mio-ops/roles/matrix.nix

# NixOps configuration for the hosts running a Matrix server (synapse)

{ config, pkgs, lib, ... }:

{

  imports = [
    ../secrets/matrix.nix
  ];

  services = {

    matrix-synapse = {
      enable = true;                                          # Enable the synapse server
      server_name = "mcwhirter.io";                           # Server's public domain name
      public_baseurl = "https://synapse.mcwhirter.io:443/";   # Matrix target URL
      web_client = true;                                      # Whether to serve a web client
      create_local_database = true;                           # Whether to create a local database
      enable_registration = true;                             # Toggle user registration
      listeners = [ {
        bind_address = "::1";                                 # Listen on localhost only
        port = 8008;                                          # Port to listen on
        resources = [
          {
            compress = true;
            names = [ "client" "webclient" ];
          } {
            compress = false;
            names = [ "federation" ];
        } ];
        tls = true;
        type = "http";
        x_forwarded = true;
      } ];
      max_upload_size = "100M";
      tls_certificate_path = "/var/lib/acme/synapse.mcwhirter.io/fullchain.pem";
      tls_private_key_path = "/var/lib/acme/synapse.mcwhirter.io/key.pem";
      turn_shared_secret = "IZI43ylg6aJdMwy5MyhUPqT8SJD4C3P1vDcIFMzqGvTXJiCjAEvnPcDCBZfig5Q6";
      turn_uris = [
        "turn:turn.mcwhirter.io:5349?transport=udp"
        "turn:turn.mcwhirter.io:5350?transport=udp"
        "turn:turn.mcwhirter.io:5349?transport=tcp"
        "turn:turn.mcwhirter.io:5350?transport=tcp"
      ];
      url_preview_enabled = true;
    };

    nginx = {
      enable = true;
      recommendedTlsSettings = true;
      recommendedOptimisation = true;
      recommendedGzipSettings = true;
      recommendedProxySettings = true;
      virtualHosts = {
        "synapse.mcwhirter.io" = {
          forceSSL = true;
          enableACME = true;
          locations = {
            "/_matrix" = {
              proxyPass = "https://[::1]:8008";
            };
            "/.well-known/matrix/server".extraConfig =
              let
                # use 443 instead of the default 8448 port to unite
                # the client-server and server-server port for simplicity
                server = { "m.server" = "synapse.mcwhirter.io:443"; };
              in ''
                add_header Content-Type application/json;
                return 200 '${builtins.toJSON server}';
              '';
            "= /.well-known/matrix/client".extraConfig =
              let
                client = {
                  "m.homeserver" =  { "base_url" = "https://synapse.mcwhirter.io"; };
                  "m.identity_server" =  { "base_url" = "https://vector.im"; };
                };
              # ACAO required to allow riot-web on any URL to request this json file
              in ''
                add_header Content-Type application/json;
                add_header Access-Control-Allow-Origin *;
                return 200 '${builtins.toJSON client}';
              '';
          };
        };
        "chat.mcwhirter.io" = {
          forceSSL = true;
          enableACME = true;
          serverAliases = [
            "chat.${config.networking.domain}"
          ];
          root = pkgs.riot-web;   # Install RIOT web in the nginx root
        };
      };
    };

    postgresql = {
      enable = true;
    };
  };

  security.acme.certs = {
    "chat.mcwhirter.io" = {
      group = "matrix-synapse";
      allowKeysForGroup = true;
      postRun = "systemctl reload nginx.service";
      email = "acme@mcwhirter.io";
    };
    "synapse.mcwhirter.io" = {
      group = "matrix-synapse";
      allowKeysForGroup = true;
      postRun = "systemctl reload nginx.service; systemctl restart matrix-synapse.service";
      email = "acme@mcwhirter.io";
    };
  };

  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
      443   # HTTPS
    ];
  };

}