2021-01-31 16:56:44 +01:00
|
|
|
# Matrix homeserver setup, using different endpoints for federation and client
|
|
|
|
# traffic. The main trick for this is defining two nginx servers endpoints for
|
|
|
|
# matrix.domain.com, each listening on different ports.
|
|
|
|
#
|
|
|
|
# Configuration shamelessly stolen from [1]
|
|
|
|
#
|
|
|
|
# [1]: https://github.com/alarsyo/nixos-config/blob/main/services/matrix.nix
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
|
|
|
let
|
|
|
|
cfg = config.my.services.matrix;
|
|
|
|
|
|
|
|
federationPort = { public = 8448; private = 11338; };
|
|
|
|
clientPort = { public = 443; private = 11339; };
|
|
|
|
domain = config.networking.domain;
|
2023-09-28 17:28:11 +02:00
|
|
|
matrixDomain = "matrix.${domain}";
|
2021-01-31 16:56:44 +01:00
|
|
|
in
|
|
|
|
{
|
2021-02-04 16:46:39 +01:00
|
|
|
options.my.services.matrix = with lib; {
|
|
|
|
enable = mkEnableOption "Matrix Synapse";
|
2021-06-09 18:54:16 +02:00
|
|
|
|
2022-03-08 11:56:32 +01:00
|
|
|
secretFile = mkOption {
|
2021-09-25 13:20:22 +02:00
|
|
|
type = with types; nullOr str;
|
|
|
|
default = null;
|
2022-03-08 11:56:32 +01:00
|
|
|
example = "/var/lib/matrix/shared-secret-config.yaml";
|
2021-02-04 16:46:39 +01:00
|
|
|
description = "Shared secret to register users";
|
|
|
|
};
|
2021-06-09 18:54:16 +02:00
|
|
|
|
2023-09-28 17:53:46 +02:00
|
|
|
slidingSync = {
|
|
|
|
port = mkOption {
|
|
|
|
type = types.port;
|
|
|
|
default = 8009;
|
|
|
|
example = 8084;
|
|
|
|
description = "Port used by sliding sync server";
|
|
|
|
};
|
|
|
|
|
|
|
|
secretFile = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
example = "/var/lib/matrix/sliding-sync-secret-file.env";
|
|
|
|
description = "Secret file which contains SYNCV3_SECRET definition";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2021-09-25 13:20:22 +02:00
|
|
|
mailConfigFile = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
example = "/var/lib/matrix/email-config.yaml";
|
|
|
|
description = ''
|
|
|
|
Configuration file for mail setup.
|
|
|
|
'';
|
2021-06-09 18:54:16 +02:00
|
|
|
};
|
2021-01-31 16:56:44 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
|
|
services.postgresql = {
|
|
|
|
enable = true;
|
2021-02-04 17:06:11 +01:00
|
|
|
initialScript = pkgs.writeText "synapse-init.sql" ''
|
|
|
|
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
|
|
|
|
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
|
|
|
|
TEMPLATE template0
|
|
|
|
LC_COLLATE = "C"
|
|
|
|
LC_CTYPE = "C";
|
|
|
|
'';
|
2021-01-31 16:56:44 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
services.matrix-synapse = {
|
|
|
|
enable = true;
|
2021-02-07 21:01:53 +01:00
|
|
|
dataDir = "/var/lib/matrix-synapse";
|
2021-01-31 16:56:44 +01:00
|
|
|
|
2022-03-08 11:56:32 +01:00
|
|
|
settings = {
|
|
|
|
server_name = domain;
|
2023-09-28 17:28:11 +02:00
|
|
|
public_baseurl = "https://${matrixDomain}";
|
2021-02-04 16:46:39 +01:00
|
|
|
|
2022-03-08 11:56:32 +01:00
|
|
|
enable_registration = false;
|
2021-01-31 16:56:44 +01:00
|
|
|
|
2022-03-08 11:56:32 +01:00
|
|
|
listeners = [
|
|
|
|
# Federation
|
|
|
|
{
|
|
|
|
bind_addresses = [ "::1" ];
|
|
|
|
port = federationPort.private;
|
|
|
|
tls = false; # Terminated by nginx.
|
|
|
|
x_forwarded = true;
|
|
|
|
resources = [{ names = [ "federation" ]; compress = false; }];
|
|
|
|
}
|
2021-06-09 18:32:59 +02:00
|
|
|
|
2022-03-08 11:56:32 +01:00
|
|
|
# Client
|
|
|
|
{
|
|
|
|
bind_addresses = [ "::1" ];
|
|
|
|
port = clientPort.private;
|
|
|
|
tls = false; # Terminated by nginx.
