sercanto/mio-ops
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Activity

Finalised initial server configuration

Browse source
This commit is contained in:
Craige McWhirter 2020-03-30 13:37:09 +10:00
parent fe5bd1d840
commit 08f8ad9816
Signed by: sercanto
GPG key ID: 7DBA9F5689EFB6AA
1 changed files with 35 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

53
roles/matrix.nix
View file

@ -7,15 +7,15 @@
services = { services = {
matrix-synapse = { matrix-synapse = {
enable = true; # Enable the synapse server enable = true; # Enable the synapse server
server_name = "mcwhirter.io"; # Server's public domain name server_name = "mcwhirter.io"; # Server's public domain name
public_baseurl = "https://mcwhirter.io:443/"; # Matrix target URL public_baseurl = "https://synapse.mcwhirter.io:443/"; # Matrix target URL
web_client = true; # Whether to serve a web client web_client = true; # Whether to serve a web client
create_local_database = true; # Whether to create a local database create_local_database = true; # Whether to create a local database
enable_registration = true; # Toggle user registration enable_registration = true; # Toggle user registration
listeners = [ { listeners = [ {
bind_address = "::1"; # Listen on localhost only bind_address = "::1"; # Listen on localhost only
port = 8008; # Port to listen on port = 8008; # Port to listen on
resources = [ resources = [
{ {
compress = true; compress = true;
@ -28,8 +28,11 @@
type = "http"; type = "http";
x_forwarded = true; x_forwarded = true;
} ]; } ];
tls_certificate_path = "/var/lib/acme/mcwhirter.io/fullchain.pem"; tls_certificate_path = "/var/lib/acme/synapse.mcwhirter.io/fullchain.pem";
tls_private_key_path = "/var/lib/acme/mcwhirter.io/key.pem"; tls_private_key_path = "/var/lib/acme/synapse.mcwhirter.io/key.pem";
extraConfig = ''
max_upload_size: "100M"
'';
}; };
nginx = { nginx = {
@ -39,13 +42,9 @@
recommendedGzipSettings = true; recommendedGzipSettings = true;
recommendedProxySettings = true; recommendedProxySettings = true;
virtualHosts = { virtualHosts = {
"mcwhirter.io" = { "synapse.mcwhirter.io" = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
serverAliases = [
"chat.mcwhirter.io"
];
root = pkgs.riot-web; # Install RIOT web in the nginx root
locations = { locations = {
"/_matrix" = { "/_matrix" = {
proxyPass = "https://[::1]:8008"; proxyPass = "https://[::1]:8008";
@ -54,7 +53,7 @@
let let
# use 443 instead of the default 8448 port to unite # use 443 instead of the default 8448 port to unite
# the client-server and server-server port for simplicity # the client-server and server-server port for simplicity
server = { "m.server" = "mcwhirter.io:443"; }; server = { "m.server" = "synapse.mcwhirter.io:443"; };
in '' in ''
add_header Content-Type application/json; add_header Content-Type application/json;
return 200 '${builtins.toJSON server}'; return 200 '${builtins.toJSON server}';
@ -62,7 +61,7 @@
"= /.well-known/matrix/client".extraConfig = "= /.well-known/matrix/client".extraConfig =
let let
client = { client = {
"m.homeserver" = { "base_url" = "https://mcwhirter.io"; }; "m.homeserver" = { "base_url" = "https://synapse.mcwhirter.io"; };
"m.identity_server" = { "base_url" = "https://vector.im"; }; "m.identity_server" = { "base_url" = "https://vector.im"; };
}; };
# ACAO required to allow riot-web on any URL to request this json file # ACAO required to allow riot-web on any URL to request this json file
@ -73,12 +72,30 @@
''; '';
}; };
}; };
"chat.mcwhirter.io" = {
forceSSL = true;
enableACME = true;
serverAliases = [
"chat.${config.networking.domain}"
];
root = pkgs.riot-web; # Install RIOT web in the nginx root
};
}; };
}; };
postgresql = {
enable = true;
};
}; };
security.acme.certs = { security.acme.certs = {
"mcwhirter.io" = { "chat.mcwhirter.io" = {
group = "matrix-synapse";
allowKeysForGroup = true;
postRun = "systemctl reload nginx.service";
email = "acme@mcwhirter.io";
};
"synapse.mcwhirter.io" = {
group = "matrix-synapse"; group = "matrix-synapse";
allowKeysForGroup = true; allowKeysForGroup = true;
postRun = "systemctl reload nginx.service; systemctl restart matrix-synapse.service"; postRun = "systemctl reload nginx.service; systemctl restart matrix-synapse.service";