matrix: migrate server and setup federation

It works, but looks and feels hacky. Needs cleanups

configuration.nix

@@ -75,6 +75,8 @@
       useACME = true;
       domain = "monitoring.${config.networking.domain}";
     };
+
+    matrix.enable = true;
   };
 
   security.acme.acceptTerms = true;

services/default.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ./matrix.nix
     ./monitoring.nix
   ];
 }

services/matrix.nix

@@ -0,0 +1,102 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.my.services.matrix;
+
+  federationPort = { public = 8448; private = 11338; };
+  clientPort = { public = 443; private = 11339; };
+  domain = config.networking.domain;
+in {
+  options.my.services.matrix = {
+    enable = lib.mkEnableOption "Matrix Synapse";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.postgresql = {
+      enable = true;
+      package = pkgs.postgresql_12;
+    };
+
+    services.matrix-synapse = {
+      enable = true;
+      server_name = domain;
+      public_baseurl = "https://matrix.${domain}";
+
+      listeners = [
+        # Federation
+        {
+          bind_address = "127.0.0.1";
+          port = federationPort.private;
+          tls = false;  # Terminated by nginx.
+          x_forwarded = true;
+          resources = [ { names = [ "federation" ]; compress = false; } ];
+        }
+
+        # Client
+        {
+          bind_address = "127.0.0.1";
+          port = clientPort.private;
+          tls = false;  # Terminated by nginx.
+          x_forwarded = true;
+          resources = [ { names = [ "client" ]; compress = false; } ];
+        }
+      ];
+    };
+
+    services.nginx = {
+      enable = true;
+
+      recommendedGzipSettings = true;
+      recommendedTlsSettings = true;
+      recommendedProxySettings = true;
+
+      virtualHosts = let
+        passToMatrix = port: {
+          proxyPass = "http://127.0.0.1:${toString port}";
+        };
+      in {
+        "matrix.${domain}" = {
+          forceSSL = true;
+          enableACME = true;
+
+          locations."/" = passToMatrix clientPort.private;
+        };
+
+        "matrix.${domain}_federation" = rec {
+          onlySSL = true;
+          serverName = "matrix.${domain}";
+          useACMEHost = serverName;
+
+          listen = [
+            { addr = "0.0.0.0"; port = federationPort.public; ssl = true; }
+            { addr = "[::]"; port = federationPort.public; ssl = true; }
+          ];
+
+          locations."/" = passToMatrix federationPort.private;
+        };
+
+        "${domain}" = {
+          onlySSL = true;
+          enableACME = true;
+
+          listen = [
+            { addr = "0.0.0.0"; port = federationPort.public; ssl = true; }
+            { addr = "[::]"; port = federationPort.public; ssl = true; }
+          ];
+
+          locations."/" = passToMatrix federationPort.private;
+        };
+      };
+    };
+
+    # For administration tools.
+    environment.systemPackages = [ pkgs.matrix-synapse ];
+
+    networking.firewall.allowedTCPPorts = [
+      clientPort.public
+      federationPort.public
+    ];
+  };
+}