116 lines
2.9 KiB
Nix
116 lines
2.9 KiB
Nix
# Portions of this file are sourced from
|
|
# https://github.com/NickCao/flakes/blob/3b03efb676ea602575c916b2b8bc9d9cd13b0d85/nixos/hcloud/hio0/matrix.nix
|
|
{
|
|
config,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
conf = {
|
|
default_server_config = {
|
|
"m.homeserver" = {
|
|
base_url = config.services.matrix-synapse.settings.public_baseurl;
|
|
server_name = config.services.matrix-synapse.settings.server_name;
|
|
};
|
|
};
|
|
show_labs_settings = true;
|
|
};
|
|
in
|
|
{
|
|
services.postgresql = {
|
|
enable = true;
|
|
package = pkgs.postgresql_16;
|
|
};
|
|
|
|
services.postgresqlBackup = {
|
|
enable = true;
|
|
location = "/var/lib/backup/postgresql";
|
|
backupAll = true;
|
|
compression = "zstd";
|
|
};
|
|
|
|
sops.secrets."synapse/signing-key" = {
|
|
sopsFile = config.sops.secretFiles.get "hosts/reisen-lax0.yaml";
|
|
};
|
|
|
|
sops.secrets."synapse/mautrix-telegram" = {
|
|
sopsFile = config.sops.secretFiles.get "hosts/reisen-lax0.yaml";
|
|
};
|
|
|
|
systemd.services.matrix-synapse.serviceConfig.LoadCredential = [
|
|
"telegram:/var/lib/mautrix-telegram/telegram-registration.yaml"
|
|
"irc:/var/lib/heisenbridge/registration.yml"
|
|
];
|
|
|
|
services.matrix-synapse = {
|
|
enable = false;
|
|
withJemalloc = true;
|
|
settings = {
|
|
server_name = "rebmit.moe";
|
|
public_baseurl = "https://matrix.rebmit.moe";
|
|
signing_key_path = config.sops.secrets."synapse/signing-key".path;
|
|
|
|
app_service_config_files = [
|
|
"/run/credentials/matrix-synapse.service/telegram"
|
|
"/run/credentials/matrix-synapse.service/irc"
|
|
];
|
|
|
|
enable_registration = true;
|
|
registration_requires_token = true;
|
|
|
|
listeners = [
|
|
{
|
|
bind_addresses = [ "127.0.0.1" ];
|
|
port = 8196;
|
|
tls = false;
|
|
type = "http";
|
|
x_forwarded = true;
|
|
resources = [
|
|
{
|
|
compress = true;
|
|
names = [
|
|
"client"
|
|
"federation"
|
|
];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
media_retention = {
|
|
remote_media_lifetime = "14d";
|
|
};
|
|
|
|
experimental_features = {
|
|
# Room summary api
|
|
msc3266_enabled = true;
|
|
# Removing account data
|
|
msc3391_enabled = true;
|
|
# Thread notifications
|
|
msc3773_enabled = true;
|
|
# Remotely toggle push notifications for another client
|
|
msc3881_enabled = true;
|
|
# Remotely silence local notifications
|
|
msc3890_enabled = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
services.caddy = {
|
|
virtualHosts."matrix.rebmit.moe".extraConfig = ''
|
|
reverse_proxy /_matrix/* 127.0.0.1:8196
|
|
reverse_proxy /_synapse/* 127.0.0.1:8196
|
|
|
|
header {
|
|
X-Frame-Options SAMEORIGIN
|
|
X-Content-Type-Options nosniff
|
|
X-XSS-Protection "1; mode=block"
|
|
Content-Security-Policy "frame-ancestors 'self'"
|
|
}
|
|
|
|
file_server
|
|
root * "${pkgs.element-web.override { inherit conf; }}"
|
|
'';
|
|
};
|
|
}
|