matrix: init

2025-01-18 17:11:39 +01:00 · 2023-10-17 10:39:14 +02:00 · 2023-10-17 10:39:14 +02:00 · 78a47101ac
commit 78a47101ac
parent fdcfeb524c
7 changed files with 153 additions and 25 deletions
--- a/flake.lock
+++ b/flake.lock
@ -171,11 +171,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1696940889,
-        "narHash": "sha256-p2Wic74A1tZpFcld1wSEbFQQbrZ/tPDuLieCnspamQo=",
+        "lastModified": 1697410455,
+        "narHash": "sha256-jCs/ffIP3tUPN7HWWuae4BB8+haAw2NI02z5BQvWMGM=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "6bba64781e4b7c1f91a733583defbd3e46b49408",
+        "rev": "78125bc681d12364cb65524eaa887354134053d0",
        "type": "github"
      },
      "original": {
@ -206,11 +206,11 @@
    },
    "impermanence": {
      "locked": {
-        "lastModified": 1694622745,
-        "narHash": "sha256-z397+eDhKx9c2qNafL1xv75lC0Q4nOaFlhaU1TINqb8=",
+        "lastModified": 1697303681,
+        "narHash": "sha256-caJ0rXeagaih+xTgRduYtYKL1rZ9ylh06CIrt1w5B4g=",
        "owner": "nix-community",
        "repo": "impermanence",
-        "rev": "e9643d08d0d193a2e074a19d4d90c67a874d932e",
+        "rev": "0f317c2e9e56550ce12323eb39302d251618f5b5",
        "type": "github"
      },
      "original": {
@ -272,11 +272,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1696736548,
-        "narHash": "sha256-Dg0gJ9xVXud55sAbXspMapFYZOpVAldQQo7MFp91Vb0=",
+        "lastModified": 1697340827,
+        "narHash": "sha256-XlrR68N7jyaZ0bs8TPrhqcWG0IPG3pbjrKzJMpYOsos=",
        "owner": "nix-community",
        "repo": "nix-index-database",
-        "rev": "2902dc66f64f733bfb45754e984e958e9fe7faf9",
+        "rev": "29977d0796c058bbcfb2df5b18eb5badf1711007",
        "type": "github"
      },
      "original": {
@ -347,11 +347,11 @@
    },
    "nixpkgs-stable_2": {
      "locked": {
-        "lastModified": 1696717752,
-        "narHash": "sha256-qEq1styCyQHSrw7AOhskH2qwCFx93bOwsGEzUIrZC0g=",
+        "lastModified": 1697332183,
+        "narHash": "sha256-ACYvYsgLETfEI2xM1jjp8ZLVNGGC0onoCGe+69VJGGE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "2f3b6b3fcd9fa0a4e6b544180c058a70890a7cc1",
+        "rev": "0e1cff585c1a85aeab059d3109f66134a8f76935",
        "type": "github"
      },
      "original": {
@ -481,11 +481,11 @@
        "nixpkgs-stable": "nixpkgs-stable_2"
      },
      "locked": {
-        "lastModified": 1697064251,
-        "narHash": "sha256-xxp2sB+4vqB6S6zC/L5J8LlRKgVbgIZOcYl9/TDrEzI=",
+        "lastModified": 1697339241,
+        "narHash": "sha256-ITsFtEtRbCBeEH9XrES1dxZBkE1fyNNUfIyQjQ2AYQs=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "f995ea159252a53b25fa99824f2891e3b479d511",
+        "rev": "51186b8012068c417dac7c31fb12861726577898",
        "type": "github"
      },
      "original": {
--- a/hosts/falkenstein-1/modules/nginx/default.nix
+++ b/hosts/falkenstein-1/modules/nginx/default.nix
@ -1,4 +1,25 @@
 { config, ... }:
+# matrix homeserver discovery
+let
+  matrix_domain = "matrix.${config.networking.domain}";
+  serverConfig = {
+    "m.server" = "${matrix_domain}:443";
+  };
+  clientConfig = {
+    "m.homeserver" = {
+      base_url = "https://${matrix_domain}";
+      # server_name = config.networking.domain;
+    };
+    "org.matrix.msc3575.proxy" = {
+      url = "https://${matrix_domain}";
+    };
+  };
+  mkWellKnown = data: ''
+    add_header Content-Type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON data}';
+  '';
+in
 {
  networking.firewall.allowedTCPPorts = [ 80 443 ];
  services.nginx = {
@ -12,6 +33,8 @@
      enableACME = true;
      forceSSL = true;
      root = "/srv/web/${config.networking.domain}";
+      locations."/.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
+      locations."/.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
    };
  };
