modules: services: matrix: add sliding sync

This is simply to make use of my infrastructure for port collision
detection.

.envrc

@@ -1,10 +1,8 @@
-if ! has nix_direnv_version || ! nix_direnv_version 2.2.1; then
-    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.1/direnvrc" "sha256-zelF0vLbEl5uaqrfIzbgNzJWGmLzCmYAkInj/LNxvKs="
+if ! has nix_direnv_version || ! nix_direnv_version 2.4.0; then
+    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.4.0/direnvrc" "sha256-XQzUAvL6pysIJnRJyR7uVpmUSZfc7LSgWQwq/4mBr1U="
 fi
 
+nix_direnv_watch_file ./flake/checks.nix
+nix_direnv_watch_file ./flake/dev-shells.nix
+
 use flake
-
-watch_file ./flake/checks.nix
-watch_file ./flake/dev-shells.nix
-
-eval "$shellHooks"

home/comma/default.nix

@@ -5,25 +5,11 @@ in
 {
   options.my.home.comma = with lib; {
     enable = my.mkDisableOption "comma configuration";
-
-    pkgsFlake = mkOption {
-      type = types.str;
-      default = "pkgs";
-      example = "nixpkgs";
-      description = ''
-        Which flake from the registry should be used with
-        <command>nix shell</command>.
-      '';
-    };
   };
 
   config = lib.mkIf cfg.enable {
     home.packages = with pkgs; [
       ambroisie.comma
     ];
-
-    home.sessionVariables = {
-      COMMA_PKGS_FLAKE = cfg.pkgsFlake;
-    };
   };
 }

home/xdg/default.nix

@@ -47,6 +47,7 @@ in
     LESSHISTFILE = "${dataHome}/less/history";
     LESSKEY = "${configHome}/less/lesskey";
     PSQL_HISTORY = "${dataHome}/psql_history";
+    REPO_CONFIG_DIR = "${configHome}/repo";
     REDISCLI_HISTFILE = "${dataHome}/redis/rediscli_history";
     XCOMPOSECACHE = "${dataHome}/X11/xcompose";
   };

hosts/homes/ambroisie@mousqueton/default.nix

@@ -1,5 +1,5 @@
 # Google Cloudtop configuration
-{ ... }:
+{ lib, pkgs, ... }:
 {
   # Google specific configuration
   home.homeDirectory = "/usr/local/google/home/ambroisie";
@@ -13,6 +13,8 @@
     LD_PRELOAD = "/lib/x86_64-linux-gnu/libnss_cache.so.2\${LD_PRELOAD:+:}$LD_PRELOAD";
   };
 
+  programs.git.package = lib.mkForce pkgs.emptyDirectory;
+
   # I use scripts that use the passthrough sequence often on this host
   my.home.tmux.enablePassthrough = true;
 }

hosts/nixos/porthos/secrets/matrix/sliding-sync-secret.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 cKojmg N182xey8TWRVUWTRP16rT0zlhYZNr/pOZVR7YRnlIkk
+HVqAag55z1cKLgjR3WsUj2wvaVjxm169JcDRJGRvCVU
+-> ssh-ed25519 jPowng Dc+aaUTxDsMTY+oOst0SC3ldq1e6zX8F5A5uBL5RHhc
+JWZou6+VaFc5f2OLRIrmFFWg3Er6WSY+TloXU0mP1K8
+-> |9_9Aqh%-grease $ X8Mn|5 aKnl' fl<D{T-
++fAc0cajqxhYWu55HCY
+--- SrmtWXQXGYxNTabSrb5tBRXHnK1F22Qoiy7hKYrrF+0
+ñD·û²:,õn0i<>½Àß^ÆŠ`üÔ2Æ#y'ý9ÖñÓÒŽéÿæ<C3BF>r]ÀØ›¹x“³S=ú°ˆôuJéEÛóc€lH Ê~eÅ‚›ŸKtévo'êv+

hosts/nixos/porthos/secrets/secrets.nix

@@ -35,6 +35,9 @@ in
     owner = "matrix-synapse";
     publicKeys = all;
   };
+  "matrix/sliding-sync-secret.age" = {
+    publicKeys = all;
+  };
 
