93 lines
2.7 KiB
Nix
93 lines
2.7 KiB
Nix
# Portions of this file are sourced from
|
|
# https://github.com/NickCao/flakes/blob/3b03efb676ea602575c916b2b8bc9d9cd13b0d85/nixos/hcloud/hio0/matrix.nix
|
|
# https://github.com/linyinfeng/dotfiles/blob/b618b0fd16fb9c79ab7199ed51c4c0f98a392cea/nixos/profiles/services/matrix/default.nix
|
|
{ config, ... }:
|
|
{
|
|
sops.secrets."synapse/signing-key" = {
|
|
sopsFile = config.sops.secretFiles.host;
|
|
owner = config.systemd.services.matrix-synapse.serviceConfig.User;
|
|
};
|
|
|
|
sops.secrets."synapse/oidc-client-secret" = {
|
|
sopsFile = config.sops.secretFiles.host;
|
|
owner = config.systemd.services.matrix-synapse.serviceConfig.User;
|
|
};
|
|
|
|
services.matrix-synapse = {
|
|
enable = true;
|
|
withJemalloc = true;
|
|
settings = {
|
|
server_name = "rebmit.moe";
|
|
public_baseurl = "https://chat.rebmit.moe";
|
|
|
|
dynamic_thumbnails = true;
|
|
enable_registration = true;
|
|
registration_requires_token = true;
|
|
|
|
signing_key_path = config.sops.secrets."synapse/signing-key".path;
|
|
|
|
listeners = [
|
|
{
|
|
bind_addresses = [ "127.0.0.1" ];
|
|
port = config.networking.ports.matrix-synapse;
|
|
tls = false;
|
|
type = "http";
|
|
x_forwarded = true;
|
|
resources = [
|
|
{
|
|
compress = true;
|
|
names = [
|
|
"client"
|
|
"federation"
|
|
];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
oidc_providers = [
|
|
{
|
|
idp_id = "keycloak";
|
|
idp_name = "idp.rebmit.moe";
|
|
issuer = "https://idp.rebmit.moe/realms/rebmit";
|
|
client_id = "synapse";
|
|
client_secret_path = config.sops.secrets."synapse/oidc-client-secret".path;
|
|
scopes = [
|
|
"openid"
|
|
"profile"
|
|
];
|
|
allow_existing_users = true;
|
|
backchannel_logout_enabled = true;
|
|
user_mapping_provider.config = {
|
|
confirm_localpart = true;
|
|
localpart_template = "{{ user.preferred_username }}";
|
|
display_name_template = "{{ user.name }}";
|
|
};
|
|
}
|
|
];
|
|
|
|
media_retention = {
|
|
remote_media_lifetime = "14d";
|
|
};
|
|
};
|
|
};
|
|
|
|
services.caddy.virtualHosts."chat.rebmit.moe" = {
|
|
extraConfig = ''
|
|
reverse_proxy /_matrix/* 127.0.0.1:${toString config.networking.ports.matrix-synapse}
|
|
reverse_proxy /_synapse/* 127.0.0.1:${toString config.networking.ports.matrix-synapse}
|
|
'';
|
|
};
|
|
|
|
preservation.preserveAt."/persist".directories = [
|
|
{
|
|
directory = "/var/lib/matrix-synapse";
|
|
mode = "0700";
|
|
user = config.systemd.services.matrix-synapse.serviceConfig.User;
|
|
group = config.systemd.services.matrix-synapse.serviceConfig.Group;
|
|
}
|
|
];
|
|
|
|
services.restic.backups.b2.paths = [ "/persist/var/lib/matrix-synapse" ];
|
|
}
|