feat(modules/matrix-homeserver)!: dendrite -> synapse

1 files changed, 90 insertions, 126 deletions

diff --git a/modules/services/matrix-homeserver.nix b/modules/services/matrix-homeserver.nix
index 6af8f7f..6089b12 100644
--- a/modules/services/matrix-homeserver.nix
+++ b/modules/services/matrix-homeserver.nix
@@ -1,15 +1,12 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 with lib;
 let
   cfg = config.modules.services.matrix-homeserver;
 
-  database = {
-    connection_string = "postgres:///dendrite?host=/run/postgresql";
-    max_open_conns = 100;
-    max_idle_conns = 5;
-    conn_max_lifetime = -1;
-  };
+  httpPort = 8008;
+  slidingSyncPort = 8009;
+  metricsPort = 8010;
 in
 {
   imports = [
@@ -28,148 +25,116 @@ in
     };
     secrets = {
       matrix-server-key = mkOption { type = types.str; description = "path to the server key"; };
+      matrix-shared-secret = mkOption { type = types.str; description = "path to the registration shared secret"; };
       dendrite-envs = mkOption { type = types.nullOr types.str; description = "path for the environment file to source"; };
+      extra-config-path = mkOption { type = types.nullOr types.str; description = "path to the extra configuration file to source"; };
       sliding-sync-secret = mkOption { type = types.nullOr types.str; description = "path to the sliding sync secret"; };
     };
   };
 
   config = mkIf cfg.enable {
-    # Adapted from Mic92/dotfiles, (C) 2021 Jörg Thalheim (MIT)
-    services.dendrite = {
+    services.matrix-synapse = {
       enable = true;
+      withJemalloc = true;
+      dataDir = "/var/lib/matrix-synapse";
       settings = {
-        global = {
-          server_name = cfg.domain;
-          # `private_key` has the type `path`
-          # prefix a `/` to make `path` happy
-          private_key = "/$CREDENTIALS_DIRECTORY/matrix-server-key";
-          jetstream.storage_path = "/var/lib/dendrite/jetstream";
-          trusted_third_party_id_servers = [
-            "matrix.org"
-            "vector.im"
-          ];
-          metrics.enabled = true;
+        server_name = cfg.domain;
+        public_baseurl = "https://${cfg.realHost}";
+
+        signing_key_path = cfg.secrets.matrix-server-key;
+
+        allow_guest_access = false;
+        enable_registration = false;
+        # registration_requires_token = true;
+        registration_shared_secret_path = cfg.secrets.matrix-shared-secret;
+
+        enable_metrics = true;
+        url_preview_enabled = true;
+
+        database = {
+          name = "psycopg2";
+          args.password = "synapse";
         };
-        logging = [
+
+        listeners = [
+          {
+            port = httpPort;
+            resources = [
+              {
+                compress = true;
+                names = [ "client" ];
+              }
+              {
+                compress = false;
+                names = [ "federation" ];
+              }
+            ];
+            type = "http";
+            tls = false;
+            x_forwarded = true;
+          }
           {
-            type = "std";
-            level = "info"; # "warn" on public release
+            port = metricsPort;
+            resources = [{
+              compress = false;
+              names = [ "metrics" ];
+            }];
+            type = "metrics";
+            tls = false;
           }
         ];
-        app_service_api = {
-          inherit database;
-          config_files = [ ];
-        };
-        client_api = {
-          registration_disabled = true;
-          rate_limiting.enabled = false;
-          rate_limiting.exempt_user_ids = [
-            "@abuse:${cfg.domain}"
-          ];
-          # registration_shared_secret = ""; # Initially set this option to configure the admin user.
-        } // optionalAttrs cfg.turn.enable {
-          turn = {
-            turn_user_lifetime = "24h";
-            turn_uris = [
-              "turns:${cfg.turn.domain}?transport=udp"
-              "turns:${cfg.turn.domain}?transport=tcp"
-              "turn:${cfg.turn.domain}?transport=udp"
-              "turn:${cfg.turn.domain}?transport=tcp"
-            ];
-            turn_shared_secret = cfg.turn.shared_secret;
+
+        trusted_key_servers = [{
+          server_name = "matrix.org";
+          verify_keys = {
+            "ed25519:auto" = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
           };
+        }];
+        # Yes, we want to use matrix.org as our trusted key server
+        suppress_key_server_warning = true;
+      } // optionalAttrs (cfg.turn.enable) {
+        turn_uris = [
+          "turns:${cfg.turn.domain}?transport=udp"
+          "turns:${cfg.turn.domain}?transport=tcp"
+          "turn:${cfg.turn.domain}?transport=udp"
+          "turn:${cfg.turn.domain}?transport=tcp"
+        ];
+      };
+
+      sliding-sync = {
+        enable = true;
+        createDatabase = true;
+        settings = {
+          SYNCV3_SERVER = "https://${cfg.realHost}";
+          SYNCV3_BINDADDR = "[::1]:${toString slidingSyncPort}";
         };
-        media_api = {
-          inherit database;
-          dynamic_thumbnails = true;
-        };
-        room_server = {
-          inherit database;
-        };
-        push_server = {
-          inherit database;
-        };
-        mscs = {
-          inherit database;
-          mscs = [ "msc2836" "msc2946" ];
-        };
-        sync_api = {
-          inherit database;
-          real_ip_header = "X-Real-IP";
-          # The NixOS option is 'enable', which doesn't exist in Dendrite.
-          search.enabled = true;
-        };
-        key_server = {
-          inherit database;
-        };
-        federation_api = {
-          inherit database;
-          key_perspectives = [
-            {
-              server_name = "matrix.org";
-              keys = [
-                {
-                  key_id = "ed25519:auto";
-                  public_key = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";
-                }
-                {
-                  key_id = "ed25519:a_RXGa";
-                  public_key = "l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ";
-                }
-              ];
-            }
-          ];
-          prefer_direct_fetch = false;
-        };
-        user_api = {
-          account_database = database;
-          device_database = database;
-        };
+        environmentFile = cfg.secrets.sliding-sync-secret;
       };
-      loadCredential = [ "matrix-server-key:${cfg.secrets.matrix-server-key}" ];
-    } // optionalAttrs (cfg.secrets.dendrite-envs != null) {
-      environmentFile = cfg.secrets.dendrite-envs;
     };
-
+    ###################################### SYNAPSE END ##############################
+    # Adapted from Mic92/dotfiles, (C) 2021 Jörg Thalheim (MIT)
     services.prometheus.scrapeConfigs = [
       {
-        job_name = "dendrite";
+        job_name = "synapse";
+        metrics_path = "/_synapse/metrics";
         static_configs = [{
-          targets = [ "127.0.0.1:${toString config.services.dendrite.httpPort}" ];
+          targets = [ "127.0.0.1:${toString metricsPort}" ];
         }];
       }
     ];
 
