modules: services: matrix: use 'settings'

The unstructured attributes are hard-deprecated.

modules/services/matrix/default.nix

@@ -19,10 +19,10 @@ in
   options.my.services.matrix = with lib; {
     enable = mkEnableOption "Matrix Synapse";
 
-    secret = mkOption {
+    secretFile = mkOption {
       type = with types; nullOr str;
       default = null;
-      example = "deadbeef";
+      example = "/var/lib/matrix/shared-secret-config.yaml";
       description = "Shared secret to register users";
     };
 
@@ -50,16 +50,18 @@ in
     services.matrix-synapse = {
       enable = true;
       dataDir = "/var/lib/matrix-synapse";
+
+      settings = {
         server_name = domain;
         public_baseurl = "https://matrix.${domain}";
 
         enable_registration = false;
-      registration_shared_secret = cfg.secret;
+        # registration_shared_secret = cfg.secret; # FIXME: use a secret file for this
 
         listeners = [
           # Federation
           {
-          bind_address = "::1";
+            bind_addresses = [ "::1" ];
             port = federationPort.private;
             tls = false; # Terminated by nginx.
             x_forwarded = true;
@@ -68,7 +70,7 @@ in
 
           # Client
           {
-          bind_address = "::1";
+            bind_addresses = [ "::1" ];
             port = clientPort.private;
             tls = false; # Terminated by nginx.
             x_forwarded = true;
@@ -76,16 +78,18 @@ in
           }
         ];
 
-      account_threepid_delegates.msisdn = "https://vector.im";
+        account_threepid_delegates = {
+          msisdn = "https://vector.im";
+        };
 
-      extraConfig = ''
-        experimental_features:
-          spaces_enabled: true
-      '';
+        experimental_features = {
+          spaces_enabled = true;
+        };
+      };
 
       extraConfigFiles = [
         cfg.mailConfigFile
-      ];
+      ] ++ lib.optional (cfg.secretFile != null) cfg.secretFile;
     };
 
     my.services.nginx.virtualHosts = [