241 lines
7.7 KiB
Nix
241 lines
7.7 KiB
Nix
|
{
|
||
|
|
lib,
|
||
|
|
config,
|
||
|
|
pkgs,
|
||
|
|
...
|
||
|
|
}:
|
||
|
|
let
|
||
|
|
inherit (config.networking) domain;
|
||
|
|
inherit (config.serverConfig) vhosts;
|
||
|
|
|
||
|
|
fqdn = vhosts.matrix_host.host;
|
||
|
|
base_url = "https://${fqdn}";
|
||
|
|
|
||
|
|
clientConfig."m.homeserver" = {inherit base_url; }; # = "https://${vhosts.matrix_host.host}";
|
||
|
|
serverConfig."m.server" = "${vhosts.matrix_host.host}:443";
|
||
|
|
mkWellKnown = data: ''
|
||
|
|
default_type application/json;
|
||
|
|
add_header Access-Control-Allow-Origin *;
|
||
|
|
return 200 '${builtins.toJSON data}';
|
||
|
|
'';
|
||
|
|
synapse_backend = "http://[::1]:8008";
|
||
|
|
in
|
||
|
|
{
|
||
|
|
services.postgresql = {
|
||
|
|
enable = true;
|
||
|
|
ensureDatabases = [ "synapse" ];
|
||
|
|
ensureUsers = [
|
||
|
|
{
|
||
|
|
name = "synapse";
|
||
|
|
passFile = config.age.secrets.synapse_db_pass.path;
|
||
|
|
ensureDBOwnership = true;
|
||
|
|
}
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
|
||
|
|
services.matrix-synapse = {
|
||
|
|
enable = true;
|
||
|
|
settings.server_name = domain;
|
||
|
|
# The public base URL value must match the `base_url` value set in `clientConfig` above.
|
||
|
|
# The default value here is based on `server_name`, so if your `server_name` is different
|
||
|
|
# from the value of `fqdn` above, you will likely run into some mismatched domain names
|
||
|
|
# in client applications.
|
||
|
|
settings.public_baseurl = base_url;
|
||
|
|
settings.listeners = [
|
||
|
|
{ port = 8008;
|
||
|
|
bind_addresses = [ "::1" ];
|
||
|
|
type = "http";
|
||
|
|
tls = false;
|
||
|
|
x_forwarded = true;
|
||
|
|
resources = [ {
|
||
|
|
names = [ "client" "federation" ];
|
||
|
|
compress = true;
|
||
|
|
} ];
|
||
|
|
}
|
||
|
|
];
|
||
|
|
|
||
|
|
settings.database = {
|
||
|
|
name = "psycopg2";
|
||
|
|
args = { user="synapse"; database= "synapse"; };
|
||
|
|
};
|
||
|
|
settings.log_config = ./matrix_synapse_log_config.yaml;
|
||
|
|
settings.enable_registration = false;
|
||
|
|
configureRedisLocally = true;
|
||
|
|
settings.redis.enabled = true;