-    systemd.services.dendrite = {
-      after = [ "postgresql.service" ];
-    };
-
     environment.persistence."/persist".directories = [
-      "/var/lib/private/dendrite"
+      "/var/lib/matrix-synapse"
     ];
 
-    services.sliding-sync = {
-      enable = true;
-      server = "https://${cfg.realHost}";
-      bindAddr = "[::1]:8009";
-      db = "postgres:///syncv3?host=/run/postgresql";
-      secret = cfg.secrets.sliding-sync-secret;
-      after = [ "dendrite.service" ];
-    };
-
     services.postgresql.enable = true;
-    services.postgresql.ensureDatabases = [ "dendrite" "syncv3" ];
-    services.postgresql.ensureUsers = [
-      {
-        name = "dendrite";
-        ensurePermissions."DATABASE dendrite" = "ALL PRIVILEGES";
-      }
-      {
-        name = "sliding-sync";
-        ensurePermissions."DATABASE syncv3" = "ALL PRIVILEGES";
-      }
-    ];
-
+    services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
+      CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
+      CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+       TEMPLATE template0
+       LC_COLLATE = "C"
+       LC_CTYPE = "C";
+    '';
     services.nginx.virtualHosts.${cfg.realHost} = {
       forceSSL = true;
       useACMEHost = cfg.domain;
@@ -186,9 +151,8 @@ in
         proxy_read_timeout 600;
         client_max_body_size 50M;
       '';
-      locations."/_matrix".proxyPass = "http://[::1]:${toString config.services.dendrite.httpPort}";
-      locations."/_dendrite".proxyPass = "http://[::1]:${toString config.services.dendrite.httpPort}";
-      locations."/_synapse".proxyPass = "http://[::1]:${toString config.services.dendrite.httpPort}";
+      locations."/_matrix".proxyPass = "http://[::1]:${toString httpPort}";
+      locations."/_synapse".proxyPass = "http://[::1]:${toString httpPort}";
     };
 
     services.nginx.virtualHosts.${cfg.domain} =
@@ -223,7 +187,7 @@ in
     services.nginx.virtualHosts.${cfg.slidingSyncHost} = {
       forceSSL = true;
       useACMEHost = cfg.domain;
-      locations."/".proxyPass = "http://${config.services.sliding-sync.bindAddr}";
+      locations."/".proxyPass = "http://${config.services.matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}";
     };
 
     networking.firewall.allowedTCPPorts = [ 443 8448 ];