matrix: init

hosts/falkenstein-1/modules/nginx/default.nix

@@ -1,4 +1,25 @@
 { config, ... }:
+# matrix homeserver discovery
+let
+  matrix_domain = "matrix.${config.networking.domain}";
+  serverConfig = {
+    "m.server" = "${matrix_domain}:443";
+  };
+  clientConfig = {
+    "m.homeserver" = {
+      base_url = "https://${matrix_domain}";
+      # server_name = config.networking.domain;
+    };
+    "org.matrix.msc3575.proxy" = {
+      url = "https://${matrix_domain}";
+    };
+  };
+  mkWellKnown = data: ''
+    add_header Content-Type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON data}';
+  '';
+in
 {
   networking.firewall.allowedTCPPorts = [ 80 443 ];
   services.nginx = {
@@ -12,6 +33,8 @@
       enableACME = true;
       forceSSL = true;
       root = "/srv/web/${config.networking.domain}";
+      locations."/.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
+      locations."/.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
     };
   };
   security.acme = {

hosts/nuc/default.nix

@@ -5,10 +5,11 @@
     [
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ./modules/adguard
+      # ./modules/adguard
       ./modules/networks
       ./modules/backup
       ./modules/hydra
+      ./modules/matrix
       ./modules/nextcloud
       ./modules/seafile
       ./modules/uptime-kuma

hosts/nuc/modules/matrix/default.nix

@@ -0,0 +1,97 @@
+{ config, pkgs, ... }:
+let
+  domain = "matrix.${config.networking.domain}";
+in
+{
+
+  sops.secrets = {
+    "matrix/shared_secret" = {
+      owner = config.systemd.services.matrix-synapse.serviceConfig.User;
+    };
+    "matrix/sync/environment" = {
+      # owner = "matrix-sliding-sync";
+    };
+  };
+
+  services = {
+    postgresql = {
+      enable = true;
+      ensureUsers = [{
+        name = "matrix-synapse";
+      }];
+    };
+
+
+    matrix-synapse = {
+      enable = true;
+      configureRedisLocally = true;
+      extraConfigFiles = [ config.sops.secrets."matrix/shared_secret".path ];
+
+      settings = {
+        server_name = config.networking.domain;
+
+        listeners = [{
+          port = 8008;
+          bind_addresses = [ "::1" ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+          resources = [{
+            names = [ "client" "federation" ];
+            compress = false;
+          }];
+        }];
+      };
+      sliding-sync = {
+        enable = true;
+        settings = {
+          SYNCV3_SERVER = "https://${domain}";
+        };
+        environmentFile = config.sops.secrets."matrix/sync/environment".path;
+      };
+    };
+
+
+    nginx = {
+      recommendedProxySettings = true;
+      virtualHosts = {
+        # synapse
+        "${domain}" = {
+          enableACME = true;
+          forceSSL = true;
+
+
+          # locations."/".extraConfig = "return 404;";
+
+          # # proxy to synapse
+          # locations."/_matrix".proxyPass = "http://[::1]:8008";
+          locations."/".proxyPass = "http://[::1]:8008";
+          locations."~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)".proxyPass = "http://localhost:8009";
+          # locations."/_synapse/client".proxyPass = "http://[::1]:8008";
+        };
+      };
+    };
+  };
+
+  systemd.services.matrix-synapse.after = [ "matrix-synapse-pgsetup.service" ];
+
+  systemd.services.matrix-synapse-pgsetup = {
+    description = "Prepare Synapse postgres database";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "networking.target" "postgresql.service" ];
+    serviceConfig.Type = "oneshot";
+
+    path = [ pkgs.sudo config.services.postgresql.package ];
+
+    # create database for synapse. will silently fail if it already exists
+    script = ''
+      sudo -u ${config.services.postgresql.superUser} psql <<SQL
+        CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+          ENCODING 'UTF8'
+          TEMPLATE template0
+          LC_COLLATE = "C"
+          LC_CTYPE = "C";
+      SQL
+    '';
+  };
+}

hosts/nuc/modules/networks/default.nix

@@ -9,7 +9,7 @@
   services.lldpd.enable = true;
   services.resolved = {
     enable = true;
-    dnssec = "true";
+    # dnssec = "true";
     fallbackDns = [
       "9.9.9.9"
       "149.112.112.112"
@@ -17,11 +17,11 @@
       "2620:fe::9"
     ];
     # make room for the adguard dns
-    extraConfig = ''
-      [Resolve]
-      DNS=127.0.0.1
-      DNSStubListener=no
-    '';
+    # extraConfig = ''
+    #   [Resolve]
+    #   DNS=127.0.0.1
+    #   DNSStubListener=no
+    # '';
   };
   systemd.network = {
     enable = true;