System Gen171 @ 2026-07-17-23:59:59 by jonas@monolith

.sops.yaml

@@ -4,7 +4,7 @@ keys:
   - &comfy-station age1xkmnvzus6fhundn4c0f6hyuwrj0f0m7x3hxtuhnez6cecr6m032qalw308
   - &monolith age1clh2c489j7mx94aqr44u6k2cx5axqme9rlshqu9l2mcynluwhq6qwn0sv0
 creation_rules:
-  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/[^/]+$
     key_groups:
     - age:
       - *jonas
@@ -12,24 +12,24 @@ creation_rules:
       - *comfy-station
       - *monolith
 
-  - path_regex: secrets/jonas/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/jonas/[^/]+$
     key_groups:
     - age:
       - *jonas
 
-  - path_regex: secrets/comfy-station/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/comfy-station/[^/]+$
     key_groups:
     - age:
       - *comfy-station
       - *jonas
 
-  - path_regex: secrets/harbor/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/harbor/[^/]+$
     key_groups:
     - age:
       - *harbor
       - *jonas
 
-  - path_regex: secrets/monolith/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/monolith/[^/]+$
     key_groups:
     - age:
       - *monolith

hosts/harbor/configuration.nix

@@ -29,6 +29,18 @@
     owner = config.hive.gotify-instance.user;
     key = "adminPassword";
   };
+  sops.secrets.matrix-hs-secret = {
+    format = "binary";
+    sopsFile = ../../secrets/harbor/hs_ed25519_secret_key;
+  };
+  sops.secrets.hidden-matrix-hostname = {
+    sopsFile = ../../secrets/harbor/hidden-matrix.yaml;
+    key = "hostname";
+  };
+  sops.secrets.hidden-matrix-registration-secret = {
+    sopsFile = ../../secrets/harbor/hidden-matrix.yaml;
+    key = "registration_secret";
+  };
 
   # gc settings and binary caches
   nix = {
@@ -82,6 +94,10 @@
   hive.borg-server.repositories.comfy-station.ssh_public_key = builtins.readFile (../../static/keys + "/borg-jonas@comfy-station.pub");
   hive.wg.server.enable = true;
   hive.wg.server.privateKeyFile = config.sops.secrets.wg-priv.path;
+  hive.matrix.enable = true;
+  hive.matrix.hiddenServiceSecret = config.sops.secrets.matrix-hs-secret.path;
+  hive.matrix.hiddenServiceHostnameSopsKey = config.sops.secrets.hidden-matrix-hostname.name;
+  hive.matrix.registrationSecretSopsKey = config.sops.secrets.hidden-matrix-registration-secret.name;
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions

hosts/harbor/default.nix

@@ -20,6 +20,7 @@
       self.nixosModules.minecraft-server
       self.nixosModules.borg-server
       self.nixosModules.wireguard-server
+      self.nixosModules.matrix
     ];
   };
 }

