{ config, lib, pkgs, ... }: let clientConfig = { "m.homeserver".base_url = "https://matrix.aciceri.dev"; "org.matrix.msc3575.proxy".url = "https://syncv3.matrix.aciceri.dev"; }; serverConfig."m.server" = "matrix.aciceri.dev:443"; mkWellKnown = data: '' default_type application/json; add_header Access-Control-Allow-Origin *; return 200 '${builtins.toJSON data}'; ''; in { imports = [ ../nginx-base ]; services.nginx.virtualHosts = { "aciceri.dev" = { enableACME = true; forceSSL = true; locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig; locations."= /.well-known/matrix/client".extraConfig = mkWellKnown clientConfig; }; "matrix.aciceri.dev" = { forceSSL = true; enableACME = true; locations."/".proxyPass = "http://127.0.0.1:${builtins.toString (lib.head config.services.matrix-synapse.settings.listeners).port}"; locations."/_matrix".proxyPass = "http://localhost:8008"; locations."/_synapse/client".proxyPass = "http://localhost:8008"; }; }; services.postgresql = { enable = true; initialScript = pkgs.writeText "synapse-init.sql" '' CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse'; CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" TEMPLATE template0 LC_COLLATE = "C" LC_CTYPE = "C"; ''; }; systemd.tmpfiles.rules = [ "d ${config.services.matrix-synapse.dataDir} 770 matrix-synapse matrix-synapse" ]; services.matrix-synapse = { enable = true; dataDir = "/mnt/hd/matrix-synapse"; configureRedisLocally = true; settings = { server_name = "aciceri.dev"; public_baseurl = "https://matrix.aciceri.dev"; listeners = [ { port = 8008; bind_addresses = [ "127.0.0.1" ]; type = "http"; tls = false; x_forwarded = true; resources = [ { names = [ "client" "federation" ]; compress = true; } ]; } ]; }; extraConfigFiles = [ config.age.secrets.matrix-registration-shared-secret.path ]; }; backup.paths = [ config.services.matrix-synapse.dataDir "/var/backup/postgresql/matrix-synapse.sql.gz" ]; services.postgresqlBackup = { enable = true; databases = [ "matrix-synapse" ]; }; services.matrix-sliding-sync = { enable = true; environmentFile = config.age.secrets.matrix-sliding-sync-secret.path; settings = { SYNCV3_SERVER = "http://localhost:8008"; }; }; services.nginx.virtualHosts."syncv3.matrix.aciceri.dev" = { enableACME = true; forceSSL = true; locations."/".proxyPass = config.services.matrix-sliding-sync.settings.SYNCV3_SERVER; }; }