matrix-synapse

nixos/services/synapse.nix

@@ -1,3 +1,4 @@
+{pkgs, config, lib, ...}:
 let
   fqdn = "${hostname}.${domain}";
   domain = "tristans.cloud";
@@ -7,10 +8,80 @@ let
     add_header Access-Control-Allow-Origin *;
     return 200 '${builtins.toJSON data}';
   '';
+  port = 8008;
+  inherit (config) sops;
+  inherit (config.services) matrix-synapse;
+  inherit (sops) secrets templates;
+
 in {
-  services.matrix-synapse = {
+  services.postgresql.enable = true;
-    enable = false; # using podman for the moment
+  services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
+    CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
+    CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+      TEMPLATE template0
+      LC_COLLATE = "C"
+      LC_CTYPE = "C";
+  '';
+
+  sops.secrets = {
+    "synapse/signing_key".owner = "matrix-synapse";
+    "synapse/oidc_client_secret" = {};
+    "synapse/sliding_sync_secret" = {};
   };
+  sops.templates = {
+    "synapse/secrets.yaml" = {
+      owner = "matrix-synapse";
+      content = builtins.toJSON {
+        oidc_providers = [{
+          idp_id = "authentik";
+          idp_name = "authentik";
+          discover = true;
+          issuer = "https://auth.tristans.cloud/application/o/chat/";
+          client_id = "fdad520e8c57f228aaa658aa74d5e00ba9b164a3";
+          client_secret = sops.placeholder."synapse/oidc_client_secret";
+          scopes = ["openid" "profile" "email"];
+          user_mapping_provider = {
+            config = {
+              localpart_template= "{{ user.preferred_username }}";
+              display_name_template= "{{ user.name|capitalize }}";
+            };
+          };
+        }];
+      };
+    };
+    "synapse/sliding_sync_env".content = ''
+      SYNCV3_SECRET=${sops.placeholder."synapse/sliding_sync_secret"}
+    '';
+  };
+
+  services.matrix-synapse = {
+    enable = true;
+    extraConfigFiles = [templates."synapse/secrets.yaml".path];
+    settings = {
+      signing_key_path = secrets."synapse/signing_key".path;
+      server_name = domain;
+      baseurl = "https://${domain}";
+      oidc_providers = [];
+      settings.listeners = [ {
+        inherit port;
+        bind_addresses = [ "localhost" ];
+        type = "http";
+        tls = false;
+        x_forwarded = true;
+        resources = [ {
+          names = [ "client" "federation" ];
+          compress = true;
+        } ];
+      } ];
+    };
+  };
+
+  services.matrix-sliding-sync = {
+    enable = true;
+    environmentFile = templates."synapse/sliding_sync_env".path;
+    settings.SYNCV3_SERVER = "https://${domain}";
+  };
+
   services.nginx.virtualHosts = {
     ${domain} = {
       locations."= /.well-known/matrix/server".extraConfig = mkWellKnown {
@@ -29,16 +100,16 @@ in {
           }
         ];
       };
-      locations."/_matrix".proxyPass = "http://localhost:8008";
+      locations."/_matrix".proxyPass = "http://localhost:${toString port}";
-      locations."/_synapse/client".proxyPass = "http://localhost:8008";
+      locations."/_synapse/client".proxyPass = "http://localhost:${toString port}";
-      locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://localhost:8009";
+      locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://${toString matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}";
     };
     ${fqdn} = {
       enableACME = true;
       forceSSL = true;
-      locations."/_matrix".proxyPass = "http://localhost:8008";
+      locations."/_matrix".proxyPass = "http://localhost:${toString port}";
-      locations."/_synapse/client".proxyPass = "http://localhost:8008";
+      locations."/_synapse/client".proxyPass = "http://localhost:${toString port}";
-      locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://localhost:8009";
+      locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://${toString matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}";
     };
   };
 }

