matrix: move into folder

modules/matrix/default.nix

@@ -0,0 +1,147 @@
+{ config, pkgs, ... }:
+let
+  domainServer = "matrix.${config.networking.domain}";
+  domainClient = "chat.${config.networking.domain}";
+
+  clientConfig = {
+    "m.homeserver" = {
+      base_url = "https://${domainServer}:443";
+      server_name = domainServer;
+    };
+  };
+  serverConfig = {
+    "m.server" = "${domainServer}:443";
+  };
+
+  mkWellKnown = data: ''
+    add_header Content-Type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON data}';
+  '';
+
+  matrix-synapse-ldap3 = config.services.matrix-synapse.package.plugins.matrix-synapse-ldap3;
+in
+{
+  imports = [ ./mautrix-telegram.nix ];
+  sops.secrets.matrix_ldap_search = {
+    key = "portunus/search-password";
+    owner = config.systemd.services.matrix-synapse.serviceConfig.User;
+  };
+
+  services = {
+    postgresql = {
+      enable = true;
+      ensureUsers = [{
+        name = "matrix-synapse";
+      }];
+    };
+
+    nginx = {
+      recommendedProxySettings = true;
+      virtualHosts = {
+        # synapse
+        "${domainServer}" = {
+          enableACME = true;
+          forceSSL = true;
+
+          # homeserver discovery
+          locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
+          locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
+
+          # 404 on /
+          locations."/".extraConfig = "return 404;";
+
+          # proxy to synapse
+          locations."/_matrix".proxyPass = "http://[::1]:8008";
+          locations."/_synapse/client".proxyPass = "http://[::1]:8008";
+        };
+
+        # element
+        "${domainClient}" = {
+          enableACME = true;
+          forceSSL = true;
+
+          root = pkgs.element-web.override {
+            conf = {
+              default_server_config = {
+                inherit (clientConfig) "m.homeserver";
+                "m.identity_server".base_url = "";
+              };
+              disable_3pid_login = true;
+            };
+          };
+        };
+      };
+    };
+
+    matrix-synapse = {
+      enable = true;
+
+      plugins = [ matrix-synapse-ldap3 ];
+
+
+      log = {
+        root.level = "WARNING";
+      };
+      settings = {
+        server_name = domainServer;
+
+        listeners = [{
+          port = 8008;
+          bind_addresses = [ "::1" ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+          resources = [{
+            names = [ "client" "federation" ];
+            compress = false;
+          }];
+        }];
+      };
+
+      extraConfigFiles = [
+        (pkgs.writeTextFile {
+          name = "matrix-synapse-extra-config.yml";
+          text = let portunus = config.services.portunus; in
+            ''
+              modules:
+                - module: ldap_auth_provider.LdapAuthProviderModule
+                  config:
+                    enabled: true
+                    uri: ldap://localhost
+                    base: ou=users,${portunus.ldap.suffix}
+                    # taken from kaki config
+                    attributes:
+                      uid: uid
+                      mail: uid
+                      name: cn
+                    bind_dn: uid=search,ou=users,${portunus.ldap.suffix}
+                    bind_password_file: ${config.sops.secrets.matrix_ldap_search.path}
+            '';
+        })
+      ];
+    };
+  };
+
+  systemd.services.matrix-synapse.after = [ "matrix-synapse-pgsetup.service" ];
+
+  systemd.services.matrix-synapse-pgsetup = {
+    description = "Prepare Synapse postgres database";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "networking.target" "postgresql.service" ];
+    serviceConfig.Type = "oneshot";
+
+    path = [ pkgs.sudo config.services.postgresql.package ];
+
+    # create database for synapse. will silently fail if it already exists
+    script = ''
+      sudo -u ${config.services.postgresql.superUser} psql <<SQL
+        CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+          ENCODING 'UTF8'
+          TEMPLATE template0
+          LC_COLLATE = "C"
+          LC_CTYPE = "C";
+      SQL
+    '';
+  };
+}

modules/matrix/mautrix-telegram.nix

@@ -0,0 +1,70 @@
+{ config, lib, pkgs, ... }:
+let
+  homeserverDomain = config.services.matrix-synapse.settings.server_name;
+  registrationFileSynapse = "/var/lib/matrix-synapse/telegram-registration.yaml";
+  registrationFileMautrix = "/var/lib/mautrix-telegram/telegram-registration.yaml";
+  settingsFile = builtins.head (builtins.match ".*--config='(.*)' \\\\.*" config.systemd.services.mautrix-telegram.preStart);
+in
+{
+  services.postgresql = {
+    enable = true;
+    ensureUsers = [{
+      name = "mautrix-telegram";
+      ensureDBOwnership = true;
+    }];
+    ensureDatabases = [ "mautrix-telegram" ];
+  };
+
+  sops.secrets.mautrix-telegram_env = { };
+
+  services.matrix-synapse.settings.app_service_config_files = [
+    # The registration file is automatically generated after starting the
+    # appservice for the first time.
+    registrationFileSynapse
+  ];
+
+  systemd.tmpfiles.rules = [
+    # copy registration file over to synapse
+    "C ${registrationFileSynapse} - - - - ${registrationFileMautrix}"
+    "Z /var/lib/matrix-synapse/ - matrix-synapse matrix-synapse - -"
+  ];
+
+  services.mautrix-telegram = {
+    enable = true;
+
+    environmentFile = config.sops.secrets.mautrix-telegram_env.path;
+
+    settings = {
+      homeserver = {
+        address = "http://[::1]:8008";
+        domain = homeserverDomain;
+      };
+
+      appservice = rec {
+        # Use postgresql instead of sqlite
+        database = "postgresql:///mautrix-telegram?host=/run/postgresql";
+        port = 8082;
+        address = "http://localhost:${toString port}";
+      };
+
+      bridge = {
+        relaybot.authless_portals = false;
+        permissions = {
+          # Add yourself here temporarily
+          "@admin:${homeserverDomain}" = "admin";
+        };
+        relay_user_distinguishers = [ ];
+      };
+    };
+  };
+
+  # If we don't explicitly set {a,h}s_token, mautrix-telegram will try to read them from the registrationFile
+  # and write them to the settingsFile in /nix/store, which obviously fails.
+  systemd.services.mautrix-telegram.serviceConfig.ExecStart =
+    lib.mkForce (pkgs.writeShellScript "start" ''
+      export MAUTRIX_TELEGRAM_APPSERVICE_AS_TOKEN=$(grep as_token ${registrationFileMautrix} | cut -d' ' -f2-)
+      export MAUTRIX_TELEGRAM_APPSERVICE_HS_TOKEN=$(grep hs_token ${registrationFileMautrix} | cut -d' ' -f2-)
+
+      ${pkgs.mautrix-telegram}/bin/mautrix-telegram --config='${settingsFile}'
+    '');
+}