my nixos config
fucking synapse??!! lets see how long this will last
+95
+1
machines/fovps/services/caddy/default.nix
+1
machines/fovps/services/caddy/default.nix
+1
machines/fovps/services/default.nix
+1
machines/fovps/services/default.nix
+93
machines/fovps/services/synapse.nix
+93
machines/fovps/services/synapse.nix
···
1
+
{ config, pkgs, lib, ... }:
2
+
3
+
with builtins;
4
+
let
5
+
domain = "eeep.ee";
6
+
synapsePort = 8008; # todo: unix socket maybe?
7
+
slidingPort = 8009;
8
+
9
+
synapse = config.services.matrix-synapse;
10
+
synapseUnit = config.systemd.services.matrix-synapse.serviceConfig;
11
+
in
12
+
{
13
+
services.matrix-synapse.enable = true;
14
+
services.matrix-synapse.withJemalloc = true; # hell why not
15
+
16
+
services.matrix-synapse.settings.server_name = domain;
17
+
services.matrix-synapse.settings.enableRegistrationScript = true;
18
+
19
+
# automatically created
20
+
services.matrix-synapse.settings.registration_shared_secret_path = "${synapse.dataDir}/.env.synapse-reg";
21
+
22
+
#services.coturn = {
23
+
# enable = true;
24
+
# use-auth-secret = true;
25
+
# static-auth-secret-file = "";
26
+
#};
27
+
28
+
services.matrix-synapse.settings.database.name = "psycopg2";
29
+
services.postgresql = let args = synapse.settings.database.args; in {
30
+
enable = true;
31
+
initdbArgs = [ "--locale=C" "--encoding=UTF8" ];
32
+
ensureDatabases = [ args.database ];
33
+
ensureUsers = [ { name = args.user; ensureDBOwnership = true; } ];
34
+
};
35
+
36
+
services.matrix-sliding-sync = {
37
+
enable = true;
38
+
createDatabase = true;
39
+
settings = {
40
+
SYNCV3_SERVER = "https://localhost:${toString synapsePort}";
41
+
SYNCV3_BINDADDR = "127.0.0.1:${toString slidingPort}";
42
+
};
43
+
# https://stackoverflow.com/questions/42835750/systemd-script-environment-file-updated-by-execstartpre
44
+
environmentFile = "${synapseUnit.WorkingDirectory}/.env.sliding-sync";
45
+
};
46
+
systemd.services.matrix-sliding-sync = rec {
47
+
preStart = let
48
+
envFile = config.services.matrix-sliding-sync.environmentFile;
49
+
in ''
50
+
if ! [ -f "${envFile}" ]; then
51
+
echo -n 'SYNCV3_SECRET=' > ${envFile}
52
+
${pkgs.openssl}/bin/openssl rand -hex 64 >> ${envFile}
53
+
fi
54
+
'';
55
+
serviceConfig = {
56
+
DynamicUser = lib.mkForce false;
57
+
User = synapseUnit.User;
58
+
Group = synapseUnit.Group;
59
+
WorkingDirectory = lib.mkForce synapseUnit.WorkingDirectory;
60
+
StateDirectory = lib.mkForce "";
61
+
EnvironmentFile = lib.mkForce "-${config.services.matrix-sliding-sync.environmentFile}";
62
+
};
63
+
};
64
+
65
+
services.matrix-synapse.settings.listeners = [
66
+
{
67
+
bind_addresses = [ "127.0.0.1" ];
68
+
port = synapsePort;
69
+
resources = [
70
+
{
71
+
compress = false;
72
+
names = [ "client" "federation" ];
73
+
}
74
+
];
75
+
tls = false;
76
+
type = "http";
77
+
x_forwarded = true;
78
+
}
79
+
];
80
+
services.caddy.enable = true;
81
+
services.caddy.virtualHosts."${domain}".extraConfig = ''
82
+
reverse_proxy /_matrix/* localhost:${toString synapsePort}
83
+
reverse_proxy /_synapse/client/* localhost:${toString synapsePort}
84
+
85
+
reverse_proxy /_matrix/client/unstable/org.matrix.msc3575/sync localhost:${toString slidingPort}
86
+
'';
87
+
services.caddy.virtualHosts."https://${domain}:8448".extraConfig = ''
88
+
reverse_proxy /_matrix/* localhost:${toString synapsePort}
89
+
respond / "Balls" 200
90
+
'';
91
+
networking.firewall.allowedTCPPorts = [ 8448 ];
92
+
networking.firewall.allowedUDPPorts = [ 8448 ];
93
+
}