This repository has no description
2.6 kB
90 lines
1{ config, pkgs, ... }:
2{
3 services.matrix-synapse = {
4 enable = true;
5 settings = {
6 server_name = "lassul.us";
7 # Bot accounts (Hermes, bridges) burst many events per turn — thinking
8 # panes, reactions, redactions, chunked replies — and hit the default
9 # caps (rc_message 1/s burst 10), causing "M_LIMIT_EXCEEDED / Too Many
10 # Requests" dropped sends. Raise message + redaction rate limits.
11 rc_message = {
12 per_second = 100;
13 burst_count = 1000;
14 };
15 rc_admin_redaction = {
16 per_second = 100;
17 burst_count = 1000;
18 };
19 database = {
20 args.user = "matrix-synapse";
21 args.database = "matrix-synapse";
22 name = "psycopg2";
23 };
24 turn_uris = [
25 "turn:turn.matrix.org?transport=udp"
26 "turn:turn.matrix.org?transport=tcp"
27 ];
28 listeners = [
29 {
30 port = 8008;
31 bind_addresses = [
32 "::1"
33 config.krebs.build.host.nets.retiolum.ip6.addr
34 ];
35 type = "http";
36 tls = false;
37 x_forwarded = true;
38 resources = [
39 {
40 names = [ "client" ];
41 compress = true;
42 }
43 {
44 names = [ "federation" ];
45 compress = false;
46 }
47 ];
48 }
49 ];
50 };
51 extraConfigFiles = [
52 "/var/lib/matrix-synapse/registration_shared_secret.yaml"
53 ];
54 };
55 systemd.services.matrix-synapse.serviceConfig.ExecStartPre = [
56 "+${pkgs.writeScript "copy_registration_shared_secret" ''
57 #!/bin/sh
58 cp ${
59 config.clan.core.vars.generators.matrix-synapse.files."synapse-registration_shared_secret".path
60 } /var/lib/matrix-synapse/registration_shared_secret.yaml
61 chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/registration_shared_secret.yaml
62 chmod 600 /var/lib/matrix-synapse/registration_shared_secret.yaml
63 ''}"
64 ];
65
66 clan.core.vars.generators.matrix-synapse = {
67 files."synapse-registration_shared_secret" = { };
68 runtimeInputs = with pkgs; [
69 coreutils
70 pwgen
71 ];
72 script = ''
73 echo "registration_shared_secret: $(pwgen -s 32 1)" > "$out"/synapse-registration_shared_secret
74 '';
75 };
76
77 # TODO add other VPNs here as well
78 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 8008 ];
79
80 services.postgresql.enable = true;
81 services.postgresql = {
82 ensureDatabases = [ "matrix-synapse" ];
83 ensureUsers = [
84 {
85 name = "matrix-synapse";
86 ensureDBOwnership = true;
87 }
88 ];
89 };
90}