nixos-config/services/matrix.nix

293 lines
7.4 KiB
Nix
Raw Permalink Normal View History

2021-01-29 13:59:41 +01:00
# Matrix homeserver setup, using different endpoints for federation and client
# traffic. The main trick for this is defining two nginx servers endpoints for
# matrix.domain.com, each listening on different ports.
#
# Configuration inspired by :
#
# - https://github.com/delroth/infra.delroth.net/blob/master/roles/matrix-synapse.nix
# - https://nixos.org/manual/nixos/stable/index.html#module-services-matrix
#
2022-04-10 11:54:58 +02:00
{
config,
lib,
pkgs,
...
}: let
inherit
(lib)
2022-01-11 16:08:21 +01:00
mkEnableOption
mkIf
mkOption
optionals
2022-04-10 11:54:58 +02:00
;
2022-01-11 16:08:21 +01:00
cfg = config.my.services.matrix;
my = config.my;
2022-04-10 11:54:58 +02:00
federationPort = {
public = 8448;
private = 11338;
};
clientPort = {
public = 443;
private = 11339;
};
domain = config.networking.domain;
hostname = config.networking.hostName;
fqdn = "${hostname}.${domain}";
in {
2022-04-10 11:54:58 +02:00
options.my.services.matrix = let
inherit (lib) types;
in {
2022-01-11 16:08:21 +01:00
enable = mkEnableOption "Matrix Synapse";
2021-02-02 01:20:31 +01:00
secretConfigFile = mkOption {
type = types.nullOr types.path;
2021-02-02 01:20:31 +01:00
default = null;
example = "/var/run/my_secrets/config.secret";
description = "Secrets file included in configuration";
2021-02-02 01:20:31 +01:00
};
};
2022-01-11 16:08:21 +01:00
config = mkIf cfg.enable {
services.postgresql = {
enable = true;
ensureDatabases = ["matrix-synapse"];
ensureUsers = [
{
name = "matrix-synapse";
ensureDBOwnership = true;
}
];
};
2021-03-23 22:24:12 +01:00
services.postgresqlBackup = {
2022-04-10 11:54:58 +02:00
databases = ["matrix-synapse"];
2021-01-30 19:32:46 +01:00
};
services.matrix-synapse = {
enable = true;
extraConfigFiles = optionals (cfg.secretConfigFile != null) [
cfg.secretConfigFile
];
2021-05-21 10:00:46 +02:00
settings = let
logConfig = ''
version: 1
# In systemd's journal, loglevel is implicitly stored, so let's omit it
# from the message text.
formatters:
journal_fmt:
format: '%(name)s: [%(request)s] %(message)s'
filters:
context:
(): synapse.util.logcontext.LoggingContextFilter
request: ""
handlers:
journal:
class: systemd.journal.JournalHandler
formatter: journal_fmt
filters: [context]
SYSLOG_IDENTIFIER: synapse
root:
level: WARN
handlers: [journal]
disable_existing_loggers: False
'';
in {
server_name = domain;
public_baseurl = "https://matrix.${domain}";
account_threepid_delegates = {
msisdn = "https://vector.im";
};
listeners = [
# Federation
{
2022-04-10 11:54:58 +02:00
bind_addresses = ["::1"];
port = federationPort.private;
2022-04-10 11:54:58 +02:00
tls = false; # Terminated by nginx.
x_forwarded = true;
2022-04-10 11:54:58 +02:00
resources = [
{
names = ["federation"];
compress = false;
}
];
}
# Client
{
2022-04-10 11:54:58 +02:00
bind_addresses = ["::1"];
port = clientPort.private;
2022-04-10 11:54:58 +02:00
tls = false; # Terminated by nginx.