modules/services/matrix.nix

@@ -0,0 +1,113 @@
+{
+  flake.nixosModules.matrix = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: let
+    cfg = config.hive.matrix;
+  in {
+    options.hive.matrix = {
+      enable = lib.mkEnableOption "Enable matrix server (synapse)";
+
+      localPort = lib.mkOption {
+        type = lib.types.int;
+        default = 8474;
+        description = "The internal port of the synapse server";
+      };
+
+      registrationSecretSopsKey = lib.mkOption {
+        type = lib.types.str;
+        description = "The sops key of the secret containing the registration secret";
+      };
+
+      hiddenServiceHostnameSopsKey = lib.mkOption {
+        type = lib.types.str;
+        description = "The sops key of the secret containing the hostname of the hidden service";
+      };
+      hiddenServiceSecret = lib.mkOption {
+        type = lib.types.path;
+        description = "The file containing the hidden service's secret";
+      };
+      instanceFQDN = lib.mkOption {
+        type = lib.types.str;
+        example = "nextcloud.example.com";
+        description = "Fully qualified domain name of the Nextcloud instance";
+      };
+    };
+
+    config = lib.mkIf cfg.enable {
+      # Database setup
+      services.postgresql = {
+        enable = true;
+        initialScript = pkgs.writeText "matrix-synapse-initScript" ''
+          CREATE ROLE "matrix-synapse";
+          CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+            TEMPLATE template0
+            LC_COLLATE = "C"
+            LC_CTYPE = "C";
+        '';
+      };
+
+      # Hidden service
+      services.tor = {
+        enable = true;
+        enableGeoIP = false;
+        relay.onionServices.matrix = {
+          secretKey = cfg.hiddenServiceSecret;
+          version = 3;
+          map = [
+            {
+              port = 80;
+              target = {
+                addr = "[::1]";
+                port = cfg.localPort;
+              };
+            }
+          ];
+        };
+      };
+
+      # Secret hostname for matrix-synapse
+      sops.templates."hidden-matrix-synapse".owner = "matrix-synapse";
+      sops.templates."hidden-matrix-synapse".content = ''
+        server_name: "${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
+        public_baseurl: "http://${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
+        registration_shared_secret: "${config.sops.placeholder.${cfg.registrationSecretSopsKey}}"
+      '';
+
+      # Synapse
+      services.matrix-synapse = {
+        enable = true;
+        settings.listeners = [
+          {
+            port = cfg.localPort;
+            bind_addresses = ["::1"];
+            type = "http";
+            tls = false;
+            x_forwarded = false;
+            resources = [
+              {
+                names = [
+                  "client"
+                ];
+                compress = false;
+              }
+            ];
+          }
+        ];
+        settings = {
+          enable_registration = false;
+          registration_requires_token = true;
+          report_stats = false;
+          federation_domain_whitelist = [];
+          federation_ip_range_blacklist = ["0.0.0.0/0"];
+        };
+
+        extraConfigFiles = [
+          config.sops.templates."hidden-matrix-synapse".path
+        ];
+      };
+    };
+  };
+}

secrets/harbor/hidden-matrix.yaml

@@ -0,0 +1,26 @@
+hostname: ENC[AES256_GCM,data:XRWNaOW738h9s1ppu6mopw6fEdrO7FoH0Tg3sqxFacMGvwIUonCaTm0dKtuqaToq8PNVlOE3Fkg74bMnzJ4=,iv:7iRalbTlrpoGXkNBm+StetvMBQyxtT0+ZYhMyBmipts=,tag:HQqnBP2Wj6I3bZTsoc27Yw==,type:str]
+registration_secret: ENC[AES256_GCM,data:jPiq+n3c2o4lC1AnA6E=,iv:kTjRl3ipV8WSEXqLUgveUQtxq1QWeNIUN17o2xGS3dI=,tag:He2zK/jXRi4GOWisw4yjSA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaTWJ6djJqU0FtdUkvL2d6
+            SWt3NHBSUS9jQmlJVUVpaUZ3RGVJS0NCT2t3CkhvZzc3cUIyV3ZlT1ZVMUhFbDRE
+            RWtGTmxFQllnOTdJQ3ppNCtNcG9qbmcKLS0tIEdQNGlpQzBVU2c4alVrTUlmeXNZ
+            enRwUWl0Mzd6bmtRaDhkSlN0cGVRVG8KpJqu51CIRNK/nVLnUoFhPSyEWdW0TdqS
+            EUbDt71zKUEg4jHe+RqR9ThT2PSY3j03ZtkCYJ+aDIftWJrmpisUew==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2TWZxVDEzckNjMTRrNXpF
+            RGtMUmVVMjdjbVNzWHBHc21aV1RQZGExSmlrCnNpbXZLUHhnaWxNbFNyUHVnM05F
+            cWVYSFhGbUF2ejlGRjNvRWp6SFFQMncKLS0tIGt2VXhmcGFGOTNlSzdCM3Y3NFNr
+            NStxbkN4VitSOUJwN3BxWjljM1QvUWMK4dgk/luLWp9qDGLOp9vy/xJco/dLvepz
+            SSXKtuT3UbbyWqjV6AJ/slzsVWbBQCnf4fkJKpBnlCiqprjaFehXFg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z
+    lastmodified: "2026-07-17T21:59:19Z"
+    mac: ENC[AES256_GCM,data:hZ14dzYNrXLr2FK7LPZoggYT36n0kD2gX1Nd3OM256+uJcvLV1jyqhGqeg+xWLVWC4R31YZlhHWQwA6ZcGrzgk/ograarGEgE1pDkG74+02fRyqcvC6SxvF8I1hq2FxDKzmAK89lXh7GTjiFmo9nqrkgA1aDTnogW0FHoJhVB+4=,iv:3cPMHQmpc+Lfu2GpiGKn9H9y1DNo0dhGfr8M5zzXvl8=,tag:6uhGRnBXN7Mnw6M1iULZCQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

