114 lines
3.2 KiB
Nix
114 lines
3.2 KiB
Nix
{
|
|
flake.nixosModules.matrix = {
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
cfg = config.hive.matrix;
|
|
in {
|
|
options.hive.matrix = {
|
|
enable = lib.mkEnableOption "Enable matrix server (synapse)";
|
|
|
|
localPort = lib.mkOption {
|
|
type = lib.types.int;
|
|
default = 8474;
|
|
description = "The internal port of the synapse server";
|
|
};
|
|
|
|
registrationSecretSopsKey = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "The sops key of the secret containing the registration secret";
|
|
};
|
|
|
|
hiddenServiceHostnameSopsKey = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "The sops key of the secret containing the hostname of the hidden service";
|
|
};
|
|
hiddenServiceSecret = lib.mkOption {
|
|
type = lib.types.path;
|
|
description = "The file containing the hidden service's secret";
|
|
};
|
|
instanceFQDN = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = "nextcloud.example.com";
|
|
description = "Fully qualified domain name of the Nextcloud instance";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
# Database setup
|
|
services.postgresql = {
|
|
enable = true;
|
|
initialScript = pkgs.writeText "matrix-synapse-initScript" ''
|
|
CREATE ROLE "matrix-synapse";
|
|
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
|
TEMPLATE template0
|
|
LC_COLLATE = "C"
|
|
LC_CTYPE = "C";
|
|
'';
|
|
};
|
|
|
|
# Hidden service
|
|
services.tor = {
|
|
enable = true;
|
|
enableGeoIP = false;
|
|
relay.onionServices.matrix = {
|
|
secretKey = cfg.hiddenServiceSecret;
|
|
version = 3;
|
|
map = [
|
|
{
|
|
port = 80;
|
|
target = {
|
|
addr = "[::1]";
|
|
port = cfg.localPort;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
# Secret hostname for matrix-synapse
|
|
sops.templates."hidden-matrix-synapse".owner = "matrix-synapse";
|
|
sops.templates."hidden-matrix-synapse".content = ''
|
|
server_name: "${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
|
|
public_baseurl: "http://${config.sops.placeholder.${cfg.hiddenServiceHostnameSopsKey}}"
|
|
registration_shared_secret: "${config.sops.placeholder.${cfg.registrationSecretSopsKey}}"
|
|
'';
|
|
|
|
# Synapse
|
|
services.matrix-synapse = {
|
|
enable = true;
|
|
settings.listeners = [
|
|
{
|
|
port = cfg.localPort;
|
|
bind_addresses = ["::1"];
|
|
type = "http";
|
|
tls = false;
|
|
x_forwarded = false;
|
|
resources = [
|
|
{
|
|
names = [
|
|
"client"
|
|
];
|
|
compress = false;
|
|
}
|
|
];
|
|
}
|
|
];
|
|
settings = {
|
|
enable_registration = false;
|
|
registration_requires_token = true;
|
|
report_stats = false;
|
|
federation_domain_whitelist = [];
|
|
federation_ip_range_blacklist = ["0.0.0.0/0"];
|
|
};
|
|
|
|
extraConfigFiles = [
|
|
config.sops.templates."hidden-matrix-synapse".path
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|