blob: 043d9c072513b01b7015de0a16f21058839bb504 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
{
config,
pkgs,
...
}: let
fqdn = "matrix.vhack.eu";
clientConfig."m.homeserver".base_url = "https://${fqdn}";
serverConfig."m.server" = "${fqdn}:443";
mkWellKnown = data: ''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON data}';
'';
in {
networking.firewall.allowedTCPPorts = [80 443];
vhack.persist.directories = [
{
directory = "/var/lib/matrix";
user = "matrix-synapse";
group = "matrix-synapse";
mode = "0700";
}
{
directory = "/var/lib/mautrix-whatsapp";
user = "mautrix-whatsapp";
group = "matrix-synapse";
mode = "0750";
}
];
systemd.tmpfiles.rules = [
"d /etc/matrix 0755 matrix-synapse matrix-synapse"
];
services = {
postgresql = {
enable = true;
initialScript = pkgs.writeText "synapse-init.sql" ''
--Matrix:
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
--Whatsapp-bridge:
CREATE ROLE "mautrix-whatsapp" WITH LOGIN PASSWORD 'whatsapp';
CREATE DATABASE "mautrix-whatsapp" WITH OWNER "mautrix-whatsapp"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
'';
};
nginx = {
enable = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedProxySettings = true;
virtualHosts = {
"vhack.eu" = {
enableACME = true;
forceSSL = true;
locations = {
"/.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
"/.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
};
};
"matrix.vhack.eu" = {
enableACME = true;
forceSSL = true;
locations = {
"/".return = "404";
"/_matrix".proxyPass = "http://[::1]:8008";
"/_synapse/client".proxyPass = "http://[::1]:8008";
};
};
};
};
mautrix-whatsapp = {
# FIXME(@bpeetz): This was disabled because `mautrix-whatsapp` dependends on libolm.
# Re-enable it, when this has changed. <2024-09-06>
enable = false;
settings = {
appservice = {
database = {
type = "postgres";
uri = "postgres:///mautrix-whatsapp?host=/run/postgresql";
};
whatsapp = {
# TODO: See https://github.com/tulir/whatsmeow/blob/efc632c008604016ddde63bfcfca8de4e5304da9/binary/proto/def.proto#L43-L64 for a list.
# This also determines the WhatsApp icon
browser_name = "unknown";
};
};
homeserver.address = "https://matrix.vhack.eu";
bridge.permissions = {
"@soispha:vhack.eu" = "admin";
"@sils:vhack.eu" = "admin";
"@nightingale:vhack.eu" = "admin";
};
};
};
matrix-synapse = {
enable = true;
dataDir = "/var/lib/matrix";
configFile = "/etc/matrix/matrix.conf";
settings = {
media_store_path = "/var/lib/matrix/media_store";
registration_shared_secret_path = "${config.age.secrets.matrix-synapse_registration_shared_secret.path}";
server_name = "vhack.eu";
listeners = [
{
port = 8008;
bind_addresses = ["::1"];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = ["client" "federation"];
compress = true;
}
];
}
];
};
};
};
}
|
