rebmit/nixos-config
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

services/matrix-synapse: init

Browse source
This commit is contained in:
Lu Wang 2024-12-18 16:36:47 +08:00
parent 68961dc077
commit f3ea502179
Signed by: rebmit
SSH key fingerprint: SHA256:3px8QV1zEerIrEWHaqtH5rR9kjetyRST5EipOPrd+bU
5 changed files with 145 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
nixos/hosts/suwako-vie0/default.nix
View file

@ -11,6 +11,7 @@
services.caddy
services.keycloak
services.knot.secondary
services.matrix-synapse
services.miniflux
services.ntfy
services.postgresql

1
nixos/modules/networking/ports.nix
View file

@ -19,6 +19,7 @@ in
ntfy = 4000;
keycloak = 4010;
miniflux = 4020;
matrix-synapse = 4030;
# public ports
enthalpy-ipsec = 13000;

110
nixos/profiles/services/matrix-synapse/default.nix Normal file
View file

@ -0,0 +1,110 @@
# Portions of this file are sourced from
# https://github.com/NickCao/flakes/blob/3b03efb676ea602575c916b2b8bc9d9cd13b0d85/nixos/hcloud/hio0/matrix.nix
# https://github.com/linyinfeng/dotfiles/blob/b618b0fd16fb9c79ab7199ed51c4c0f98a392cea/nixos/profiles/services/matrix/default.nix
{ config, pkgs, ... }:
{
sops.secrets."synapse/signing-key" = {
sopsFile = config.sops.secretFiles.get "hosts/suwako-vie0.yaml";
owner = config.systemd.services.matrix-synapse.serviceConfig.User;
};
sops.secrets."synapse/oidc-client-secret" = {
sopsFile = config.sops.secretFiles.get "hosts/suwako-vie0.yaml";
owner = config.systemd.services.matrix-synapse.serviceConfig.User;
};
services.matrix-synapse = {
enable = true;
withJemalloc = true;
settings = {
server_name = "rebmit.moe";
public_baseurl = "https://matrix.rebmit.moe";
dynamic_thumbnails = true;
enable_registration = true;
registration_requires_token = true;
signing_key_path = config.sops.secrets."synapse/signing-key".path;
listeners = [
{
bind_addresses = [ "127.0.0.1" ];
port = config.networking.ports.matrix-synapse;
tls = false;
type = "http";
x_forwarded = true;
resources = [
{
compress = true;
names = [
"client"
"federation"
];
}
];
}
];
oidc_providers = [
{
idp_id = "keycloak";
idp_name = "keycloak.rebmit.moe";
issuer = "https://keycloak.rebmit.moe/realms/rebmit";
client_id = "synapse";
client_secret_path = config.sops.secrets."synapse/oidc-client-secret".path;
scopes = [
"openid"
"profile"
];
allow_existing_users = true;
backchannel_logout_enabled = true;
user_mapping_provider.config = {
confirm_localpart = true;
localpart_template = "{{ user.preferred_username }}";
display_name_template = "{{ user.name }}";
};
}
];
media_retention = {
remote_media_lifetime = "14d";
};
};
};
services.caddy.virtualHosts."matrix.rebmit.moe" = {
extraConfig = ''
reverse_proxy /_matrix/* 127.0.0.1:${toString config.networking.ports.matrix-synapse}
reverse_proxy /_synapse/* 127.0.0.1:${toString config.networking.ports.matrix-synapse}
header {
X-Frame-Options SAMEORIGIN
X-Content-Type-Options nosniff
X-XSS-Protection "1; mode=block"
Content-Security-Policy "frame-ancestors 'self'"
}
file_server
root * "${
pkgs.element-web.override {
conf = {
default_server_config = {
"m.homeserver" = {
base_url = config.services.matrix-synapse.settings.public_baseurl;
server_name = config.services.matrix-synapse.settings.server_name;
};
};
show_labs_settings = true;
};
}
}"
'';
};
services.caddy.virtualHosts."synapse-admin.rebmit.moe" = {
extraConfig = ''
file_server
root * "${pkgs.synapse-admin}"
'';
};
}

