tristan/nix
1
0
Fork 0
Code Projects Releases Packages Activity

matrix-synapse

Browse source
This commit is contained in:
Tristan 2024-02-26 18:02:34 +00:00
parent fe3d338d1e
commit 7fc3164ab8
2 changed files with 86 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

87
nixos/services/synapse.nix
View file

@ -1,3 +1,4 @@
{pkgs, config, lib, ...}:
let
fqdn = "${hostname}.${domain}";
domain = "tristans.cloud";
@ -7,10 +8,80 @@ let
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON data}';
'';
port = 8008;
inherit (config) sops;
inherit (config.services) matrix-synapse;
inherit (sops) secrets templates;
in {
services.matrix-synapse = {
enable = false; # using podman for the moment
services.postgresql.enable = true;
services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
'';
sops.secrets = {
"synapse/signing_key".owner = "matrix-synapse";
"synapse/oidc_client_secret" = {};
"synapse/sliding_sync_secret" = {};
};
sops.templates = {
"synapse/secrets.yaml" = {
owner = "matrix-synapse";
content = builtins.toJSON {
oidc_providers = [{
idp_id = "authentik";
idp_name = "authentik";
discover = true;
issuer = "https://auth.tristans.cloud/application/o/chat/";
client_id = "fdad520e8c57f228aaa658aa74d5e00ba9b164a3";
client_secret = sops.placeholder."synapse/oidc_client_secret";
scopes = ["openid" "profile" "email"];
user_mapping_provider = {
config = {
localpart_template= "{{ user.preferred_username }}";
display_name_template= "{{ user.name|capitalize }}";
};
};
}];
};
};
"synapse/sliding_sync_env".content = ''
SYNCV3_SECRET=${sops.placeholder."synapse/sliding_sync_secret"}
'';
};
services.matrix-synapse = {
enable = true;
extraConfigFiles = [templates."synapse/secrets.yaml".path];
settings = {
signing_key_path = secrets."synapse/signing_key".path;
server_name = domain;
baseurl = "https://${domain}";
oidc_providers = [];
settings.listeners = [ {
inherit port;
bind_addresses = [ "localhost" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [ {
names = [ "client" "federation" ];
compress = true;
} ];
} ];
};
};
services.matrix-sliding-sync = {
enable = true;
environmentFile = templates."synapse/sliding_sync_env".path;
settings.SYNCV3_SERVER = "https://${domain}";
};
services.nginx.virtualHosts = {
${domain} = {
locations."= /.well-known/matrix/server".extraConfig = mkWellKnown {
@ -29,16 +100,16 @@ in {
}
];
};
locations."/_matrix".proxyPass = "http://localhost:8008";
locations."/_synapse/client".proxyPass = "http://localhost:8008";
locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://localhost:8009";
locations."/_matrix".proxyPass = "http://localhost:${toString port}";
locations."/_synapse/client".proxyPass = "http://localhost:${toString port}";
locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://${toString matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}";
};
${fqdn} = {
enableACME = true;
forceSSL = true;
locations."/_matrix".proxyPass = "http://localhost:8008";
locations."/_synapse/client".proxyPass = "http://localhost:8008";
locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://localhost:8009";
locations."/_matrix".proxyPass = "http://localhost:${toString port}";
locations."/_synapse/client".proxyPass = "http://localhost:${toString port}";
locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://${toString matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}";
};
};
}