non-critical-infra/matrix-synapse: init
Martin Weinelt committed
Jan 26, 2024 at 00:04 UTC
f73d6ace59d3bba40cbd4056c9678df7d612c43d
4 files changed
+236
non-critical-infra/hosts/caliban.nixos.org/default.nix
+1
@@ -8,6 +8,7 @@
8
inputs.srvos.nixosModules.hardware-hetzner-online-amd
9
../../modules/first-time-contribution-tagger.nix
10
../../modules/backup.nix
11
+ ../../modules/matrix-synapse.nix
12
../../modules/vaultwarden.nix
13
];
14
non-critical-infra/modules/matrix-synapse.nix
new
+171
@@ -0,0 +1,171 @@
1
+{ config
2
+, pkgs
3
+, ...
4
+}:
5
+
6
+{
7
+ imports = [
8
+ ./nginx.nix
9
+ ./postgresql.nix
10
+ ];
11
+
12
+ fileSystems."/var/lib/matrix-synapse" = {
13
+ device = "zroot/root/matrix-synapse";
14
+ fsType = "zfs";
15
+ options = [
16
+ "zfsutil"
17
+ ];
18
+ };
19
+
20
+ services.postgresql = {
21
+ ensureUsers = [ {
22
+ name = "matrix-synapse";
23
+ ensureDBOwnership = true;
24
+ } ];
25
+ # Insufficient to create the database with the correct collation
26
+ # https://github.com/element-hq/synapse/blob/develop/docs/postgres.md#set-up-database
27
+ ensureDatabases = [
28
+ "matrix-synapse"
29
+ ];
30
+ };
31
+
32
+ services.postgresqlBackup.databases = [
33
+ "matrix-synapse"
34
+ ];
35
+
36
+ services.redis.servers.matrix-synapse = {
37
+ enable = true;
38
+ };
39
+
40
+ environment.systemPackages = with pkgs; [
41
+ matrix-synapse-tools.synadm
42
+ ];
43
+
44
+ services.backup.includesZfsDatasets = [
45
+ "/var/lib/matrix-synapse"
46
+ ];
47
+
48
+ sops.secrets.matrix-synapse-signing-key = {
49
+ sopsFile = ../secrets/matrix-synapse-signing-key.caliban;
50
+ format = "binary";
51
+ path = "/var/lib/matrix-synapse/nixos.org.signing.key";
52
+ mode = "0600";
53
+ owner = "matrix-synapse";
54
+ group = "matrix-synapse";
55
+ };
56
+
57
+ sops.secrets.matrix-synapse-secrets = {
58
+ sopsFile = ../secrets/matrix-synapse-secrets.caliban;
59
+ format = "binary";
60
+ path = "/var/keys/matrix-synapse-secrets.conf";
61
+ mode = "0600";
62
+ owner = "matrix-synapse";
63
+ group = "matrix-synapse";
64
+ };
65
+
66
+ systemd.services.matrix-synapse.serviceConfig.SupplementaryGroups = [
67
+ "redis-matrix-synapse"
68
+ ];
69
+
70
+ #systemd.services.matrix-synapse.enable = false;
71
+
72
+ services.matrix-synapse = {
73
+ enable = true;
74
+ withJemalloc = true;
75
+
76
+ extraConfigFiles = [
77
+ config.sops.secrets.matrix-synapse-secrets.path
78
+ ];
79
+
80
+ # https://github.com/element-hq/synapse/blob/master/docs/usage/configuration/config_documentation.md