secrets/harbor/hs_ed25519_secret_key

@@ -0,0 +1,19 @@
+{
+	"data": "ENC[AES256_GCM,data:1OXbkYAQrKgB49ex8UUOJXSirXD0Pjbm+IvUUniYLrCU8mItyuEvyuU3KNifn4ygkcm2pJ/oVbHpNtUvikxUWgrAVbc2t1U0GaEpTEEz/Si9g4uliJov4Qke+RZtz4Mh,iv:eReke55jV8N44YgNQEQffLPrk2+0DK0T9knPAFofW5Y=,tag:/653TVicd4StzEanhH9vFw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvSk5XM1dIVXZvOHFzbzRo\nSzcvZEtWMGZtaTIxa1hRbUZXVFRodC9JRkdBCkJ3V0t4R2N4bEdTUFNrNU9vUGs1\nVjRGZ1VzZnBBYUpIL1JXcmNtNEhWM0UKLS0tIG5XbjdobkFrMGZXaHlaRFdwMWo0\nU21MNnlNbkk1TVcwbEtsUC81Q1JBbFUKkgAiQCIscxuuIG+7Aplx67L4G1F4pMhX\n3UUnR6uWlrhhYS84K/oRb5h7tqHcK2ZPNRQtf66+QYLeYnoQkw2fAA==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1wf0rq27v0n27zfy0es8ns3n25e2fdt063dgn68tt3f89rgrtu9csq4yhsp"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKRFdkTmlZc3RqVWwvMXJE\nZHVhNzNRWE1Wc3Y0M0VjR1M4R1pITlBBRTJrCllETlFiaEJGcHN0WW1jTnVldTZl\nV2ZxbUtBdytFeDFocXhVZ1Z3M01TWW8KLS0tIEpyeTJhMy95NnNaU3Fhbm91TVpu\nZjNjdmQwWGJ6YUlCRXh6Uk54eHlPUGMK5RGFrteIcon1CpVWddI0jftU3Q/SXGdz\nw9DwqtwkFTQpvRl2RGSJToipGwy91Pn3vubF+U77xEcPvtAhW8cIcQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1expg8vyduf290pz7l4f3mjzvk9f0azfdn48pyjzs3m6p7v4qjq0qwtn36z"
+			}
+		],
+		"lastmodified": "2026-07-17T20:23:08Z",
+		"mac": "ENC[AES256_GCM,data:vwz/UOSbE3p57HzYx5Im2Zgq/W7qHh9SSX10k6sIzJJQHIKTSFJaA8qwYJIStz8ULyBw0CDcROun+1RBhdpUCBDNl/fVcXHVgk39ubBbLJji0z84eW1qZmg9/WAW7y/nAid1SH5TU95OwC1KCUxSLzDdUNuO2YdRwvQ10ST8QJo=,iv:9yJ0yP7SoNhuFJ9LR1BXileQTYNus/FwSKLZETXY8Hg=,tag:S8tXzl6DhN/u6wMjIsr13w==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.13.2"
+	}
+}