This repository has no description
3.5 kB
123 lines
1{
2 self,
3 config,
4 pkgs,
5 ...
6}:
7{
8 services.matrix-synapse = {
9 enable = true;
10 settings = {
11 server_name = "lassul.us";
12 # Bot accounts (Hermes, bridges) burst many events per turn — thinking
13 # panes, reactions, redactions, chunked replies — and hit the default
14 # caps (rc_message 1/s burst 10), causing "M_LIMIT_EXCEEDED / Too Many
15 # Requests" dropped sends. Raise message + redaction rate limits.
16 rc_message = {
17 per_second = 100;
18 burst_count = 1000;
19 };
20 rc_admin_redaction = {
21 per_second = 100;
22 burst_count = 1000;
23 };
24 # Bridge portal rooms have many ghost users (signal_*, whatsapp_*, ...)
25 # join at once, exhausting the per-room join limiter (default 1/s burst
26 # 10) and causing "M_LIMIT_EXCEEDED / Too Many Requests / 429" for the
27 # human trying to join. Raise join + invite limits to match.
28 rc_joins = {
29 local = {
30 per_second = 100;
31 burst_count = 1000;
32 };
33 remote = {
34 per_second = 100;
35 burst_count = 1000;
36 };
37 };
38 rc_joins_per_room = {
39 per_second = 100;
40 burst_count = 1000;
41 };
42 rc_invites = {
43 per_room = {
44 per_second = 100;
45 burst_count = 1000;
46 };
47 per_user = {
48 per_second = 100;
49 burst_count = 1000;
50 };
51 };
52 database = {
53 args.user = "matrix-synapse";
54 args.database = "matrix-synapse";
55 name = "psycopg2";
56 };
57 turn_uris = [
58 "turn:turn.matrix.org?transport=udp"
59 "turn:turn.matrix.org?transport=tcp"
60 ];
61 listeners = [
62 {
63 port = 8008;
64 bind_addresses = [
65 "::1"
66 self.inputs.kartei.hosts.${config.networking.hostName}.nets.retiolum.ip6.addr
67 ];
68 type = "http";
69 tls = false;
70 x_forwarded = true;
71 resources = [
72 {
73 names = [ "client" ];
74 compress = true;
75 }
76 {
77 names = [ "federation" ];
78 compress = false;
79 }
80 ];
81 }
82 ];
83 };
84 extraConfigFiles = [
85 "/var/lib/matrix-synapse/registration_shared_secret.yaml"
86 ];
87 };
88 systemd.services.matrix-synapse.serviceConfig.ExecStartPre = [
89 "+${pkgs.writeScript "copy_registration_shared_secret" ''
90 #!/bin/sh
91 cp ${
92 config.clan.core.vars.generators.matrix-synapse.files."synapse-registration_shared_secret".path
93 } /var/lib/matrix-synapse/registration_shared_secret.yaml
94 chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/registration_shared_secret.yaml
95 chmod 600 /var/lib/matrix-synapse/registration_shared_secret.yaml
96 ''}"
97 ];
98
99 clan.core.vars.generators.matrix-synapse = {
100 files."synapse-registration_shared_secret" = { };
101 runtimeInputs = with pkgs; [
102 coreutils
103 pwgen
104 ];
105 script = ''
106 echo "registration_shared_secret: $(pwgen -s 32 1)" > "$out"/synapse-registration_shared_secret
107 '';
108 };
109
110 # TODO add other VPNs here as well
111 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 8008 ];
112
113 services.postgresql.enable = true;
114 services.postgresql = {
115 ensureDatabases = [ "matrix-synapse" ];
116 ensureUsers = [
117 {
118 name = "matrix-synapse";
119 ensureDBOwnership = true;
120 }
121 ];
122 };
123}