127 lines
3.3 KiB
Nix
127 lines
3.3 KiB
Nix
{
|
|
flake.nixosModules.matrix = {
|
|
config,
|
|
lib,
|
|
...
|
|
}: let
|
|
cfg = config.hive.matrix;
|
|
ketesa-web-root = fetchTarball {
|
|
url = "https://github.com/etkecc/ketesa/releases/download/v1.4.0/ketesa.tar.gz";
|
|
sha256 = "sha256:0za0rddcbxn2ra4xlykn7v8b4j0ddyacivyzp91m80r071ds1dk7";
|
|
};
|
|
in {
|
|
options.hive.matrix = {
|
|
enable = lib.mkEnableOption "Enable matrix server (synapse)";
|
|
|
|
localPort = lib.mkOption {
|
|
type = lib.types.int;
|
|
default = 8474;
|
|
description = "The internal port of the synapse server";
|
|
};
|
|
|
|
ketesaLocalPort = lib.mkOption {
|
|
type = lib.types.int;
|
|
default = 8475;
|
|
description = "The internal port of the ketesa virtual host";
|
|
};
|
|
|
|
hiddenServiceHostnameSopsKey = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "The sops key of the secret containing the hostname of the hidden service";
|
|
};
|
|
|
|
hiddenServiceSecret = lib.mkOption {
|
|
type = lib.types.path;
|
|
description = "The file containing the hidden service's secret";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
# Database setup
|
|
services.postgresql = {
|
|
enable = true;
|
|
};
|
|
|
|
# Hidden service
|
|
services.tor = {
|
|
enable = true;
|
|
enableGeoIP = false;
|
|
relay.onionServices.matrix = {
|
|
secretKey = cfg.hiddenServiceSecret;
|
|
version = 3;
|
|
map = [
|
|
{
|
|
port = 80;
|
|
target = {
|
|
addr = "[::1]";
|
|
port = cfg.localPort;
|
|
};
|
|
}
|
|
{
|
|
port = 8080;
|
|
target = {
|
|
addr = "127.0.0.1";
|
|
port = cfg.ketesaLocalPort;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
# Virtual host for ketesa
|
|
services.nginx.virtualHosts."ketesa-localhost" = {
|
|
listen = [
|
|
{
|
|
addr = "127.0.0.1";
|
|
port = cfg.ketesaLocalPort;
|
|
}
|
|
];
|
|
forceSSL = false;
|
|
enableACME = false;
|
|
root = "${ketesa-web-root}";
|
|
};
|
|
|
|
# Secret hostname for matrix-synapse
|
|
sops.templates."hidden-matrix-synapse".owner = "matrix-synapse";
|
|
sops.templates."hidden-matrix-synapse".content = ''
|
|
server_name: "${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
|
|
public_baseurl: "http://${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
|
|
'';
|
|
|
|
# Synapse
|
|
services.matrix-synapse = {
|
|
enable = true;
|
|
settings.listeners = [
|
|
{
|
|
port = cfg.localPort;
|
|
bind_addresses = ["::1"];
|
|
type = "http";
|
|
tls = false;
|
|
x_forwarded = false;
|
|
resources = [
|
|
{
|
|
names = [
|
|
"client"
|
|
];
|
|
compress = false;
|
|
}
|
|
];
|
|
}
|
|
];
|
|
settings = {
|
|
enable_registration = true;
|
|
registration_requires_token = true;
|
|
report_stats = false;
|
|
federation_domain_whitelist = [];
|
|
federation_ip_range_blacklist = ["0.0.0.0/0"];
|
|
matrix_static_files_file_matrix_support_enabled = true;
|
|
};
|
|
|
|
extraConfigFiles = [
|
|
config.sops.templates."hidden-matrix-synapse".path
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|