defiant: Configure matrix-synapse. Remove janeway.

hosts/defiant/configuration.nix

@@ -6,6 +6,10 @@
       ../../base.nix
       ../../common/metrics-exporters.nix
       ./hardware-configuration.nix
+
+      ./services/postgresql.nix
+      ./services/nginx.nix
+      ./services/matrix-synapse.nix
   ];
 
   networking = {
@@ -13,13 +17,13 @@
     defaultGateway = "192.168.10.1";
     interfaces.enp3s0.ipv4 = {
       addresses = [
-      { address = "192.168.10.175"; prefixLength = 24; }
+        { address = "192.168.10.175"; prefixLength = 24; } # Main IP for defiant, internal
       ];
     };
     hostId = "8e84f235";
   };
 
-  # sops.defaultSopsFile = ../../secrets/defiant/defiant.yaml;
+  sops.defaultSopsFile = ../../secrets/defiant/defiant.yaml;
 
   environment.variables = { EDITOR = "vim"; };
   environment.systemPackages = with pkgs; [

hosts/defiant/services/matrix-synapse.nix

@@ -0,0 +1,84 @@
+{ config, pkgs, lib, ... }:
+{
+  sops.secrets."matrix/synapse/registrationsecret" = {
+    restartUnits = [ "matrix-synapse.service" ];
+    owner = "matrix-synapse";
+    group = "matrix-synapse";
+  };
+
+  services.matrix-synapse-next = {
+    enable = true;
+    enableNginx = true;
+
+    workers = {
+      federationSenders = 1;
+      federationReceivers = 2;
+      initialSyncers = 1;
+      normalSyncers = 1;
+      eventPersisters = 1;
+      useUserDirectoryWorker = true;
+    };
+
+    extraConfigFiles = [
+      config.sops.secrets."matrix/synapse/registrationsecret".path
+    ];
+
+    settings = {
+      server_name = "feal.no";
+      public_baseurl = "https://matrix.feal.no";
+      database.name = "psycopg2";
+      autocreate_auto_join_rooms = false;
+      max_upload_size = "50M";
+
+      #registration_shared_secret = "do_not_put_secret_here_use_extraConfigFiles";
+
+      trusted_key_servers = [
+        {
+          server_name = "matrix.org";
+          verify_keys = {};
+        }
+      ];
+
+      enable_registration = false;
+      use_presence = true;
+
+      url_preview_enabled = true;
+      url_preview_ip_range_blacklist = [
+        # synapse example config
+        "127.0.0.0/8"
+        "10.0.0.0/8"
+        "172.16.0.0/12"
+        "192.168.0.0/16"
+        "100.64.0.0/10"
+        "192.0.0.0/24"
+        "169.254.0.0/16"
+        "192.88.99.0/24"
+        "198.18.0.0/15"
+        "192.0.2.0/24"
+        "198.51.100.0/24"
+        "203.0.113.0/24"
+        "224.0.0.0/4"
+        "::1/128"
+        "fe80::/10"
+        "fc00::/7"
+        "2001:db8::/32"
+        "ff00::/8"
+        "fec0::/10"
+      ];
+
+      tls_certificate_path = "/etc/ssl-snakeoil/matrix_feal_no.crt";
+      tls_private_key_path = "/etc/ssl-snakeoil/matrix_feal_no.key";
+
+    };
+  };
+
+  services.redis.servers."".enable = true;
+
+  services.nginx.virtualHosts."matrix.feal.no" = {
+    listen = [
+      { addr = "192.168.10.175"; port = 43443; ssl = true; }
+      { addr = "192.168.10.175"; port = 43080; ssl = false; }
+    ];
+  };
+
+}

hosts/defiant/services/nginx.nix

@@ -0,0 +1,30 @@
+{ config, values, ... }:
+{
+  services.nginx = {
+    enable = true;
+    enableReload = true;
+
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+
+    defaultListen = [
+      {
+        addr = "192.168.10.175";
+        port = "80";
+        ssl = false;
+      }
+    ];
+  };
+
+  networking.firewall.allowedTCPPorts = [
+       80   443 # Internal / Default
+    43080 43443 # External / Publicly exposed
+  ];
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "felix@albrigtsen.it";
+  };
+}

hosts/defiant/services/postgresql.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, lib, ... }:
+{
+  services.postgresql = {
+    enable = true;
+    enableTCPIP = false;
+  };
+
+  services.postgresqlBackup = {
+    enable = true;
+    location = "/data/backup/postgresql/";
+    startAt = "*-*-* 03:15:00";
+    backupAll = true;
+  };
+
+
+  environment.systemPackages = [ config.services.postgresql.package ];
+}