   "miniflux/credentials.age".publicKeys = all;
 

hosts/nixos/porthos/services.nix

@@ -64,6 +64,9 @@ in
       mailConfigFile = secrets."matrix/mail".path;
       # Only necessary when doing the initial registration
       secretFile = secrets."matrix/secret".path;
+      slidingSync = {
+        secretFile = secrets."matrix/sliding-sync-secret".path;
+      };
     };
     miniflux = {
       enable = true;
@@ -116,7 +119,13 @@ in
       secretKeyFile = secrets."paperless/secret-key".path;
     };
     # The whole *arr software suite
-    pirate.enable = true;
+    pirate = {
+      enable = true;
+      # ... But not Lidarr because I don't care for music that much
+      lidarr = {
+        enable = false;
+      };
+    };
     # Podcast automatic downloader
     podgrab = {
       enable = true;

modules/services/matrix/default.nix

@@ -13,6 +13,7 @@ let
   federationPort = { public = 8448; private = 11338; };
   clientPort = { public = 443; private = 11339; };
   domain = config.networking.domain;
+  matrixDomain = "matrix.${domain}";
 in
 {
   options.my.services.matrix = with lib; {
@@ -25,6 +26,21 @@ in
       description = "Shared secret to register users";
     };
 
+    slidingSync = {
+      port = mkOption {
+        type = types.port;
+        default = 8009;
+        example = 8084;
+        description = "Port used by sliding sync server";
+      };
+
+      secretFile = mkOption {
+        type = types.str;
+        example = "/var/lib/matrix/sliding-sync-secret-file.env";
+        description = "Secret file which contains SYNCV3_SECRET definition";
+      };
+    };
+
     mailConfigFile = mkOption {
       type = types.str;
       example = "/var/lib/matrix/email-config.yaml";
@@ -52,7 +68,7 @@ in
 
       settings = {
         server_name = domain;
-        public_baseurl = "https://matrix.${domain}";
+        public_baseurl = "https://${matrixDomain}";
 
         enable_registration = false;
 
@@ -88,6 +104,17 @@ in
       extraConfigFiles = [
         cfg.mailConfigFile
       ] ++ lib.optional (cfg.secretFile != null) cfg.secretFile;
+
+      sliding-sync = {
+        enable = true;
+
+        settings = {
+          SYNCV3_SERVER = "https://${matrixDomain}";
+          SYNCV3_BINDADDR = "127.0.0.1:${toString cfg.slidingSync.port}";
+        };
+
+        environmentFile = cfg.slidingSync.secretFile;
+      };
     };
 
     my.services.nginx.virtualHosts = [
@@ -98,12 +125,15 @@ in
           conf = {
             default_server_config = {
               "m.homeserver" = {
-                "base_url" = "https://matrix.${domain}";
+                "base_url" = "https://${matrixDomain}";
                 "server_name" = domain;
               };
               "m.identity_server" = {
                 "base_url" = "https://vector.im";
               };
+              "org.matrix.msc3575.proxy" = {
+                "url" = "https://matrix-sync.${matrixDomain}";
+              };
             };
             showLabsSettings = true;
             defaultCountryCode = "FR"; # cocorico
@@ -116,11 +146,25 @@ in
           };
         };
       }
+      # Dummy VHosts for port collision detection
+      {
+        subdomain = "matrix-federation";
+        port = federationPort.private;
+      }
+      {
+        subdomain = "matrix-client";
+        port = clientPort.private;
+      }
+      # Sliding sync
+      {
+        subdomain = "matrix-sync";
+        inherit (cfg.slidingSync) port;
+      }
     ];
 
     # Those are too complicated to use my wrapper...
     services.nginx.virtualHosts = {
-      "matrix.${domain}" = {
+      ${matrixDomain} = {
         onlySSL = true;
         useACMEHost = domain;
 
@@ -138,6 +182,11 @@ in
 
             "/_matrix" = proxyToClientPort;
             "/_synapse/client" = proxyToClientPort;
+
+            # Sliding sync
+            "~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)" = {
+              proxyPass = "http://${config.services.matrix-synapse.sliding-sync.settings.SYNCV3_BINDADDR}";
+            };
           };
 
         listen = [
@@ -148,9 +197,9 @@ in
       };
 