81
+ settings = {
82
+ enable_metrics = true;
83
+
84
+ server_name = "nixos.org";
85
+ signing_key_path = config.sops.secrets.matrix-synapse-signing-key.path;
86
+ public_baseurl = "https://matrix.nixos.org";
87
+ admin_contact = "infra@nixos.org";
88
+ web_client_location = "https://matrix.to/#/#community:nixos.org";
89
+
90
+ allow_public_rooms_over_federation = true;
91
+ allow_public_rooms_without_auth = true;
92
+
93
+ max_upload_size = "50M";
94
+
95
+ media_retention = {
96
+ local_media_lifetime = "90d";
97
+ remote_media_lifetime = "14d";
98
+ };
99
+
100
+ database = {
101
+ name = "psycopg2";
102
+ args = {
103
+ host = "/run/postgresql";
104
+ };
105
+ };
106
+
107
+ redis = {
108
+ enabled = true;
109
+ path = config.services.redis.servers.matrix-synapse.unixSocket;
110
+ };
111
+
112
+ listeners = [ {
113
+ type = "http";
114
+ # TODO: migrate to UNIX domain socket
115
+ #path = "/run/matrix-synapse/matrix-synapse.sock";
116
+ #mode = "0660";
117
+ port = 8008;
118
+ tls = false;
119
+ resources = [ {
120
+ compress = true;
121
+ names = [
122
+ "client"
123
+ ];
124
+ } {
125
+ compress = false;
126
+ names = [
127
+ "federation"
128
+ ];
129
+ } ];
130
+ } {
131
+ type = "http";
132
+ bind_addresses = [
133
+ "127.0.0.1"
134
+ "::1"
135
+ ];
136
+ port = 8090;
137
+ tls = false;
138
+ resources = [ {
139
+ names = [
140
+ "metrics"
141
+ ];
142
+ } ];
143
+ } ];
144
+ };
145
+ };
146
+
147
+ systemd.services.nginx.serviceConfig.SupplementaryGroups = [ "matrix-synapse" ];
148
+
149
+ services.nginx = {
150
+ clientMaxBodySize = config.services.matrix-synapse.settings.max_upload_size;
151
+ upstreams."matrix-synapse".servers = {
152
+ # TODO: migrate to UNIX domain socket
153
+ #"unix:/run/matrix-synapse/matrix-synapse.sock" = {};
154
+ "localhost:8008" = {};
155
+ };
156
+ virtualHosts."matrix.nixos.org" = {
157
+ forceSSL = true;
158
+ enableACME = true;
159
+
160
+ locations."~* ^(\/_matrix|\/_synapse)" = {
161
+ proxyPass = "http://matrix-synapse";
162
+ };
163
+ locations."= /metrics" = {
164
+ proxyPass = "http://localhost:8090/_synapse/metrics";
165
+ };
166
+ locations."= /" = {
167
+ return = "301 https://matrix.to/#/#community:nixos.org";
168
+ };
169
+ };
170
+ };
171
+}
non-critical-infra/secrets/matrix-synapse-secrets.caliban
new
+32
@@ -0,0 +1,32 @@
1
+{
2
+ "data": "ENC[AES256_GCM,data:DR4VtLpBFM90uasJLqEdu7LQ0x3rof4qxuSlBtAfPVSVfKOYFx/NBYGdHIt/A45mhKIq/Rp14GK6pFX4mxt+9LhZHdaPUoiJ3OzW2Iwn0faevevvH1t9bA/rw2+UB9iGW9NtK6IsSdKzqsazlLCrM9nYlvkpMQCaWw==,iv:otJmMFZ5HvjKK4JyBbYizw0ZW2D4TWhKebY1F2Im+Bk=,tag:fcehpFiM6HMgS6bjbLRx4Q==,type:str]",
