diff options
| -rw-r--r-- | modules/services/matrix-homeserver.nix | 216 | ||||
| -rw-r--r-- | systems/cobalt/default.nix | 6 | ||||
| -rw-r--r-- | systems/cobalt/secrets/secrets.yaml | 13 |
3 files changed, 103 insertions, 132 deletions
diff --git a/modules/services/matrix-homeserver.nix b/modules/services/matrix-homeserver.nix index 6af8f7f..6089b12 100644 --- a/modules/services/matrix-homeserver.nix +++ b/modules/services/matrix-homeserver.nix @@ -1,15 +1,12 @@ -{ config, lib, ... }: +{ config, lib, pkgs, ... }: with lib; let cfg = config.modules.services.matrix-homeserver; - database = { - connection_string = "postgres:///dendrite?host=/run/postgresql"; - max_open_conns = 100; - max_idle_conns = 5; - conn_max_lifetime = -1; - }; + httpPort = 8008; + slidingSyncPort = 8009; + metricsPort = 8010; in { imports = [ @@ -28,148 +25,116 @@ in }; secrets = { matrix-server-key = mkOption { type = types.str; description = "path to the server key"; }; + matrix-shared-secret = mkOption { type = types.str; description = "path to the registration shared secret"; }; dendrite-envs = mkOption { type = types.nullOr types.str; description = "path for the environment file to source"; }; + extra-config-path = mkOption { type = types.nullOr types.str; description = "path to the extra configuration file to source"; }; sliding-sync-secret = mkOption { type = types.nullOr types.str; description = "path to the sliding sync secret"; }; }; }; config = mkIf cfg.enable { - # Adapted from Mic92/dotfiles, (C) 2021 Jörg Thalheim (MIT) - services.dendrite = { + services.matrix-synapse = { enable = true; + withJemalloc = true; + dataDir = "/var/lib/matrix-synapse"; settings = { - global = { - server_name = cfg.domain; - # `private_key` has the type `path` - # prefix a `/` to make `path` happy - private_key = "/$CREDENTIALS_DIRECTORY/matrix-server-key"; - jetstream.storage_path = "/var/lib/dendrite/jetstream"; - trusted_third_party_id_servers = [ - "matrix.org" - "vector.im" - ]; - metrics.enabled = true; + server_name = cfg.domain; + public_baseurl = "https://${cfg.realHost}"; + + signing_key_path = cfg.secrets.matrix-server-key; + + allow_guest_access = false; + enable_registration = false; + # registration_requires_token = true; + registration_shared_secret_path = cfg.secrets.matrix-shared-secret; + + enable_metrics = true; + url_preview_enabled = true; + + database = { + name = "psycopg2"; + args.password = "synapse"; }; - logging = [ + + listeners = [ + { + port = httpPort; + resources = [ + { + compress = true; + names = [ "client" ]; + } + { + compress = false; + names = [ "federation" ]; + } + ]; + type = "http"; + tls = false; + x_forwarded = true; + } { - type = "std"; - level = "info"; # "warn" on public release + port = metricsPort; + resources = [{ + compress = false; + names = [ "metrics" ]; + }]; + type = "metrics"; + tls = false; } ]; - app_service_api = { - inherit database; - config_files = [ ]; - }; - client_api = { - registration_disabled = true; - rate_limiting.enabled = false; - rate_limiting.exempt_user_ids = [ - "@abuse:${cfg.domain}" - ]; - # registration_shared_secret = ""; # Initially set this option to configure the admin user. - } // optionalAttrs cfg.turn.enable { - turn = { - turn_user_lifetime = "24h"; - turn_uris = [ - "turns:${cfg.turn.domain}?transport=udp" - "turns:${cfg.turn.domain}?transport=tcp" - "turn:${cfg.turn.domain}?transport=udp" - "turn:${cfg.turn.domain}?transport=tcp" - ]; - turn_shared_secret = cfg.turn.shared_secret; + + trusted_key_servers = [{ + server_name = "matrix.org"; + verify_keys = { + "ed25519:auto" = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw"; }; + }]; + # Yes, we want to use matrix.org as our trusted key server + suppress_key_server_warning = true; + } // optionalAttrs (cfg.turn.enable) { + turn_uris = [ + "turns:${cfg.turn.domain}?transport=udp" + "turns:${cfg.turn.domain}?transport=tcp" + "turn:${cfg.turn.domain}?transport=udp" + "turn:${cfg.turn.domain}?transport=tcp" + ]; + }; + + sliding-sync = { + enable = true; + createDatabase = true; + settings = { + SYNCV3_SERVER = "https://${cfg.realHost}"; + SYNCV3_BINDADDR = "[::1]:${toString slidingSyncPort}"; }; - media_api = { - inherit database; - dynamic_thumbnails = true; - }; - room_server = { - inherit database; - }; - push_server = { - inherit database; - }; - mscs = { - inherit database; - mscs = [ "msc2836" "msc2946" ]; - }; - sync_api = { - inherit database; - real_ip_header = "X-Real-IP"; - # The NixOS option is 'enable', which doesn't exist in Dendrite. - search.enabled = true; - }; - key_server = { - inherit database; - }; - federation_api = { - inherit database; - key_perspectives = [ - { - server_name = "matrix.org"; - keys = [ - { - key_id = "ed25519:auto"; - public_key = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw"; - } - { - key_id = "ed25519:a_RXGa"; - public_key = "l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ"; - } - ]; - } - ]; - prefer_direct_fetch = false; - }; - user_api = { - account_database = database; - device_database = database; - }; + environmentFile = cfg.secrets.sliding-sync-secret; }; - loadCredential = [ "matrix-server-key:${cfg.secrets.matrix-server-key}" ]; - } // optionalAttrs (cfg.secrets.dendrite-envs != null) { - environmentFile = cfg.secrets.dendrite-envs; }; - + ###################################### SYNAPSE END ############################## + # Adapted from Mic92/dotfiles, (C) 2021 Jörg Thalheim (MIT) services.prometheus.scrapeConfigs = [ { - job_name = "dendrite"; + job_name = "synapse"; + metrics_path = "/_synapse/metrics"; static_configs = [{ - targets = [ "127.0.0.1:${toString config.services.dendrite.httpPort}" ]; + targets = [ "127.0.0.1:${toString metricsPort}" ]; }]; } ]; - systemd.services.dendrite = { - after = [ "postgresql.service" ]; - }; - environment.persistence."