Add matrix-synapse

hosts/voyager/configuration.nix

@@ -8,11 +8,13 @@
       ./hardware-configuration.nix
       ./filesystems.nix
       ./exports.nix
+
       #./vms.nix
 
       ./services/nginx
       ./services/postgres.nix
       ./services/kanidm.nix
+      ./services/matrix
       ./services/jellyfin.nix
       ./services/metrics
       ./services/flame.nix

hosts/voyager/services/matrix/default.nix

@@ -0,0 +1,12 @@
+{ config, ... }:
+{
+  imports = [
+    ./synapse.nix
+#    ./bridge-facebook.nix
+#    ./bridge-discord.nix
+#    ./element.nix
+#    ./coturn.nix
+#    ./discord.nix
+  ];
+}
+

hosts/voyager/services/matrix/synapse.nix

@@ -0,0 +1,104 @@
+{ config, pkgs, ... }:
+let
+  main_ip = "127.0.1.2";
+in
+{
+  sops.secrets."matrix/synapse/registrationsecret" = {
+    restartUnits = [ "matrix-synapse.service" ];
+    owner = "matrix-synapse";
+    group = "matrix-synapse";
+  };
+
+  services.matrix-synapse = {
+    enable = true;
+    package = pkgs.matrix-synapse;
+
+    extraConfigFiles = [
+      config.sops.secrets."matrix/synapse/registrationsecret".path
+    ];
+
+    settings = {
+      server_name = "feal.no";
+      public_baseurl = "https://matrix.feal.no";
+      database.name = "psycopg2";
+      autocreate_auto_join_rooms = false;
+      max_upload_size = "50M";
+
+      #registration_shared_secret = "do_not_put_secret_here_use_extraConfigFiles";
+
+      trusted_key_servers = [
+        {
+          server_name = "matrix.org";
+          verify_keys = {};
+        }
+      ];
+
+      enable_registration = false;
+      use_presence = true;
+
+      url_preview_enabled = true;
+      url_preview_ip_range_blacklist = [
+        # synapse example config
+        "127.0.0.0/8"
+        "10.0.0.0/8"
+        "172.16.0.0/12"
+        "192.168.0.0/16"
+        "100.64.0.0/10"
+        "192.0.0.0/24"
+        "169.254.0.0/16"
+        "192.88.99.0/24"
+        "198.18.0.0/15"
+        "192.0.2.0/24"
+        "198.51.100.0/24"
+        "203.0.113.0/24"
+        "224.0.0.0/4"
+        "::1/128"
+        "fe80::/10"
+        "fc00::/7"
+        "2001:db8::/32"
+        "ff00::/8"
+        "fec0::/10"
+      ];
+
+      tls_certificate_path = "/etc/ssl-snakeoil/matrix_feal_no.crt";
+      tls_private_key_path = "/etc/ssl-snakeoil/matrix_feal_no.key";
+
+      listeners = [
+        { port = 8008;
+          bind_addresses = [ main_ip ];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+          resources = [
+            { names = [ "client" ]; compress = true; }
+            { names = [ "federation" ]; compress = true; }
+          ];
+        }
+      ];
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.nginx = {
+    enable = true;
+    enableReload = true;
+
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedProxySettings = true;
+
+    virtualHosts."matrix.feal.no" = {
+      locations."/_matrix" = {
+        proxyPass = "http://${main_ip}:8008";
+        extraConfig = ''
+          client_max_body_size 50M;
+        '';
+      };
+      # locations."/_synapse/client".proxyPass = "http://${main_ip}:8008";
+      locations."/" = {
+        proxyPass = "http://${main_ip}:8008";
+      };
+    };
+  };
+}

secrets/voyager/voyager.yaml

@@ -10,6 +10,9 @@
 #ENC[AES256_GCM,data:fvJA2s0OEs7PDOr/,iv:HlO9MCqBHtz1Hm9tILlEsJ2gfgTPThmmyoCXlGyy/9Y=,tag:7L1Kl4RgAFG+WLvtk30nYQ==,type:comment]
 hedgedoc:
     env: ENC[AES256_GCM,data:okkj5V0veAwWwdmhjhsd4seAHiBOjdk7m80C3iVi78LNeHlNuGL2zdvKV5b4ClUR3awabotR/QwdvSvCUxZiFRpXwyeETxHPRRTtR4VDL1L4MifJ0LS27A5DAzAdjCjc799ckgDyBn5L3+T6P1136X0PnaXQT1KyRegizC1DFQ15/3fvlIe05tonDwDVAsPkV8ZEtmGuseB87yoFBxs=,iv:VKwB+AAq4kgOYwntHNXK+xdf0kk+sn39jAxJhLFiqdw=,tag:6bDyl7c23uAWMzVrJ5/YYQ==,type:str]
+matrix:
+    synapse:
+        registrationsecret: ENC[AES256_GCM,data:lrj4itbDdfwSJYlvgYbWy2bcgNj69DJA2gzLUiN2AINRfoprsZI7kbNvJO0E2FVPWrfcB6HSHqomgIi6G+77NoyPOSTzzI6aHMvt4Ups6/KpQFpR2QV3VykzADoagWs=,iv:GiuT4lAD8/ZPgTVwXUaHmjSvzHqnGPzAuwxFBlzU8O0=,tag:79tuTluST8E6gigm9Z7nEQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -34,8 +37,8 @@ sops:
             THFRNjZXc0RsS0xKK1BkeEU1UzA4MW8KgOIQyL6A9u+Ii8zYkHJDWVAG/EEc61Qh
             u+VFyGB7esTG56G19u1aCHB/NUxG5HYMG/DEqH/SyCyKUvHrXjEF4g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-26T11:53:47Z"
+    lastmodified: "2023-05-09T21:06:32Z"
-    mac: ENC[AES256_GCM,data:CQi0+67t6NrYFlpqry7lULIlQs3adLG1L9bH7iYDhAPF/1Bi/A3OrKZfdNozp/VRqBlMnfp2z6UWh9ScvI1V5aOWfsTfEFKF4l945rwN4f7MYYRaYtgSDSefAoZrgE036Fzuh2seDDcvfoeOEnQ1VJ6BD/1wSrMPP1z1F3au1dE=,iv:cMZUXzedX1Gjkqn1uAZ1gufehtYQ9X/A8m/GRF5TLZw=,tag:C231MYSPUvYnAYiJ4TjdFA==,type:str]
+    mac: ENC[AES256_GCM,data:C/vZmn+jVNaakJxv6XjtMaXDO0CLhTEG8ZSpFBkobd8IKRnsn3OwNySQN0RvIzYL3kaDaS2twEOKN2h3eTcDbX6nNa3m4Eagv7fwXw8yTY2T6pVBni9qudZzlzPpxXSmR7sZYqtay05NdwgSEuu8qIP+S4ECtiSo0JHMdyP1YpQ=,iv:iJsKgA/YjYQ9gVO8ET70+0SdjMTIkbzh2yIkgiFQ+4Y=,tag:ytHaCBJxO1J60lfRQBKplw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.7.3