|
|
|
|
x_forwarded = true;
|
|
|
|
resources = [{ names = [ "client" ]; compress = false; }];
|
|
|
|
}
|
|
|
|
];
|
2021-06-09 18:33:54 +02:00
|
|
|
|
2022-03-08 11:56:32 +01:00
|
|
|
account_threepid_delegates = {
|
|
|
|
msisdn = "https://vector.im";
|
|
|
|
};
|
|
|
|
|
|
|
|
experimental_features = {
|
|
|
|
spaces_enabled = true;
|
|
|
|
};
|
|
|
|
};
|
2021-09-25 13:20:22 +02:00
|
|
|
|
|
|
|
extraConfigFiles = [
|
|
|
|
cfg.mailConfigFile
|
2022-03-08 11:56:32 +01:00
|
|
|
] ++ lib.optional (cfg.secretFile != null) cfg.secretFile;
|
2024-01-03 23:37:27 +01:00
|
|
|
};
|
2023-09-28 17:53:46 +02:00
|
|
|
|
2024-01-03 23:37:27 +01:00
|
|
|
services.matrix-sliding-sync = {
|
|
|
|
enable = true;
|
2023-09-28 17:53:46 +02:00
|
|
|
|
2024-01-03 23:37:27 +01:00
|
|
|
settings = {
|
|
|
|
SYNCV3_SERVER = "https://${matrixDomain}";
|
|
|
|
SYNCV3_BINDADDR = "127.0.0.1:${toString cfg.slidingSync.port}";
|
2023-09-28 17:53:46 +02:00
|
|
|
};
|
2024-01-03 23:37:27 +01:00
|
|
|
|
|
|
|
environmentFile = cfg.slidingSync.secretFile;
|
2021-01-31 16:56:44 +01:00
|
|
|
};
|
|
|
|
|
2023-12-25 19:25:08 +01:00
|
|
|
my.services.nginx.virtualHosts = {
|
2021-08-24 23:05:10 +02:00
|
|
|
# Element Web app deployment
|
2023-12-25 19:25:08 +01:00
|
|
|
chat = {
|
2021-08-24 23:05:10 +02:00
|
|
|
root = pkgs.element-web.override {
|
|
|
|
conf = {
|
|
|
|
default_server_config = {
|
|
|
|
"m.homeserver" = {
|
2023-09-28 17:28:11 +02:00
|
|
|
"base_url" = "https://${matrixDomain}";
|
2021-08-24 23:05:10 +02:00
|
|
|
"server_name" = domain;
|
|
|
|
};
|
|
|
|
"m.identity_server" = {
|
|
|
|
"base_url" = "https://vector.im";
|
|
|
|
};
|
2023-09-28 17:53:46 +02:00
|
|
|
"org.matrix.msc3575.proxy" = {
|
|
|
|
"url" = "https://matrix-sync.${domain}";
|
|
|
|
};
|
2021-08-24 23:05:10 +02:00
|
|
|
};
|
|
|
|
showLabsSettings = true;
|
|
|
|
defaultCountryCode = "FR"; # cocorico
|
|
|
|
roomDirectory = {
|
|
|
|
"servers" = [
|
|
|
|
"matrix.org"
|
|
|
|
"mozilla.org"
|
|
|
|
];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
2023-12-25 19:25:08 +01:00
|
|
|
};
|
2023-09-28 18:42:13 +02:00
|
|
|
# Dummy VHosts for port collision detection
|
2023-12-25 19:25:08 +01:00
|
|
|
matrix-federation = {
|
2023-09-28 18:42:13 +02:00
|
|
|
port = federationPort.private;
|
2023-12-25 19:25:08 +01:00
|
|
|
};
|
|
|
|
matrix-client = {
|
2023-09-28 18:42:13 +02:00
|
|
|
port = clientPort.private;
|
2023-12-25 19:25:08 +01:00
|
|
|
};
|
2023-09-28 17:53:46 +02:00
|
|
|
# Sliding sync
|
2023-12-25 19:25:08 +01:00
|
|
|
matrix-sync = {
|
2023-09-28 17:53:46 +02:00
|
|
|
inherit (cfg.slidingSync) port;
|
2023-12-25 19:25:08 +01:00
|
|
|
};
|
|
|
|
};
|
2021-08-24 23:05:10 +02:00
|
|
|
|
|
|
|
# Those are too complicated to use my wrapper...
|
2021-01-31 16:56:44 +01:00
|
|
|
services.nginx.virtualHosts = {
|
2023-09-28 17:28:11 +02:00
|
|
|
${matrixDomain} = {
|
2021-07-13 17:43:26 +02:00
|
|
|
onlySSL = true;
|
2021-02-24 21:50:05 +01:00
|
|
|
useACMEHost = domain;
|
2021-01-31 16:56:44 +01:00
|
|
|
|
2021-02-04 17:19:34 +01:00
|
|
|
locations =
|
|
|
|
let
|
|
|
|
proxyToClientPort = {
|
|
|
|
proxyPass = "http://[::1]:${toString clientPort.private}";
|
|
|
|
};
