chaos-jetzt-nixfiles/services/matrix/default.nix

168 lines
6 KiB
Nix
Raw Normal View History

2023-02-07 20:01:42 +01:00
{ lib, config, pkgs, baseDomain, ... }: let
matrixPort = 8008;
isDev = (builtins.substring 0 3 baseDomain) == "dev";
synapseDb = config.services.matrix-synapse.settings.database.args;
initSynapseDb = ''CREATE DATABASE "${synapseDb.database}" WITH OWNER "${synapseDb.user}" ENCODING "UTF8" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C";'';
in {
sops.secrets = {
"coturn_static_auth_secret".owner = "turnserver";
"synapse/signing_key" = {
owner = "matrix-synapse";
path = config.services.matrix-synapse.settings.signing_key_path;
mode = "0600";
};
"synapse/secret_config".owner = "matrix-synapse";
"synapse/registration_shared_secret".owner = "matrix-synapse";
2023-02-07 20:01:42 +01:00
};
services.nginx.virtualHosts = {
"chat.${baseDomain}" = {
enableACME = true;
forceSSL = true;
root = pkgs.element-web.override {
# Somewhat duplicate of the stuff in website.nix but I am
# not sure if we absolutely need to dedup this, just out of complexity perspective
2023-07-22 22:19:28 +02:00
conf = {
default_server_config."m.homeserver" = {
base_url = "https://matrix.${baseDomain}/";
server_name = baseDomain;
};
default_country_code = "DE";
};
2023-02-07 20:01:42 +01:00
};
};
"matrix.${baseDomain}" = {
enableACME = true;
forceSSL = true;
# It's also possible to do a redirect here or something else, this vhost is not
# needed for Matrix. It's recommended though to *not put* element
# here, see also the section about Element.
locations."/".extraConfig = ''
return 404;
'';
# Forward all Matrix API calls to the synapse Matrix homeserver. A trailing slash
# *must not* be used here.
locations."/_matrix".proxyPass = "http://[::1]:${toString matrixPort}";
# Forward requests for e.g. SSO and password-resets.
locations."/_synapse/client".proxyPass = "http://[::1]:${toString matrixPort}";
};
};
services.postgresql = {
enable = true;
ensureUsers = [
{ name = synapseDb.user; }
];
};
systemd.services.postgresql = {
postStart = ''
$PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'matrix-synapse'" | grep -q 1 || $PSQL -tAc '${initSynapseDb}'
'';
};
security.acme.certs."turn.${baseDomain}" = {
group = "turnserver";
reloadServices = [ "coturn.service" ];
};
services.coturn = let
sslDir = config.security.acme.certs."turn.${baseDomain}".directory;
in {
enable = true;
cert = "${sslDir}/fullchain.pem";
pkey = "${sslDir}/key.pem";
static-auth-secret-file = config.sops.secrets."coturn_static_auth_secret".path;
};
# TODO: Use media storage volume on prod
services.matrix-synapse = {
enable = true;
plugins = [
pkgs.python3Packages.matrix-synapse-saml-mapper
];
settings = {
server_name = baseDomain;
public_baseurl = "https://matrix.${baseDomain}";
allow_public_rooms_over_federation = true;
enable_registration = false;
registration_shared_secret_path = config.sops.secrets."synapse/registration_shared_secret".path;
log_config = ./synapse-log_config.yaml;
2023-02-07 20:01:42 +01:00
database = {
name = "psycopg2";
args.database = "matrix-synapse";
};
federation_ip_range_blacklist = [
"127.0.0.0/8"
"10.0.0.0/8"
"172.16.0.0/12"
"192.168.0.0/16"
"100.64.0.0/10"
"169.254.0.0/16"
"::1/128"
"fe80::/64"
"fc00::/7"
];
admin_contact = "mailto:administration@chaos.jetzt";
url_preview_enabled = true;
media_store_path = "/mnt/synapse_media_store";
turn_uris = let
turn_base = "turn.${baseDomain}";
ct = config.services.coturn;
port = builtins.toString ct.listening-port;
tlsPort = builtins.toString ct.tls-listening-port;
in [
"turn:${turn_base}:${port}?transport=tcp"
"turn:${turn_base}:${port}?transport=udp"
"turns:${turn_base}:${tlsPort}?transport=tcp"
"turns:${turn_base}:${tlsPort}?transport=udp"
];
auto_join_rooms = builtins.map (v: "#${v}:${baseDomain}") [ "grosse_halle" "allgemein" ];
autocreate_auto_join_rooms = true;
enable_metrics = false;
user_directory = {
enabled = true;
search_all_users = true;
};
saml2_config = {
enabled = true;
sp_config.metadata.remote = [{
url = "https://sso.chaos.jetzt/auth/realms/${if isDev then "dev" else "chaos-jetzt"}/protocol/saml/descriptor";
}];
user_mapping_provider.module = "matrix_synapse_saml_mapper.SamlMappingProvider";
};
password_config.enabled = false;
};
extraConfigFiles = let
format = (pkgs.formats.yaml {}).generate;
in [
# Contains turn_shared_secret, macaroon_secret_key, and form_secret
config.sops.secrets."synapse/secret_config".path
# For our saml sso stuff we need to have additional_ressouces, but they are not possible with the NixOS module listener
(format "additional_ressources.yaml" {
listeners = [{
2023-07-22 22:19:28 +02:00
bind_addresses = [ "::1" "127.0.0.1" ];
port = matrixPort;
type = "http";
tls = false;
x_forwarded = true;
resources = [{
names = [ "client" "federation" ];
compress = false;
}];
additional_resources."/_matrix/saml2/pick_username".module = "matrix_synapse_saml_mapper.pick_username_resource";
2023-02-07 20:01:42 +01:00
}];
})
];
};
system.activationScripts."synapse-media-store-mnt".text = ''
mkdir -p ${lib.escapeShellArg config.services.matrix-synapse.settings.media_store_path}
chown matrix-synapse:matrix-synapse ${lib.escapeShellArg config.services.matrix-synapse.settings.media_store_path}
'';
systemd.services.matrix-synapse = {
unitConfig.RequiresMountsFor = [ config.services.matrix-synapse.settings.media_store_path ];
serviceConfig.ReadWritePaths = [ config.services.matrix-synapse.settings.media_store_path ];
};
}