3
+ "sops": {
4
+ "kms": null,
5
+ "gcp_kms": null,
6
+ "azure_kv": null,
7
+ "hc_vault": null,
8
+ "age": [
9
+ {
10
+ "recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1MW1WZ1VWWWwxbnAwcHdt\nM041MCtWMm5LbDdFVEd3alVaV2tSeEErRzFRCkRzOXRCOE1jRTIvcUhXWXozS1h5\nTlEyL2E3NmFUSkhTZCszYyt0a3JVUm8KLS0tIGxUUDBYaXk2NnF2alJaaFNGWTFH\nYXloZFNIVFZET0RZTndvM1VtMGpDTGsKK5HIxpvdy1HGOlp0MGd83u0A9KPbSK+4\n15023XKE/5zuFOzWOtxyxA/A8O6MnGIrw8tOVzXp5bFRwRWa/g/a0A==\n-----END AGE ENCRYPTED FILE-----\n"
12
+ },
13
+ {
14
+ "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSbk1ORTNCVzhPWWZJcHAy\nUlFYcmwrUlE0OXJ5TDNIbTdXWm1SdHJYalZjClQvNjJQSGp1ZTlzU2htL1N5QS81\nUzRjc3NjVGovVXhaRkNVbEhhMGJLdUkKLS0tIHdibjNrRDV1UW5Qdlp6UVE1RGNv\nd1lESFZDUmVYSmd4dC8zWHU4TU1PY3MKGkdm8io6SP0oAJeOFEjB/lbZB9XI4UMa\nnfmiA9NbwovvBATiYhNpEcpQ+lxhcR59a7ZyTWexWxtMfDvhJ1HrQw==\n-----END AGE ENCRYPTED FILE-----\n"
16
+ },
17
+ {
18
+ "recipient": "age1qlwzeg37fwwn2l6fm3quvkn787nn0m89xrjtrhgf9uedtfv2kqlqnec976",
19
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMYVhGc1F0SlN3SnpWamFF\nYkFuSUxPWmxTM3E0R0R4RlBIYVJBKzhNMEFnCkVTbW1VRWpUYUJYSHRoWTBIWFc3\nd2xxWEViNHlza1o3cEtwSUVYcDl2TW8KLS0tIGdxSmRxd2YzY0Q1b2V3aGtzMHRo\nRFNmYUVvTDljVTJnQjZsamVjSUt5QW8KZGntSWX35XlLeKkuw/BmBuWKKEasCyyP\nn+/2rokVu/DTKiTaTMJXUd2CWj7qNc7HwCMV8ibOGjkIi7KQNYwNuQ==\n-----END AGE ENCRYPTED FILE-----\n"
20
+ },
21
+ {
22
+ "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
23
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXUkdjK04wOEJZQ3hTYzI1\ncU9MTCtpT2RPSmhWOHd1emNGakorR2RPVEVnCmI3Y3ZEYkZMNEQ0QTloM2VaMXVF\nSGZvK25rV1N0R3h0Vy9VV3BUd2QxbGMKLS0tIE90YkpqQTFPVVpISC9jYzU0SHNV\nQ0JmMWx1cEp0cjRsaVk4WUEwWVJSbDgKKJGl6cv+IAz1h3XZyL/W1Q2l6nZXmEyQ\nB5nCzVY/Yr2g45eIjfTZKCo2ORxG6HvDkK8MnVpMr3dfCv7XbRi7qA==\n-----END AGE ENCRYPTED FILE-----\n"
24
+ }
25
+ ],
26
+ "lastmodified": "2024-05-20T18:18:09Z",
27
+ "mac": "ENC[AES256_GCM,data:/GTwJwCXHqE/iOpcPCU69W1nV8SUBr3rauQ7aZP8N777yQzieka8/trJuMvuaJBg0cotm7Vr5krwrZC8kOqoZcf2jIK3E4p7/Y8Eos30VZIGnkF64FFjBACbxjwox+xUsOGxV9mGF1qQcZFx4L/S98qWzeReZV60HqGWshh6+pc=,iv:C0GN3+dRiguHA5YFhw/AFWfYItVKiy7Sqz0rR+07GM8=,tag:lyGhs+8Abb1Rp+qaQ9MFSg==,type:str]",
28
+ "pgp": null,
29
+ "unencrypted_suffix": "_unencrypted",
30
+ "version": "3.8.1"
31
+ }
32
+}
\ No newline at end of file
non-critical-infra/secrets/matrix-synapse-signing-key.caliban
new
+32
@@ -0,0 +1,32 @@
