Self host matrixy-synapse on sisko

modules/cloudflare-dyndns/default.nix

@@ -4,13 +4,15 @@
     ipv4 = true;
     ipv6 = false; # not anymore 😭
     domains = [
-      # "sevenofnix.aciceri.dev"
+      "aciceri.dev"
+      "git.aciceri.dev"
       "home.aciceri.dev"
       "torrent.aciceri.dev"
       "search.aciceri.dev"
       "invidious.aciceri.dev"
       "vpn.aciceri.dev"
       "cache.aciceri.dev"
+      "matrix.aciceri.dev"
     ];
     apiTokenFile = config.age.secrets.cloudflare-dyndns-api-token.path;
   };

modules/matrix/default.nix

@@ -0,0 +1,77 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  clientConfig."m.homeserver".base_url = "https://matrix.aciceri.dev";
+  serverConfig."m.server" = "matrix.aciceri.dev:443";
+  mkWellKnown = data: ''
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${builtins.toJSON data}';
+  '';
+in {
+  imports = [../nginx-base];
+
+  services.nginx.virtualHosts = {
+    "aciceri.dev" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
+      locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
+    };
+    "matrix.aciceri.dev" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/".proxyPass = "http://127.0.0.1:${builtins.toString (lib.head config.services.matrix-synapse.settings.listeners).port}";
+      locations."/_matrix".proxyPass = "http://localhost:8008";
+      locations."/_synapse/client".proxyPass = "http://localhost:8008";
+    };
+  };
+
+  services.postgresql = {
+    enable = true;
+    initialScript = pkgs.writeText "synapse-init.sql" ''
+           CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
+           CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+             TEMPLATE template0
+      LC_COLLATE = "C"
+             LC_CTYPE = "C";
+    '';
+  };
+
+  services.matrix-synapse = {
+    enable = true;
+    settings = {
+      server_name = "aciceri.dev";
+      public_baseurl = "https://matrix.aciceri.dev";
+      listeners = [
+        {
+          port = 8008;
+          bind_addresses = ["127.0.0.1"];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+          resources = [
+            {
+              names = ["client" "federation"];
+              compress = true;
+            }
+          ];
+        }
+      ];
+    };
+    extraConfigFiles = [config.age.secrets.matrix-registration-shared-secret.path];
+  };
+
+  backup.paths = [
+    "/var/lib/matrix-synapse"
+    "/var/backup/postgresql/matrix-synapse.sql.gz"
+  ];
+
+  services.postgresqlBackup = {
+    enable = true;
+    databases = ["matrix-synapse"];
+  };
+}