32
secrets/hosts/suwako-vie0.yaml Normal file
View file

@ -0,0 +1,32 @@
synapse:
signing-key: ENC[AES256_GCM,data:yFxwWDpdQvHetThkK02a/GN3lcw4GNb7BItutO5zisKptG6qB+BdWwHB34oK81J5Rbt3MGLwMwVpa0w=,iv:pQMDF4wSyzLvlRj3jMVbjyx16G76gj7e2ZvEHTB2VUU=,tag:dl1Onm5LNzH2aHZNfnRPbg==,type:str]
oidc-client-secret: ENC[AES256_GCM,data:1zUxCuFyTWFvcu7W0dJ70RKyPWW0WY9fJwlaQkYRzok=,iv:8+3w1kz81CfTvzYv8thd/EaEUn2A/OdL8Uw4n0o69tE=,tag:qGTZodnQwOsI/cyXK6X09Q==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1sfnct03u4cvfj98x4yjrcrrnu5gg8qgxrwk4uqq8w4e6wveeaedq97rn44
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUOHhiRE9Mc3BEblpUbWtq
SDhmbm9OblhhRS84NE9JM3hNOHA3WUVRV2lRClRMUW9kUlB2THc0aHZDb1FDTWtq
SkJIT1dLUkpBTkNreGhKMDJBSGQ2WHMKLS0tIEpqQnFZVW9uT3dFczFnVHFpTkpV
VTlSdEh3VklQZENHcVIxdEdnNjdYejQK2DbiOlJQLUW4cmtMlZbKObCFafPPv8hn
J59qSri05wvns83jXm52gGIRBCOIjZfQUr1kXFKWUotvGlaW9Gb11g==
-----END AGE ENCRYPTED FILE-----
- recipient: age1p9xzkzc3zxasgxtd75html0pvrtd6fzvmhz6n388vtjg36d3zffsvma0j0
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxb2RvTEU2Wk0xUVRvWVA3
TytqSUJ6aUhEWEE0S3dTV3N4ZFlid3hIRGhBCktpemZIQ2R2ZUN4U1FrVThFZ2ZH
YVJla3JzMjV1KzhEQk1kT2Y1am0veGMKLS0tIG1kVVVhYjY0L3FJTk9wRU1lVFE2
ZjQyOG1ZVDVnTGxBNWR0RGs3d082aGsKqqIdYDPsnvCa5+YFWCqdwAi5vgWuMazv
sZF1K96MHFgxgqgGonu2wZN3uj2mGttDRC8ZZmMPEftY1na6VLl40A==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-12-18T07:21:22Z"
mac: ENC[AES256_GCM,data:TTOlCeSubkpp4CEI+sJ9k0yMoozeSSTWdWPMmRiTGpMNPLI4E9cA0jsTqcHZt06AIFNCRLnRVz9Vjq3oSUbImR/DKb/Ox7u0CVguIpMJW40aU9Jw3whSwehY8EageUqBHgPhuB1GTUF8nTx2WBxpkd9A70foPuvVy4UHqtIrH+I=,iv:uwkl3jbk9jSQQdhPV2CS1BkHfyIcR1SKDpoXsp2xLBI=,tag:wpFL4ir9bs2mNe3TFYY9nQ==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.1

1
zones/rebmit.moe.nix
View file

@ -25,5 +25,6 @@ dns.lib.toString "rebmit.moe" {
matrix.CNAME = [ "suwako-vie0.rebmit.link." ];
miniflux.CNAME = [ "suwako-vie0.rebmit.link." ];
ntfy.CNAME = [ "suwako-vie0.rebmit.link." ];
synapse-admin.CNAME = [ "suwako-vie0.rebmit.link." ];
};
}