/persist".directories = [ - "/var/lib/private/dendrite" + "/var/lib/matrix-synapse" ]; - services.sliding-sync = { - enable = true; - server = "https://${cfg.realHost}"; - bindAddr = "[::1]:8009"; - db = "postgres:///syncv3?host=/run/postgresql"; - secret = cfg.secrets.sliding-sync-secret; - after = [ "dendrite.service" ]; - }; - services.postgresql.enable = true; - services.postgresql.ensureDatabases = [ "dendrite" "syncv3" ]; - services.postgresql.ensureUsers = [ - { - name = "dendrite"; - ensurePermissions."DATABASE dendrite" = "ALL PRIVILEGES"; - } - { - name = "sliding-sync"; - ensurePermissions."DATABASE syncv3" = "ALL PRIVILEGES"; - } - ]; - + services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" '' + CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse'; + CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" + TEMPLATE template0 + LC_COLLATE = "C" + LC_CTYPE = "C"; + ''; services.nginx.virtualHosts.${cfg.realHost} = { forceSSL = true; useACMEHost = cfg.domain; @@ -186,9 +151,8 @@ in proxy_read_timeout 600; client_max_body_size 50M; ''; - locations."/_matrix".proxyPass = "http://[::1]:${toString config.services.dendrite.httpPort}"; - locations."/_dendrite".proxyPass = "http://[::1]:${toString config.services.dendrite.httpPort}"; - locations."/_synapse".proxyPass = "http://[::1]:${toString config.services.dendrite.httpPort}"; + locations."/_matrix".proxyPass = "http://[::1]:${toString httpPort}"; + locations."/_synapse".proxyPass = "http://[::1]:${toString httpPort}"; }; services.nginx.virtualHosts.${cfg.domain} = @@ -223,7 +187,7 @@ in services.nginx.virtualHosts.${cfg.slidingSyncHost} = { forceSSL = true; useACMEHost = cfg.domain; - locations."/".proxyPass = "http://${config.services.sliding-sync.bindAddr}"; + locations."/".proxyPass = "http://${config.services.matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}"; }; networking.firewall.allowedTCPPorts = [ 443 8448 ]; diff --git a/systems/cobalt/default.nix b/systems/cobalt/default.nix index bbd5261..3137581 100644 --- a/systems/cobalt/default.nix +++ b/systems/cobalt/default.nix @@ -157,7 +157,9 @@ in sops.secrets.acme-envs = { owner = "acme"; }; - sops.secrets.matrix-server-key = { }; + sops.secrets.matrix-server-key = { owner = "matrix-synapse"; }; + sops.secrets.matrix-shared-secret = { owner = "matrix-synapse"; }; + sops.secrets.synapse-extra-config = { owner = "matrix-synapse"; }; sops.secrets.dendrite-envs = { }; sops.secrets.sliding-sync-secret = { }; sops.secrets.mjolnir-password = { owner = "mjolnir"; }; @@ -266,6 +268,8 @@ in }; secrets = { matrix-server-key = config.sops.secrets.matrix-server-key.path; + matrix-shared-secret = config.sops.secrets.matrix-shared-secret.path; + extra-config-path = config.sops.secrets.synapse-extra-config; dendrite-envs = config.sops.secrets.dendrite-envs.path; sliding-sync-secret = config.sops.secrets.sliding-sync-secret.path; }; diff --git a/systems/cobalt/secrets/secrets.yaml b/systems/cobalt/secrets/secrets.yaml index b40573d..3079847 100644 --- a/systems/cobalt/secrets/secrets.yaml +++ b/systems/cobalt/secrets/secrets.yaml @@ -2,11 +2,14 @@ root-password: ENC[AES256_GCM,data:utvaJtoAN+9CSmnEd86OjdMB5QFWq/ICm0cv6F26QAdBa sefidel-password: ENC[AES256_GCM,data:i3fLsgHXIogbPh95k7EPXs9rzfrl617lDqwXktMd/buy5MhUfgl6lNftayeIhIihqmZP4Fu0r7m5s6DYvpfpyvK22Y/Yvib57w==,iv:u9iZ+261lh3ckJubH9iD2iFCAJhUB8ca2VhFYvrHwzA=,tag:4j7j61aOu9zFomU4AS5ThA==,type:str] borg-cobalt-rolling-pass: ENC[AES256_GCM,data:sR1V7JkNN5AmXINQYoqpdxFJ7wjcVeHKzYMV8/dAMQ==,iv:CXVMkN4wQi0khfxG8J0a8ZFCwn5Ynh4M1GIaKTY70Bw=,tag:8naCtTu3mlzPI5FKtVmDvg==,type:str] acme-envs: ENC[AES256_GCM,data:9IvoY1E2VLikZgPcNnEl2e33SMgLOJsX7aVTEbld1ggl8Z77a2iau17d/ZLWs0+u,iv:gr2iHuYmtZp2eWhX0E0OKolIn/Nm5+9hJqFTYZagV4c=,tag:9mqUFzqe8+3T+Nwbu5V0Fg==,type:str] -matrix-server-key: ENC[AES256_GCM,data:MsPH8g0bc0cY+k5XvVIyi1hDpX2up7+noU9P4Dfm3Z9f1eXv7SaJhlRnR40qrk4sQN1uG0R/ro7S2z9EswX0iZx10PfjWF8Igrc9w9b2+EM/gb0O3dGskPAnDrm9JYh+gF6SsqmwJUEYh+Lx1EfuGMTWpnXZjLrimIWCfmz/1qxJECQds/aQwuA=,iv:B8yzXZ1IUVVvxFQ0MzzS5LSHZXQirnXiLoOru4S2H78=,tag:TNp1Y3C/iYgq5itqXGIt/g==,type:str] +dendrite-matrix-server-key: ENC[AES256_GCM,data:ZzNjc/olciXQoXiYuHeZOeFP81GEb6FYIugHuPqCY5yXuJk+nQ4tNdk4nIBAkNXCeoMne4I7fBWraZnxz4PRGNLNutz2CGyutKsX54lFNJkEgl7JahVJGBI4mw+InwWEZwPliOEzs6jzZDjmd8IBuPklrj2z5UfGFHyMH2fXmMq8Yw5jXg4na0s=,iv:zE6zGfbN3V+kkkWxOf5XJgvROfL/bf25CARXVDGoK5A=,tag:ADM7BWbRp/rxMU/ikSZp+g==,type:str] +matrix-server-key: ENC[AES256_GCM,data:gv1zTWRNqmpB/WtPGwYahm9BnCNNsuzKN5oMTnkv1x34jujznYFjgETL26SbSo68j1y2X712Mn9434Y=,iv:hYUo3VK8eDp873ddXB3LWjifM4oeqv/sDSZqPW8Ieq0=,tag:6OXja0TndNNwIeeGjhkJJA==,type:str] +matrix-shared-secret: ENC[AES256_GCM,data:Xv9pOMA/kUJUrYxdXRA7NTrbkFvVsA==,iv:J3rZJGJ1cQPyhBK5lcd04dv2cGbhAvjg9IEQeXU+K/U=,tag:3YD3/MMUsVPnbW3ZUuf11Q==,type:str] +synapse-extra-config: ENC[AES256_GCM,data:bJh9nMzZvP36Uwe7x03MLEk2N+FKq2V2YAFJT43vhMQ/XkvdN9yAeWhlxPGNEtl2wcMpCLnqbVAtfhJVI4VI5hGnue5HZz4Q51lbVQr2ZwzWuU6I25mY,iv:2qJuuyBlwgSWx5dkxGDbHhTW7ajI68lPgrvjdHmNTZ8=,tag:xRM6XGlitvcf+MrxBQ9GDw==,type:str] mjolnir-password: ENC[AES256_GCM,data:dyM2VVxn1PFRXy5dgfvq3EuWyGDhDZvJOd1sTnKE5q0Arv1y,iv:DD80um8QXLybj1w4ZsxPbv3+s2NrQfpPDAEpkztkMFo=,tag:3ZEJ7V+ICh2Ip5gZt06zjA==,type:str] mautrix-telegram-envs: ENC[AES256_GCM,data:hDfEI6tshgPHn/yPHkqO9/VZnB/vTnuyopVm2/0CKoWska66UXOHbXwvO6UXXUZldzkvKe6min3O9xjEGBC+SZdLWmfi6AxJvoKnmU2MzufNkrDG4k0turK7LwwVnm8ADZd9tEII+P3h42t78jhkgerailjP1rtVKleAZpr+ioRGhCTAE6tVWnhV4jveUwNkml+0AhMc3aY0N2PLvedw8p/jsX6Yujn2baKc7HOkvAasctqq/p8kdiTZCA+ASIVC15iR+KtGu2V7vXjDuzYU7Xv7+RbXN7rUTCBIJwyc3XxpwOmD46XR+/2iSZ3nL0PmDftbIEaA9LatjUap7mRFOwX5JruAl1XxAGdG965HZFyTHp1UggjjWvoHQmyb1xJXD5ZE+EU8obkFV0N1o7Q4XIF6/REz9+01JrOd1F5GxjoAo29JV+1lhdxGykrFcA63VLsXdsUgZflWH7Rxol2nOMI5t88+zohYJ5OpeLlRD0gVaX8dvgSzvzmZaNxASW+9tHOQBSzkZsM6jEon6ZXeAa0oh/ee+W82jHhe/ohlj0UV7TtpW/QWs3NR3mv1x41TMBawnVQ7sb9UH/sbdbajJYEAkSD/32ETSjXiQJsmhGEj5kRBNAQA16s1o0M24+UnpHo71jqQnRQpOUtFhLQqakOWvSdM4KgIXExc87Fkw+bQxLtpIup+T4WpJkCe5f5rB/jHvob33oitzjS1mam9UTtzwQjTuR/P4V8IORygDHlcq8W2PtDhWOdgtWI9cfIlqIIgu6+7Rg4+1dq5aw8j06eWrNH2NElPMji0opN+onT3VflgwGPXHlemId20Z2TXNuE6LlnUhyyxdh0rw3tVuCDcodzj4HfXk9mbjlTufyGKY41K/A6QTotiHANojizuTyulyjI3Gx1Wvzv8+Ib84SZGl9ZSsg7g6Ig5U12IJhNtZ/vMj8MHpRjxnyRmZ4jsQi9UctDKrhHjulD1WJyhBveoEv8L79c6e0xZYAwkSlxvdaOPK3OMGbbtbH8vy7WYXSwHZomwJ7BrsrQ/5lWav2xXzgM7ASnEg/rKBPr9YQYOBA==,iv:K2qdi99cjom4mzcNH26qqX3gQNSvZzuAh9QY4zmZv9I=,tag:e9/4biFz6mVsGHV/YOA1jg==,type:str] dendrite-envs: ENC[AES256_GCM,data:67FnrGQUZWFfHAoUM/idTZlBX7aek3fbPkswB9+3pjLNQuXpIWYoa2vpdGt7zec2n9o9z0V3LdlkookjS95aPpZmKYwPaKkH2L7Jaxw=,iv:c4lEReLizcQeTTiG7cJwd+2sBH+EKBGycKeoDgJ/394=,tag:zBBxIcXn+8Q90BkPidltfQ==,type:str] -sliding-sync-secret: ENC[AES256_GCM,data:lNIlUtNbXw1/w44m7RwqmvOTmc4MYfag7Nvo0izTM6Al7eOZXjEXGgfr7b4PB3QNewghN4LEEj1ae8HqpivT/w==,iv:Qw2XLjYp3/78OuEakUDJ0Sp3fmjw36IJTg8UKTZ7UEU=,tag:tp3gACPEZNMzj+aDP3Ax4A==,type:str] +sliding-sync-secret: ENC[AES256_GCM,data:mBgQZ/SVRpvELrqwCzjxJETxDSj5gw+CcIb3rk/vjQ3j8tvjt4Z2GbuE6fwQ1CXhHKRL7kYOLn8ec7rgaMTr6me2pRcI+Sz/40IKUvlE,iv:NQvkJ4gjmOtfOyb8ciOudNHBYOytizNg6K6IhVxhE28=,tag:LNhd6MgUOPBHY9qK/tDBjA==,type:str] turn-secret: ENC[AES256_GCM,data:JA5/BlGwH6yIjYsFZGa8Nm8XVbOBKpre+NFybniOtlmbSx89ldKBvuqF2ZoPltJS+vzQ/+wxM/VorhF7M+s4jA==,iv:rK5SFj4VOzgfaP/LIzWTVFyCBmklGMSyd9iWbet2CVc=,tag:QycYCHH72bMMX5UubDHTlg==,type:str] openldap-admin-key: ENC[AES256_GCM,data:WBBDPFDW6Q4sJ5+/pK8kAe6iFgJ8gGgi3eCVNvZB,iv:1rnmhu29UGsXLxD9Ptbv7P67EAYgKVk1dlkM6p0L4vA=,tag:yNRrHMI2yT8Oo7qkwxSeUg==,type:str] sefidel-imap-pass: ENC[AES256_GCM,data:rx9hZb+BARs9gB+XLLRMLWDSx67KqkKB1/4nOOtU9i56uagMprFEeDnh8pEaioZbNlqjJRO8kWTBBvWZ,iv:WxKLp0VmwfxVFZt9cnZUbp4wn5WEHubImp8fQy2bXyg=,tag:Vzh0Ntz8iFaSIEf2wjbOKg==,type:str] @@ -38,8 +41,8 @@ sops: cUpBZ01CMEFjNnNuWjlYejVKajkwcGMKehqYCZP0zZHDTfJrC/5LYiE/3doa0OiM OKXhOuUX8HF8RfkyiOSMpntxuNX2jSvd9sQRYnHkUvgm793+IuQjrg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-08-01T16:24:22Z" - mac: ENC[AES256_GCM,data:2kp7TYn1C+uo0gtnAvLglhhKxe3j/rmAZnN1GcKnA4/RTCunef6zlGup+g+Yogv8z+wktmN+WGsBFhuu51o027paTlExlMsFwuvb7FOVNGPxyksDnAHJc9SBQYYMKtqUrVqPKxm8cfVmKIV+vYoW+C3SFL11XyOCtxjaI+R4IXc=,iv:4uPxt+CzDyMwHSEGZncfOH+4wN7w20Pj2lV0cTBhGgk=,tag:Je2fzTGcrX93xNAFjdL1Lg==,type:str] + lastmodified: "2023-11-05T09:09:41Z" + mac: ENC[AES256_GCM,data:uniRzzxp0Yr999O9/z6plc59MRqDKyKpkORRgVD3HYRfXmMP8nKUrKej9Cttr9W81RRjzBSnse5/YWYLWROAhnxuLFpcJTiTRrDHDiH+NKcpgMwAkSnF8mS/qKCn4ewcXRCaA2blA71v0OiPoCrhmRbJvezNV85Fuzm2VMQZejU=,iv:23TwdmuNOR2Dt2mn4HeWm7izbJ5KQ6ODXFa+TZkPWyE=,tag:3gl5E52v4iRjOkvwfgp4cw==,type:str] pgp: [] unencrypted_suffix: _unencrypted - version: 3.7.3 + version: 3.8.1 |