/.well-known/matrix/server" = {
        return = "200 '{\"m.server\":\"${matrix_host}:443\"}'";
        extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
add_header Accept-Ranges bytes;'';
      };
      locations."/.well-known/matrix/client" = {
        return = "200 '{\"m.homeserver\": {\"base_url\": \"https://${matrix_host}\"}}'";
        extraConfig = ''
add_header Access-Control-Allow-Origin *;
default_type application/json;
'';
      };
      locations."/_matrix" = {
        proxyPass = "http://$synapse_backend";
        extraConfig = ''
          add_header X-debug-backend $synapse_backend;
          add_header X-debug-group $synapse_uri_group;
          client_max_body_size ${config.services.matrix-synapse-next.settings.max_upload_size};
          proxy_read_timeout 10m;
        '';
      };
      locations."~ ^/_matrix/client/(r0|v3)/sync$" = {
        proxyPass = "http://$synapse_backend";
        extraConfig = ''
          proxy_read_timeout 1h;
        '';
      };
      locations."~ ^/_matrix/client/(api/v1|r0|v3)/initialSync$" = {
        proxyPass = "http://synapse_worker_initial_sync";
        extraConfig = ''
          proxy_read_timeout 1h;
        '';
      };
      locations."~ ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$" = {
        proxyPass = "http://synapse_worker_initial_sync";
        extraConfig = ''
          proxy_read_timeout 1h;
        '';
      };
      locations."/_synapse/client" = {
        proxyPass = "http://$synapse_backend";
      };
      locations."/.well-known/matrix" = {
        proxyPass = "http://$synapse_backend";
      };
    };

    virtualHosts."${puffer_host}" = {
      serverName = puffer_host;
      forceSSL = true;
      useACMEHost = root_host;
      locations."/" = {
        proxyPass = "http://127.0.0.1:${builtins.toString puffer_port}";
      };
    };

    virtualHosts."${gitea_host}" = {
      serverName = gitea_host;
      forceSSL = true;
      useACMEHost = root_host;
      locations."/" = {
        proxyPass = "http://127.0.0.1:${builtins.toString gitea_port}";
      };
    };
  };

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  system.stateVersion = "unstable";
  nixpkgs.config.allowUnfree = true;

  boot.tmp.cleanOnBoot = true;
  zramSwap.enable = true;
  networking.hostName = "grimmauld-nixos-server";
  networking.domain = "";
  services.openssh.enable = true;
#  users.users.root.openssh.authorizedKeys.keys = (import ./authorizedKeys.nix);
}