  security.acme = {
--- a/hosts/nuc/default.nix
+++ b/hosts/nuc/default.nix
@ -5,10 +5,11 @@
    [
      # Include the results of the hardware scan.
      ./hardware-configuration.nix
-      ./modules/adguard
+      # ./modules/adguard
      ./modules/networks
      ./modules/backup
      ./modules/hydra
+      ./modules/matrix
      ./modules/nextcloud
      ./modules/seafile
      ./modules/uptime-kuma
--- a/hosts/nuc/modules/matrix/default.nix
+++ b/hosts/nuc/modules/matrix/default.nix
@ -0,0 +1,97 @@
+{ config, pkgs, ... }:
+let
+  domain = "matrix.${config.networking.domain}";
+in
+{
+
+  sops.secrets = {
+    "matrix/shared_secret" = {
+      owner = config.systemd.services.matrix-synapse.serviceConfig.User;
+    };
+    "matrix/sync/environment" = {
+      # owner = "matrix-sliding-sync";
+    };
+  };
+
+  services = {
+    postgresql = {
+      enable = true;
+      ensureUsers = [{
+        name = "matrix-synapse";
+      }];
+    };
+
+
+    matrix-synapse = {
+      enable = true;
+      configureRedisLocally = true;
+      extraConfigFiles = [ config.sops.secrets."matrix/shared_secret".path ];
+
+      settings = {
+        server_name = config.networking.domain;
+
+        listeners = [{
+          port = 8008;
+          bind_addresses = [ "::1" ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+          resources = [{
+            names = [ "client" "federation" ];
+            compress = false;
+          }];
+        }];
+      };
+      sliding-sync = {
+        enable = true;
+        settings = {
+          SYNCV3_SERVER = "https://${domain}";
+        };
+        environmentFile = config.sops.secrets."matrix/sync/environment".path;
+      };
+    };
+
+
+    nginx = {
+      recommendedProxySettings = true;
+      virtualHosts = {
+        # synapse
+        "${domain}" = {
+          enableACME = true;
+          forceSSL = true;
+
+
+          # locations."/".extraConfig = "return 404;";
+
+          # # proxy to synapse
+          # locations."/_matrix".proxyPass = "http://[::1]:8008";
+          locations."/".proxyPass = "http://[::1]:8008";
+          locations."~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)".proxyPass = "http://localhost:8009";
+          # locations."/_synapse/client".proxyPass = "http://[::1]:8008";
+        };
+      };
+    };
+  };
+
+  systemd.services.matrix-synapse.after = [ "matrix-synapse-pgsetup.service" ];
+
+  systemd.services.matrix-synapse-pgsetup = {
+    description = "Prepare Synapse postgres database";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "networking.target" "postgresql.service" ];
+    serviceConfig.Type = "oneshot";
+
+    path = [ pkgs.sudo config.services.postgresql.package ];
+
+    # create database for synapse. will silently fail if it already exists
+    script = ''
+      sudo -u ${config.services.postgresql.superUser} psql <<SQL
+        CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+          ENCODING 'UTF8'
+          TEMPLATE template0
+          LC_COLLATE = "C"
