blob: fb0b3d98e5906b768e83c3935710e48e6b28662d (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
{pkgs, ...}: let
fqdn = "matrix.vhack.eu";
clientConfig."m.homeserver".base_url = "https://${fqdn}";
serverConfig."m.server" = "${fqdn}:443";
mkWellKnown = data: ''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON data}';
'';
in {
networking.firewall.allowedTCPPorts = [80 443];
services.postgresql.enable = true;
services.postgresql.initialScript = pkgs.writeText "synapse-init.sql" ''
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
TEMPLATE template0
LC_COLLATE = "C"
LC_CTYPE = "C";
'';
services.nginx = {
enable = true;
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedProxySettings = true;
virtualHosts = {
"vhack.eu" = {
enableACME = true;
forceSSL = true;
locations = {
"/.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
"/.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
};
};
"matrix.vhack.eu" = {
enableACME = true;
forceSSL = true;
locations."/".extraConfig = ''
return 404;
'';
locations = {
"/_matrix".proxyPass = "http://[::1]:8008";
"/_synapse/client".proxyPass = "http://[::1]:8008";
};
};
};
};
services.matrix-synapse = {
enable = true;
dataDir = "/var/lib/matrix";
configFile = "/etc/matrix/matrix.conf";
settings = {
media_store_path = "/var/lib/matrix/media_store";
registration_shared_secret_path = "/run/registration_shared_secret";
server_name = "vhack.eu";
listeners = [
{
port = 8008;
bind_addresses = ["::1"];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = ["client" "federation"];
compress = true;
}
];
}
];
};
};
}
|