1
+{
2
+ "data": "ENC[AES256_GCM,data:FcqlB9tJ2ZfjhoYfvC82Ik8F120my/ZfRDg9eqEdwNkI51QaqjIhAzlAcyHmO+b2G/c9U5cy2bvMUgU=,iv:5ZsY473w3kQP4qK8CPdXCR90GTnn60I3LqGm/HMhuL4=,tag:0s/qx94SeE+580724rSgGA==,type:str]",
3
+ "sops": {
4
+ "kms": null,
5
+ "gcp_kms": null,
6
+ "azure_kv": null,
7
+ "hc_vault": null,
8
+ "age": [
9
+ {
10
+ "recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQRHU0d3VjN0loVlpZTjF0\nUS9BSUF2ZHFIcHBIRTNFYkFrbkYyUDFKaGlvCld2RWpTK0ZucGk4ak1Mdk1LOGNF\nTm5zUVduaVNINUJyTzl5KzNTSEY3MmcKLS0tIEgyWjZZYVVSK2VkRlNxM29keXpz\nSTIza1lCdUhVdUFFSU9sRFJzVXQ1NzQKyN8JSEWuGxibgdozgcoEEfXTjlHV0Lro\n9LysFUn88RjHDvYX7c5V41NOQUESJcPK3DI78yxHWzsHpmWMjNtsBA==\n-----END AGE ENCRYPTED FILE-----\n"
12
+ },
13
+ {
14
+ "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpM2dEcnJ2MG81bkdtbGFk\nNXZaSTdGZUNOVXQ0dWNvMXFFSGlZcTBwN1JNCm5YOVpjU3dOY3pGNG5XdUhxcFhN\nMzJjK1JOSExmeW5nL001WHhyYmhzUkkKLS0tIDEyR1VrcjdOa01IbEhBZ3lSTUdn\nZlRXRjFUVTMyNmN0eFBJaXdKVTVOVzQKvcpNDONcstOtRzu++3Odt9F0IhG/FB0t\nmPHw6zfYSjmpSv+nVXSOUpNnk9pcGWWtQojHukhXLMIAXssGH0hggg==\n-----END AGE ENCRYPTED FILE-----\n"
16
+ },
17
+ {
18
+ "recipient": "age1qlwzeg37fwwn2l6fm3quvkn787nn0m89xrjtrhgf9uedtfv2kqlqnec976",
19
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVcFN1OUJvbXFKNHVIRk8r\nNTFkK3BaYUpmaGxIRWROaW1WQjQyN1FXZm1VCkh5YVVocExJYjQ4eUNuSVNvY0ww\nZlVnWlJJQUQwSHlGeUJDQ1ducEE0Qm8KLS0tIHdSdTRjRFMvZkN6VSszTlk4ZjN5\nUHdQRjh5NG84eDRzMkxqaWd4OGRDZTAKc01sHFNXUbi29RtvdKe4AOsVagqj7GDT\nfeiKgMhn5kEz3Rex75gDKa7nZf4bfWOlQrKrnC6L5t4G684qoChf6A==\n-----END AGE ENCRYPTED FILE-----\n"
20
+ },
21
+ {
22
+ "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
23
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSbWZTTnJ6V0hMZEIvWWRY\nMDJZTFJtVnJqTEJrVGZhUGRyRThZRUVlblNJCmRMUTFhMEZmY2xOTzgwdkZqRVht\naUVWd2IxY0M1YU11TEhCQnhJQzVRQm8KLS0tIGFxNnp0S0dobVJiL1pxMlFSTkNQ\na3JvN0xEUFROcUVXUDVKSndhSjQ1cXcKNHzS6W8Kbvo67rICS0w5HSTcEgztBpzP\nvL8yeNh1iAcWs3YtVnmitl5dwDMxNQFiWsbOxPr/vhHN64bS4J+MHA==\n-----END AGE ENCRYPTED FILE-----\n"
24
+ }
25
+ ],
26
+ "lastmodified": "2024-05-20T19:05:40Z",
27
+ "mac": "ENC[AES256_GCM,data:tM0GE88qNSKpy/QUJDl4okf5eMbJKSiiCZrAfbJtz8V+nqiwqSTx0PYUjLcd2TIXHIicNg8bGovAp21Pm4YtOXMgLygFfNxWnGVXe2w9RcinUDOtXE1MwhJrDV3dvGWQg8C58LgzDWiq+kqgrR4m5YOk3mZUPU4dvj8HQcQ8C4s=,iv:w3nI1jPi+ObeHz32qhiXR/Zf9cRvYXJCMixkPTE+JBw=,tag:lGVfIjwKUgtez//4Uh94hg==,type:str]",
28
+ "pgp": null,
29
+ "unencrypted_suffix": "_unencrypted",
30
+ "version": "3.8.1"
31
+ }
32
+}
\ No newline at end of file