This repository has no description
2.1 kB
73 lines
1{ config, pkgs, ... }:
2{
3 services.matrix-synapse = {
4 enable = true;
5 settings = {
6 server_name = "lassul.us";
7 database = {
8 args.user = "matrix-synapse";
9 args.database = "matrix-synapse";
10 name = "psycopg2";
11 };
12 turn_uris = [
13 "turn:turn.matrix.org?transport=udp"
14 "turn:turn.matrix.org?transport=tcp"
15 ];
16 listeners = [
17 {
18 port = 8008;
19 bind_addresses = [
20 "::1"
21 config.krebs.build.host.nets.retiolum.ip6.addr
22 ];
23 type = "http";
24 tls = false;
25 x_forwarded = true;
26 resources = [
27 {
28 names = [ "client" ];
29 compress = true;
30 }
31 {
32 names = [ "federation" ];
33 compress = false;
34 }
35 ];
36 }
37 ];
38 };
39 extraConfigFiles = [
40 "/var/lib/matrix-synapse/registration_shared_secret.yaml"
41 ];
42 };
43 systemd.services.matrix-synapse.serviceConfig.ExecStartPre = [
44 "+${pkgs.writeScript "copy_registration_shared_secret" ''
45 #!/bin/sh
46 cp ${config.clanCore.facts.services.matrix-synapse.secret.synapse-registration_shared_secret.path} /var/lib/matrix-synapse/registration_shared_secret.yaml
47 chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/registration_shared_secret.yaml
48 chmod 600 /var/lib/matrix-synapse/registration_shared_secret.yaml
49 ''}"
50 ];
51
52 clanCore.facts.services."matrix-synapse" = {
53 secret."synapse-registration_shared_secret" = { };
54 generator.path = with pkgs; [ coreutils pwgen ];
55 generator.script = ''
56 echo "registration_shared_secret: $(pwgen -s 32 1)" > "$secrets"/synapse-registration_shared_secret
57 '';
58 };
59
60 # TODO add other VPNs here as well
61 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 8008 ];
62
63 services.postgresql.enable = true;
64 services.postgresql = {
65 ensureDatabases = [ "matrix-synapse" ];
66 ensureUsers = [
67 {
68 name = "matrix-synapse";
69 ensureDBOwnership = true;
70 }
71 ];
72 };
73}