       # same as above, but listening on the federation port
-      "matrix.${domain}_federation" = {
+      "${matrixDomain}_federation" = {
         onlySSL = true;
-        serverName = "matrix.${domain}";
+        serverName = matrixDomain;
         useACMEHost = domain;
 
         locations."/".return = "404";
@@ -171,7 +220,7 @@ in
 
         locations."= /.well-known/matrix/server".extraConfig =
           let
-            server = { "m.server" = "matrix.${domain}:${toString federationPort.public}"; };
+            server = { "m.server" = "${matrixDomain}:${toString federationPort.public}"; };
           in
           ''
             add_header Content-Type application/json;
@@ -181,8 +230,9 @@ in
         locations."= /.well-known/matrix/client".extraConfig =
           let
             client = {
-              "m.homeserver" = { "base_url" = "https://matrix.${domain}"; };
+              "m.homeserver" = { "base_url" = "https://${matrixDomain}"; };
               "m.identity_server" = { "base_url" = "https://vector.im"; };
+              "org.matrix.msc3575.proxy" = { "url" = "https://matrix-sync.${matrixDomain}"; };
             };
             # ACAO required to allow element-web on any URL to request this json file
           in

modules/services/pirate/default.nix

@@ -29,7 +29,7 @@ let
     ];
   };
 
-  mkFail2Ban = service: {
+  mkFail2Ban = service: lib.mkIf cfg.${service}.enable {
     services.fail2ban.jails = {
       ${service} = ''
         enabled = true
@@ -47,14 +47,30 @@ let
     };
   };
 
-  mkFullConfig = service: lib.mkMerge [
+  mkFullConfig = service: lib.mkIf cfg.${service}.enable (lib.mkMerge [
     (mkService service)
     (mkRedirection service)
-  ];
+  ]);
 in
 {
   options.my.services.pirate = {
     enable = lib.mkEnableOption "Media automation";
+
+    bazarr = {
+      enable = lib.my.mkDisableOption "Bazarr";
+    };
+
+    lidarr = {
+      enable = lib.my.mkDisableOption "Lidarr";
+    };
+
+    radarr = {
+      enable = lib.my.mkDisableOption "Radarr";
+    };
+
+    sonarr = {
+      enable = lib.my.mkDisableOption "Sonarr";
+    };
   };
 
   config = lib.mkIf cfg.enable (lib.mkMerge [

modules/services/transmission/default.nix

@@ -3,7 +3,7 @@
 # Inspired by [1]
 #
 # [1]: https://github.com/delroth/infra.delroth.net/blob/master/roles/seedbox.nix
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 let
   cfg = config.my.services.transmission;
 in
@@ -45,6 +45,7 @@ in
   config = lib.mkIf cfg.enable {
     services.transmission = {
       enable = true;
+      package = pkgs.transmission_4;
       group = "media";
 
       downloadDirPermissions = "775";

modules/services/woodpecker/agent-docker/default.nix

@@ -27,9 +27,6 @@ in
     # Make sure it is activated in that case
     my.system.docker.enable = true;
 
-    # FIXME: figure out the issue
-    services.unbound.resolveLocalQueries = false;
-
     # Adjust runner service for nix usage
     systemd.services.woodpecker-agent-docker = {
       after = [ "docker.socket" ]; # Needs the socket to be available

pkgs/comma/comma

@@ -30,4 +30,4 @@ if [ -z "$PROGRAM" ]; then
     exit 1
 fi
 
-nix shell "${COMMA_PKGS_FLAKE:-nixpkgs}#$PROGRAM" -c "$@"
+nix shell "${COMMA_NIXPKGS_FLAKE:-nixpkgs}#$PROGRAM" -c "$@"

templates/c++-cmake/.envrc

@@ -1,10 +1,5 @@
-if ! has nix_direnv_version || ! nix_direnv_version 2.2.1; then
-    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.1/direnvrc" "sha256-zelF0vLbEl5uaqrfIzbgNzJWGmLzCmYAkInj/LNxvKs="
+if ! has nix_direnv_version || ! nix_direnv_version 2.4.0; then
+    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.4.0/direnvrc" "sha256-XQzUAvL6pysIJnRJyR7uVpmUSZfc7LSgWQwq/4mBr1U="
 fi
 
 use flake
-
-watch_file ./flake/checks.nix
-watch_file ./flake/dev-shells.nix
-
-eval "$shellHooks"

templates/c++-meson/.envrc

@@ -1,10 +1,5 @@
-if ! has nix_direnv_version || ! nix_direnv_version 2.2.1; then
-    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.1/direnvrc" "sha256-zelF0vLbEl5uaqrfIzbgNzJWGmLzCmYAkInj/LNxvKs="
+if ! has nix_direnv_version || ! nix_direnv_version 2.4.0; then
+    source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.4.0/direnvrc" "sha256-XQzUAvL6pysIJnRJyR7uVpmUSZfc7LSgWQwq/4mBr1U="
 fi
 
 use flake
-
-watch_file ./flake/checks.nix
-watch_file ./flake/dev-shells.nix
-
-eval "$shellHooks"