146 lines
4.4 KiB
Nix
146 lines
4.4 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
myData,
|
|
...
|
|
}: {
|
|
options.mj.services.matrix-synapse = with lib.types; {
|
|
enable = lib.mkEnableOption "Enable matrix-synapse";
|
|
signingKeyPath = lib.mkOption {type = path;};
|
|
registrationSharedSecretPath = lib.mkOption {type = path;};
|
|
macaroonSecretKeyPath = lib.mkOption {type = path;};
|
|
};
|
|
|
|
config = lib.mkIf config.mj.services.matrix-synapse.enable {
|
|
services.matrix-synapse = {
|
|
enable = true;
|
|
extraConfigFiles = ["/run/matrix-synapse/secrets.yaml"];
|
|
settings = {
|
|
server_name = "jakstys.lt";
|
|
listeners = [
|
|
{
|
|
bind_addresses = ["0.0.0.0"];
|
|
port = myData.ports.matrix-synapse;
|
|
type = "http";
|
|
tls = false;
|
|
x_forwarded = true;
|
|
resources = [
|
|
{
|
|
names = ["client"];
|
|
compress = true;
|
|
}
|
|
{
|
|
names = ["federation"];
|
|
compress = false;
|
|
}
|
|
];
|
|
}
|
|
];
|
|
admin_contact = "motiejus@jakstys.lt";
|
|
enable_registration = false;
|
|
report_stats = true;
|
|
signing_key_path = "/run/matrix-synapse/jakstys_lt_signing_key";
|
|
log_config = pkgs.writeText "log.config" ''
|
|
version: 1
|
|
formatters:
|
|
precise:
|
|
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
|
|
handlers:
|
|
console:
|
|
class: logging.StreamHandler
|
|
formatter: precise
|
|
loggers:
|
|
synapse.storage.SQL:
|
|
level: WARN
|
|
root:
|
|
level: ERROR
|
|
handlers: [console]
|
|
disable_existing_loggers: false
|
|
'';
|
|
public_baseurl = "https://jakstys.lt/";
|
|
database.name = "sqlite3";
|
|
url_preview_enabled = false;
|
|
max_upload_size = "50M";
|
|
rc_messages_per_second = 0.2;
|
|
rc_message_burst_count = 10.0;
|
|
federation_rc_window_size = 1000;
|
|
federation_rc_sleep_limit = 10;
|
|
federation_rc_sleep_delay = 500;
|
|
federation_rc_reject_limit = 50;
|
|
federation_rc_concurrent = 3;
|
|
allow_profile_lookup_over_federation = false;
|
|
thumbnail_sizes = [
|
|
{
|
|
width = 32;
|
|
height = 32;
|
|
method = "crop";
|
|
}
|
|
{
|
|
width = 96;
|
|
height = 96;
|
|
method = "crop";
|
|
}
|
|
{
|
|
width = 320;
|
|
height = 240;
|
|
method = "scale";
|
|
}
|
|
{
|
|
width = 640;
|
|
height = 480;
|
|
method = "scale";
|
|
}
|
|
{
|
|
width = 800;
|
|
height = 600;
|
|
method = "scale";
|
|
}
|
|
];
|
|
user_directory = {
|
|
enabled = true;
|
|
search_all_users = false;
|
|
prefer_local_users = true;
|
|
};
|
|
allow_device_name_lookup_over_federation = false;
|
|
email = {
|
|
smtp_host = "127.0.0.1";
|
|
smtp_port = 25;
|
|
notf_for_new_users = false;
|
|
notif_from = "Jakstys %(app)s homeserver <noreply@jakstys.lt>";
|
|
};
|
|
include_profile_data_on_invite = false;
|
|
password_config.enabled = true;
|
|
require_auth_for_profile_requests = true;
|
|
};
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /run/matrix-synapse 0700 matrix-synapse matrix-synapse -"
|
|
];
|
|
|
|
systemd.services = {
|
|
matrix-synapse = let
|
|
# I tried to move this to preStart, but it complains:
|
|
# Config is missing macaroon_secret_key
|
|
secretsScript = pkgs.writeShellScript "write-secrets" ''
|
|
set -xeuo pipefail
|
|
umask 077
|
|
ln -sf ''${CREDENTIALS_DIRECTORY}/jakstys_lt_signing_key /run/matrix-synapse/jakstys_lt_signing_key
|
|
cat > /run/matrix-synapse/secrets.yaml <<EOF
|
|
registration_shared_secret: "$(cat ''${CREDENTIALS_DIRECTORY}/registration_shared_secret)"
|
|
macaroon_secret_key: "$(cat ''${CREDENTIALS_DIRECTORY}/macaroon_secret_key)"
|
|
EOF
|
|
'';
|
|
in {
|
|
serviceConfig.ExecStartPre = ["" secretsScript];
|
|
serviceConfig.LoadCredential = with config.mj.services.matrix-synapse; [
|
|
"jakstys_lt_signing_key:${signingKeyPath}"
|
|
"registration_shared_secret:${registrationSharedSecretPath}"
|
|
"macaroon_secret_key:${macaroonSecretKeyPath}"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|