This repository has no description
2.2 kB
79 lines
1{ config, pkgs, ... }:
2{
3 services.matrix-synapse = {
4 enable = true;
5 settings = {
6 server_name = "lassul.us";
7 database = {
8 args.user = "matrix-synapse";
9 args.database = "matrix-synapse";
10 name = "psycopg2";
11 };
12 turn_uris = [
13 "turn:turn.matrix.org?transport=udp"
14 "turn:turn.matrix.org?transport=tcp"
15 ];
16 listeners = [
17 {
18 port = 8008;
19 bind_addresses = [
20 "::1"
21 config.krebs.build.host.nets.retiolum.ip6.addr
22 ];
23 type = "http";
24 tls = false;
25 x_forwarded = true;
26 resources = [
27 {
28 names = [ "client" ];
29 compress = true;
30 }
31 {
32 names = [ "federation" ];
33 compress = false;
34 }
35 ];
36 }
37 ];
38 };
39 extraConfigFiles = [
40 "/var/lib/matrix-synapse/registration_shared_secret.yaml"
41 ];
42 };
43 systemd.services.matrix-synapse.serviceConfig.ExecStartPre = [
44 "+${pkgs.writeScript "copy_registration_shared_secret" ''
45 #!/bin/sh
46 cp ${
47 config.clan.core.vars.generators.matrix-synapse.files."synapse-registration_shared_secret".path
48 } /var/lib/matrix-synapse/registration_shared_secret.yaml
49 chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/registration_shared_secret.yaml
50 chmod 600 /var/lib/matrix-synapse/registration_shared_secret.yaml
51 ''}"
52 ];
53
54 clan.core.vars.generators.matrix-synapse = {
55 files."synapse-registration_shared_secret" = { };
56 migrateFact = "matrix-synapse";
57 runtimeInputs = with pkgs; [
58 coreutils
59 pwgen
60 ];
61 script = ''
62 echo "registration_shared_secret: $(pwgen -s 32 1)" > "$out"/synapse-registration_shared_secret
63 '';
64 };
65
66 # TODO add other VPNs here as well
67 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 8008 ];
68
69 services.postgresql.enable = true;
70 services.postgresql = {
71 ensureDatabases = [ "matrix-synapse" ];
72 ensureUsers = [
73 {
74 name = "matrix-synapse";
75 ensureDBOwnership = true;
76 }
77 ];
78 };
79}