mio-ops/profiles/matrix.nix

178 lines
5.4 KiB
Nix
Raw Normal View History

2019-11-14 01:17:20 +00:00
# NixOps configuration for the hosts running a Matrix server (synapse)
{
2022-03-07 14:26:15 +00:00
config,
pkgs,
lib,
...
}: {
imports = [../secrets/matrix.nix];
2020-03-30 10:04:25 +00:00
i18n = {
extraLocaleSettings = {
2022-12-22 17:06:34 +00:00
LC_COLLATE = "C.UTF-8"; # Ensure correct locale for postgres
LC_CTYPE = "C.UTF-8"; # Ensure correct locale for postgres
};
};
2019-11-14 01:17:20 +00:00
services = {
matrix-synapse = {
2021-11-16 04:57:23 +00:00
enable = true; # Enable the synapse server
2022-06-27 03:55:55 +00:00
settings = {
2022-06-27 08:50:26 +00:00
enable_registration = false; # Toggle user registration
enable_registration_without_verification = false;
2022-06-27 03:55:55 +00:00
extraConfig = ''
enable_group_creation: true # Allow users to create communities
'';
listeners = [
{
# federation
bind_addresses = [];
port = 8448;
resources = [
{
compress = true;
names = ["client"];
}
{
compress = false;
names = ["federation"];
}
];
tls = true;
type = "http";
x_forwarded = false;
}
{
# client
bind_addresses = ["::1"]; # Listen on localhost only
port = 8008; # Port to listen on
resources = [
{
compress = true;
names = ["client"];
}
{
compress = false;
names = ["federation"];
}
];
tls = true;
type = "http";
x_forwarded = true;
}
];
max_upload_size = "200M"; # Also set client_max_body_size to at least this
public_baseurl = "https://synapse.mcwhirter.io:443/"; # Matrix target URL
server_name = "mcwhirter.io"; # Server's public domain name
tls_certificate_path = "/var/lib/acme/mcwhirter.io/fullchain.pem";
tls_private_key_path = "/var/lib/acme/mcwhirter.io/key.pem";
turn_shared_secret = "IZI43ylg6aJdMwy5MyhUPqT8SJD4C3P1vDcIFMzqGvTXJiCjAEvnPcDCBZfig5Q6";
turn_uris = [
"turn:turn.mcwhirter.io:5349?transport=udp"
"turn:turn.mcwhirter.io:5350?transport=udp"
"turn:turn.mcwhirter.io:5349?transport=tcp"
"turn:turn.mcwhirter.io:5350?transport=tcp"
];
url_preview_enabled = true;
};
2019-11-14 01:17:20 +00:00
};
nginx = {
enable = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedProxySettings = true;
virtualHosts = {
2020-03-30 03:37:09 +00:00
"synapse.mcwhirter.io" = {
2019-11-14 01:17:20 +00:00
forceSSL = true;
enableACME = true;
locations = {
2022-03-07 14:26:15 +00:00
"/_matrix" = {proxyPass = "https://[::1]:8008";};
2021-11-16 04:57:23 +00:00
"/.well-known/matrix/server".extraConfig = let
# use 443 instead of the default 8448 port to unite
# the client-server and server-server port for simplicity
2022-03-07 14:26:15 +00:00
server = {"m.server" = "synapse.mcwhirter.io:443";};
2021-11-16 04:57:23 +00:00
in ''
add_header Content-Type application/json;
return 200 '${builtins.toJSON server}';
'';
"= /.well-known/matrix/client".extraConfig = let
client = {
"m.homeserver" = {
"base_url" = "https://synapse.mcwhirter.io";
2019-11-14 01:17:20 +00:00
};
2022-03-07 14:26:15 +00:00
"m.identity_server" = {"base_url" = "https://vector.im";};
2021-11-16 04:57:23 +00:00
};
2020-12-31 01:55:41 +00:00
# ACAO required to allow element-web on any URL to request this json file
2021-11-16 04:57:23 +00:00
in ''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON client}';
'';
2019-11-14 01:17:20 +00:00
};
2020-04-21 01:16:15 +00:00
extraConfig = ''
client_max_body_size 200M; # Needs to be no less than max_upload_size
'';
2019-11-14 01:17:20 +00:00
};
2020-03-30 03:37:09 +00:00
"chat.mcwhirter.io" = {
forceSSL = true;
enableACME = true;
2021-11-16 04:57:23 +00:00
root = pkgs.element-web; # Install RIOT web in the nginx root
2020-03-30 03:37:09 +00:00
};
2019-11-14 01:17:20 +00:00
};
};
2020-03-30 03:37:09 +00:00
postgresql = {
enable = true;
2022-03-07 14:26:15 +00:00
ensureDatabases = ["matrix-synapse"]; # Ensure the database persists
ensureUsers = [
{
name = "matrix-synapse"; # Ensure the database user persists
2024-02-06 16:24:29 +00:00
ensureDBOwnership = true;
2022-03-07 14:26:15 +00:00
}
];
# Initial database creation
initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
2022-12-22 17:06:34 +00:00
LC_COLLATE = "C.UTF-8"
LC_CTYPE = "C.UTF-8";
'';
2020-03-30 03:37:09 +00:00
};
2019-11-14 01:17:20 +00:00
};
services.postgresqlBackup = {
enable = true;
compression = "zstd";
};
2022-06-22 22:50:22 +00:00
services.postgresqlBackup.databases = ["matrix-synapse"];
2020-04-21 22:14:39 +00:00
security.acme = {
acceptTerms = true;
certs = {
"chat.mcwhirter.io" = {
postRun = "systemctl reload nginx.service";
email = "acme@mcwhirter.io";
};
"synapse.mcwhirter.io" = {
group = "matrix-synapse";
2022-03-07 14:26:15 +00:00
postRun = "systemctl reload nginx.service; systemctl restart matrix-synapse.service";
2020-04-21 22:14:39 +00:00
email = "acme@mcwhirter.io";
};
2019-11-14 01:17:20 +00:00
};
};
networking.firewall = {
enable = true;
allowedTCPPorts = [
2021-11-16 04:57:23 +00:00
443 # HTTPS
8448 # Matrix federation
2019-11-14 01:17:20 +00:00
];
};
2022-03-07 14:26:15 +00:00
users.groups.matrix-synapse.members = ["nginx"]; # Added for keys permissions
2019-11-14 01:17:20 +00:00
}