improve synapse

hosts/matrix/default.nix

@@ -5,9 +5,10 @@
     ../common.nix
     ../../services/openssh.nix
     ../../services/nginx.nix
+    ./nginx.nix
+    ./synapse.nix
+    ./draupnir.nix
     ../../services/postgres.nix
-    ../../services/synapse.nix
-    ../../services/draupnir.nix
     ../../services/prometheus.nix
     ../../services/grafana.nix
   ];

hosts/matrix/draupnir.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+
+{
+  services.draupnir = {
+    enable = true;
+    settings = {
+      homeserverUrl = "https://matrix.berlin.ccc.de";
+      managementRoom = "!ZYWNuaQBkkenNklCSm:matrix.org"; # #cccb-moderators:berlin.ccc.de
+      autojoinOnlyIfManager = true;
+      recordIgnoredInvites = true;
+      roomStateBackingStore.enabled = true;
+      displayReports = true;
+    };
+    secrets.accessToken = config.age.secrets.draupnir_access_token.path;
+  };
+}

hosts/matrix/nginx.nix

@@ -0,0 +1,24 @@
+{ config, pkgs, ... }:
+
+{
+  services.nginx.virtualHosts."matrix.berlin.ccc.de" = {
+    default = true;
+    quic = true;
+    kTLS = true;
+    forceSSL = true;
+    enableACME = true;
+    locations = {
+      #"/.well-known/acme-challenge".root = config.security.acme.defaults.webroot;
+      "/".return = "418 \"🫖\"";
+      "~ ^(/_matrix|/_synapse/client)" = {
+        recommendedProxySettings = true;
+        proxyPass = "http://[::1]:8008";
+        extraConfig = ''
+          client_max_body_size 64M;
+          proxy_set_header X-Request-ID $request_id;
+          proxy_http_version 1.1;
+        '';
+      };
+    };
+  };
+}

hosts/matrix/synapse.nix

@@ -0,0 +1,89 @@
+{ config, ... }:
+
+let
+  domain = "berlin.ccc.de";
+in
+{
+  networking.firewall.extraInputRules = ''
+    ip saddr 195.160.173.14 tcp dport 9009 accept
+    ip6 saddr 2001:678:760:cccb::14 tcp dport 9009 accept
+  '';
+
+  services = {
+    matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = domain;
+        public_baseurl = "https://matrix.${domain}:443/";
+        # "/var/lib/matrix-synapse/homeserver.signing.key"
+        signing_key_path = config.age.secrets.matrix_signing_key.path;
+        registration_shared_secret_path = config.age.secrets.matrix_registration_shared_secret.path;
+        database = {
+          name = "psycopg2";
+          args = {
+            user = "matrix-synapse";
+            database = "matrix-synapse";
+          };
+        };
+        listeners = [
+          {
+            type = "http";
+            tls = false;
+            x_forwarded = true;
+            port = 8008;
+            bind_addresses = [ "::1" ];
+            #request_id_header = "X-Request-ID";
+            resources = [
+              {
+                compress = false;
+                names = [
+                  "client"
+                  "federation"
+                ];
+              }
+            ];
+          }
+          {
+            type = "metrics";
+            tls = false;
+            port = 9009;
+            bind_addresses = ["::" "0.0.0.0"];
+            resources = [
+              {
+                compress = false;
+                names = [ "metrics" ];
+              }
+            ];
+          }
+        ];
+        enable_metrics = true;
+        dynamic_thumbnails = true;
+        max_upload_size = "128M";
+        max_image_pixels = "64M";
+
+        retention = {
+          enabled = true;
+          default_policy = {
+            min_lifetime = "1d";
+            max_lifetime = "1y";
+          };
+          allowed_lifetime_min = "1d";
+          allowed_lifetime_max = "1y";
+        };
+      };
+      enableRegistrationScript = true;
+    };
+
+    postgresql = {
+      ensureUsers = [
+        {
+          name = config.services.matrix-synapse.settings.database.args.user;
+          ensureDBOwnership = true;
+        }
+      ];
+      ensureDatabases = [
+        config.services.matrix-synapse.settings.database.args.database
+      ];
+    };
+  };
+}