|
||
|
|
|
||
|
|
settings.app_service_config_files = [
|
||
|
|
# The registration file is automatically generated after starting the
|
||
|
|
# appservice for the first time.
|
||
|
|
# cp /var/lib/mautrix-telegram/telegram-registration.yaml \
|
||
|
|
# /var/lib/matrix-synapse/
|
||
|
|
# chown matrix-synapse:matrix-synapse \
|
||
|
|
# /var/lib/matrix-synapse/telegram-registration.yaml
|
||
|
|
# "/var/lib/matrix-synapse/discord-registration.yaml"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
# services.matrix-synapse-next = {
|
||
|
|
# enable = true;
|
||
|
|
#
|
||
|
|
# workers.federationSenders = 1;
|
||
|
|
# workers.federationReceivers = 1;
|
||
|
|
# workers.initialSyncers = 1;
|
||
|
|
# workers.normalSyncers = 1;
|
||
|
|
# workers.eventPersisters = 2;
|
||
|
|
# workers.useUserDirectoryWorker = true;
|
||
|
|
# mainLogConfig = ./matrix_synapse_log_config.yaml;
|
||
|
|
#
|
||
|
|
# enableNginx = true;
|
||
|
|
# enableSlidingSync = false;
|
||
|
|
#
|
||
|
|
# settings = {
|
||
|
|
# suppress_key_server_warning = true;
|
||
|
|
# server_name = domain;
|
||
|
|
# public_baseurl = "https://${domain}";
|
||
|
|
# enable_registration = true;
|
||
|
|
# registration_requires_token = true;
|
||
|
|
# registration_shared_secret_path = config.age.secrets.synapse_registration_shared_secret.path;
|
||
|
|
# # enable_registration_without_verification = true;
|
||
|
|
# # mainLogConfig = ./matrix_synapse_log_config.yaml;
|
||
|
|
#
|
||
|
|
# # registrations_require_3pid = [ "email" ];
|
||
|
|
#
|
||
|
|
# database = {
|
||
|
|
# name = "psycopg2";
|
||
|
|
# args = {
|
||
|
|
# host = "localhost";
|
||
|
|
# port = config.services.postgresql.settings.port;
|
||
|
|
# dbname = "synapse";
|
||
|
|
# user = "synapse";
|
||
|
|
# cp_min = 5;
|
||
|
|
# cp_max = 10;
|
||
|
|
# client_encoding = "auto";
|
||
|
|
# passfile = config.age.secrets.synapse_db_pass_prepared.path;
|
||
|
|
# };
|
||
|
|
# };
|
||
|
|
# };
|
||
|
|
# };
|
||
|
|
services.redis.servers."".enable = true;
|
||
|
|
|
||
|
|
age.secrets.synapse_db_pass = {
|
||
|
|
file = ../secrets/synapse_db_pass.age;
|
||
|
|
owner = "postgres";
|
||
|
|
group = "postgres";
|
||
|
|
};
|
||
|
|
age.secrets.synapse_db_pass_prepared = {
|
||
|
|
file = ../secrets/synapse_db_pass_prepared.age;
|
||
|
|
owner = "matrix-synapse";
|
||
|
|
group = "matrix-synapse";
|
||
|
|
mode = "0600";
|
||
|
|
};
|
||
|
|
age.secrets.synapse_registration_shared_secret = {
|
||
|
|
file = ../secrets/synapse_registration_shared_secret.age;
|
||
|
|
owner = "matrix-synapse";
|
||
|
|
group = "matrix-synapse";
|
||
|
|
mode = "0600";
|
||
|
|
};
|
||
|
|
|
||
|
|
environment.systemPackages = with pkgs; [
|
||
|
|
matrix-synapse-tools.synadm
|
||
|
|
matrix-synapse
|
||
|
|
];
|
||
|
|
|
||
|
|
|
||
|
|
services.nginx = {
|
||
|
|
enable = true;
|
||
|
|
recommendedTlsSettings = true;
|
||
|
|
recommendedOptimisation = true;
|
||
|
|
recommendedGzipSettings = true;
|
||
|
|
recommendedProxySettings = true;
|
||
|
|
|
||
|
|
virtualHosts."${domain}" = {
|
||
|
|
enableACME = true;
|
||
|
|
forceSSL = true;
