@cryptotaxi247 / infra-1
Code Commits Issues Pulls Sessions CI/CD
main
main
nix 148 lines 3.84 KB
Raw
1 { config, pkgs, ... }:
2
3 {
4 imports = [
5 ./nginx.nix
6 ./postgresql.nix
7 ];
8
9 fileSystems."/var/lib/matrix-synapse" = {
10 device = "zroot/root/matrix-synapse";
11 fsType = "zfs";
12 options = [ "zfsutil" ];
13 };
14
15 services.postgresql = {
16 ensureUsers = [
17 {
18 name = "matrix-synapse";
19 ensureDBOwnership = true;
20 }
21 ];
22 # Insufficient to create the database with the correct collation
23 # https://github.com/element-hq/synapse/blob/develop/docs/postgres.md#set-up-database
24 ensureDatabases = [ "matrix-synapse" ];
25 };
26
27 services.postgresqlBackup.databases = [ "matrix-synapse" ];
28
29 services.redis.servers.matrix-synapse = {
30 enable = true;
31 };
32
33 environment.systemPackages = with pkgs; [ synadm ];
34
35 services.backup.includesZfsDatasets = [ "/var/lib/matrix-synapse" ];
36
37 sops.secrets.matrix-synapse-signing-key = {
38 sopsFile = ../secrets/matrix-synapse-signing-key.caliban;
39 format = "binary";
40 path = "/var/lib/matrix-synapse/nixos.org.signing.key";
41 mode = "0600";
42 owner = "matrix-synapse";
43 group = "matrix-synapse";
44 };
45
46 sops.secrets.matrix-synapse-secrets = {
47 sopsFile = ../secrets/matrix-synapse-secrets.caliban;
48 format = "binary";
49 path = "/var/keys/matrix-synapse-secrets.conf";
50 mode = "0600";
51 owner = "matrix-synapse";
52 group = "matrix-synapse";
53 };
54
55 systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = [ "redis-matrix-synapse" ];
56
57 services.matrix-synapse = {
58 enable = true;
59 enableRegistrationScript = false; # not compatible with unix sockets
60 withJemalloc = true;
61
62 extraConfigFiles = [ config.sops.secrets.matrix-synapse-secrets.path ];
63
64 # https://github.com/element-hq/synapse/blob/master/docs/usage/configuration/config_documentation.md
65 settings = {
66 enable_metrics = true;
67
68 server_name = "nixos.org";
69 signing_key_path = config.sops.secrets.matrix-synapse-signing-key.path;
70 public_baseurl = "https://matrix.nixos.org";
71 admin_contact = "infra@nixos.org";
72 web_client_location = "https://matrix.to/#/#community:nixos.org";
73
74 allow_public_rooms_over_federation = true;
75 allow_public_rooms_without_auth = true;
76
77 max_upload_size = "50M";
78
79 media_retention = {
80 local_media_lifetime = "90d";
81 remote_media_lifetime = "14d";
82 };
83
84 database = {
85 name = "psycopg2";
86 args = {
87 host = "/run/postgresql";
88 };
89 };
90
91 redis = {
92 enabled = true;
93 path = config.services.redis.servers.matrix-synapse.unixSocket;
94 };
95
96 listeners = [
97 {
98 type = "http";
99 path = "/run/matrix-synapse/matrix-synapse.sock";
100 mode = "0660";
101 resources = [
102 {
103 compress = true;
104 names = [ "client" ];
105 }
106 {
107 compress = false;
108 names = [ "federation" ];
109 }
110 ];
111 }
112 {
113 type = "http";
114 bind_addresses = [
115 "127.0.0.1"
116 "::1"
117 ];
118 port = 8090;
119 tls = false;
120 resources = [ { names = [ "metrics" ]; } ];
121 }
122 ];
123 };
124 };
125
126 systemd.services.nginx.serviceConfig.SupplementaryGroups = [ "matrix-synapse" ];
127
128 services.nginx = {
129 clientMaxBodySize = config.services.matrix-synapse.settings.max_upload_size;
130 upstreams."matrix-synapse".servers = {
131 "unix:/run/matrix-synapse/matrix-synapse.sock" = { };
132 };
133 virtualHosts."matrix.nixos.org" = {
134 forceSSL = true;
135 enableACME = true;
136
137 locations."~* ^(/_matrix|/_synapse)" = {
138 proxyPass = "http://matrix-synapse";
139 };
140 locations."= /metrics" = {
141 proxyPass = "http://localhost:8090/_synapse/metrics";
142 };
143 locations."= /" = {
144 return = "301 https://matrix.to/#/#community:nixos.org";
145 };
146 };
147 };
148 }