System Gen51 @ 2026-09-03-16:21:56 by jonas@harbor

modules/services/matrix.nix

@@ -2,10 +2,13 @@
   flake.nixosModules.matrix = {
     config,
     lib,
-    pkgs,
     ...
   }: let
     cfg = config.hive.matrix;
+    ketesa-web-root = fetchTarball {
+      url = "https://github.com/etkecc/ketesa/releases/download/v1.4.0/ketesa.tar.gz";
+      sha256 = "sha256:0za0rddcbxn2ra4xlykn7v8b4j0ddyacivyzp91m80r071ds1dk7";
+    };
   in {
     options.hive.matrix = {
       enable = lib.mkEnableOption "Enable matrix server (synapse)";
@@ -16,9 +19,10 @@
         description = "The internal port of the synapse server";
       };
 
-      registrationSecretSopsKey = lib.mkOption {
-        type = lib.types.str;
-        description = "The sops key of the secret containing the registration secret";
+      ketesaLocalPort = lib.mkOption {
+        type = lib.types.int;
+        default = 8475;
+        description = "The internal port of the ketesa virtual host";
       };
 
       hiddenServiceHostnameSopsKey = lib.mkOption {
@@ -29,10 +33,9 @@
         type = lib.types.path;
         description = "The file containing the hidden service's secret";
       };
-      instanceFQDN = lib.mkOption {
-        type = lib.types.str;
-        example = "nextcloud.example.com";
-        description = "Fully qualified domain name of the Nextcloud instance";
+      ketesaHiddenServiceSecret = lib.mkOption {
+        type = lib.types.path;
+        description = "The file containing the ketesa hidden service's secret";
       };
     };
 
@@ -59,6 +62,32 @@
             }
           ];
         };
+        relay.onionServices.ketesa = {
+          secretKey = cfg.ketesaHiddenServiceSecret;
+          version = 3;
+          map = [
+            {
+              port = 80;
+              target = {
+                addr = "127.0.0.1";
+                port = cfg.ketesaLocalPort;
+              };
+            }
+          ];
+        };
+      };
+
+      # Virtual host for ketesa
+      services.nginx.virtualHosts."ketesa-localhost" = {
+        listen = [
+          {
+            addr = "127.0.0.1";
+            port = cfg.ketesaLocalPort;
+          }
+        ];
+        forceSSL = false;
+        enableACME = false;
+        root = "${ketesa-web-root}";
       };
 
       # Secret hostname for matrix-synapse
@@ -66,7 +95,6 @@
       sops.templates."hidden-matrix-synapse".content = ''
         server_name: "${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
         public_baseurl: "http://${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
-        registration_shared_secret: "${config.sops.placeholder.${cfg.registrationSecretSopsKey}}"
       '';
 
       # Synapse
@@ -90,7 +118,7 @@
           }
         ];
         settings = {
-          enable_registration = false;
+          enable_registration = true;
           registration_requires_token = true;
           report_stats = false;
           federation_domain_whitelist = [];