tristan/nix
1
0
Fork 0
Code Projects Releases Packages Activity

matrix-synapse

Browse source
This commit is contained in:
Tristan 2024-02-26 18:02:34 +00:00
parent fe3d338d1e
commit 7fc3164ab8
2 changed files with 86 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

87
nixos/services/synapse.nix
View file

@ -1,3 +1,4 @@
{pkgs, config, lib, ...}:
let
fqdn = "${hostname}.${domain}";
domain = "tristans.cloud";
@ -7,10 +8,80 @@ let
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON data}';
'';
port = 8008;
inherit (config) sops;
inherit (config.services) matrix-synapse;
inherit (sops) secrets templates;
in {
services.matrix-synapse = {
enable = false; # using podman for the moment
services.postgresql.enable = true;
services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
'';
sops.secrets = {
"synapse/signing_key".owner = "matrix-synapse";
"synapse/oidc_client_secret" = {};
"synapse/sliding_sync_secret" = {};
};
sops.templates = {
"synapse/secrets.yaml" = {
owner = "matrix-synapse";
content = builtins.toJSON {
oidc_providers = [{
idp_id = "authentik";
idp_name = "authentik";
discover = true;
issuer = "https://auth.tristans.cloud/application/o/chat/";
client_id = "fdad520e8c57f228aaa658aa74d5e00ba9b164a3";
client_secret = sops.placeholder."synapse/oidc_client_secret";
scopes = ["openid" "profile" "email"];
user_mapping_provider = {
config = {
localpart_template= "{{ user.preferred_username }}";
display_name_template= "{{ user.name|capitalize }}";
};
};
}];
};
};
"synapse/sliding_sync_env".content = ''
SYNCV3_SECRET=${sops.placeholder."synapse/sliding_sync_secret"}
'';
};
services.matrix-synapse = {
enable = true;
extraConfigFiles = [templates."synapse/secrets.yaml".path];
settings = {
signing_key_path = secrets."synapse/signing_key".path;
server_name = domain;
baseurl = "https://${domain}";
oidc_providers = [];
settings.listeners = [ {
inherit port;
bind_addresses = [ "localhost" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [ {
names = [ "client" "federation" ];
compress = true;
} ];
} ];
};
};
services.matrix-sliding-sync = {
enable = true;
environmentFile = templates."synapse/sliding_sync_env".path;
settings.SYNCV3_SERVER = "https://${domain}";
};
services.nginx.virtualHosts = {
${domain} = {
locations."= /.well-known/matrix/server".extraConfig = mkWellKnown {
@ -29,16 +100,16 @@ in {
}
];
};
locations."/_matrix".proxyPass = "http://localhost:8008";
locations."/_synapse/client".proxyPass = "http://localhost:8008";
locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://localhost:8009";
locations."/_matrix".proxyPass = "http://localhost:${toString port}";
locations."/_synapse/client".proxyPass = "http://localhost:${toString port}";
locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://${toString matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}";
};
${fqdn} = {
enableACME = true;
forceSSL = true;
locations."/_matrix".proxyPass = "http://localhost:8008";
locations."/_synapse/client".proxyPass = "http://localhost:8008";
locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://localhost:8009";
locations."/_matrix".proxyPass = "http://localhost:${toString port}";
locations."/_synapse/client".proxyPass = "http://localhost:${toString port}";
locations."/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass = "http://${toString matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}";
};
};
}