|
|
|
|
in
|
|
|
|
{
|
|
|
|
# Or do a redirect instead of the 404, or whatever is appropriate
|
|
|
|
# for you. But do not put a Matrix Web client here! See the
|
|
|
|
# Element web section below.
|
|
|
|
"/".return = "404";
|
|
|
|
|
|
|
|
"/_matrix" = proxyToClientPort;
|
|
|
|
"/_synapse/client" = proxyToClientPort;
|
2023-09-28 17:53:46 +02:00
|
|
|
|
|
|
|
# Sliding sync
|
|
|
|
"~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)" = {
|
2024-01-03 23:37:27 +01:00
|
|
|
proxyPass = "http://${config.services.matrix-sliding-sync.settings.SYNCV3_BINDADDR}";
|
2023-09-28 17:53:46 +02:00
|
|
|
};
|
2021-02-04 17:19:34 +01:00
|
|
|
};
|
2021-01-31 16:56:44 +01:00
|
|
|
|
|
|
|
listen = [
|
|
|
|
{ addr = "0.0.0.0"; port = clientPort.public; ssl = true; }
|
|
|
|
{ addr = "[::]"; port = clientPort.public; ssl = true; }
|
|
|
|
];
|
|
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
# same as above, but listening on the federation port
|
2023-09-28 17:28:11 +02:00
|
|
|
"${matrixDomain}_federation" = {
|
2021-07-13 17:43:26 +02:00
|
|
|
onlySSL = true;
|
2023-09-28 17:28:11 +02:00
|
|
|
serverName = matrixDomain;
|
2021-02-24 21:50:05 +01:00
|
|
|
useACMEHost = domain;
|
2021-01-31 16:56:44 +01:00
|
|
|
|
|
|
|
locations."/".return = "404";
|
|
|
|
|
|
|
|
locations."/_matrix" = {
|
|
|
|
proxyPass = "http://[::1]:${toString federationPort.private}";
|
|
|
|
};
|
|
|
|
|
|
|
|
listen = [
|
|
|
|
{ addr = "0.0.0.0"; port = federationPort.public; ssl = true; }
|
|
|
|
{ addr = "[::]"; port = federationPort.public; ssl = true; }
|
|
|
|
];
|
|
|
|
};
|
|
|
|
|
|
|
|
"${domain}" = {
|
|
|
|
forceSSL = true;
|
2021-02-24 21:50:05 +01:00
|
|
|
useACMEHost = domain;
|
2021-01-31 16:56:44 +01:00
|
|
|
|
|
|
|
locations."= /.well-known/matrix/server".extraConfig =
|
|
|
|
let
|
2023-09-28 17:28:11 +02:00
|
|
|
server = { "m.server" = "${matrixDomain}:${toString federationPort.public}"; };
|
2021-01-31 16:56:44 +01:00
|
|
|
in
|
|
|
|
''
|
|
|
|
add_header Content-Type application/json;
|
|
|
|
return 200 '${builtins.toJSON server}';
|
|
|
|
'';
|
|
|
|
|
|
|
|
locations."= /.well-known/matrix/client".extraConfig =
|
|
|
|
let
|
|
|
|
client = {
|
2023-09-28 17:28:11 +02:00
|
|
|
"m.homeserver" = { "base_url" = "https://${matrixDomain}"; };
|
2021-01-31 16:56:44 +01:00
|
|
|
"m.identity_server" = { "base_url" = "https://vector.im"; };
|
2023-09-28 17:53:46 +02:00
|
|
|
"org.matrix.msc3575.proxy" = { "url" = "https://matrix-sync.${domain}"; };
|
2021-01-31 16:56:44 +01:00
|
|
|
};
|
|
|
|
# ACAO required to allow element-web on any URL to request this json file
|
|
|
|
in
|
|
|
|
''
|
|
|
|
add_header Content-Type application/json;
|
|
|
|
add_header Access-Control-Allow-Origin *;
|
|
|
|
return 200 '${builtins.toJSON client}';
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
# For administration tools.
|
|
|
|
environment.systemPackages = [ pkgs.matrix-synapse ];
|
|
|
|
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
|
|
clientPort.public
|
|
|
|
federationPort.public
|
|
|
|
];
|
2021-02-07 13:30:09 +01:00
|
|
|
|
|
|
|
my.services.backup = {
|
|
|
|
paths = [
|
|
|
|
config.services.matrix-synapse.dataDir
|
|
|
|
];
|
|
|
|
};
|
2021-11-03 17:12:32 +01:00
|
|
|
|
|
|
|
my.system.persist.directories = [
|
|
|
|
config.services.matrix-synapse.dataDir
|
|
|
|
];
|
2021-01-31 16:56:44 +01:00
|
|
|
};
|
|
|
|
}
|