secrets/secrets.yaml

@@ -5,6 +5,11 @@ grafana:
     oidc_client_secret: ENC[AES256_GCM,data:XU81XrM/aTZ/RDc3UPunOFQdfjJldKw3usMA5NfQkgxJYSq5NSu1ZQXsMuly4xbcYULiuUtkTAnb7Xzge+yIDoLfrZHab4mQgtLeK6hzZgLHYeSSEtQCXEYsL0p6ulA2OLrW6KoKl/o1EjiA+8htimgc7yNatdo6pBwwUXZFxpQ=,iv:de2P5uu1t0si7s7BqG4ukvouxH1TlCxgR28wRsz7i/I=,tag:1u0Wd9HRzbJRQtNbwDHOIQ==,type:str]
 anki:
     password: ENC[AES256_GCM,data:dZsz/Z0rdP8vVFEGlck=,iv:rLjrfKXnz7hiYSOOY+uTGQCmvMLZbo3Xle+069hAB+A=,tag:sNuvL9tGBXs9OPoFVfjdSw==,type:str]
+synapse:
+    postgres: ENC[AES256_GCM,data:pP/Clrcd/dTjI81Wr9I=,iv:nx3eVKH1DXGk3tipbzlIGGyZB3/bJP5TSVMFVNHTIPs=,tag:3PbODZtFlb9XtuBfO/Ey/g==,type:str]
+    oidc_client_secret: ENC[AES256_GCM,data:GXEHHAf5pi/34DY8rUtb1r+0w9HdH2LfeYzREq9BssbspORGd2lOGW22kpUWQzMP/LN8qqx0+EDxlnUuz6MbKofdDPO53Ghrkv7eKsgHdI4g8NbneOEIe4Uurjsg+ibn2EIAWP6HsdwDoLPpS260HyciHJz15i8OpyPatv+bhUc=,iv:pigc8d/LPwy/mBrlUzOFR1nIUrulYZ67nq4bI4Mn+MI=,tag:5fQj8XiXmlC0/T4Muht7bA==,type:str]
+    signing_key: ENC[AES256_GCM,data:AuXyep/aoKn0EoXFgphhlwyvqiwnmRAbGsjzQtCHOVe1Nsdd1aZZdmANt3NXbNJbtjbowIYGbYTizQ==,iv:jKfEBdXSIrg1WQRvWxi+CUiO2mXOfULkg/i3YSD4d9k=,tag:EZJnoZVyrjb0fcRbvyuiPg==,type:str]
+    sliding_sync_secret: ENC[AES256_GCM,data:EureGgSONw+29RnTBcG7+Hpjs3mOk1Zr75glc582Tr9ITFfMczAdfY0FlWQgDxiPnl3o2GqlvdQ2CwDmpVGUVQ==,iv:JUKLrxrYQmCF15o+PwY1PzNW1h9FrGxdbSFGCzm3RdA=,tag:/TMv9LcCRLoTw3MDmpE0oQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -20,8 +25,8 @@ sops:
             NUFIN3NPU2pTZ0NZRXdQY0xhWlI5T3cKd5XCj1aNsD+7+MfiAPGb1iAW9AgzyagG
             A7cwF9kQwWWLud9z4v6epuDkqGF+7uIy7N/CwBaEgi8+AS8o27wo4g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-02-22T17:24:48Z"
+    lastmodified: "2024-02-26T17:54:36Z"
-    mac: ENC[AES256_GCM,data:keBxJZqVLaIlSVRKKeOZALAbOPSVhPgenalfAVEC65WV0+8oDSGcsG/8Z66VDTUgbz48m7yNwLE9JAdFr/u2CZfww6IFR0Kz+sr7fNnRvb4HDcEt/47o5/e3UDQ39kfM11FKDzN6fVf6QKweGOUyylbVjpN+ZJ8xuuqucbd/IZA=,iv:EVZnJPEFOCQ7iHn4lY6gkQiHN6lR3WDVzh0pbBXQvqo=,tag:hwVDuxk8/gvPmDpMnZjAeg==,type:str]
+    mac: ENC[AES256_GCM,data:ACq2ZewsSYkONXBOrUWRm+Thywc4DCtmPESSUcx8qVPV+x0C7+wq8ShHlfPmIWfXwOEtNHYLWIHMFegDlRn/B5SVkok46XUq+s62tKEZI+5tI7MfM7FVFaJGFq7/Y7AFOF7uuhPYaWrSvNTTvegbBKVGAeAJXGXXrbVO1V+dw2c=,iv:mf4Cxj82iAfdJjlDZdtE31MhcP+Z/I/vWSwY2bBb2SM=,tag:Hiwd93LgGeqKo4pGiTDiOw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1