+          LC_CTYPE = "C";
+      SQL
+    '';
+  };
+}
--- a/hosts/nuc/modules/networks/default.nix
+++ b/hosts/nuc/modules/networks/default.nix
@ -9,7 +9,7 @@
  services.lldpd.enable = true;
  services.resolved = {
    enable = true;
-    dnssec = "true";
+    # dnssec = "true";
    fallbackDns = [
      "9.9.9.9"
      "149.112.112.112"
@ -17,11 +17,11 @@
      "2620:fe::9"
    ];
    # make room for the adguard dns
-    extraConfig = ''
-      [Resolve]
-      DNS=127.0.0.1
-      DNSStubListener=no
-    '';
+    # extraConfig = ''
+    #   [Resolve]
+    #   DNS=127.0.0.1
+    #   DNSStubListener=no
+    # '';
  };
  systemd.network = {
    enable = true;
--- a/secrets/nuc.yaml
+++ b/secrets/nuc.yaml
@ -3,6 +3,10 @@ store:
    publickey_unencrypted: nuc.lan:a9UkVw3AizAKCER1CfNGhx8UOMF4t4UGE3GJ9dmHwJc=
 nextcloud:
    adminpass: ENC[AES256_GCM,data:lfx7t/ewN23/O0qvSVHrX70W4NygAA0zTA==,iv:Px32DXH8BKQphldeW3CdJjRCXnmMgRx6g0YWZ6ON/pY=,tag:3Effg1hKNNlp+intUEmzxQ==,type:str]
+matrix:
+    shared_secret: ENC[AES256_GCM,data:bX2RC82xNOYnN4cLewLw/t+sN7+1AjwoglmBZitkDyJThBdxM8UA3aa4KiAx4KQmR8d22VXAILank42CtM5Kl5S33mIwCri4wTBq7ZU7mKwjCQi2cMgLuZp3S6g=,iv:s2YKMHa3SZBwwAvFcYBfWnhP5mKlh7QADGabQPjtgTs=,tag:HnYZr8/snufw/RGKM9Bl5Q==,type:str]
+    sync:
+        environment: ENC[AES256_GCM,data:9KXJJmu7ruzndHs0QRZUH4SUBdensMad1BMJ4ztmR2IQkNDT8HxJaFSeGdaNJSo8rpj7NxyOD4MrxHJKe+Jjf2OvmZD0h/vyhURX0TZIRg==,iv:CdR+KzvqzdpcqBLNYSWmATFXrbgYw3Z8ZsC3L/E8+Ig=,tag:9iiL8BYPZ7sJeBbcUnkAqQ==,type:str]
 vaultwarden:
    env: ENC[AES256_GCM,data:LZ/geI1sqA6BgFqSYNpDlNm9tn0GVKyHcbsJJoWDs89MUjEgrk7QBK1VighKQkmW+4xJqqruLfDkrNMmsSQdyWXNISawuw==,iv:ukh3ggqJ1R8DqQQDad86QoKbpHBG5mTBx7oKWbgnrZg=,tag:PlYKW5jtYVCrjAWideG1Dg==,type:str]
 borg:
@ -23,8 +27,8 @@ sops:
            V3l5WVZhL1dVMUxoV1NYdFhVaElYUU0KtYzj7r6+/j2Sqo7AiVdPPKBqsFBiefpj
            4nOJD81tJYMqh7deydKFB1kEYOX4HJ9HfQURzcdbhgWbUv6xys2eyg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-30T12:14:46Z"
-    mac: ENC[AES256_GCM,data:iD3xYcLD88+2wyNB4mE786FZUEgf10V/gnKCt8PNrpJp2W6f4URzCRUqOZU7G+m88sW/PN7sMEdNOvwJBZCirP4gmzTGuZ5oGjPVKNEiBe6hVSsqGY5D0528GIxqB/wxUhsByYybetGmrKeB8P1WXr/4iyIKwDUygJ8IkeokIC8=,iv:qMl+Jum8LbtdGi5uA9C+IMX2kv4bVCPoj1F0a++4ZHA=,tag:6A+OIA6jiFxEOePOw+M6RQ==,type:str]
+    lastmodified: "2023-10-17T07:53:01Z"
+    mac: ENC[AES256_GCM,data:GXCw/3DxrOXrxnORd/5d5eG8Gp9Ds0x9BKzgSpwARWpZosj0zXA2yXAax42MSM3Yom3DwC+sWp1Gi9Gbj6db+8dGUhs6bADtukVD3l09f0/U49CKtCuut/u6uFhz6QWTmY24sVbGWXFx/SF8TFopmDkgcelJHBA191exbCCAglo=,iv:Oztg9GbA0cnUMF5vHrk/+Ha1rRH6qKaB4nQNN0hlpJw=,tag:jlfFY+zMa4Gv/SvICq128A==,type:str]
    pgp:
        - created_at: "2023-06-12T13:53:20Z"
          enc: |-
@ -47,4 +51,4 @@ sops:
            -----END PGP MESSAGE-----
          fp: 116987A8DD3F78FF8601BF4DB95E8FE6B11C4D09
    unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.0
--- a/users/rouven/modules/packages.nix
+++ b/users/rouven/modules/packages.nix
@ -82,6 +82,9 @@ in
    gcc
    nodejs_20

+    # tools
+    postman
+
    # libs
    libyubikey
    libfido2