This repository has no description
3.4 kB
118 lines
1{ config, pkgs, ... }:
2{
3 services.matrix-synapse = {
4 enable = true;
5 settings = {
6 server_name = "lassul.us";
7 # Bot accounts (Hermes, bridges) burst many events per turn — thinking
8 # panes, reactions, redactions, chunked replies — and hit the default
9 # caps (rc_message 1/s burst 10), causing "M_LIMIT_EXCEEDED / Too Many
10 # Requests" dropped sends. Raise message + redaction rate limits.
11 rc_message = {
12 per_second = 100;
13 burst_count = 1000;
14 };
15 rc_admin_redaction = {
16 per_second = 100;
17 burst_count = 1000;
18 };
19 # Bridge portal rooms have many ghost users (signal_*, whatsapp_*, ...)
20 # join at once, exhausting the per-room join limiter (default 1/s burst
21 # 10) and causing "M_LIMIT_EXCEEDED / Too Many Requests / 429" for the
22 # human trying to join. Raise join + invite limits to match.
23 rc_joins = {
24 local = {
25 per_second = 100;
26 burst_count = 1000;
27 };
28 remote = {
29 per_second = 100;
30 burst_count = 1000;
31 };
32 };
33 rc_joins_per_room = {
34 per_second = 100;
35 burst_count = 1000;
36 };
37 rc_invites = {
38 per_room = {
39 per_second = 100;
40 burst_count = 1000;
41 };
42 per_user = {
43 per_second = 100;
44 burst_count = 1000;
45 };
46 };
47 database = {
48 args.user = "matrix-synapse";
49 args.database = "matrix-synapse";
50 name = "psycopg2";
51 };
52 turn_uris = [
53 "turn:turn.matrix.org?transport=udp"
54 "turn:turn.matrix.org?transport=tcp"
55 ];
56 listeners = [
57 {
58 port = 8008;
59 bind_addresses = [
60 "::1"
61 config.krebs.build.host.nets.retiolum.ip6.addr
62 ];
63 type = "http";
64 tls = false;
65 x_forwarded = true;
66 resources = [
67 {
68 names = [ "client" ];
69 compress = true;
70 }
71 {
72 names = [ "federation" ];
73 compress = false;
74 }
75 ];
76 }
77 ];
78 };
79 extraConfigFiles = [
80 "/var/lib/matrix-synapse/registration_shared_secret.yaml"
81 ];
82 };
83 systemd.services.matrix-synapse.serviceConfig.ExecStartPre = [
84 "+${pkgs.writeScript "copy_registration_shared_secret" ''
85 #!/bin/sh
86 cp ${
87 config.clan.core.vars.generators.matrix-synapse.files."synapse-registration_shared_secret".path
88 } /var/lib/matrix-synapse/registration_shared_secret.yaml
89 chown matrix-synapse:matrix-synapse /var/lib/matrix-synapse/registration_shared_secret.yaml
90 chmod 600 /var/lib/matrix-synapse/registration_shared_secret.yaml
91 ''}"
92 ];
93
94 clan.core.vars.generators.matrix-synapse = {
95 files."synapse-registration_shared_secret" = { };
96 runtimeInputs = with pkgs; [
97 coreutils
98 pwgen
99 ];
100 script = ''
101 echo "registration_shared_secret: $(pwgen -s 32 1)" > "$out"/synapse-registration_shared_secret
102 '';
103 };
104
105 # TODO add other VPNs here as well
106 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 8008 ];
107
108 services.postgresql.enable = true;
109 services.postgresql = {
110 ensureDatabases = [ "matrix-synapse" ];
111 ensureUsers = [
112 {
113 name = "matrix-synapse";
114 ensureDBOwnership = true;
115 }
116 ];
117 };
118}