9
secrets/secrets.yaml
View file

@ -5,6 +5,11 @@ grafana:
oidc_client_secret: ENC[AES256_GCM,data:XU81XrM/aTZ/RDc3UPunOFQdfjJldKw3usMA5NfQkgxJYSq5NSu1ZQXsMuly4xbcYULiuUtkTAnb7Xzge+yIDoLfrZHab4mQgtLeK6hzZgLHYeSSEtQCXEYsL0p6ulA2OLrW6KoKl/o1EjiA+8htimgc7yNatdo6pBwwUXZFxpQ=,iv:de2P5uu1t0si7s7BqG4ukvouxH1TlCxgR28wRsz7i/I=,tag:1u0Wd9HRzbJRQtNbwDHOIQ==,type:str]
anki:
password: ENC[AES256_GCM,data:dZsz/Z0rdP8vVFEGlck=,iv:rLjrfKXnz7hiYSOOY+uTGQCmvMLZbo3Xle+069hAB+A=,tag:sNuvL9tGBXs9OPoFVfjdSw==,type:str]
synapse:
postgres: ENC[AES256_GCM,data:pP/Clrcd/dTjI81Wr9I=,iv:nx3eVKH1DXGk3tipbzlIGGyZB3/bJP5TSVMFVNHTIPs=,tag:3PbODZtFlb9XtuBfO/Ey/g==,type:str]
oidc_client_secret: ENC[AES256_GCM,data:GXEHHAf5pi/34DY8rUtb1r+0w9HdH2LfeYzREq9BssbspORGd2lOGW22kpUWQzMP/LN8qqx0+EDxlnUuz6MbKofdDPO53Ghrkv7eKsgHdI4g8NbneOEIe4Uurjsg+ibn2EIAWP6HsdwDoLPpS260HyciHJz15i8OpyPatv+bhUc=,iv:pigc8d/LPwy/mBrlUzOFR1nIUrulYZ67nq4bI4Mn+MI=,tag:5fQj8XiXmlC0/T4Muht7bA==,type:str]
signing_key: ENC[AES256_GCM,data:AuXyep/aoKn0EoXFgphhlwyvqiwnmRAbGsjzQtCHOVe1Nsdd1aZZdmANt3NXbNJbtjbowIYGbYTizQ==,iv:jKfEBdXSIrg1WQRvWxi+CUiO2mXOfULkg/i3YSD4d9k=,tag:EZJnoZVyrjb0fcRbvyuiPg==,type:str]
sliding_sync_secret: ENC[AES256_GCM,data:EureGgSONw+29RnTBcG7+Hpjs3mOk1Zr75glc582Tr9ITFfMczAdfY0FlWQgDxiPnl3o2GqlvdQ2CwDmpVGUVQ==,iv:JUKLrxrYQmCF15o+PwY1PzNW1h9FrGxdbSFGCzm3RdA=,tag:/TMv9LcCRLoTw3MDmpE0oQ==,type:str]
sops:
kms: []
gcp_kms: []
@ -20,8 +25,8 @@ sops:
NUFIN3NPU2pTZ0NZRXdQY0xhWlI5T3cKd5XCj1aNsD+7+MfiAPGb1iAW9AgzyagG
A7cwF9kQwWWLud9z4v6epuDkqGF+7uIy7N/CwBaEgi8+AS8o27wo4g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-02-22T17:24:48Z"
mac: ENC[AES256_GCM,data:keBxJZqVLaIlSVRKKeOZALAbOPSVhPgenalfAVEC65WV0+8oDSGcsG/8Z66VDTUgbz48m7yNwLE9JAdFr/u2CZfww6IFR0Kz+sr7fNnRvb4HDcEt/47o5/e3UDQ39kfM11FKDzN6fVf6QKweGOUyylbVjpN+ZJ8xuuqucbd/IZA=,iv:EVZnJPEFOCQ7iHn4lY6gkQiHN6lR3WDVzh0pbBXQvqo=,tag:hwVDuxk8/gvPmDpMnZjAeg==,type:str]
lastmodified: "2024-02-26T17:54:36Z"
mac: ENC[AES256_GCM,data:ACq2ZewsSYkONXBOrUWRm+Thywc4DCtmPESSUcx8qVPV+x0C7+wq8ShHlfPmIWfXwOEtNHYLWIHMFegDlRn/B5SVkok46XUq+s62tKEZI+5tI7MfM7FVFaJGFq7/Y7AFOF7uuhPYaWrSvNTTvegbBKVGAeAJXGXXrbVO1V+dw2c=,iv:mf4Cxj82iAfdJjlDZdtE31MhcP+Z/I/vWSwY2bBb2SM=,tag:Hiwd93LgGeqKo4pGiTDiOw==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1