x_forwarded = true;
2022-04-10 11:54:58 +02:00
resources = [
{
names = ["client"];
compress = false;
}
];
}
];
experimental_features = {
spaces_enabled = true;
};
2022-03-12 13:52:29 +01:00
use_presence = true;
email = {
require_transport_security = true;
};
log_config = pkgs.writeText "log_config.yaml" logConfig;
};
};
services.nginx = {
2021-01-29 13:59:41 +01:00
virtualHosts = {
"matrix.${domain}" = {
onlySSL = true;
useACMEHost = fqdn;
2022-04-10 11:54:58 +02:00
locations = let
proxyToClientPort = {
proxyPass = "http://[::1]:${toString clientPort.private}";
};
2022-04-10 11:54:58 +02:00
in {
# Or do a redirect instead of the 404, or whatever is appropriate
# for you. But do not put a Matrix Web client here! See the
# Element web section below.
"/".return = "404";
"/_matrix" = proxyToClientPort;
"/_synapse/client" = proxyToClientPort;
2022-12-19 01:25:05 +01:00
"/health" = proxyToClientPort;
2022-04-10 11:54:58 +02:00
};
2021-01-29 13:59:41 +01:00
listen = [
2022-04-10 11:54:58 +02:00
{
addr = "0.0.0.0";
port = clientPort.public;
ssl = true;
}
{
addr = "[::]";
port = clientPort.public;
ssl = true;
}
2021-01-29 13:59:41 +01:00
];
};
2021-01-29 13:59:41 +01:00
# same as above, but listening on the federation port
"matrix.${domain}_federation" = rec {
onlySSL = true;
serverName = "matrix.${domain}";
useACMEHost = fqdn;
2021-01-29 13:59:41 +01:00
locations."/".return = "404";
locations."/_matrix" = {
proxyPass = "http://[::1]:${toString federationPort.private}";
};
listen = [
2022-04-10 11:54:58 +02:00
{
addr = "0.0.0.0";
port = federationPort.public;
ssl = true;
}
{
addr = "[::]";
port = federationPort.public;
ssl = true;
}
];
};
"${domain}" = {
2021-01-29 13:59:41 +01:00
forceSSL = true;
useACMEHost = fqdn;
2022-04-10 11:54:58 +02:00
locations."= /.well-known/matrix/server".extraConfig = let
server = {"m.server" = "matrix.${domain}:${toString federationPort.public}";};
in ''
2021-01-29 13:59:41 +01:00
add_header Content-Type application/json;
return 200 '${builtins.toJSON server}';
'';
2022-04-10 11:54:58 +02:00
locations."= /.well-known/matrix/client".extraConfig = let
client = {
"m.homeserver" = {"base_url" = "https://matrix.${domain}";};
"m.identity_server" = {"base_url" = "https://vector.im";};
};
# ACAO required to allow element-web on any URL to request this json file
in ''
2021-01-29 13:59:41 +01:00
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON client}';
'';
};
2021-01-29 14:32:43 +01:00
# Element Web app deployment
#
"chat.${domain}" = {
useACMEHost = fqdn;
2021-01-29 14:32:43 +01:00
forceSSL = true;
root = pkgs.element-web.override {
conf = {
default_server_config = {
"m.homeserver" = {
"base_url" = "https://matrix.${domain}";
"server_name" = "${domain}";
};
"m.identity_server" = {
"base_url" = "https://vector.im";
};
};
showLabsSettings = true;
defaultCountryCode = "FR"; # cocorico
roomDirectory = {
"servers" = [
"matrix.org"
"mozilla.org"
"prologin.org"
];
};
};
};
};
};
};
security.acme.certs.${fqdn}.extraDomainNames = ["chat.${domain}" "matrix.${domain}" domain];
# For administration tools.
2022-04-10 11:54:58 +02:00
environment.systemPackages = [pkgs.matrix-synapse];
networking.firewall.allowedTCPPorts = [
clientPort.public
federationPort.public
];
my.services.restic-backup = let
2021-03-24 19:06:03 +01:00
dataDir = config.services.matrix-synapse.dataDir;
2022-06-12 21:00:19 +02:00
in {
paths = [dataDir];
# this is just caching for other servers media, doesn't need backup
exclude = ["${dataDir}/media/remote_*"];
};
};
}