|
||
|
|
# This section is not needed if the server_name of matrix-synapse is equal to
|
||
|
|
# the domain (i.e. example.org from @foo:example.org) and the federation port
|
||
|
|
# is 8448.
|
||
|
|
# Further reference can be found in the docs about delegation under
|
||
|
|
# https://element-hq.github.io/synapse/latest/delegate.html
|
||
|
|
locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
|
||
|
|
# This is usually needed for homeserver discovery (from e.g. other Matrix clients).
|
||
|
|
# Further reference can be found in the upstream docs at
|
||
|
|
# https://spec.matrix.org/latest/client-server-api/#getwell-knownmatrixclient
|
||
|
|
locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
|
||
|
|
};
|
||
|
|
|
||
|
|
virtualHosts."${fqdn}" = {
|
||
|
|
enableACME = true;
|
||
|
|
forceSSL = true;
|
||
|
|
|
||
|
|
locations."/_matrix" = {
|
||
|
|
proxyPass = synapse_backend;
|
||
|
|
#extraConfig = ''
|
||
|
|
# add_header X-debug-backend ${synapse_backend};
|
||
|
|
# add_header X-debug-group $synapse_uri_group;
|
||
|
|
# client_max_body_size ${config.services.matrix-synapse-next.settings.max_upload_size};
|
||
|
|
# proxy_read_timeout 10m;
|
||
|
|
#'';
|
||
|
|
};
|
||
|
|
locations."/_synapse/client".proxyPass = synapse_backend;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
# services.nginx = {
|
||
|
|
# enable = true;
|
||
|
|
# virtualHosts."${domain}" = {
|
||
|
|
# forceSSL = true;
|
||
|
|
# enableACME = lib.mkForce false; # use the cert above, not some weird one that matrix-synapse module supplies
|
||
|
|
# useACMEHost = domain;
|
||
|
|
# locations."/.well-known/matrix/server" = {
|
||
|
|
# return = "200 '{\"m.server\":\"${vhosts.matrix_host.host}:443\"}'";
|
||
|
|
# extraConfig = ''
|
||
|
|
# default_type application/json;
|
||
|
|
# add_header Access-Control-Allow-Origin *;
|
||
|
|
# add_header Accept-Ranges bytes;'';
|
||
|
|
# };
|
||
|
|
# locations."/.well-known/matrix/client" = {
|
||
|
|
# return = "200 '{\"m.homeserver\": {\"base_url\": \"https://${vhosts.matrix_host.host}\"}}'";
|
||
|
|
# extraConfig = ''
|
||
|
|
# add_header Access-Control-Allow-Origin *;
|
||
|
|
# default_type application/json;
|
||
|
|
# '';
|
||
|
|
# };
|
||
|
|
# locations."/_matrix" = {
|
||
|
|
# proxyPass = "http://$synapse_backend";
|
||
|
|
# extraConfig = ''
|
||
|
|
# add_header X-debug-backend $synapse_backend;
|
||
|
|
# add_header X-debug-group $synapse_uri_group;
|
||
|
|
# client_max_body_size ${config.services.matrix-synapse-next.settings.max_upload_size};
|
||
|
|
# proxy_read_timeout 10m;
|
||
|
|
# '';
|
||
|
|
# };
|
||
|
|
# locations."/_synapse/client" = {
|
||
|
|
# proxyPass = "http://$synapse_backend";
|
||
|
|
# };
|
||
|
|
# locations."~ ^/_matrix/client/(r0|v3)/sync$" = {
|
||
|
|
# proxyPass = "http://$synapse_backend";
|
||
|
|
# extraConfig = ''
|
||
|
|
# proxy_read_timeout 1h;
|
||
|
|
# '';
|
||
|
|
# };
|
||
|
|
# locations."~ ^/_matrix/client/(api/v1|r0|v3)/initialSync$" = {
|
||
|
|
# proxyPass = "http://synapse_worker_initial_sync";
|
||
|
|
# extraConfig = ''
|
||
|
|
# proxy_read_timeout 1h;
|
||
|
|
# '';
|
||
|
|
# };
|
||
|
|
# locations."~ ^/_matrix/client/(api/v1|r0|v3)/rooms/[^/]+/initialSync$" = {
|
||
|
|
# proxyPass = "http://synapse_worker_initial_sync";
|
||
|
|
# extraConfig = ''
|
||
|
|
# proxy_read_timeout 1h;
|
||
|
|
# '';
|
||
|
|
# };
|
||
|
|
# # locations."/.well-known/matrix" = {
|
||
|
|
# proxyPass = "http://$synapse_backend";
|
||
|
|
# };
|
||
|
|
# };
|
||
|
|
# };
|
||
|
|
# networking.firewall.allowedTCPPorts = [ 8448 8008 ];
|
||
|
|
}
|